Thank you for your answer. Is waiving such liability always legal & binding? I'm not a legal expert, so take this with a healthy grain of salt, but I'm reasonably sure I have read that, in many cases, entities cannot waive certain legal rights (whether or not what I have read is correct is another story). An example is when parking a vehicle in a parking garage and the parking garage owner states they are not liable even if the sewage pipes in the garage explode & damage your vehicle. From the limited amount I understand, despite their protestations & claims otherwise, they can be liable.

But is this a software licensing issue, or a contracted service issue? My understanding is that Microsoft 365 was involved at some point which is a "Cloud" based service, and if any paid-for communication paths were affected that's definitely a contracted service.

Just read the terms of licence you agreed to, you have probably agreed to hold the software/service provider harmless - you may have taken on the liability of such harms and hazards.

There are rumours CrowdStrike pushed the update to millions of people, on a Friday, without testing it on a single computer first. If true, is that gross negligence?

Doesn't negligence, in general, require a duty of care? One can't be negligent in a situation where one has no legal responsibility in the first place.

@GlennWillen "How are standards like recklessness or gross negligence determined, in a very technical scenario like this?" Exactly the same way that they are in every other case. A judge or jury applies a very general legal standard to the facts presented at trial. The system is designed to prevent detailed sub-specification of what those standards mean at a more detailed level. It is a case by case analysis.

@MarkMorganLloyd "But is this a software licensing issue, or a contracted service issue?" The distinction might matter in some cases, but in this case it would be a distinction without a difference. The point is that some contract between the parties would contain a waiver.

@StackExchangeSupportsIsrael "There are rumours CrowdStrike pushed the update to millions of people, on a Friday, without testing it on a single computer first." That would be up to a judge or jury to decide after hearing all of the facts at a trial. You cannot, as a general rule, say "if these facts happen then there is this legal consequence". There are some very clear cases where you could, but the vast majority of the time, more than one decision could be consistent with the law and upheld on appeal.

"Pure" economic loss is recoverable in tort in some jurisdictions (e.g. Canada, Australia) in some cases - the law is fuzzy.

"universally waived contractually in software licensing agreements"—almost universal. I was pleasantly surprised when IBM's ViaVoice explicitly guaranteed that the software would perform to its specifications. And although that was thirty years ago, it performed BETTER than what my local TV stations are using today to generate captions!

I suppose one could construct liability against individuals and possibly against the company (if condoned by upper management) if they willingly and purposefully ignored standards like ISO 9000 and their local implementation they had promised (also to the customers) to adhere to. Such local implementations typically include processes like reviews and testing before deployment, which was apparently sorely missing here. An audit may find they generally violated procedure. That might amount to deception or fraud. Actual fraud may override the limitations of liability in the contracts.

@Peter-ReinstateMonica: You're wrong in all jurisdictions I know of. Employees are almost never liable for damages sustained by customers of their employer. It's already rare when employees are liable for damage to their employer, and that is a contractual relationship. Also, ISO 9000 is so complex that "an employee willingly and purposefully ignoring" it is meaningless. That can only apply to corporate liability, and there's usually no legal or contractual requirement for companies to apply ISO 9000 anyway.

@MSalters Well, you may be interested in the lawsuit against three engineers in Germany after the terrible ICE accident in Eschede. They were eventually not convicted, but the prosecution did happen for involuntary manslaughter. I can imagine that a criminal conviction would increase the chances of a liability suit against their company. The company may have a liability case against the engineers lest their negligence was condoned by management.

@MSalters And yes, ISO 9000 ff. is complex; but the complexity is reduced by the respective concrete adaptation and eventually has the shape of concrete processes for the respective company. It is actually auditable, and if they faked their audit paperwork (which is likely because else they would have lost their certification) that's fraud in my book. Now I don't actually know about their specific certifications, but typically government contractors are held to certain official standards, besides gender neutral toilets.

@MSalters I can also assure you first-hand that in the SIL4 environment I currently work in, violating the (in this case railway) norms like EN 50128) is not meaningless at all, neither procedurally (we get audited and need to fix violations) nor factually (the rules laid out in the norm do not guarantee good software but they pretty much guarantee safe software).

"Liability is universally waived". There are exceptions, depending on the jurisdiction. In the UK, if one party is a consumer, then the "unfair contract terms" law kicks in, potentially making such waivers void. And you can't waive your liability for personal injury or death. But where both parties are large corporations, it is assumed that they are free agents and are free to negotiate whatever division of the commercial risks they decide to agree on.

ISO 9000 is a joke. It basically demands that everything you do is documented. You can do the wrong things and pass if your process manual says that's what you do, and you can do the right things and fail because your process manual doesn't say that's what you should do.