Open Source Software and Legal Responsibility for Software Content

Question

I'm working with a few folks on updating some serious software for mechanism design. Engineered mechanisms have existed in the world now for a few hundred years or so.

The science here isn't really new. We're debating bringing out some software for mechanism design and synthesis. We are using really smart algorithms based on physics in the natural world. No magic, just brilliant use working with the existing laws of nature. One of our concerns is the potential for lawsuits by users of the software. We're not sure if we should share our algorithms openly or if we should seek to profit from them.

For example: Joe Cheap Carnival company invents a new wild ride using our awesome cool mechanism synthesis software. They have Podunk Assembly Company manufacture it with cheapest materials possible with really poor quality control. The ride goes up at a local carnival and oops it fails, and someone gets seriously hurt.

Here are my questions:

• If our software was used by Joe Cheap Carnival's design team to synthesize a mechanism used in the faulty carnival ride, and our software encompassed the use hidden and encoded algorithms, could we be held liable for the failure?
• If our software was absolutely open source (github), with all algorithms and logic flow in full public view, could we be sued? (Does this change the nature of "responsibility"? )

My questions relates to: Can the open source process be used as a legal protection against a potential lawsuit for a software company?

Update (post DaleM response):

I'm not sure I fully understand the "duty of care" description. We make software that tells engineers how machines move. Its a similar function to what you might read in an academic text, albeit in a much easier intuitive form to use. (Drag and drop is much easier than reading a chapter of text then doing mathematical problems, even though exactly the same concepts are being used.) The function of our code is to accurately represent the laws of physics. We don't tell somebody what to design, we tell them if you want this particular output, here are a variety of ways to achieve that output.

Hmmm... Lets say someone wants to design a six bar mechanism to move an object in a 720 degree circle and deliver it as fast as possible we can help with that. Fancy Machine works uses that model to deliver bolts to an assembly line for rapid manufacturing. Max g forces observed on the bolt is 8 G's.

Joe's Cheap Carnival decides to use that exact same mechanism to create an exciting ride for its customers. Its ten times the scale of the bolt delivery machine, but its the same basic mechanism design. Again, Max g forces observed on the customer sitting in the ride is 8 G's.

Is our design unsafe? The bolts seem to get there just fine, people, no so much. We profess no responsibility (same as an academic text book author on mechanism design.) In fact that might be a better question. Have any academic folks been sued for academic publications providing "how-to" instructions?

If Joes Cheap Carnival team designs a unsafe ride with a mechanism design textbook as a reference, can the university who published that textbook be held liable?

Apologies if I'm not using the correct language in the legal arena. And many thanks to you for your responses.

Answer 1

Sources of Liability

Liability can come from:

1. Statute law
2. Contract law
3. Common law

Statute Law

There may be (almost certainly are) laws in the jurisdiction where Joes Cheap Carnival are operating relating to Work Health and Safety.

In general, these laws will impose a non-delegable duty (i.e. one you cant get out of) to comply with certain minimum standards. If operating your software as instructed with reasonable assumptions gives results that lead to an unsafe design then you would be liable in both cases.

Contract Law

If you are selling this software then you can limit your liability in any way you like providing that the limitation is not unlawful. For example, under Australian Consumer Law (which covers B2B transactions up to AUD$40,000 - how much are you selling for?) you have a non-excludable warranty that the software is fit-for-purpose; so, again, if operating your software as instructed with reasonable assumptions gives results that lead to an unsafe design then you would be liable in both cases.

Common Law

Only parties to a contract can take action under a contract; anyone you owe a duty of care to can sue your for negligence. A person injured by a machine your software helped design need to demonstrate:

1. You had a duty of care; it would be hard to argue you didn't,
2. You breached that duty; the software was not "fit-for-purpose",
3. There was a factual cause in a "cause and effect" sense; 'but for' your software there would have been no loss,
4. There was a legal (proximate) cause; you may be able to raise something here, if your software was used incorrectly by an engineer, your breach may be too distant
5. Harm; the person must suffer real loss.

The only plausible advantage of making your software open source is that you are showing a greater amount of care by allowing your algorithms to be sort-of peer reviewed. This is not a legal shield I would really like to depend on.

TL;DR

1. Nothing can stop someone suing you - if they want to sue you they can sue you.
2. Your best defence to a lawsuit is to demonstrate that you did everything a reasonable person could do without the benefit of hindsight
3. Do you really think publishing your code is "everything a reasonable person could do"?
4. You would be far better off:
   1. Taking out professional indemnity insurance
   2. Validating you algorithms thoroughly
   3. Engaging an independent third-party to validate your algorithms
   4. Developing proper and thorough testing procedure for your software
   5. Testing it in-house
   6. Engaging an independent third-party to test it
   7. Thoroughly documenting your software including all the assumptions along with the domains where they are valid and invalid.

Answer 2

The best answer for the whole solution (not only code) is: it strictly depends on country.

1. As for strictly the software, it's easy to drop any potential responsibility. Look at the MIT license:

The software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the software or the use or other dealings in the software.

In most countries this is completely enough, if your code is freely available (even if it's intentionally stripped out of comments and documentation) and equipped with a full license text + license headers in individual source files.

Of course in case of any potential lawsuit you have to prove, that your software has been provided with such licence clauses. But it's fairly easy, if it's really open source (eg. published on GitHub).

On the other hand, nobody reasonable will take a risk of using such code, when there are "natural" risks related to it. And here's the catch.

So, while it's easy to drop responsibility at the "code layer", it's more complicated to do so at the "full solution layer".

2. As for full solution, I will try to propose a solution based on Polish law. As I wrote above:

   • the solution will vary between countries
   • nobody reasonable will use your code will such license and "natural" risks

So what you have to do, is to register a "proxy" limited liability company with very low capital, that will use your open source code, and will sell some IT services to another, "real" company.

The agreement between "real" and "proxy" company should clearly address all possible responsibility related to these IT services to "proxy" company. This way, if something happens, you just liquidate the "proxy" company, fix bugs in the code, start another "proxy" company and continue operating.

Remember, that you should find a good layer to consult exact details of such agreement, because it's the core source of the differences between countries.