1

I'm working on a crypto wallet for a top 50 cryptocurrency. I'm part of the core team and we were discussing potential liability around the app we're building.

The user always has their wallet seed and/or private keys (presumably), so they should always control their funds and that data is never transmitted off the device. We have no idea who has how much, nor could we access those funds if we wanted to (which of course we never would).

Obviously with crypto being the hot thing right now and it "combining all the things you don't understand about money with all the things you don't understand about computers," to quote John Oliver, apps, protocols, etc. will be a target for law suits.

Since our app is free, open source, presumably will have multiple contributors, a few maintainers, and the user agrees to use the app "as-is," are there any legal rulings around similar pieces of software?

I've been looking around for prior cases or rulings that have to do with lawsuits going after open source projects for something. A lot of what I've found has to do with patents, or suits over licensing, which my question does not.

Are there any famous/landmark cases where someone sued an open source project for anything (non-patent related) that I could read more about? My guess would be that if someone sued Red Hat, for example, if Red Hat (or the computer) crashed and the person lost all of their stuff, that the ruling would likely absolve Red Hat of responsibility. Obviously with crypto/money things are a bit different. I'm more looking for foundational legal/open-source rulings.

  • 1
    This question is on-topic here, but it may also be worth your while asking it on Law. If you do choose to do that, make sure to tailor it more to the legal aspect than the open source aspect, and link back to this question. – ArtOfCode Mar 30 '18 at 17:29
3

If someone sued Red Hat, for example, if Red Hat (or the computer) crashed and the person lost all of their stuff, that the ruling would likely absolve Red Hat of responsibility

IANAL/IANYL. Nonetheless, I think that's likely, and it is because almost all free software licences include a clear and unambiguous liability disclaimer. Here's the one from the 3-clause BSD, for example, since you've tagged your question BSD:

THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Disclaimers of liability are a pretty (historically and litigiously) well-tested concept. It's difficult to start quoting cases since you don't specify jurisdiction, but wikipedia's article on disclaimers is fairly clear and generally helpful:

Under UK law, the validity of disclaimers is significantly limited by the Unfair Contract Terms Act 1977. By virtue of the Act, a business cannot use a contract term or a notice to exclude or restrict its liability for negligence causing death or personal injury. In the case of other loss or damage, a disclaimer will only be effective so long as it is reasonable in all the circumstances. The common law in other nations may also place legal limits on the validity of disclaimers[...]

In the United States, disclaimers on the sale of goods are covered by Article 2 of the Uniform Commercial Code, but details vary by state. Unless considered unconscionable, disclaimers are generally enforceable as part of a contract between knowledgeable parties of comparable bargaining power, but most states do not allow a party to limit their liability for gross negligence.

So you can disclaim your liability to the end-user by using most standard free licences, and courts have generally held disclaimers to be valid, save that if negligence can be proved many jurisdictions will still attach liability.

I use Bitcoin Wallet on my mobile phone, to administer the small amount of Bitcoin I choose to carry around in my pocket. It's GPL3, whose disclaimer is even clearer than 3BSD's. It's been very clear with me about the need to have a wallet backup, and often nagged me if I've not made one recently enough. It's told me I should keep the wallet backup off-device. If something were to go wrong, I wouldn't dream of suing the developers; I've been well-warned.

Obviously with crypto/money things are a bit different.

That's not obvious to me. I find nothing that suggests you generally have a greater duty of care to your users if you're writing software to look after their money than if you're writing software to look after their data - and it's not at all clear that most jurisdictions recognise cryptocurrency as money.

  • This is a fantastic response. Thanks for taking the time to write this, MadHatter – Ken Griffey Mar 30 '18 at 19:44
  • You're very welcome, thanks for accepting my answer. Do note that IANAL, and you should probably take qualified legal advice if you're betting a company on this. – MadHatter Mar 31 '18 at 10:48
  • Of course. I have a few conversations with lawyers early next week about this who have expertise in crypto/FOSS as well. – Ken Griffey Mar 31 '18 at 12:26

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.