I asked a question on law about the responsibilities placed on open source software developers globally who want or have to stop work by the forthcoming EU Cyber Resilience Act. The answer has suggested that the responsibilities are significant, not particularly unusual and insurable. I know very little about insurance, but this seems unlikely to me.
The Cyber Resilience Act, described in this factsheet places upon manufacturer’s these obligations, among many others:
- Once sold, manufacturers must ensure that for the expected product lifetime or for a period of five years (whichever is the shorter), vulnerabilities are handled effectively;
- Security updates to be made available for at least five years.
- Manufacturers will have to report actively exploited vulnerabilities and incidents;
Examples of the sort of things that can go wrong with small bits of software developed and maintained by individuals include "The Internet is Being Protected by Two Guys Named Steve" who were largely responsible for OpenSSL (used by almost all servers and involved in the Heartbleed bug) and when the sole maintainer of the library core-js (used by 75% of the top 100 websites) went to prison for 18 months for lack of the money to settle.
The extent of the potential harm, the inherent uncertainty of the difficulty of the fix and the problems with working with someones elses code seem to make insuring such projects challenging for large organisations. It would imagine as a sole developer I could not even get a quote, let alone pay the amount that would be required to insure against such a risk.
Could I get such an insurance today? Is this the sort of thing a conventional profesional insurance would cover? Is it likely this is going to become a product individual open source contributors may be able to purchase in the future?
