Richmond Journal of Law and Technology

Sherer Publication Version PDF

Cite as: James A. Sherer, Melinda L. McLellan, Emily R. Fedeles, and Nichole L. Sterling, Ransomware – Practical and Legal Considerations for Confronting the New Economic Engine of the Dark Web, 23 Rich. J.L. & Tech. Ann. Survey (2017), http://jolt.richmond.edu/2017/04/30/volume23_annualsurvey_sherer/.

 

By: James A. Sherer,* Melinda L. McLellan,** Emily R. Fedeles,*** and Nichole L. Sterling****

 

I.    Introduction

 

[1]       Ransomware is malicious software that encrypts data on a device or a system, then bars access to, or recovery of, that data until the owner has paid a ransom.[1] This type of threat has existed in some shape or form since at least 1989,[2] but over the past two years the frequency and scope of attacks have increased to alarming levels. In response, the U.S. Federal Trade Commission (FTC) identified Ransomware as “one of the most serious online threats facing people and businesses” in 2016 as well as “the most profitable form of malware criminals use,”[3] and the FBI developed a special working group dedicated to fighting it.[4]

 

[2]       Considering that Ransomware emerged “at the dawn of the Internet revolution,”[5] even before the development of formalized Internet law and policy, attorneys have now had a bit of time to become familiar with its operation and effects and to contemplate reasonable and legitimate responses to Ransomware attacks. Despite the intervening decades, and although Ransomware as a process and business are (somewhat) better understood, the legal implications of Ransomware attacks are still up for debate, and there is no simple answer to the question of how Ransomware victims can, or should, deal with an attack.

 

[3]       This digital menace poses constantly evolving threats, which adds to the challenges victims confront when attempting to implement current guidance and benchmarked response efforts to Ransomware. These challenges are not only rooted in functionality and potential damage, but also due to the emergence of a viable business model facilitating Ransomware’s exponential growth as a tool for criminals. We will explore these challenges by providing an overview of Ransomware’s development and spread and then examining the current, albeit unsettled, legal landscape surrounding Ransomware attacks and victim responses, to consider what the future might hold for regulation in this space.

 

II.    A History of Ransomware

 

[4]       As noted above, Ransomware has been around in one form or another for at least ten years,[6] and as early as 1989 in the U.S.[7] and Europe.[8] The first recorded example was biologist Joseph Popp’s “AIDS Trojan”: Popp developed the virus and “passed 20,000 infected floppy disks out at the 1989 World Health Organization’s AIDS conference.”[9] Ransomware subsequently faded as a notable security concern for more than a decade before making another brief appearance in 2005.[10] Then, in the wake of an economic recession, Ransomware came back with a vengeance, making a dramatic entrance as it “resurged in 2013;”[11] it has continued to flourish ever since. Interestingly, Ransomware’s recent reemergence may be explained, in part, by the success of other hacking efforts. The historical model for the most obvious cybercrimes had been stealing and selling data (usually credit card numbers), but this fraud became so prevalent that the going rate for stolen payment card information has dropped precipitously over the past five years.[12] In response, “[t]o keep cybercrime profitable, criminals needed to find a new cohort of potential buyers, and they did: all of us.”[13]

 

[5]       Although experts rightly emphasize the significant problem Ransomware presents today, the risks have not always been so grave in the hostage-software industry. As Doug Pollack noted, “ironically, until [the 2005 resurgence], most [Ransomware] was fake. Fraudulent spyware removal tools and performance optimizers scared users into paying to fix problems that didn’t really exist.”[14] Regardless, most present-day (and, likely, future) Ransomware is serious business, both in the effects it has on victims and in the underground infrastructure that buttresses Ransomware’s propagation. Moreover, the scourge of Ransomware is growing steadily, with some researchers noting 500% yearly increases.[15] Other experts focus on the exponential reach of Ransomware, noting that it “infects one computer but…often spreads across network drives to infect other computers as well.”[16]

 

[6]       In the face of an inarguably immense and expanding problem, an understanding of the relevant legal issues is crucial for practitioners who will encounter Ransomware and its effects. That said, evaluating the applicable legal framework requires knowledge of Ransomware’s mechanics, which may vary widely by the type, source, and purpose of the Ransomware—not to mention the specific effects it may have on a given organization.

 

III.    Ransomware as a Process

 

[7]       Malware is malicious software, but that category “encompasses a wide range of program types including viruses, worms, logic bombs, Trojan horses, keyloggers, zombie programs, and backdoors.”[17] One subcategory of Malware is “Scareware,” or Malware that “takes advantage of people’s fear of revealing their private information, losing their critical data, or facing irreversible hardware damage.”[18] Ransomware is a subset of Scareware; specifically a “category of malicious software which, when run, disables the functionality of a computer in some way,”[19] making it essentially “a digital version of hostage taking.”[20] Ransomware is also classified as a type of viral software, which is software that may be grouped into separate “families” and differentiated by whether it presents only the superficial trappings of a threat or poses an actual problem.[21] We may divide the types of Ransomware that pose an actual threat into two main groups: “one-off” variants used in an ad-hoc fashion, and software that serves as an extension of the broader criminal infrastructure into which victims pay their ransom.

 

A.    Locker Ransomware

 

[8]       Beginning with the functional mechanics of the software, Ransomware attacks can be segregated by form. Early variants[22] were primarily Locker Ransomware, and were identified as such (e.g., WinLocker, which would lock up a user’s screen, and Master Boot Record, which would interrupt a user’s normal operating system).[23] The Locker approach “restricts user access to infected systems by locking up the interface or computing resources within the system,”[24] thereby blocking off access to the computer or denying access to files.[25] Locker Ransomware may display “a message that demands payment to restore functionality,”[26] such that it appears similar to the other Ransomware variants discussed below, but operates quite differently.

 

[9]       If the victim’s operating system is imagined as a storage unit, where the worth of the operating system lies in the items contained within the unit, Locker Ransomware operates by effectively changing the lock on the door, or, in some cases, changing the mechanism by which the lock engages. The items within the storage unit remain untouched, and the victim is asked to pay to have the door unlocked (or to have the locking mechanism restored to its original form), but victims in such Locker Ransomware cases have other options for regaining access. For example, they can try to bypass the door by (metaphorically) drilling out the lock, taking the door off its hinges, or just removing the walls from around the unit’s contents.

 

B.    Crypto Ransomware

 

[10]     Cryptographic approaches to Ransomware operate differently, though the initial message—pay us or you cannot access your data—looks the same at first blush. Rather than focusing solely on the lock, however, these variants[27] employ a Crypto Ransomware or CryptoLocker approach.[28] Here, the Ransomware “encrypts files on the target system so that the computer is still usable, but users can’t access their data.”[29] This type of Ransomware typically “uses RSA 2048 encryption to encrypt files,” making “cracking the lock” to avoid paying ransom an impossibility; for an average desktop computer, this approach would take “around 6.4 quadrillion years.”[30]

 

[11]     Continuing with the storage unit metaphor, a Crypto Ransomware approach may or may not tamper with the lock on the front door. Instead, Crypto Ransomware sizes up each item within the unit, systematically determining the relative value of the files to the user. These may include, for example, unstructured data comprised of user photos, Word documents, Excel files, or PDFs. Once those files are identified by extension, the program goes to work, encrypting each file and rendering it unusable pending payment of the ransom—unless, as we discuss below, (1) the user can find a workaround solution online; or (2) the ransom is paid but no key is provided.

 

[12]     When it comes to Crypto Ransomware, there is no option to drill out the lock, take the door off the hinges, or tear down the wall; each file is locked up separately and indefinitely.[31] Accordingly, this type of Ransomware poses a very different kind of threat and, as such, is handled quite differently by experienced security professionals tasked with solving the problem.

 

[13]     Crypto Ransomware doesn’t stop there. Certain variants add insult to injury, as some may, “while encrypting files, search[] and steal[] [B]itcoins from the user.”[32] Others, called “Doxware,” may focus on areas normally associated with user privacy such as conversations, photos, and other sensitive files; and threaten to release them publicly unless the ransom is paid.[33] Still another form of Crypto Ransomware, Shadowlock, “forces users to complete consumer surveys of products and services as the ransom payment.”[34]

 

[14]     Although Ransomware’s efficacy has improved over the decades since its introduction, many earlier forms are still in use.[35] This may be due in part to its inherent longevity, as one key element of older Ransomware’s functionality is the malicious way in which its self-propagating features make it incredibly difficult to eliminate. Some legacy Ransomware variations are no longer in circulation, but certain “[m]alware that was released years—in some cases, decades—ago is still alive and well today,”[36] making awareness of modern Ransomware’s progenitors required knowledge for practitioners active in this space.

 

C.    Ransomware Delivery

 

[15]     Despite the automated nature of Ransomware’s self-propagation, the spread of most Ransomware is still a personal process that relies on human error.[37] The FBI notes specifically that “Ransomware is frequently delivered through spear phishing emails” to end users.[38] Other common methods of installing Ransomware are “exploit kits,”[39] “Web exploits and drive-by downloads,”[40] “infected removable drives, infected software installers,”[41] and “mass phishing campaigns.”[42] In a “mass phishing campaign,”[43] malware is “installed on a user’s computer without their knowledge when that user browses to a compromised website,”[44] and is using “outdated browsers, browser plugins, and other software.”[45] These techniques may be referred to as “malvertising” where “[c]ybercriminals leverage compromised advertising networks to serve malicious advertisements on legitimate websites which subsequently infect the visitors…[later] redirecting the user to an Exploit Kit (EK) landing page.”[46]

 

[16]     In addition to leveraging self-propagation, Ransomware schemes also may rely on the “spray and pray” technique, or sending out massive quantities of malware-infected emails in hopes of hitting “as many individual targets…as quickly as possible” by virtue of sheer volume.[47] Still other types of Ransomware have begun to deploy an even more personal approach, tailoring messages to appear as genuine as possible; often through social engineering research used to gain knowledge of a company’s operational structure, invoicing and remittance practices, and even individuals’ writing styles.[48] Increasingly, “e-mails are highly targeted to both the organization and individual, making scrutiny of the document and sender important to prevent exploitation.”[49]

 

D.    Personality and Psychology

 

[17]     The customization of these programs is reflected in a variety of features that are now common to Ransomware schemes. For example, certain programs display multiple language options so “language is not a barrier to payment, [allowing] the user [to] access ransom instructions in English, French, German, Russian, Italian, Spanish, Portuguese, Japanese, Chinese and Arabic”[50] and making sure that the Ransomware “experience” is appropriately localized for the victim.[51] Once the Ransomware is downloaded, it disables the victim’s machine “by disallowing execution of various programs,” demanding ransom, and even “using local police images” –the program geo-locates the user’s internet protocol address and associates that address with location-specific law enforcement decals and insignia deployed from a central command-and-control server.[52]

 

[18]     In connection with this locality-based personalization, Ransomware may use psychological tactics to induce guilt or shame in individual victims.[53] For example, ransom notes may include salacious details to frighten users, sometimes claiming that the victim has violated federal statutes and/or threatening imprisonment for alleged visits to websites “containing pornography, child pornography, zoophilia and child abuse.”[54] These ransom notes are then spread throughout the computer’s operating system, often propagating hundreds of copies on a given computer to ensure the user’s attention is drawn to the threat.[55]

 

[19]     Alternatively, “some versions of Ransomware are now designed to seek out the files on a victim’s computer that are most likely to be precious, such as a large number of old photographs, for example, tax filings, or financial worksheets.”[56] Other variants “just delete[] files instead of encrypting them.”[57] Finally, some “variants display a countdown timer to the victim, threatening to delete the key/decryption tool if payment is not received before the timer reaches zero or, in other cases, increase the price of the ransom.”[58]

 

[20]     Even setting aside the nuances of these personal approaches, it is nearly impossible for security experts to keep pace with Ransomware advances generally, as “hackers are releasing over 100,000 new [R]ansomware variants daily,”[59] and “‘evil genius’ [R]ansomware ideas are ‘coming out on a regular basis.’”[60] Perhaps even more challenging for law enforcement and security specialists, the level of technological expertise required to engineer a Ransomware attack has decreased significantly; at this point, deploying Ransomware is “relatively low budget, low stakes, and [doesn’t] require much skill to pull off.”[61] Indeed, in one instance, a recent drop in price to US$39 for Ransomware software concerned experts who believed “the low price coupled with its potency could trigger a wave of new infections.”[62]

 

[21]     Evolving with the times, recent Ransomware variants have focused on smartphones and other connected devices, including those that are a part of the “Internet of Things.”[63] The first instances of “mobile-focused Ransomware came out in 2013,”[64] buoyed in part “by the practice of users downloading pirated apps from unsanctioned app stores.”[65] As noted by another commentator, “[R]ansomware criminals can achieve some profit from targeting any system: mobile devices, personal computers, industrial control systems, refrigerators, portable hard drives, etc. The majority of these devices are not secured in the slightest against a [R]ansomware threat.”[66]

 

IV.    The Business of Ransomware

 

You always wanted a Ransomware but never wanted two pay Hundreds of dollars for it? This list is for you!?? Stampado is a cheap and easy-to-manage ransomware, developed by me and my team. It’s meant two be really easy-to-use. You’ll not need a host. All you will need is an email account.[67]

 

[22]     The mentality behind Ransomware seems to have deep-rooted cultural underpinnings, likened by some authors to medieval roadways that became host “to travelling footpads referred to as highwaymen.”[68] Methodologically, the purveyors of Ransomware bear little resemblance to hackers “who attempt to exfiltrate or manipulate data where it is stored, processed, or in transmission;” instead, “ransomware criminals only attempt to prevent access to the data.”[69] In short, Ransomware aims to disrupt.

 

[23]     Ransomware differs from many other types of hacking on a number of levels. It has been called a “business model”[70] that has “quickly risen to dominance”[71] within the “cybercriminal market in the past few years”[72] and has “emerged as one of the most serious online threats facing businesses.”[73]

 

[24]     Often, a Ransomware attempt betrays the fact that its author “lack[s] the technical complexity to perform successful attacks;”[74] some versions have been described as lacking technical savvy, and others as “not very well developed” beginner-level efforts.[75] Perhaps because of a general lack of know-how, and Ransomware’s reputation as offering “easier money than hacking into personal information to use for identity theft,”[76] a cottage industry has mushroomed. Certain criminals “now have the resources to hire professional developers to build increasingly sophisticated malware” on their behalf.[77] Providers, “usually based in Russia, Ukraine, Eastern Europe and China, have begun licensing what’s known as ‘exploit kits’—all-inclusive Ransomware apps—to individual hackers for a couple hundred dollars a week,”[78] or even “[US]$50 for a set period time of use,”[79] frequently taking a “cut of the profits from payouts.”[80]

 

[25]     Known as “Ransomware-as-a-service” (or RaaS), there are now “products, such as CerberRing, which provide[] less-tech savvy criminals a corridor into cybercrime, and yield[] criminal affiliates (often tasked with distributing the [R]ansomware) a healthy portion of the profits.”[81] Interestingly enough, because Ransomware is such big business, some Ransomware enterprises actually offer “customer service which victims can contact to negotiate”[82] and similar structures that make both launching the attacks, and paying the ransoms, easier.[83]

 

[26]     Some commentators note that there is “some honour among thieves,” where “hackers almost always honour their word and provide the encryption key to those who make timely online payments.”[84] Others disagree, noting that a decision to pay does not consistently restore functionality, and “[t]he only reliable way to restore functionality is to remove the malware.”[85] For many this is truly unfortunate, as “[t]he costs of downtime often exceed the cost of ransom.”[86]

 

[27]     Ransomware infrastructure has “begun to mimic the way modern software is developed: there are criminal engineers and manufacturers, retailers, and ‘consumers’—[those] hackers on the lookout for the newest, most effective product.”[87] In some cases, when a ransom is paid functionality may be restored but in an inconsistent manner (e.g., accounting data may be returned, but mapped drive data is not); in at least one of those cases, the victim determined that the “help” offered by the Ransomware attacker could instead lead to the loss of more data.[88]

 

[28]     Ransomware may be preferred by criminals because it cuts out the middle-man. [89] It bypasses many of the annoyances associated with hacking to steal data that then must be monetized. Where “intellectual property, or other sensitive information that is stolen outright….is often ‘fenced’ on the Dark Web, then the buyer has to turn it into a false identity that can be used to fraudulently obtain goods or services.”[90] In contrast, Ransomware has victims who “pay the criminal directly, the payment happens within hours or days in untraceable currency, and there is no chain of custody to point to the criminals because the data stays on the victim’s system the whole time.”[91] Indeed, deploying Ransomware is especially convenient for criminals, as its operation “often means dealing not with a small group of fellow criminals, but instead with a much larger population of lay users who are unlikely to disappear behind bars.”[92]

 

V.    Ransomware’s Direct Impact

 

[29]     In some cases, specific industries have been singled out as popular targets. For instance, at the time of writing, “[R]ansomware is the dominant current information security threat to health care providers.”[93] Ransomware may target “victims like healthcare providers whose complex independent networks and critical need for real-time information can make reliance on backups difficult and potentially life-threatening.”[94] These types of targets (“hospitals in particular” but also “other firms heavily dependent on computers”[95]) tend to focus on paying off the attacker to make the problem go away, whereas other types of companies may be amenable to “resisting the attack and rebuilding entire systems.”[96] If the demands are not met, in the most extreme examples, a victim might be “forced back into the 1980s: digital typewriters, notebooks, fax machines, post-it notes, paper checks and the like.”[97] In the face of these challenges, many organizations and individuals simply pay. Some do so without fanfare, and experts claim it “would shock you [] how many companies have quietly gone ahead and paid for information to be returned.”[98] Others, like PayPal, have made public the fact that they will pay for stolen data to protect their customers.[99]

 

[30]     One commentator noted that attorneys increasingly are “targets of [R]ansomware;” in the past several years, a number of “large and small law firms in the United States and Canada have had their office computer systems compromised by [R]ansomware.”[100] Some professionals “suspect that paying gets you listed on the Dark Web as an easy target, setting you up for more attacks.”[101] At least in some cases, the FBI appears to agree.[102] Ransomware’s effects are not just monetary, as the loss of the files themselves (or the cost of ransom) may be eclipsed by the loss of “client trust, relationships, and reputation.”[103]

 

VI.    Ransomware’s Indirect Impact

 

[31]     One commentator notes that Ransomware is an exception (and perhaps portends a wave of such exceptions) to the traditional “data security breach” concept with which we have all become familiar.[104] Whereas a traditional “breach” typically entails the acquisition of data, Ransomware allows wrongdoers to control, damage, and interrupt systems; deny access to data; and destroy or otherwise harm the data’s integrity—all without actual acquisition of the data.[105]

 

[32]     Although some contend that “no information is actually stolen during a [R]ansomware attack,”[106] others argue that falling victim to Ransomware “could also be considered a data breach, even though the data never leaves the victim’s systems.”[107]

 

[33]     The issue of whether Ransomware constitutes a breach was raised at the 2016 Healthcare Compliance Association conference.[108] There, Iliana Peters of the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) “pointed out that HIPAA regulations define a data breach as ‘impermissible acquisition, access, use or disclosure of PHI [protected health information](paper or electronic) which compromises the security or privacy of the PHI.’”[109] Additional HIPAA guidance from the OCR also notes that some Ransomware may “exfiltrate” the data,[110] which further complicates a simple explanation for the mechanics of a Ransomware attack. The OCR also noted that “[h]ospitals and other healthcare providers hit by [R]ansomware attacks should notify affected individuals, the federal government and perhaps the news media unless there is a ‘low probability’ any personal health information was disclosed.”[111] That “guidance makes clear that a [R]ansomware attack usually results in a ‘breach’ of healthcare information under the HIPAA Breach Notification Rule,” noted OCR’s Executive Director, Jocelyn Samuels.[112]

 

[34]     In contrast, some argue that data breach notification statutes were implemented with a focus on informing citizens that their personal information may have been compromised, offering “valuable warnings to assist victims in protecting themselves” and otherwise corralling information that has been set loose in the outside world.[113] The July 2016 HHS guidance also indicates that the question of “whether notification is required comes down to a ‘fact-specific determination.’”[114] In some cases, a forensic investigation may provide evidence to support a company’s conclusion that a ransomware attack did not expose any personal information, even if the incident resulted in a system shutdown or other functional difficulties. Many healthcare entities have reached this same conclusion under HIPAA.

 

VII.    Response to Ransomware

 

[35]     Although the following discussion examines conventional best practice approaches for dealing with Ransomware, but the preceding section should signal that there is no one-size-fits-all solution. As with many computer infections, a typical initial response to Ransomware may be to restart the computer in “safe mode” in an effort to disable a number of programs that might be causing issues.[115] In the case of Ransomware, however, this approach may backfire, allowing the malicious software to flourish by un-loading antivirus programs that otherwise may have stopped it.[116]

 

[36]     The next step in the response protocol is for victims to identify which “strain” of Ransomware they are dealing with, and then determine whether an “applicable decryption method” may be readily available to help unlock or decrypt files.[117] Whether this approach will be successful depends on the sophistication of the Ransomware. Certain generic, readily available strains that are still freely disseminated among would-be hackers may be defeated with relative ease, and the fact that a given strain of Ransomware is still in circulation is not proof of its viability or effectiveness.[118] To give one example, “the makers of Jigsaw ransomware have continued their assault against victims despite the fact its encryption scheme has been defeated by security researchers.”[119]

 

[37]     If these initial efforts are unsuccessful, certain victims may be inclined to pay the ransom. Experts may caution against paying the ransom prematurely, but for many, a relatively paltry Ransomware demands (demands often range from US$200 to US$2,000) may be seen as “nuisance fee” more than anything else.[120] The “To Pay or Not to Pay”[121] characterization of a standard response to Ransomware is apt, though this decision-making process may mean waiting to decide until after an initial deadline is extended.[122] Waiting may result in a doubling of the ransom[123] or even an exponential increase—up to US$20,000 in some instances.[124] And in some cases there really is no choice. As noted in a recent report, “[f]or variants of [R]ansomware that rely on types of strong asymmetric encryption that remain relatively unbreakable without the decryption key, victim response is sharply limited to pay[ing] the ransom or los[ing] the data. No security vendor or law enforcement authority can help victims recover from these attacks.”[125]

 

[38]     Paying a ransom may, therefore, make logical sense, given that “Ransomware attacks, especially those against individual users, only demand a few hundred dollars at most from the victim” and “[f]rom law enforcement’s perspective, a home burglary results in greater loss than a singular [R]ansomware attack.”[126] At least one commentator noted cynically that, because “[s]ecurity has always been a business decision, [s]ome companies would rather pay a lower fee for ransom than pay for the cost of having a robust security stance.”[127] Others note that “to save money, some organizations don’t include all their important files in their backups, or don’t run their backups often enough.”[128]

 

[39]     However, notwithstanding the low dollar value of most demands, taken in the aggregate, these attacks cost real money. “[L]osses for victims from a single strain of the CryptoWall malware were close to $18 million,”[129] and another Ransomware attacker earned roughly $1 million.[130] Given that “nearly 30 percent of CryptoLocker and CryptoWall victims pay the ransom,”[131] there remains the concern that “hackers [will] continue to ask for higher and higher ransoms.”[132] Early payment schemes involved payment through “an SMS text message or regular call to a premium rate number” where such charges could be “as high as $460.”[133] A second iteration of payment schemes moved to prepaid electronic payment systems such as Paysafecard, Ukash, and Moneypak, where Ransomware victims are required to purchase special PIN numbers.[134]

 

[40]     Regardless of whether it makes business sense for victims to pay a victim to pay a given ransom, victims must also consider whether they may pay. Unhelpfully, regulatory authorities have expressed varying opinions on that point and have not provided definitive guidance as to whether victims should pay. The FTC notes that “[l]aw enforcement doesn’t recommend paying the ransom” while warning that “it’s up to you to determine whether the risks and costs of paying are worth the possibility of getting your files back.”[135] In contrast, Joseph Bonavolonta, the head of the FBI’s Cyberand Counterintelligence Program in 2015, stated that the FBI “often advise[s] people just to pay the ransom.”[136] Rick Kam, president of ID Experts, also opined that “it is often easier just to pay the ransom than to do without the data.”[137] Anecdotally, the authors have heard a wide range of opinions with respect to whether paying the ransom is a sound approach. Indeed, given the exploding number of attacks and diversity of outcomes, it is increasingly challenging to offer affected companies or individuals clear recommendations on how to assess the likelihood of success when it comes to answering a Ransomware demand.

 

[41]     In short, law enforcement guidance may boil down to a “[l]ook, we can’t help you,”[138] response, even if some agencies indicate that “[m]ost…including law enforcement don’t condone paying the ransom,”[139]and “[m]ost security vendors advise the public (who are not yet victims) to never pay the ransom and to focus on mitigation efforts instead.”[140] The FBI, however, appears to be seeking “public-private partnerships,” as the Bureau utilizes notifications it receives regarding Ransomware and other threats in an overall effort to build up more comprehensive forms of defense and prevention.[141]

 

VIII.    Practical and Legal Considerations

 

[42]     In almost all cases, Ransomware ransom demands must be paid in a digital currency such as Bitcoin.[142] Bitcoin emerged in 2009[143] and has had unpredictable and profound effects, particularly with respect to the underground economy.[144] For many victims, receipt of a Bitcoin ransom demand is the first time they are exposed to the term, and very few have the necessary resources available to pay such a demand in a timely manner. Others who are aware of the threat—or who have a need for Bitcoin as a payment method for unrelated reasons—may “stockpile [B]itcoins in order to pay off cyber criminals who threaten to bring down their critical IT systems.”[145] To provide one public example, Hollywood Presbyterian Medical Center recently paid $17,000 in Bitcoin in response to a ransom demand.[146]

 

[43]     Unfortunately, making a Bitcoin payment is not a straightforward prospect for most organizations. The process is rife with potential legal and practical problems, because the company will likely “need to buy Bitcoins from an online exchange. The exchange will require you to supply a bank account or debit card number to fund the transaction, which creates an immediate risk because Bitcoin exchanges are notorious for being hacked.”[147]

 

[44]     To add another layer of complexity, in its March 25, 2014 Virtual Currency Guide, the United States Internal Revenue Service declared that a virtual currency such as Bitcoin is considered property, not currency, and thus its use is a taxable event.[148] Further, “[a] payment made using virtual currency is subject to information reporting to the same extent as any other payment made in property.”[149] “The basis of virtual currency…is the fair market value of the virtual currency in U.S. dollars as of the date of receipt”, which means that a taxpayer could end up with a taxable gain or loss, depending on the net outcome.[150]

 

[45]     Concurrently, Ransomware perpetrators who demand Bitcoin ransoms run the risk of also violating financial services laws and regulations prohibiting the operation of unlicensed banks—or at least causing such violations.[151] “[T]he U.S. Attorney for the Southern District of New York issued a press release concerning [a] criminal prosecution against Anthony R. Murgio and Yuri Lebedev for running an unlicensed Bitcoin exchange used by victims of CryptoWall [R]ansomware to pay ransoms [to their attackers] via TOR (The Onion Router).”[152] The two men were accused of having operated Coin.mx, a Bitcoin exchange service, in violation of federal anti-money laundering laws and regulations and that, “in doing so, they knowingly exchanged cash for people whom they believed may be engaging in criminal activity.”[153] It is alleged that, in total, “between approximately October 2013 and January 2015, Coin.mx exchanged at least [US]$1.8 million for Bitcoins on behalf of tens of thousands of customers.”[154] In addition, during this time, Murgio allegedly “transferred hundreds of thousands of dollars to bank accounts in Cyprus, Hong Kong, and Eastern Europe, and received hundreds of thousands of dollars from bank accounts in Cyprus and the British Virgin Islands, in furtherance of the operations of his unlawful business.”[155] In doing so, the operators of Coin.mx were said to have “knowingly enabled the criminals responsible for those attacks to receive the proceeds of their crimes” thereby violating federal anti-money laundering laws, because they “never filed any suspicious activity reports regarding any of the transactions.”[156]

 

[46]     As part of its efforts to combat global terrorism, the U.S. actively works to prevent terrorists from accessing and using its financial system.[157] Payments to criminals using Ransomware to hold data hostage may run afoul of banking laws and policies as well as related statutes and regulations. Individuals and organizations choosing to make ransom payments to end Ransomware attacks could be subject to international sanctions programs administered in the U.S. by the Office of Foreign Assets Control (OFAC), though such enforcement has not yet been tested as of this writing. Under these sanctions programs, ransom payments to certain entities are illegal, as noted by Samuel Cutler:

 

It’s important to begin from the fact that ransom payments to [Foreign Terrorist Organizations] FTOs or Specially Designated Global Terrorists (“SDGTs”) identified by [OFAC] are illegal under U.S. law. Monetary contributions to FTOs are considered material support under 18 U.S.C. 2339B, while transfers to SDGTs are violations of economic sanctions imposed pursuant to the International Emergency Economic Powers Act (“IEEPA”).

 

Furthermore, as the Financial Action Task Force (“FATF”) notes in discussion of ransom payments to the Islamic State in Iraq and the Levant (“ISIL”), “[U.N. Security Council] Resolution 2161 applies to both direct payments and indirect payments through multiple intermediaries, of ransoms to groups or individuals on the Al-Qaida Sanctions List. These restrictions apply not only to the ultimate payer of the ransom, but also to the parties that may mediate such transfers, including insurance companies, consultancies, and any other financial facilitators.”[158]

 

[47]     So far, the act of paying to remove Ransomware has not been prosecuted under 18 U.S.C. 2339B[159] or IEEPA, but U.S. law enforcement officials encourage victims of Ransomware to report the attacks and are actively seeking to uncover the people behind these attacks. It remains to be seen whether a substantial Ransomware-related payment that was determined to have been made to a person or group on an OFAC list may result in legal action.[160]

 

[48]     In addition, an Executive Order issued in April 2015 “expand[s] the [existing] sanctions regime to block the property and interests of persons engaging in ‘significant malicious cyber-enabled activities’” outside of the U.S. that constitute a significant threat to the country as “determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State.” [161] Activities deemed significant “have the purpose or effect of” seriously harming or compromising critical infrastructure; disrupting the availability of computers and networks; and misappropriating funds, trade secrets, personal identifiers, or financial information.[162] Moreover, “[t]he blocking extends to assets of those who ‘have materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services in support of, any activity [proscribed by the order] or any person whose property and interests are blocked pursuant to this order,’” which could implicate individuals and institutions that choose to pay to remove Ransomware.[163] Ransomware disrupts the availability of computers and networks, has the ability to compromise critical infrastructure, and may allow for the misappropriation of information; these and other risks are among the considerations presented in the Order.[164]

 

[49]     In addition, the U.S. government’s hostage policy may be instructive in determining whether a Ransomware payment is likely to be prosecuted. The government itself will not pay ransoms to release human hostages, but the relevant policy explicitly states that families will not be prosecuted for paying ransoms in exchange for hostages, even if these payments are made to FTOs or other individuals or groups on the government’s sanctions lists.[165] Former President Obama noted that “no family of an American hostage has ever been prosecuted for paying a ransom for the return of their loved ones.”[166] Whether that U.S. policy would extend to photos of an individual’s loved ones held hostage by Ransomware is an entirely different question—one that may well test the limits of the government’s humanitarian leniency in this regard.

 

[50]     Current U.S. hostage policy also offers no exemption from prosecution for organizations making or facilitating ransom payments.[167] The FBI notes in its Ransomware guidance that “by paying a ransom, an organization might inadvertently be funding other illicit activity associated with criminals.”[168] Moreover, intermediaries cannot be used to avoid OFAC sanctions, which include freezing assets, forfeiture of assets, preventing payment transfers, fines, and imprisonment.[169] In Ransomware attacks, it may be impossible to ascertain who exactly is holding the data hostage, which in turn prevents the victim from determining in advance whether a ransom payment could result in sanctions for the organization.

 

[51]     Ultimately, it seems unlikely that individuals will be penalized for making small payments to regain access to personal data affected by Ransomware; enforcement is challenging on a practical level, as the anonymity of virtual currencies makes it difficult—if not impossible—to know whether payments are going to individuals or groups on sanctions lists.[170] Large organizations considering whether to pay higher amounts to meet demands from Ransomware attackers may face a more aggressive enforcement landscape. In some cases, organizations have engaged third parties to pay virtual currency ransom demands on their behalf. Ransomware payoffs and other hacking-related expenses may be funneled through intermediaries that “are often part of a larger contract for countersurveillance work, ensuring corporate accounting departments don’t need to green-light individual black market buys.”[171] With respect to the concept of paying ransom generally, it is worth considering the court’s ruling in United States v. Kozeny,[172] in which the “United States District Court for the Southern District of New York [found] that only extortion or duress under the threat of imminent physical harm would excuse[] the conduct” (emphasis added).[173] It is difficult to imagine extending that line of reasoning to include threats to important documents or photos, especially given that industry best practices for business continuity include maintaining robust backups that would protect against just this threat.[174]

 

[52]     As noted by some practitioners,[175] counsel’s advice on preventing and responding to Ransomware attacks may implicate Model Rule 1.1 – Competence, as amended by Comment 8, where “…a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology…”[176] Although the recent explosion in Ransomware attacks is a relatively new phenomenon, there is no shortage of resources lawyers can use to become familiar with the threats posed by Ransomware and, consequently, to their clients’ data. For example, the FBI has issued guidance that provides “key areas to focus on with Ransomware [such as] prevention, business continuity, and remediation.”[177]

 

[53]     With respect to potential regulatory enforcement, the FTC has warned that “a company’s failure to update its systems and patch vulnerabilities known to be exploited by Ransomware could violate Section 5 of the FTC Act.”[178] In addition, the Gramm-Leach-Bliley Act (GLBA) includes requirements concerning the disclosure by financial institutions of fraudulent access to customer information.[179] The GLBA Safeguards Rule may be used “in conjunction with the FTC’s Section 5 authority to bring actions against financial institutions that fail to properly protect consumer financial information.”[180] Covered Entities under HIPAA are themselves subject to the Security Rule which, among a myriad of requirements to safeguard patient data, obligates Covered Entities to implement a data backup plan.[181] HIPAA compliance guides indicate that HIPAA security requirements extend to Ransomware, noting “…the possibility of a [R]ansomware attack must now be covered in any risk assessment.”[182]

 

[54]     Ransomware attacks also create eDiscovery conundrums. Ransomware as an application has been considered in a number of cases, including with respect to assessing a defendant’s behavior to determine whether parole was violated,[183] and in an arbitration regarding the ownership of a domain name.[184] Given the potential for increasingly complex conflicts in this space, practitioners should consider the implications of Ransomware on eDiscovery across a variety of scenarios. These include situations in which Ransomware is the source of a given dispute, as well as when Ransomware becomes a complicating factor in the eDiscovery process.[185]

 

[55]     Although eDiscovery has not been directly addressed in published decisions that contain a Ransomware element, the duty to preserve remains inviolate.[186] If a matter involves Ransomware, and whether that matter affects the data itself or has secondary implications with respect to the data’s unavailability (such as when a hospital is attacked and patients are rerouted to other locations),[187] eDiscovery considerations should be front-of-mind for practitioners. Not only will claims or defenses associated with the Ransomware attack necessarily implicate the technology used, the practices that may have enabled (or failed to prevent) the attack (e.g., the infection vector, the data affected, or the target’s backup environment) all may be relevant to the case, thus subject to discovery and requiring preservation.

 

[56]     Yet another potential risk concerns the possibility that Ransomware could negatively impact eDiscovery collection, preservation, and later discovery efforts. The data preserved by eDiscovery collections often includes highly refined sets of important, often “entirely new stores of extraordinarily sensitive information”[188] that are retained for legal hold purposes regardless of the company’s standard data retention policies and information governance practices.[189] As discussed above, law firms have become a lucrative target for criminals using Ransomware;[190] among other valuable data sources, information preserved pursuant to litigation holds often is maintained by law firms that are representing multiple companies in a variety of matters. Law firms and other organizations—including vendors that provide preservation-related services—that have custody of these eDiscovery data sets should be cognizant of the risks created by atypical retention practices. These data sets are no less susceptible to Ransomware than their “standard” counterparts—and may even be more attractive targets, given the one-off nature of eDiscovery collections as well as the highly sensitive data they contain. Further, Ransomware may “preserve” data in a sense, but the data cannot be made available for production or may not exist in a usable format, which can add to the eDiscovery conundrums noted above.

 

IX.    Ransomware’s Future

 

[57]     Ransomware appears poised to evolve along the same lines as many other non-criminal programming efforts, increasingly adopting the aesthetic and practicality of popular software instances that rely on a modular design, allowing criminals to “use certain functions as-needed,” and offering “much better efficiency” and the “ability to switch tactics as required in the event one method is discovered or is found to be ineffective.”[191] This approach would retain certain core elements associated with functional, successful Ransomware variants in play while remaining nimble enough to affect new Internet of Things and mobile device usage.

 

[58]     For example, replacing the usual “command and control” center and related Deep- or Dark-Web business model, future Ransomware might “simply transmit a beacon with a GUID (globally unique identifier) to a Command and Control domain, trying to reach this domain through common protocols/services…to transmit this data.”[192] That is, Ransomware applications will be streamlined to suit a market seeking self-service options, exchanging a bespoke process for one that is both easier to replicate on a mass scale and cheaper to produce and distribute.[193]

 

[59]     As noted above, the volume and scope of attacks has expanded as demographics and usage patterns have shifted more and more Ransomware activity onto mobile and Internet of Things devices.[194] In addition, the software and strategy underlying Ransomware attacks has adapted to evade common protective measures; since good backups often are the best defense against serious damage in the event of an attack, newer Ransomware variations have been built to go after those backups as well, destroying “all Shadow Copy and restore point data on Windows systems.”[195] Ransomware is being developed to target not only a given piece of hardware, but also the device’s local and virtual environment, in an attempt to outwit the efforts of potential victims by guessing at where they might back up their data and undermining those preventative or responsive measures. Future Ransomware may well exploit would-be victims’ digital networking or social connections, using information gleaned from online posts to identify additional targets who may value the same types of data and thus be willing to pay the same types of ransoms to secure its release.

 

[60]     Although individuals will no doubt continue to fall victim to Ransomware, the trend seems to be toward attacks carried out on a more ambitious scale. Criminals are said to be “shying away from random attacks,” shifting from a focus on individuals and “expanding [further] into the corporate world” where victims are more likely to have the financial wherewithal to pay larger sums.[196] In short, an “individual might be limited to a [US] $500 ransom, but how about a manufacturer or a hedge fund?”[197] Criminals can leverage knowledge gained through experience in the ransom marketplace to seek out specific opportunities, determining, for example, that an average person’s photos are worth $X; an investment manager’s emails and personal diary are worth $Y; and a hedge fund’s proprietary formulas, representing “need-to-know” intelligence that is jealously guarded, are worth $Z. Adept attackers have already demonstrated their ability to exploit victim psychology in the abstract; laser-like, focused shakedowns may be the next horizon for Ransomware attacks.

 

[61]     In addition to diversified attack methodology, the potential impacts of Ransomware attacks are evolving. Beyond the hijacking or theft of stored financial records or customer files, targeting connected technology has the potential to wreak physical, “real life” havoc.[198] In the case of the Hollywood Presbyterian Medical Center Ransomware attack, for example, in addition to “forcing staff to go back to paper records and fax machines,” the data loss may have impacted care as “emergency patients were diverted to other hospitals.”[199] As we continue to rely more heavily on connected devices, it is not difficult to see how these types of disruptions could create serious problems across multiple industry sectors—the incipient arrival of driverless cars, for example, represents a potentially vulnerable technology that could be exploited for profit by data hostage-takers. An instance of Ransomware may be localized, but its effects can extend much further afield. Cars without accessible data could be paralyzed, regardless of whether they are in motion at the time the attack begins. Picture the movie Speed, replacing Sandra Bullock at the helm of a passenger-laden bus with a driverless car heading toward a cliff, doomed to disaster unless a ransom is paid.[200] Likewise, many hospital treatments rely on accurate patient data at critical moments. How much would an individual pay to ensure her blood type is communicated correctly or that his medical history warns doctors of possible drug interactions? If a patient were to die under such circumstances, how would a court assess liability for a failure either to prevent the Ransomware attack, or to pay the ransom promptly?

 

X.    Conclusion

 

“[Ransomware] is a volume business. It’s simple, relatively anonymous and fast. Some people will pay, some will not pay, so what. With a wide enough set of targets there is enough upside for these types of attacks to generate a steady revenue stream.”[201]

 

[62]     Grey areas abound, but thoughtful preparation is the best defense; both to avoid a Ransomware attack in the first place, and to manage the issues that may arise when an attack occurs. Practitioners should not only be knowledgeable about Ransomware, which includes understanding Ransomware’s operation, effects, and ramifications, but also vigilant in following the latest trends and tracking the ever-evolving threats. Ransomware is not going anywhere, and while the meteoric rise and spread of Ransomware has been startling as a singular issue, it also serves as a clear warning of things to come. There is still plenty of room for innovation and tremendous incentives for criminals to pursue these opportunities. In a marketplace flooded with stolen credit card numbers and digital credentials, selling ill-gotten personal information to identity thieves has become both more cumbersome and less lucrative than holding data hostage and demanding a ransom from its owner.[202]

 

[63]     Given this environment, practitioners should take a proactive approach to understanding Ransomware, not only to counsel clients effectively, but also to safeguard their own sensitive data, both professional and personal. Such understanding demands a working knowledge of digital currencies and ransom payment options, although there is some debate as to whether employing intermediaries[203] may help address that particular challenge.[204] Regardless, the key will be education and vigilance to guide strategic responses to Ransomware incidents. In addition to taking steps to prevent Ransomware attacks, practitioners must prepare to respond as effectively and efficiently as possible to this ever-evolving threat.[205]

 

 

 

 

* James A. Sherer is a Partner in the New York office of Baker & Hostetler LLP.

** Melinda L. McLellan is a Partner in the New York office of Baker & Hostetler LLP.

*** Emily R. Fedeles is an Associate in the New York office of Baker & Hostetler LLP.

**** Nichole L. Sterling is an Associate in the New York office of Baker & Hostetler LLP.

 

[1] See Krzysztof Cabaj & Wojciech Mazurczyk, Using Software-Defined Networking for Ransomware Mitigation: the Case of CryptoWall, 30 IEEE Network 14 (2016).

 

[2] See James Scott & Drew Spaniel, The ICIT Ransomware Report: 2016 Will be the Year Ransomware Holds America Hostage 3–4 (2016).

 

[3] Ben Rossen, How to Defend Against Ransomware, FTC (Nov. 10, 2016), https://www.consumer.ftc.gov/blog/how-defend-against-ransomware, https://perma.cc/CJA5-BV2B.

 

[4] See Paul Merrion, FBI Creates Task Force to Fight Ransomware Threat, CQ Roll Call, Apr. 4, 2016, 2016 WL 2758516.

 

[5] Robert E. Litan, Law and Policy in the Age of the Internet, 50 Duke L.J. 1045, 1045 (2001).

 

[6] See Amin Kharraz et al., Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks, in DIMVA 2015 Proceedings of the 12th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment 3 (Springer 2015).

 

[7] See James Scott & Drew Spaniel, supra note 2, at 4.

 

[8] Nicole van der Meulen et al., European Parliament Policy Dep’t for Citizens’ Rights & Constitutional Affairs, Cybersecurity in the European Union and Beyond: Exploring the Threats and Policy Responses 35 (2015), http://www.europarl.europa.eu/RegData/etudes/STUD/2015/536470/IPOL_STU(2015)536470_EN.pdf, https://perma.cc/6M58-B4TW.

 

[9] James Scott & Drew Spaniel, supra note 2, at 6.

 

[10] See id.

 

[11] See van der Meulen, supra note 8, at 35.

 

[12] See Josephine Wolff, The New Economics of Cybercrime, The Atlantic (June 7, 2016), http://www.theatlantic.com/business/archive/2016/06/ransomware-new-economics-cybercrime/485888/, https://perma.cc/5L3U-47CT.

 

[13] Id.

 

[14] Doug Pollack, Ransomware 101: What to Do When Your Data is Held Hostage 7 (2016) (ebook), http://lpa.idexpertscorp.com/acton/attachment/6200/f-051f/1/-/-/-/-/IDE_eBook_Ransomware_082616_v1.pdf?cm_mmc=Act-On%20Software-_-email-_-ID%20Experts%20Download%20-%20Ransomware%20101%3A%20What%20to%20Do%20When%20Your%20Data%20is%20Held%20Hostage-_-Download%20Now&sid=TV2:dA7ip6myT, https://perma.cc/327S-TXFL.

 

[15] See Kharraz, supra note 6, at 1, 4.

 

[16] See Azad Ali et al., Recovering from the Nightmare of Ransomware – How Savvy Users Get Hit with Viruses and Malware: A Personal Case Study, 17 Issues in Information Systems 58, 61 (2016).

 

[17] Robert J. Kroczynski, Are the Current Computer Crime Laws Sufficient or Should the Writing of Virus Code Be Prohibited?, 18 Fordham Intell. Prop. Media & Ent. L.J. 817, 823 (2008).

 

[18] See Kharraz, supra note 6, at 1.

 

[19] Gavin O’Gorman & Geoff McDonald, Ransomware: A Growing Menace, Symantec Corp. (2012) at 2, http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/ransomware-a-growing-menace.pdf, https://perma.cc/F6UF-UDUL.

 

[20] Eric Jardine, A Continuum of Internet-Based Crime: How the Effectiveness of Cybersecurity Policies Varies across Cybercrime Types, ResearchGate, 10 (Jan. 2016), reprinted in Research Handbook on Digital Transformations 421 (F. Xavier Olleros & Majinda Zhegu eds., 2016).

 

[21] See Kharraz, supra note 6, at 2.

 

[22] See, e.g., William Largent, Ransomware: Past, Present, and Future, Talos Blog (Apr. 11, 2016, 9:01 AM), http://blog.talosintel.com/2016/04/ransomware.html, https://perma.cc/QU27-WDRK (last visited Feb. 6, 2017).

 

[23] See Ian T. Ramsey & Edward A. Morse, Cyberspaxe Law Comm. Winter Working Grp., Ransoming Data: Technological and Legal Implications of Payments for Data Privacy 4–5 (Jan. 29-30, 2016) (unpublished manuscript) (on file with author), http://www.stites.com/uploads/learning-center/Ramsey_Ransoming-data_Jan2016.pdf, https://perma.cc/H4BZ-UHY3.

 

[24] Pollack, supra note 14, at 7.

 

[25] See Largent, supra note 22.

 

[26] See O’Gorman & McDonald, supra note 19, at 2.

 

[27] See, e.g., Largent, supra note 22.

 

[28] See id.

 

[29] Doug Pollack, Trading in Fear: The Anatomy of Ransomware, id experts (May 2, 2016), https://www2.idexpertscorp.com/blog/single/trading-in-fear-the-anatomy-of-ransomware, https://perma.cc/7VTU-5QAC.

 

[30] Adam Alessandrini, Ransomware Hostage Rescue Manual 2, (2015), http://resources.idgenterprise.com/original/AST-0147692_Ransomware-Hostage-Rescue-Manual.pdf, https://perma.cc/9V7T-L4YA.

 

[31] Considerations associated with quantum computing and decryption are outside the purview of this paper.

 

[32] Ramsey & Morse, supra note 23, at 5.

 

[33] Chris Ensey, Ransomware Has Evolved, And Its Name Is Doxware, DarkReading (Jan. 4, 2017, 07:30 AM) http://www.darkreading.com/attacks-breaches/ransomware-has-evolved-and-its-name-is-doxware/a/d-id/1327767, https://perma.cc/VGJ6-HUHD (noting also that this would be one way of getting back access to at least some of the hostage files).

 

[34] Technical Intricacies of Ransomware and Safeguarding Strategies, Fall 2016 E-Newsletter (Digital Mountain, Santa Clara, C.A.), 2016, at 1, http://digitalmountain.com/enews/FALL_2016_Article2.pdf, https://perma.cc/8CKR-3Q3A.

 

[35] See Largent, supra note 22.

 

[36] Id.

 

[37] See id.

 

[38] See U.S. Dep’t of Justice, Protecting Your Networks from Ransomware 2, https://www.justice.gov/criminal-ccips/file/872771/download, https://perma.cc/3GT6-ARH.

 

[39] See Largent, supra note 22, at 1.

 

[40] See O’Gorman & McDonald, supra note 19, at 4.

 

[41] See Practical Steps to Thwart Ransomware and other Cyberbreaches, YourABA (Dec. 2016), http://www.americanbar.org/publications/youraba/2016/december-2016/be-prepared-to-thwart-ransomware-and-other-cyber-attacks.html, https://perma.cc/U5G4-VX97.

 

[42] See Largent, supra note 22.

 

[43] Id.

 

[44] See O’Gorman & McDonald, supra note 19, at 4.

 

[45] Fed. Bureau of Investigation, Ransomware, www.blockchainalliance.org/docs/Ransomware_e-version.pdf, https://perma.cc/66XL-V4J7.

 

[46] Deepen Desai, Malvertising, Exploit Kits, ClickFraud & Ransomware: A Thriving Underground Economy, ZScaler (Apr. 21, 2015), https://www.zscaler.com/blogs/research/malvertising-exploit-kits-clickfraud-ransomware-thriving-underground-economy, https://perma.cc/C4PN-TM4C.

 

[47] See Largent, supra note 22.

 

[48] See Ransomware on the Rise: Norton Tips on How to Prevent Getting Infected, Norton by Symantec, https://us.norton.com/ransomware/article, https://perma.cc/7MZU-XYVU.

 

[49] See Fed. Bureau of Investigation, supra note 45.

 

[50] Ramsey & Morse, supra note 23, at 5.

 

[51] See Azad Ali et al., supra note 16, at 62.

 

[52] O’Gorman & McDonald, supra note 19, at 5.

 

[53] See Haley S. Edwards, A Devastating Type of Hack Is Costing People Big Money, Time (Apr. 21, 2016), http://time.com/4303129/hackers-computer-ransom-ransomware/, https://perma.cc/AAQ3-52BB.

 

[54] O’Gorman & McDonald, supra note 19, at 2.

 

[55] See Ali et al., supra note 16, at 61–62.

 

[56] Edwards, supra note 53.

 

[57] Tom Spring, Dirt Cheap Stampado Ransomware Sells on Dark Web for $39, ThreatPost (July 14, 2016, 12:35 PM), https://threatpost.com/dirt-cheap-stampado-ransomware-sells-on-dark-web-for-39/119284/, https://perma.cc/A4HS-ZF3H.

 

[58] Largent, supra note 22.

 

[59] Pollack, supra note 14, at 5.

 

[60] Ricci Dipshan, Danger Ahead: 3 New Ransomware Developments in 2016; From Hybrid Ransomware to Attacks on Mobile Devices and New Entrants in the Field, Experts Warn of a Difficult Year Ahead, Law Tech. News (May 31, 2016).

 

[61] Edwards, supra note 53.

 

[62] Spring, supra note 57.

 

[63] See, e.g., Antigone Peyton, A Litigator’s Guide to the Internet of Things, 22 Rich. J. L. & Tech. 9, ¶ 1 (2016), http://jolt.richmond.edu/v22i3/article9.pdf, https://perma.cc/VSZ7-85LE.

 

[64] See van der Meulen, supra note 8, at 45.

 

[65] Dipshan, supra note 60.

 

[66] See Scott & Spaniel, supra note 2, at 4.

 

[67] Spring, supra note 57.

[68] Scott & Spaniel, supra note 2, at 3.

[69] See id. at 4.

[70] See Jon Neiditz, Ransomware in Society and Practice, Practising Law Inst. 39, 41.

[71] Id.

 

[72] Id.

[73] Ben Rossen, Ransomware – A Closer Look, Fed. Trade Comm’n (Nov. 10, 2016, 11:05 AM), https://www.ftc.gov/news-events/blogs/business-blog/2016/11/ransomware-closer-look, https://perma.cc/3HX4-NDE3.

[74] Kharraz, supra note 6, at 2.

[75] Dipshan, supra note 60.

[76] Thompson Information Services, Malware Attack Causes System Shutdown at Medstar, 15 No. 4 Guide Med. Privacy & HIPAA Newsl. 2, at 1 (May 2016) [hereinafter Malware Attack]

[77] Rossen, supra note 73.

 

[78] Edwards, supra note 53.

 

[79] Spring, supra note 57.

 

[80] Largent, supra note 22.

 

[81] See Technical Intricacies of Ransomware and Safeguarding Strategies, Digital Mountain (Fall 2016) http://digitalmountain.com/enews/FALL_2016_Article2.pdf, https://perma.cc/QV3V-ESJQ.

 

[82] Pollack, supra note 14, at 14.

 

[83] See Brian Krebs, CryptoLocker Crew Ratchets Up the Ransom, Krebs on Security (Nov. 6, 2013, 12:13 AM), http://krebsonsecurity.com/tag/cryptolocker-decryption-service/, https://perma.cc/7369-JSKT.

 

[84] Jardine, supra note 20, at 10.

 

[85] O’Gorman & McDonald, supra note 19, at 2.

 

[86] Pollack, supra note 14, at 5.

 

[87] Edwards, supra note 53.

 

[88] See Azad Ali et. al., supra note 16, at 64.

 

[89] See Sentinel One, Ransomware is Here: What You Can Do About It? 2, https://go.sentinelone.com/rs/327-MNM-087/images/Sentinel%20One_Ransomware%20is%20Here.pdf, https://perma.cc/3H46-QJCB.

 

[90] Pollack, supra note 14, at 5.

 

[91] Id.

 

[92] Wolff, supra note 12.

 

[93] Neiditz, supra note 71, at 7 (citing Danny Palmer, Ransomware is Now the Biggest Cybersecurity Threat, ZDNet (May 6, 2016), http://www.zdnet.com/article/ransomware-is-now-the-top-cybersecurity-threat-warns-kaspersky/, https://perma.cc/84XM-57M3).

 

[94] Id. at 9.

 

[95] Merrion, supra note 4.

 

[96] Id.

 

[97] Largent, supra note 22.

 

[98] Wolff, supra note 12.

 

[99] See Sean Sposito, PayPal, OthersBuy Stolen Data from Criminals to Protect Users, San Francisco Chron. (Jan. 8, 2016), http://www.sfchronicle.com/business/article/PayPal-others-buy-stolen-data-from-criminals-to-6744699.php, https://perma.cc/XLE9-AX3Q.

 

[100] Daniel Crothers, Cybersecurity for Lawyers – Part IV: Is Payment of Ransom in Your Budget?, 63 The Gavel 24, 24 (2016).

 

[101] Pollack, supra note 14, at 11 (quoting unnamed consultant “D”).

 

[102] See Mathew J. Schwartz, Please Don’t Pay Ransoms, FBI Urges, Data Breach Today (May 4, 2016), http://www.databreachtoday.com/blogs/please-dont-pay-ransoms-fbi-urges-p-2120, https://perma.cc/8ZND-KM2J.

 

[103] See A.B.A., Practical steps to thwart ransomware and other cyberbreaches, YourABA (Dec. 2016), http://www.americanbar.org/publications/youraba/2016/december-2016/be-prepared-to-thwart-ransomware-and-other-cyber-attacks.html, https://perma.cc/LFT2-UP9E.

 

[104] See Neiditz, supra note 70, at 41.

 

[105] See id.

 

[106] Jardine, supra note 20, at 10-11.

 

[107] Doug Pollack, Ransomware 101: What to Do When Your Data is Held Hostage, 5 (2016) (ebook).

 

[108] See id.

 

[109] Id.

 

[110] See Fact Sheet: Ransomware and HIPAA, Dept. of Health & Hum. Serv., http://www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf, https://perma.cc/G6ZV-S87S (last visited Feb. 8, 2017).

 

[111] Paul Merrion, HHS Clarifies When Ransomware Attacks Trigger HIPAA Notification, CQ Roll Call, July 13, 2016, 2016 WL 3709987 [hereinafter HHS Clarifies].

 

[112] Jocelyn Samuels, Your Money or Your PHI: New Guidance on Ransomware, OpenHealth News, July 11, 2016, http://www.openhealthnews.com/news-clipping/2016-07-11/your-money-or-your-phi-hhs-issues-new-guidance-ransomware, https://perma.cc/Q7P7-P8WL.

 

[113] John Neiditz & David Cox, Beyond Breaches: Growing Issues In Information Security, Integro (2016), https://integrogroup.com/uploads/white_papers/06_16_Beyond-Breaches.pdf, https://perma.cc/U5EJ-SAC8.

 

[114] HHS Clarifies, supra note 111.

 

[115] See generally Azad Ali et. al., supra note 16, at 66 (describing the authors’ personal experience with ransomware mechanisms).

 

[116] See id.

 

[117] See Adam Alessandrini, Ransomware Hostage Rescue Manual, KnowBe4 (2015) at 8, http://resources.idgenterprise.com/original/AST-0147692_Ransomware-Hostage-Rescue-Manual.pdf, https://perma.cc/KNS8-BT5N.

 

[118] See id. at 7.

 

[119] Tom Spring, Dirt Cheap Stampado Ransomware Sells on Dark Web for $39, ThreatPost, July 14, 2016, https://threatpost.com/dirt-cheap-stampado-ransomware-sells-on-dark-web-for-39/119284/, https://perma.cc/2LAV-63HE.

[120] See Crothers, supra note 100 at 24.

 

[121] See Scott & Spaniel, supra note 2, at 3.

 

[122] See Ondrej Kehel, Ransomware: To Pay or Not To Pay, LexisNexis, Aug. 16, 2016, https://www.lexisnexis.com/communities/corporatecounselnewsletter/b/newsletter/archive/2016/08/16/ransomware-to-pay-or-not-to-pay.aspx, https://perma.cc/V2JJ-YHPT.

 

[123] See Azad Ali et. al., supra note 16, at 64.

 

[124] See Jardine, supra note 20, at 10.

 

[125] Scott & Spaniel, supra note 2, at 4.

 

[126] Id. at 5.

 

[127] Michael Sutton, Big Business Ransomware: A Lucrative Market in the Underground Economy, DarkReading, July 1, 2016, http://www.darkreading.com/vulnerabilities—threats/big-business-ransomware-a-lucrative-market-in-the-underground-economy/a/d-id/1326144, https://perma.cc/3GUA-Z8UE.

 

[128] Maria Korolov, Will Your Backups Protect You Against Ransomware?, CSO (May 31, 2016) http://www.csoonline.com/article/3075385/backup-recovery/will-your-backups-protect-you-against-ransomware.html, https://perma.cc/LM56-ZMY5.

 

[129] Doug Pollack, How Ransomware Could Hold Your Business Hostage, idexerts, Apr. 29, 2016, https://www2.idexpertscorp.com/blog/single/how-ransomware-could-hold-your-business-hostage, https://perma.cc/VK9J-B4J5.

.

[130] See Haley Sweetland Edwards, A Devastating Type of Hack is Costing People Big Money, Time (Apr. 21, 2016), http://time.com/4303129/hackers-computer-ransom-ransomware/, https://perma.cc/VS8M-CDZW.

 

[131] Nicole van der Meulen et. al., Cybersecurity in the European Union and Beyond: Exploring the Threats and Policy Responses, European Parliament at 35 (2015), http://www.europarl.europa.eu/RegData/etudes/STUD/2015/536470/IPOL_STU(2015)536470_EN.pdf, https://perma.cc/242L-VJTM (citing Richard Pinson, Computer threat: Cryptolocker virus is ransomware, Nashville Business Journal, Aug. 10, 2015 http://www.bizjournals.com/nashville/blog/2015/08/computer-threatcryptolocker-virus-is-ransomware.html, https://perma.cc/69SN-RD2Y (last visited Oct. 12, 2015)).

 

[132] Michael Sutton, Big Business Ransomware: A Lucrative Market in the Underground Economy, DarkReading (July 1, 2016 11:20 AM) http://www.darkreading.com/vulnerabilities—threats/big-business-ransomware-a-lucrative-market-in-the-underground-economy/a/d-id/1326144, https://perma.cc/63LK-7855.

 

[133] O’Gorman & McDonald, supra note 19, at 4.

 

[134] See id.

 

[135] Ben Rossen, How to Defend Against Ransomware, Federal Trade Commission, Nov. 10, 2016, https://www.consumer.ftc.gov/blog/how-defend-against-ransomware, https://perma.cc/7VVN-WG2L.

 

[136] Scott & Spaniel, supra note 2, at 5.

 

[137] Malware Attack, supra note 76, at 1.

 

[138] Edwards, supra note 54.

 

[139] Rossen, supra note 73.

 

[140] Scott & Spaniel, supra note 2, at 5.

 

[141] Merrion, supra note 4.

 

[142] See Azad Ali et. al., supra note 16, at 63.

 

[143] See Barber, Simon, Xavier Boyen, Elaine Shi, and Ersin Uzun, Bitter to better—how to make bitcoin a better currency, International Conference on Financial Cryptography and Data Security, pp. 399-414. Springer Berlin Heidelberg (2012). See also, Who is Satoshi Nakamoto, CoinDesk, Feb. 19, 2016, http://www.coindesk.com/information/who-is-satoshi-nakamoto/, https://perma.cc/6JP8-NLRU.

 

[144] See generally Andy Greenberg, Follow The Bitcoins: How We Got Busted Buying Drugs On Silk Road’s Black Market, Forbes (Sept. 5, 2013), https://www.forbes.com/sites/andygreenberg/2013/09/05/follow-the-bitcoins-how-we-got-busted-buying-drugs-on-silk-roads-black-market/#3cd73b93adf7, https://perma.cc/ZEA2-JPDR (explaining why Bitcoin is used for underground transactions).

 

[145] Jamie Doward, City Banks Plan to Hoard Bitcoins to Help Them Pay Cyber Ransoms, The Guardian, Oct. 22, 2016, https://www.theguardian.com/technology/2016/oct/22/city-banks-plan-to-hoard-bitcoins-to-help-them-pay-cyber-ransoms, https://perma.cc/PG4H-2TVL.

 

[146] See Robert Mclean, Hospital Pays Bitcoin Ransom After Malware Attack, CNN, Feb. 17, 2016, http://money.cnn.com/2016/02/17/technology/hospital-bitcoin-ransom/, https://perma.cc/78FT-GUMM.

 

[147] Doug Pollack, Tradable, Untraceable, Sometimes Unavoidable: The Business of Bitcoin, id Experts, June 20, 2016, https://www2.idexpertscorp.com/blog/single/tradable-untraceable-sometimes-unavoidable-the-business-of-bitcoin, https://perma.cc/VM4R-R2Y4.

 

[148] See Ramsey & Morse, supra note 23, at 7.

 

[149] IRS Virtual Currency Guidance: Virtual Currency Is Treated as Property of U.S. Federal Tax Purposes; General Rules for Property Transactions Apply, IRS, Mar. 25, 2014, https://www.irs.gov/uac/newsroom/irs-virtual-currency-guidance, https://perma.cc/JP66-2H87.

 

[150] I.R.S. Notice 2014-21 at 3, Mar. 25, 2014, https://www.irs.gov/irb/2014-16_IRB/ar12.html, https://perma.cc/MX9U-WCWN.

 

[151] See Ramsey & Morse, supra note 23, at 5.

 

[152] Id.

 

[153] Manhattan U.S. Attorney Announces Charges Against Two Florida Men for Operating an Underground Bitcoin Exchange, FBI, July 21, 2015, https://www.fbi.gov/contact-us/field-offices/newyork/news/press-releases/manhattan-u.s.-attorney-announces-charges-against-two-florida-men-for-operating-an-underground-bitcoin-exchange, https://perma.cc/Z85B-LT87.

 

[154] Id.

 

[155] Id.

 

[156] Id.

 

[157] See David S. Cohen, Kidnapping for Ransom: The Growing Terrorist Financing Challenge, Council on Foreign Relations, Oct. 5, 2012, http://www.cfr.org/terrorist-financing/remarks-treasury-under-secretary-cohenkidnapping-ransom-growing-terrorist-financing-challenge/p29376, https://perma.cc/6X6P-NKHJ.

 

[158] Samuel Cutler, Could the Administration’s New Hostage Policy Leave Banks Vulnerable?, Sanction Law, June 24, 2015, http://sanctionlaw.com/could-the-administrations-new-hostage-policy-leave-banks-vulnerable/, https://perma.cc/5B9Z-KX23.

 

[159] See 18 U.S.C. § 2339B (2012).

 

[160] See id.

 

[161] Ramsey & Morse, supra note 23, at 14.

 

[162] See Exec. Order No. 13,694, 80 Fed. Reg. 18,077 (Apr. 1, 2015).

 

[163] Ramsey & Morse, supra note 23, at 14 (quoting Exec. Order No. 13,694, 80 Fed. Reg. at 18078).

[164] See id.

 

[165] See Cutler, supra note 158; see also Statement by the President on the U.S. Government’s Hostage Policy Review, The White House Office of the Press Secretary, June 24, 2015, https://www.whitehouse.gov/the-press-office/2015/06/24/statement-president-us-governments-hostage-policy-review, https://perma.cc/W5J4-UNFK (“[T]he United States government will not make concessions, such as paying ransom, to terrorist groups holding American hostages…. At the same time, we are clarifying that our policy does not prevent communication with hostage-takers – by our government, the families of hostages, or third parties who help these families”).

 

[166] See Statement by the President on the U.S. Government’s Hostage Policy Review, supra note 165.

 

[167] See, e.g., Manhattan U.S. Attorney Announces Charges Against Two Florida Men for Operating an Underground Bitcoin Exchange, supra note 153. DOUBLE CHECK THIS TO SEE IF ACTUALY 18 USC 2339

 

[168] Incidents of Ransomware on the Rise: Protect Yourself and Your Organization, FBI, April 29, 2016, https://www.fbi.gov/news/stories/incidents-of-ransomware-on-the-rise/incidents-of-ransomware-on-the-rise, https://perma.cc/83FC-G2W8

(citing Federal Bureau of Investigation Cyber Division Assistant Director James Trainor).

 

[169] See OFAC FAQs: Sanctions Compliance, U.S. Dep’t of the Treasury, https://www.treasury.gov/resource-center/faqs/Sanctions/Pages/faq_compliance.aspx, https://perma.cc/2ACP-XZ7V (last visited Mar. 31, 2017).

 

[170] See Jardine, supra note 20, at 11.

 

[171] Sposito, supra note 99.

 

[172] See United States v. Kozeny, 582 F. Supp. 2d 535, 540 (S.D.N.Y. 2008).

 

[173] Ramsey & Morse, supra note 23, at 19 (emphasis added).

 

[174] See Korolov, supra note 128.

 

[175] See, e.g., Ivan Hemmans & David G. Ries, Cybersecurity: Ethically Protecting Your Confidential Data in a Breach-A-Day World (PowerPoint), at slides 18–21, April 27, 2016, http://www.americanbar.org/content/dam/aba/multimedia/cle/materials/2016/04/ce1604lpi.authcheckdam.pdf, https://perma.cc/V4T7-TAFT.

 

[176] Comment on Rule 1.1, American Bar Association: The Center for Professional Responsibility, http://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/model_rules_of_professional_conduct_table_of_contents.html, https://perma.cc/GC6Q-4FN6 (last visited Feb. 12, 2017).

 

[177] FBI Internet Crime Complaints, Florida Atlantic University, http://www.fau.edu/police/images/FBI%20Internet%20Crime%20Complaints.pdf, https://perma.cc/5LLL-JGCE (last visited Feb. 12, 2017); see also Incidents of Ransomware on the Rise: Protect Yourself and Your Organization, supra note 168.

 

[178] Rossen, supra note 73.

 

[179] See 15 U.S.C. § 6803; see also Ransomware – Legal Liability and Enforcement, Fall 2016 E-Newsletter (Digital Mountain, Santa Clara, C.A.), Oct. 24, 2016, http://digitalmountain.com/enews/FALL_2016_Article3.pdf, https://perma.cc/7YWZ-C3GP.

 

[180] Ransomware – Legal Liability and Enforcement, supra note 179.

 

[181] Fact Sheet: Ransomware and HIPAA, supra note 110.

 

[182] Malware Attack, supra note 76 (quoting John Parmigiani, HIPAA consultant and editorial advisory board member).

 

[183] See, e.g., United States v. Haymond, No. 08-CR-201-TCK, 2016 WL 4094886, at *2 (N.D. Okla. Aug. 2, 2016).

 

[184] See Virginia College Savings Plan v. Zhouda, 2016 WL 5920046 (UDRP-ARB Dec), at *2–3 (Lowry, Arb.).

 

[185] See generally Ed Silverstein, Law Firm Among the Latest Victims of Ransomware Attack, Law Technology News, Mar. 11, 2015, www.legaltechnews.com/id=1202720266972/Law-Firm-Among-the-Latest-Victims-of-Ransomware-Attack, https://perma.cc/4QVA-3Z4B (detailing a law firm’s recent ransomware attack).

 

[186] See Univ. of Montreal Pension Plan v. Bank of Am. Sec., LLC, 685 F. Supp. 2d 456, 462 (S.D.N.Y. 2010).

 

[187] See Korolov, supra note 128.

 

[188] James A. Sherer, Taylor M. Hoffman & Eugenio E. Ortiz, Merger and Acquisition Due Diligence: A Proposed Framework to Incorporate Data Privacy, Information Security, e-Discovery, and Information Governance into Due Diligence Practices, 21 Rich J.L. & Tech 5, ¶ 36 (2015), http://jolt.richmond.edu/v21i2/article5.pdf, https://perma.cc/4KBL-2GZ6.

 

[189] This is often a mandatory “exception” in many Records and Information Management and Information Governance policies. See Vicki Miller Luoma, Computer Forensics and Electronic Discovery: The New Management Challenge, 25 Computers & Security 91, 96 (2006) (When creating an “electronic document retention and deletion policy . . . [a]ny such policy must retain the flexibility to implement litigation holds by suspending routine document deletion” in the face of a reasonable anticipation of litigation).

 

[190] See Crothers, supra note 100.

 

[191] Ransomware: Past, Present, and Future, supra note 22.

 

[192] See id.

 

[193] Tom Spring, Dirt Cheap Stampado Ransomware Sells on Dark Web for $39, ThreatPost (July 14, 2016, 12:35 PM), https://threatpost.com/dirt-cheap-stampado-ransomware-sells-on-dark-web-for-39/119284/, https://perma.cc/5FLX-GBPM.

 

[194] See Ben Dickson, What makes IoT ransomware a different and more dangerous threat?, Tech Crunch, Oct. 2, 2016, https://techcrunch.com/2016/10/02/what-makes-iot-ransomware-a-different-and-more-dangerous-threat/, https://perma.cc/8VEP-HUK4.

 

[195] Korolov, supra note 128.

 

[196] Sutton, supra note 127.

 

[197] Id.

 

[198] See Brian Buntz, The 10 Most Vulnerable IoT Security Targets, Internet of Things Institute, July 27, 2016, http://www.ioti.com/security/10-most-vulnerable-iot-security-targets?NL=IOT-001UBER&Issue=IOT-001UBER_20160804_IOT-001UBER_796&sfvc4enews=42&cl=article_7&utm_rid=CPG03000004380699&utm_campaign=13637&utm_medium=email&elq2=6a8551b97117440a8d6f316007c6c548, https://perma.cc/8UH5-QPVT.

 

[199] Korolov, supra note 128.

 

[200] See generally Speed (Twentieth Century Fox Film Corp. 1994) (a film in which a police officer must drive a bus above 50 miles per hour in order to prevent a bomb from exploding on the bus).

 

[201] Raynham Remains Offline in Computer Virus Mystery, Wicked Local (Mar. 11, 2016, 5:30 PM), http://www.wickedlocal.com/news/20160311/raynham-remains-offline-in-computer-virus-mystery, https://perma.cc/BWW8-J9DF (quoting Brian Contos, ICIT Fellow and VP & Chief Sec. Strategist at Securonix).

 

[202] See Wolff, supra note 12.

 

[203] See Sposito, supra note 99.

 

[204] See Cutler, supra note 158.

 

[205] See Practical Steps to Thwart Ransomware and Other Cyberbreaches, Your ABA, Dec. 2016, http://www.americanbar.org/publications/youraba/2016/december-2016/be-prepared-to-thwart-ransomware-and-other-cyber-attacks.html, https://perma.cc/5RX3-WWJG.

Jennings Publication Version PDF

Cite as: Madison Jennings, Protected Genetics: A Case for Property and Privacy Interests in One’s Own Genetic Material, 23 Rich. J.L. & Tech. 10 (2016), http://jolt.richmond.edu/volume23_issue4_jennings/.

 

By: Madison Jennings*

I.  Henrietta And Her Cells

 

[1]       In 1951, a young black woman named Henrietta Lacks entered Johns Hopkins Hospital, having been diagnosed with cervical cancer.[1] There, a biopsy of her cancerous tissue was, without her knowledge or consent, taken.[2] The biological human tissue sample, produced from that biopsy procedure[3] would ultimately become more celebrated and influential than anyone present at that extraction might have dared to imagine.[4]

[2]       In her 2010 book, author Rebecca Skloot recounts this story of how a small cluster of cells scraped from the cervix of this impoverished woman from rural Virginia—a woman who grew to adulthood on the land her ancestors had once worked as slaves—became the cornerstone of millions, if not billions, of dollars worth of scientific research.[5] Looking back at the second half of the twentieth century, it would be an extraordinary challenge to find a discovery, innovation, or breakthrough involving human biology that did not, at some point, rely on these cells.[6]

A.  The Cells

[3]       HeLa cells, aptly named after the woman from which they derived, were developed into the world’s first line of immortal human cells.[7] Immortal cells are cells that can reproduce continuously without degrading or dying out.[8] Typical human cells have a reproductive lifespan, just as human beings do, limiting the timeframe in which they can replicate themselves. Eventually, the copies that cells make of themselves begin to degrade, contaminated by bacteria or other microorganisms, producing corrupted replicas, ultimately becoming incapable of cellular reproduction and dying out.[9] Immortal cells are different. An immortal cell line reproduces indefinitely and constantly—almost obsessively—never dying out entirely.[10]

[4]       Henrietta’s cancer cells did just that, duplicating themselves at an impressive rate and continuing to do so indefinitely, unless frozen.[11] Her cells were the first to be capable of such a feat.[12]

[5]       Before Henrietta Lacks, the ideal of an immortal line of human cells was nothing more than wishful thinking—a pipe dream of the scientific community–the stuff of science fiction.

[6]       Her cells were unique and represented a major breakthrough for scientific research. For years, researchers had been attempting to grow human cells in culture, largely without success.[13] Using the same techniques and the same procedures they had been employing unsuccessfully, researchers expected the same results—eventual death of the cells.[14] Henrietta’s normal cells performed as anticipated, dying just a few days after being put into culture.[15] Her cancer, however, grew at an indefatigable rate.[16] The very cancer that killed Henrietta would, inexplicably, lead to her immortality, and when it became clear to those with access to those cells just what it was that they had in their possession–the first ever line of immortal human cells–little time was wasted in announcing the breakthrough to the world.[17] HeLa cells made their debut on national television, a vial of them held out for the world to see—a victory for science and for mankind, heralding a new age of medicine and discovery.[18]

[7]       At the same time, Henrietta lay prostrate in a hospital bed at Johns Hopkins, succumbing to the same cancer contained in that vial.[19] After she passed away, she was “buried in an unmarked grave.”[20]

[8]       For most of the HeLa cells’ history, they were not connected to Henrietta, the person, in any meaningful way.[21] A chance mention of her name by a professor in a community college class inspired a teenager named Rebecca Skloot to embark on a years-long journey to remedy that—looking beyond the cells themselves, to the life that had produced them.[22] Skloot sought to know and to make known the woman whose cancerous misfortune led to such astonishing and important things as the polio vaccine and chemotherapy.[23] Skloot succeeded in that endeavor when in 2010, twenty-two years after first hearing Henrietta’s name, she published her biography of Henrietta, Henrietta’s family, and the HeLa legacy.[24]

[9]       The Immortal Life of Henrietta Lacks catapulted Henrietta, her cells, and her family into the national spotlight. It spent seventy-five weeks on the New York Time’s bestseller list,[25] became required reading at educational institutions across the country,[26] and in April 2017 HBO premiered a film version starring Oprah Winfrey.[27]

[10]     Henrietta’s story has captured the imagination of almost everyone it is exposed to. However, reactions to her story vary–from awe at all that arose from such seemingly unremarkable circumstances, to gratitude for all that her cells have made possible, to indignation and outrage on her behalf.[28] For many, the harsh reality that Henrietta died impoverished and in pain, her contributions unknown, while so many strangers benefited from the products of her body–taken without her knowledge and without her consent—is difficult to accept.

B.  Henrietta Lacks, The Woman

[11]     Henrietta was born as Loretta Pleasant in Roanoke, Virginia in 1920.[29] It is unclear why or when she came to be called Henrietta.[30] She was one of ten siblings, and following her mother’s death in 1924, her father moved the entire family to Clover, Virginia, where the siblings were divided amongst relatives to be cared for.[31] There, Henrietta shared a cabin with her grandfather and cousin.[32]

[12]     Henrietta later married that cousin, David Lacks, in 1941.[33] The couple already had two children.[34] After marrying, they moved to Baltimore, Maryland.[35] It was there, after giving birth to their fifth child, that Henrietta sought medical attention for vaginal pain and bleeding.[36] At that time, Johns Hopkins was the only hospital in the area that treated black patients, particularly poor ones like Henrietta who could not afford medical care.[37]

[13]     In many ways, an intersection of two major themes of Henrietta’s life—poverty and being a black minority—created the circumstances that allowed her cells to be harvested and commercialized. It is worth questioning whether an affluent white woman would have had the same experiences as Henrietta, or been taken advantage of quite so easily.[38]

[14]     Back in that day, many physicians and researchers believed that poor patients who received reduced or no-cost medical care were freely available for testing–consensual or otherwise–almost as a form of payment.[39] In general, very few people felt that it was morally necessary to gain a patient’s permission before obtaining, storing, or analyzing any tissue sample.[40] It is extremely unlikely that anyone would have thought of it as being so much as a common courtesy, let alone a prerequisite to the maintenance of her human rights, to inform someone like Henrietta of what had been done to her.[41]

[15]     This is no longer the way of the world. Today, it would be an appalling violation of ethical and legal standards for a physician to perform a biopsy without the informed consent of his patient.[42] One might hope that modern standards would extend beyond the biopsy itself to the usage of tissue samples. That modern legal, social, and moral standards would mandate a different result. It might be expected that, in today’s world, Henrietta would have had the right to decide for herself. That she would have been legally entitled to choose whether her cells were used for research. It is uncertain whether she would have.

[16]     Despite these changes in expectations over a person’s right to full control over their body, it is possible that in today’s world, there isn’t much about Henrietta’s story that would turn out differently. Granted, the initial biopsy would not have been undertaken without her knowledge or consent.[43] However, there is not much reason to believe that once a sample was taken, she would have had any control over what happened to it.[44] In fact, the evidence suggests otherwise; that she, or any other person, would have very little control at that point.[45]

II.  Biobanks

[17]     Today, biopsies are regularly performed medical procedures,[46] and although Henrietta never had the opportunity to consent to hers, it is fair to speculate that her modern-day counterpart would consent without second thought.[47] Biopsies are a routine part of cancer treatments, used to diagnose, assess, and provide individualized care.[48] The biopsy itself does not present a challenge. The challenge lies in what is done, and what ought to be done, with leftover human tissue that is no longer needed for the purpose for which it was originally taken?

[18]     The following section discusses what becomes of our biological leftovers, and whether any individual should have the right to decide for themselves whether their tissue is saved or discarded.

[19]     Every day, individuals across the country and around the world consent to a variety of medical tests and procedures, many of which require the extraction of their body tissue.[49] These tests range from the commonplace (drawing blood at an annual physical) to the unexpected (an emergency appendectomy).[50] Very few of these individuals will wonder what happens to their leftover tissue: what becomes of the blood, the bone marrow, the appendix that goes unused? Unfailingly, many just assume it is discarded.[51] Sometimes, it is. However, often it is not. Rather, it is stored.[52]

[20]     Biobanks are institutions that collect and distribute biological materials—often human tissue or blood—for research purposes.[53] When researchers need human material, they peruse a catalogue and order what they need.[54] Specimens are sorted by type (blood, bone marrow, etc.), and labelled with their demographical designations (“male”, “thirty years old”, and “Caucasian”).[55] The source’s name, or other “identifying” information, is not included.[56]

[21]     Biobanks are an invaluable resource for the scientific community.[57] Without them, researchers might waste invaluable time, money, and resources in acquiring enough specimens–of appropriate type and variety–necessary to conduct their studies. This comment does not argue against the existence of biobanks. They are a necessary resource and should exist. Instead, this comment critically examines the methodology employed in the creation of these biobanks, arguing that the methodology must change to protect the rights of ordinary individuals whose bodily products are bought and sold without their knowledge.

[22]     Most of the human samples stored and sold by biobanks are the leftover byproducts of medical testing.[58] As described above, a person goes to the doctor, and has blood work done. Once the testing has concluded, the unused blood is often sent for storage at a biobank, where it is accessible to researchers across the country—perhaps even the world.[59]

[23]     Henrietta’s story, a half-century ago, is achingly similar to this modern process. She went to a hospital, received medical care, and died, none the wiser that some small piece of her had been taken and stored for future use.[60]

[24]     Most people would hope to have control over whether their tissue is taken and stored like this,[61] or that they would at least know that their biological materials—their genetic information, something so intrinsically theirs—was being used for this purpose.

[25]     Unfortunately, that is not the case.[62] More than likely, any person alive today is no more protected in this regard than Henrietta Lacks was when she walked into Johns Hopkins.

[26]     Very few people are aware that their unused biological material is saved at all, let alone saved for the purpose of sale and distribution to scientists and researchers. Many would hope that they would be asked, or at least informed, before their samples were kept or sold.[63] Despite this, it is not common practice to inform someone when their medical waste is saved instead of being discarded, let alone request permission to do so. This comment argues that consumers and patients have the right to be informed, and the right to control what becomes of their own genetic materials.

A.  A Moore Modern Henrietta?

[27]     In 1976, a man named John Moore was diagnosed with leukemia.[64] While treated, copious amounts of blood and other samples were taken from his body.[65] Without his consent, some of Moore’s cells were turned into commercial cell lines—similar to Henrietta’s.[66] Despite the fact that the doctor who treated him and the hospital where he was being treated profited substantially from the sale of his cells, Moore did not receive any compensation.[67]

[28]     Moore brought several claims, among them a claim for a breach of informed consent, a breach of fiduciary duty, and a claim of conversion.[68] The California court addressed the merits of the conversion claim, finding that Moore did not have a sufficient property interest in his cells to sustain the claim.[69]

[29]     The story of John Moore eerily echoes that of Henrietta Lacks. Both should be taken as cautionary tales, and as clear examples of why there exists a need for extensive protections for the rights of individuals to have control over their own genetic information and materials.

B.  Proposed Protections

[30]     Protections of this kind are generally conceived under one of two already-existing legal frameworks: privacy or property.[70] Property regimes orient around the right to patent, commercialize, or otherwise control genetic information or genetic materials themselves,[71] while privacy regimes focus on disclosure or dissemination of genetic information found in human tissue samples.[72] Scholarship on the matter tends to pit these frameworks against one another,[73] asking the question of whether a privacy right or a property interest best protects individuals against the sort of infringement and violation suffered by Henrietta Lacks.[74]

[31]     Proposed here is not solely a property or a privacy regime, but rather an attempt to weave the two types of rights together in an effort to comprehensively protect a right that most Americans believe ought to exist.

[32]     In what ways might a modern Henrietta be protected from a transgressional, trespassory use of her body, her cellular being, and her very DNA? This comment seeks to use existing legal structures and the promulgation of newly recognized rights to create a framework through which a person in Henrietta’s situation would not only have their rights vindicated, but would have rights to assert in the first place.

[33]     The law is lagging, falling woefully short of protecting rights of individuals when it comes to their DNA, their genetic materials, and their genetic information. This next section briefly explores current law at the federal level, noting its shortcomings and inadequacies, to showcase the need for new law. Then, a sampling of state legislation is discussed, with particular focus on those states, which have created a statutorily designated property interest in genetic information. The designation of a property interest in genetic information ultimately forms the backbone of my proposed legislation, with a supplementary privacy right encompassed within it.

III.  Current Federal Law

[34]     Federal protections for the genetic information of individuals as a privacy right are found mainly in the Genetic Information Nondiscrimination Act (“GINA”), which prohibits genetic discrimination in the health insurance and employment contexts.[75] Under GINA, health insurance companies may not deny benefits to anyone because of any genetic predisposition they may have to certain illnesses or afflictions.[76] Similarly, it is against the law for employers to use genetic testing to determine any aspect of a person’s employment.[77]

[35]     Notably, the focus of GINA (and of many other statutes designed to protect individuals in this realm) is the prevention of discrimination based on an individual’s genetic information.[78] This is not the focus here—Henrietta was not discriminated against because of anything found in her genes. While admirable, protection against genetic discrimination does not solve the problem found in Henrietta’s story.

[36]     In the field of medical and scientific research, individual protections reach no further than the Common Rule.[79] The Common Rule regulates federally-funded research whenever that research uses human being as subjects.[80] The Common Rule requires informed consent—a concept taken from doctor-patient interactions and requirements—as its strongest protection for otherwise-vulnerable subjects.[81] Consent is only informed, and therefore valid, when it is given after a potential subject is made aware of all information relevant to her decision to participate (or not) in any given study.[82] Consent is not informed if, for instance, potential side effects are not disclosed beforehand.[83]

[37]     The Common Rule expands on the principle of informed consent, articulating the specific disclosures required for the use of human test subjects.[84] Subjects must be told that their consent can be withdrawn at any time; that agreement to participate at the onset of a study never requires someone to continue their participation if, at any time, they wish to stop.[85] The Common Rule also requires certain findings of ongoing studies to be disclosed to the subjects of those studies, if preliminary findings might affect a person’s willingness to continue to participate.[86]

[38]     The U.S. Food and Drug Administration imposes similar standards on the studies it reviews,[87] effectively extending the Common Rule beyond those studies that are federally-funded.[88]

[39]     This is the extent to which human research is governed at the federal level, and while the Common Rule provides extensive protections to human beings engaged in scientific studies, it does not extend to research using human tissue.[89] Under guidance issued by the federal Office of Human Research Protections in 2004, tissue samples collected for present or future research are not covered by the consent provisions of the Common Rule, as long as those samples are without personally identifying information.[90] If a sample is not linked to an individual, then it is not protected by federal regulation.[91]

[40]     The existence of the Common Rule during Henrietta’s lifetime would not have stalled the events that culminated in the world’s first immortal cell line. The story of Henrietta Lacks is a helpful rubric against which the legislation proposed by this comment is graded. In what ways could federal law protect a modern Henrietta?

 

IV.  Current State Law

           

[41]     Without federal protection, the onus of protecting the rights of individuals in their genetic material has fallen to the states. Many states have genetic privacy laws requiring informed consent to disclose genetic information, [92] but just eight states require that same consent to retain that same information.[93] Only five states recognize a personal property interest in genetic information for the individual to whom that information pertains.[94] This section first addresses these different state-level property regimes, assessing their strengths and weaknesses and using them to build the foundation for a federal rule recognizing a similar right. From there, I take a broader look at state-level privacy regimes to consider how the right of privacy might be expanded beyond the realm of discrimination to strengthen my proposed protections.

[42]     Of the states that recognize some sort of property interest related to genetic data, three states–Colorado,[95] Georgia,[96] and Louisiana[97]–recognize the interest as inhering only in the genetic information and not in the genetic samples themselves.[98] These statutes provide a civil remedies for violations (i.e. the unauthorized disclosure of genetic information), but those protections extend only to instances of discrimination in the health insurance context.[99] As currently written and enforced, these state statutes provide no more protection than current federal regulation, and so do not solve the problem raised by the story of Henrietta Lacks. Statutes that do not reach beyond employment and insurance discrimination and into the realm of research conducted using human tissue samples would not have helped Henrietta.

[43]     Of the remaining states that recognize a property interest in genetic information, we can learn several things. First, the most comprehensive state system currently enacted shows us just how far legislation needs to go to truly protect the interests of individuals in this context. Second, is a bit of a cautionary tale, a lesson in how it is not enough for statutory language to be broad enough that it could encompass research. Statutes must specifically address the use of human tissue in research, explicitly subjecting researchers to the same standards imposed upon physicians and others when it comes to the use and misuse of someone’s genetic material. Finally, we will briefly confront a common policy argument against the promulgation of the rights suggested in this comment.

A.  The Model Case

[44]     Of the states that recognize a property interest in genetic data, just one explicitly identifies a physical genetic sample in and of itself as the personal property of the individual from whom the sample is derived—Alaska.[100]

[45]     The Alaska statute provides that a DNA sample and the results of any analysis of that sample are the “exclusive property” of the individual sampled.[101] The collection, analysis, or retention of a DNA sample without the informed consent of that individual is a violation of Alaska law, as is the intentional disclosure of any such analysis without the requisite consent.[102] While there are exemptions to this standard,[103] Alaska has the most comprehensive protection regime for individuals’ rights over their own genetic material.

[46]     Creating these rights are one thing, and enforcing them is another. To that end, Alaska created both a private cause of action[104] and a criminal penalty–enforceable against those who collect, analyze, retain, or disclose genetic information in violation of the statute.[105] If a violation results in profit or monetary gain for the violator, he may be civilly liable for up to $100,000.[106]

[47]     Had Henrietta’s cells been taken, tested, and commercialized without her knowledge in modern day Alaska, she could have recovered hundreds of thousands of dollars from those who profited from the extensive research conducted using her cells. She may not have died impoverished, when so many profited from her cells. She may not have gone unacknowledged for decades after. She might have had a headstone.[107]

B.  A Cautionary Tale

[48]     Florida is the fifth and final state recognizing a property interest in genetic information.[108] Like Alaska, Florida recognizes a criminal penalty for violations of these protections.[109]

[49]     Under Florida law, challenges arise not from the inadequacy of legislation, but from courts’ narrow interpretations of the legislation– restricting its scope, rendering it ineffective at protecting individuals in the context of scientific research. Florida’s law is broad enough to form an attempted extension of the desired protections. However, it still fails the public, as it must also be specific enough that it cannot be interpreted otherwise.

[50]     The Florida legislature approaches genetic information as a civil rights issue, protecting its citizens from discrimination in areas such as “insurance, employment, mortgage, loan, credit, or educational opportunity”[110] based on their genetics. It is the specificity of this objective that allows courts to interpret the statute as narrowly as possible.

[51]     As a result, despite seemingly enthusiastic protection provided by the Florida statute, practically these rights are nearly unenforceable when violated for the purpose of scientific research.

[52]     Use in scientific research is not one of the several exceptions[111] built into the Florida statute for certain uses of genetic information. A literal reading might lead to the belief that individuals are protected against unauthorized use of their genetic information in that context. Courts have not agreed with this interpretation.[112]

[53]     In 2003, a federal district court for the Southern District of Florida held that protections offered to individuals regarding their genetic information did not extend to the realm of scientific research.[113] For the court, informed consent principles apply only in the context of patient-doctor relationships, and do not extend to the researcher-subject relationship.[114]

[54]     The Greenberg case addressed a dispute arising from the patent of a gene sequence[115] discovered as a result of research conducted using tissue samples from children born with Canavan[116] disease.[117] Plaintiffs were the parents of those children.[118] They claimed that the eventual patenting and commercialization of the research product–made possible by their children’s genetic information–was beyond the scope of what they had consented to.[119] Plaintiffs argued that because the researchers’ economic interest had not been revealed to them at the outset, the patenting of the genetic sequence amounted to unlawful conversion of plaintiff’s property, and any money made subsequent to that patent was unjust enrichment.[120]

[55]     Despite the statutory language regarding genetic information being broad enough to encompass this circumstance,[121] and despite the designation of a property interest in genetic information,[122] the court ultimately declined to find a property right for the Greenberg plaintiffs.[123] Ultimately, their suit was dismissed.[124]

[56]     The court in Greenberg failed to cite statutory language supporting its decision, instead leaning heavily on policy arguments.[125] The court reasoned that the links between the physical samples, to the information in those samples, to the research conducted using that information, to the results of that research, to the ultimate commercialization of those results were too attenuated to fall within the intended scope of the statute.[126] This argument is not entirely without merit but does not fully justify the decision.

[57]     To supplement this justification, the court raised a concern commonly invoked whenever a restriction on research is proposed—that recognizing this sort of right would too heavily burden research, resulting in a negative impact to society as a whole.[127] The court goes so far as to claim that permitting plaintiffs to bring a cause of action for conversion would “cripple” medical research.[128]

[58]     This is a common policy argument made against the sorts of rights and protections proposed by the plaintiffs in Greenberg, in this comment, and elsewhere. This argument weighs the good done by scientific research against the infringement of the natural rights of any one person, deciding that the good of society must outweigh the rights of any individual person.[129]

[59]     This sort of values judgment can certainly be appealing. But in an ethical context, an argument that pits the ease of research against the personal rights and liberties of individual people unreasonably relies upon the specter of a negative outcome that is not certain. A requirement to acquire informed consent before conducting research on any one person’s genetic materials would hinder research, this is true—but so did requiring informed consent before conducting experiments on human beings;[130] so did the abolition of slavery, when research could no longer be conducted on unwilling human chattel.[131] Research will persist, regardless.

C.  States Without a Property Interest

[60]     State genetic privacy statutes are somewhat more common than statutes identifying a personal property right in genetic information. However, of the twenty-seven states that require consent for the dissemination of an individual’s genetic information, only twelve require that same consent for the performance of a genetic test, and even fewer require consent to obtain, access, or retain genetic information.[132] This inconsistency speaks to the need for federal regulation to standardize the rights of all Americans in the realm of genetic information.

[61]     Of all the states, only two (Alaska and New Mexico) require consent for performing a genetic test; obtaining, accessing, or retaining genetic information; and disseminating that information.[133] New Mexico provides a civil remedy for those whose genetic information has been acquired or used in violation of the statute, although the damages are restricted to actual damages plus $5,000[134]—a relatively small sum.

[62]     In any state other than Alaska, a modern day Henrietta would be unable to vindicate her rights, as she would likely have no rights to vindicate. Her cells were made anonymous and no information gleaned from them was used to discriminate against her in any way. As the cells were studied and distributed, information gleaned from them was not linked to Henrietta or to the Lacks family. Most information gleaned from the cells had nothing to do with Henrietta at all—the use of the cells was their ability to reproduce and be used as test subjects,[135] not in any secrets hidden in the strands of her DNA.

[63]     Federal recognition of a property interest in one’s own genetic information and material, extending fully into the realm of research, is necessary to prevent injustice. A property regime gives individuals the legal structure necessary to truly exercise control over their own genetic material.

V.  Theories of Property and Privacy

[64]     The Alaskan structure for protecting individual rights in the realm of genetic information is the most comprehensive of any state, as it recognizes both a property interest in one’s own genetic information as well as privacy right protection against unwarranted obtainment and disclosure of that same information.[136]

A.  Property

[65]     At a most fundamental level, to own something as one’s own property is to have complete dominion and control over that thing.[137] In the context of one’s own body and body products, there is a natural inclination to want that sort of control. Many people may even feel some degree of discomfort with the idea that human bodies can be property in the way that a house or a car are. This could be because there is an implicit understanding that if something is property, it is therefore alienable.[138] Property, as we understand it, has economic value.[139] It can be bought, and it can be sold.[140]

[66]     The idea that a human body, or any part of it, can be bought or sold is an uncomfortable one, and for good reason.[141] Moving beyond that initial reaction, however, allows us to view property regimes with a more open mind.

[67]     Strong public policy working against alienation of a particular type of property can ultimately counteract the alienability of that property.[142] This theory of property is underutilized in American jurisprudence, largely because of the belief that free alienation of property best serves the interests of society as a whole.[143] Public policy is therefore rarely interpreted as favoring any restriction on alienability. In the instance of human bodies, an exception should be made.

[68]     Human tissue samples hold immense economic value.[144] We live in a world where biological samples and genetic data is collected, aggregated, analyzed, and commercialized.[145] It is insincere to pretend otherwise, and placing an arbitrary restriction solely on individuals seeking to commercialize their own biological materials serves to remove them from the market without impacting the existence or the robustness of that market.[146] This makes donors of genetic material vulnerable, as they are the only ones who are unable to profit off of something that is, in all conventional senses, very much “theirs.”[147]

[69]     If the goal is to give individuals autonomy over their own genetic information and material, a property interest feels almost essential. Property doctrine is an efficient device for allowing individuals to express and enforce preferences over who may and may not access what information.[148]

[70]     Without a property interest, Henrietta had no right to any of the profits resulting from the development and commercialization of her cell line. She remained poor, and her family still wondered: “If our mother so important to science, why can’t we get health insurance?”[149]

B.  Privacy

[71]     Practically however, a property interest is not enough, and would do little for the person whose material is stored and analyzed absent their consent, but never commercialized—why should a person whose tissue yielded something worthy of commercialization be entitled to greater recovery (or recovery at all) than a person whose tissue yielded naught but a test subject? Each person received an equal amount of harm to their dignity and to their personal autonomy. These are the types of harms we are seeking to prevent.

[72]     A flaw of any property regime on its own is that it emancipates the part from the whole, ignoring the incalculable value of an entire person.[150] It is impossible to quantify the indignity done to a person when her injury is reduced to the conversion of a good with an often unquantifiable economic value. The right to privacy is crucial to effectively legislating genetic information protections.

[73]     Privacy doctrine is traceable to the work of Justices Warren and Brandeis in their 1890 work, The Right to Privacy.[151] They sought to expand and redefine the scope of the protections offered by traditional property doctrine, creating a new right of privacy in the process.[152] Although the right to privacy is typically understood be to rooted in the theory of natural law,[153] any right to privacy as we currently understand it is derived from and wholly reliant on the fundamental right of property ownership that serves as a lynchpin of American law.[154] If “property doctrine” is a toolbox, the “right of privacy” is just one of the many tools within.[155]

[74]     Many legal scholars who have taken a hard look at the protection of genetic information have cast doubt upon the idea that privacy and property protections can peacefully co-exist, to create truly comprehensive genetic protection doctrines.[156] For these individuals, privacy exists as an entirely independent right, regardless of its property law origins.[157] However, a right to privacy is, at its core, a property interest, and always has been.[158]

[75]     The need for a right to privacy–both originally and in this context–arises from the need for an interest that cannot be monetized in the way that traditional property can.[159] By owning our bodies and body products, we gain control over how and when our genetic information and material can be used, but in treating our individual parts as separate from each other, we inevitably detach ourselves from our identities as full, entire persons—the very thing we hope to protect.[160]

[76]     If the goal here—and it is—is to preserve the dignity of the individual, then we must strive to keep the self whole, a goal best served by the right of privacy.[161]

[77]     Ultimately, if we aim to create a framework through which Henrietta’s dignity would have been preserved, and her children would have been able to benefit from the commercialization of her cells (if she had chosen to donate them), we must craft a legal structure that instills in individuals interests in both privacy and property when it comes to their genetic materials and information.

VI.  A Proposal

 

[78]     To protect Henrietta, and those who find themselves in the position she was in, there needs to be basic, yet comprehensive, legislation at the federal level. That legislation must accomplish three main things: (1) create a property interest in genetic information and materials for the individuals to whom that information pertains; (2) supplement the privacy rights of individuals in their genetic information; and (3) create both a civil remedy and a criminal penalty for those who infringe upon the interests that individuals have in their own genetic information and materials.

[79]     To that end, the following is a brief outline of what such legislation might look like, modeled in part off the Alaska statute discussed previously:

 

1.  Statement of Intent

This statute shall be interpreted as affording to individuals a property interest in their own genetic material and information, with that interest possessing all the rights typically attached to an interest in property. This statute shall be applied to all instances of research conducted on human biological material, and shall not be construed as applying only in the doctor-patient context.

2.  Definitions

(a)        “Genetic information” means both the biological human material (blood, tissue, et al.) and the results of any analysis, testing, or observation of that material.[162]

(b)       “Genetic testing” means laboratory tests of human biological material for medical or research purposes.[163]

(c)        “Researcher” means any individual who performs genetic testing on the      genetic information of another.

3.  Genetic Information

(a)        Genetic information is the unique property of the individual to whom the information pertains.

(b)       A researcher may not collect genetic information from, perform genetic testing on, retain genetic testing results of, or disclose the genetic testing results of another person unless that researcher has first obtained the written, informed consent of the person, or that person’s legal guardian or authorized representative.[164]

(c)        Prohibitions of section (b) of this statute do not apply to genetic information collected or tested for law enforcement purposes, for the purpose of determining paternity, or for emergency medical treatment.

(d)       Civil Remedy. A person may bring a civil action against a researcher who collects, tests, retains, or discloses his genetic information in violation of (a) of this section. In addition to actual damages, a researcher violating this section will be liable for damages in the amount of $10,000. If the violation resulted in monetary gain for the violator, he will be liable for damages in the amount of $200,000.[165]

(e)        Criminal Penalty. An individual has committed the crime of unlawful genetic information collection, testing, retention, or disclosure when he collects, tests, retains, or discloses the genetic information of another in violation of (a) of this section. A person who has committed the crime of unlawful collection, testing, retention, or disclosure of genetic information is guilty of an infraction, punishable by a fine of no less than $1000 and no more than $100,000.[166]

 

[80]     Statutory language may not be enough. As we learned from the Florida example, broad language can be interpreted narrowly. This proposal seeks to be specific enough to avoid that scenario, while remaining generally applicable enough to provide adequate coverage. Frustratingly, it is not even certain that a statute such as this would have helped Henrietta maintain control over her biological tissue.

[81]     Had things not unfolded as they did—Henrietta’s biopsy done without her knowledge, her cells kept with her none the wiser, and her name lost to the annals of history until an industrious young writer took the time to dig her up—she may still not have had the wherewithal to vindicate her rights, had they existed. How can a person seek relief for damages they are unaware have been done to them?

[82]     That analysis ignores a crucial component of any modern statute—modern society. Societal values, ideas, and sensibilities have changed and evolved in the years since Henrietta first walked into Johns Hopkins complaining of a pain in her abdomen. This statute, or one like it, may not have saved the real Henrietta from the injustice done to her, but it could very well prevent the same from happening to a modern Henrietta Lacks.

* J.D. Candidate, 2018, University of Richmond School of Law. B.A., 2014, Virginia Commonwealth University. The author would like to acknowledge Professors Thaddeus Fortney and John Aughenbaugh of Virginia Commonwealth University for their encouragement and support throughout the years. The author would also like to thank the editors and staff of the Richmond Journal of Law & Technology for their efforts in editing this article, and for their endless patience.

[1] See Rebecca Skloot, The Immortal Life of Henrietta Lacks 27-28 (Broadway Books 2010).

[2] See id. at 33.

 

[3] See id.

 

[4] See Catherine K. Dunn, Protecting the Silent Third Party: The Need for Legislative Reform with Respect to Informed Consent and Research on Human Biological Materials, 6 Charleston L. Rev. 635, 639 (2012).

[5] See generally Skloot, supra note 1 at 31-33 (describing the breakthrough scientific achievements of HeLa cells).

[6] See id. at 2.

[7] See id. at 41.

[8] See id. at 40-41.

[9] See Skloot, supra note 1 at 35-37.

[10] See id. at 40-41.

[11] See, e.g., id. at 4 (discussing the proliferation of cell retention in laboratories).

[12] See id. at 40-41.

[13] See generally Skloot, supra note 1, at 34-41 (describing the laboratory environment of the cell culturist who developed HeLa).

[14] See id. at 40.

[15] See id. at 40-41.

[16] See id. at 41.

 

[17] See Rebecca Skloot, Henrietta’s Dance, Johns Hopkins Mag. (Apr. 2000), http://pages.jh.edu/jhumag/0400web/01.html, https://perma.cc/6DR4-NSDN.

[18] See Skloot, supra note 1, at 56-58.

[19] See Dunn, supra note 4, at 637-38.

[20] Denise Watson Batts, After 60 Years of Anonymity, Henrietta Lacks Has a Headstone, Virginian-Pilot Online (May 30, 2010), http://pilotonline.com/news/local/after-years-of-anonymity-henrietta-lacks-has-a-headstone/article_5bb9a40e-8cd5-5ed7-927e-736d80972099.html, https://perma.cc/S34Y-CFGR (stating that Henrietta Lacks was buried in an unmarked grave. In 2010, Dr. Roland Pattillo, who had worked with HeLa cells, donated the money necessary to give her a headstone).

[21] See generally Skloot, supra note 1, at 1-6 (describing the ubiquity of information about the cells and contrasting it with the scarcity of information about Henrietta).

[22] See id. at 2-4, 7.

[23] See Alexandra del Carpio, The Good, The Bad, and The HeLa, Berkley Sci. Rev. (Apr. 27, 2014),

http://berkeleysciencereview.com/article/good-bad-hela/, https://perma.cc/VFU8-KKLL; see also Skloot, supra note 1, at 2-4.

[24] Skloot first heard of Henrietta Lacks in a community college class she attended as a high school student in 1988. See Skloot supra note 1, at 2; see Patricia Cohen, Returning the Blessings of an Immortal Life, N.Y. Times (Feb. 4, 2011), http://www.nytimes.com/2011/02/05/books/05lacks.html, https://perma.cc/724L-YXJX.

[25] See Books – Best Sellers Paperback Nonfiction, N.Y. Times (Aug. 26, 2012), https://www.nytimes.com/books/best-sellers/2012/08/26/paperback-nonfiction/, https://perma.cc/KDN2-STZ6.

[26] See Online Catalog, Random House for High School Teachers (Apr. 7, 2017), http://www.randomhouse.com/highschool/catalog/display.pperl?isbn=9781400052189, https://perma.cc/RPV2-YEA9.

[27] See Erik Pedersen, Oprah Winfrey Starrer ‘The Immortal Life of Henrietta Lacks’ Gets HBO Premiere Date, Deadline Hollywood (Feb. 14, 2017, 10:42 AM), http://deadline.com/2017/02/oprah-winfrey-immortal-life-of-henrietta-lacks-premiere-date-hbo-rose-byrne-

1201911527/, https://perma.cc/8TNG-WUDA.

[28] See generally Robin McKie, Henrietta Lacks’s Cells Were Priceless, but Her Family Can’t Afford a Hospital, Guardian (Apr. 3, 2010), https://www.theguardian.com/world/2010/apr/04/henrietta-lacks-cancer-cells, https://perma.cc/P7HW-5SEJ (describing her story as “disturbing”).

[29] Skloot, supra note 1, at 18.

[30] See id.

[31] See id.

[32] The cabin Henrietta grew up in was situated on land that had once belonged to her great-grandfather, a white slaveholder. The cabin itself had once housed his slaves. See id. at 18, 122-24.

[33] See id. at 24.

[34] See Skloot, supra note 1, at 23.

[35] See id. at 24-26.

[36] See id. at 13-15.

[37] See Skloot, supra note 1, at 15.

[38] See id. at 64.

[39] See id. at 29-30.

[40] See Gail Javitt, Why Not Take All of Me? Reflections on The Immortal Life of Henrietta Lacks and the Status of Participants in Research Using Human Specimens, 11 Minn. J.L. Sci. & Tech. 713, 718 (2010).

[41] See Natalie Ram, Assigning Rights and Protecting Interests: Constructing Ethical and Efficient Legal Rights in Human Tissue Research, 23 Harv. J. Law & Tech. 119, 134 (2009).

[42] See Dunn, supra note 4, at 645-47.

[43] See id. at 646.

 

[44] See id. at 635,647.

[45] See id. at 647.

[46] See Elizabeth R. Pike, Securing Sequences: Ensuring Adequate Protections for Genetic Samples in the Age of Big Data, 37 Cardozo L. Rev. 1977, 1988 (2016).

[47] See Lori B. Andrews, Harnessing the Benefits of Biobanks, 33 J.L. Med. & Ethics 22, 23 (2005).

[48] See Pike, supra note 46, at 2032.

 

[49] See Andrews, supra note 47, at 25.

[50] See Pike, supra note 46, at 1988.

[51] See id.

[52] See Dunn, supra note 4, at 642–43.

[53] See Andrews, supra note 47, at 23.

[54] See id.

[55] See, e.g., HS-5 (ATCC® CRL-11882™), American Tissue Culture Catalogue, https://www.atcc.org/Products/Cells_and_Microorganisms/By_Tissue/Bone_Marrow/CRL-11882.aspx, https://perma.cc/P3GM-7LHL (last visited Apr. 2 2017) (stating that CRL-11882 is a human bone marrow sample taken from a thirty year old white man and can be purchased by a for-profit company for $431 USD, or by a non-profit organization for $359.15).

[56] See id. (demonstrating that the source’s name and other personal information is not included).

[57] See generally J.E. Olson, et al., Biobanks and Personalized Medicine, 86 Clinical Genetics 51, 51 (2014) (describing how biobanks provide crucial infrastructure and support for clinical genetics).

[58] See Pike, supra note 46, at 1979.

[59] See id.

[60] See generally Skloot, supra note 1, at 32-33, 40, 66 (telling the story of Henrietta’s life, her experience at Johns Hopkins, and her eventual death).

[61] See Dunn, supra note 4, at 644–45.

[62] See Andrews, supra note 47, at 23.

 

[63] See Dunn, supra note 4, at 645.

[64] See Moore v. Regents of University of California, 51 Cal. 3d 120, 125 (Cal. 1990).

[65] See id. at 125–26.

[66] See id. at 126–27.

[67] See id. at 127–28

[68] See Moore, 51 Cal. 3d 120 at 128 n.4.

[69] See id. at 136–38.

[70] See Anya E.R. Prince, Comprehensive Protection of Genetic Information: One Size Privacy or Property Models May Not Fit All, 79 Brook. L. Rev. 175, 175 (2013).

[71] See id. at 183.

[72] See id. at 184–85.

[73] See generally Jaclyn G. Ambriscoe, Note, Massachusetts Genetic Bill of Rights: Chipping Away at Genetic Privacy, 45 Suffolk L. Rev. 1177, 1209–11 (2012) (describing the ways in which combining privacy and property rights is like mixing “oil and water”).

[74] See id. at 1185–87.

[75] See Genetic Information Nondiscrimination Act of 2008, Pub. L. No. 110-233, 122 Stat. 881 (2008).

[76] See id.

[77] See id.; see also, H.R. 1313, 115th Cong. (1st Sess. 2017) (permitting employers to demand genetic test results from their workers).

[78] See Genetic Information Nondiscrimination Act of 2008, Pub. L. No. 110-233, 122 Stat. 881 (2008).

[79] See 45 C.F.R. § 46.101(a) (2017).

[80] See id.

[81] See 45 C.F.R. § 46.116(a)(1)–(5) (2017).

[82] See id.

[83] See 45 C.F.R. § 46.116(a)(2)–(3) (2017).

[84] See 45 C.F.R. § 46.116(a)(1)–(8) (2017).

[85] See id. at (a)(8).

[86] See id. at (b)(5).

[87] See generally 21 C.F.R. § 50.1 (2017) (discussing standards for clinical investigations run by the Food and Drug Administration).

[88] See 21 C.F.R. §§ 56.109, 812.25 (2017).

[89] See Ram, supra note 41, at 140.

[90] See id.

[91] A question must be asked whether, in an age of DNA testing, a tissue sample containing genetic information can ever be truly anonymous. Research has shown that even an incomplete DNA sample can be matched to the unique individual from whom it was taken, which renders the concept of ‘anonymous genetic material’ somewhat obsolete. See generally Amy L. McGuire & Richard A. Gibbs, Genetics: No Longer De-Identified, 312 Science Mag. 370, 370-71 (2006) (discussing research finding that an individual can be identified with just 75 single-nucleotide polymorphisms).

[92] See Nat’l Conf. of State Legs., Genetic Privacy Laws, NCSL, http://www.ncsl.org/research/health/genetic-privacy-laws.aspx, https://perma.cc/ZB3Q-RQT9 (last updated Jan. 2008) (stating that 17 states required informed consent).

[93] See id.

[94] These states are Alaska, Colorado, Florida, Georgia, and Louisiana. See id.

[95] See Colo. Rev. Stat. § 10-3-1104.7(1)(a) (2016) (holding genetic information as property and imposing remedies for a violation of such property).

[96] See Ga. Code. Ann. § 33-54-1 (2016) (holding genetic information as property and imposing remedies for a violation of such property).

[97] See La Stat. Ann. § 22:2013(E) (2017) (imposing remedies for a violation of such property).

[98] See generally Nat’l Conf. of State Legs., supra note 92 (discussing the eight states require informed consent for the retention of genetic information—Alaska, Delaware, Minnesota, Nevada, New Jersey, New Mexico, New York, and Oregon. Five states identify a personal property interest in genetic information: Alaska, Colorado, Florida, Georgia, and Louisiana).
[99] See Colo. Rev. Stat. § 10-3-1104.7(12)-(13) (2016); Ga. Code. Ann. § 33-54-8 (2016); La Stat. Ann. § 22:2013(E)–(F) (2017).
[100] See Alaska Stat. § 18.13.010(a)(2) (2016).

[101] See id.

[102] See Alaska Stat. § 18.13.010(a)(1) (2016).

[103] Such as samples collected for law enforcement purposes; the collection of DNA samples in this realm is a common exception to most all legislation on the matter. Whether this should be the case is a question worth asking, but is not within the scope of this comment. See Alaska Stat. § 18.13.010(b)(1)–(5) (2016).

[104] See Alaska Stat. § 18.13.020 (2016).

[105] See Alaska Stat. § 18.13.030(a), (c) (2016).

[106] See Alaska Stat. § 18.13.020 (2016).

 

[107] See Batts, supra note 20.

[108] See Fla. Stat. § 760.40 (2)(a) (2016).

[109] See Fla. Stat. § 760.40 (2)(b) (2016) .

[110] Fla. Stat. § 760.40 (3) (2016).

[111] See Fla. Stat. § 760.40 (2)(a) (2016) (“Except for purposes of criminal prosecution, except for purposes of determining paternity as provided in s. 409.256 or s. 742.12(1), and except for purposes of acquiring specimens as provided in s. 943.325, DNA analysis may be performed only with the informed consent of the person to be tested, and the results of such DNA analysis, whether held by a public or private entity, are the exclusive property of the person tested, are confidential, and may not be disclosed without the consent of the person tested.”).

[112] See generally Greenberg v. Miami Children’s Hosp. Research Inst., Inc., 264 F. Supp. 2d 1064 (S.D. Fla. 2003) (holding that plaintiffs could not recover under the Florida statute protecting against misuse of genetic information).

[113] See id. at 1075.

[114] See id. at 1069.

[115] Today, this case might have resolved slightly differently. In 2013, the Supreme Court ruled that genes found in nature are not patentable merely because a particular person or institution has isolated any particular gene. See Association for Molecular Pathology, et al. v. Myriad Genetics, Inc., et al., 133 S. Ct. 2107, 2120 (2013).

[116] Canavan disease is a neurological genetic disorder. Children born with Canavan disease typically die before age ten. See Nat’l Inst. of Neurological Disorders and Stroke, Canavan Disease Information Page, NIH, https://www.ninds.nih.gov/Disorders/All-Disorders/Canavan-Disease-Information-Page, https://perma.cc/HHW7-VT7D (last visited Apr. 1, 2017).

[117] See Greenberg, at 264 F. Supp. 2d 1064 (S.D. Fla. 2003)

[118] See id. at 1066.

[119] See id. at 1068.

[120] See id. at 1072.

[121] See Fla. Stat. § 760.40(1) (2016).

[122] See id. at (2)(a).

[123] See Greenberg v. Miami Children’s Hosp. Research Inst., Inc., 264 F. Supp. 2d 1064, 1075 (S.D. Fla. 2003).

[124] See id. at 1077.

[125] See id. at 1076.

[126] See id.

[127] See generally Natalie Anne Stepanuk, Genetic Information and Third Party Access to Information: New Jersey’s Pioneering Legislation as a Model for Federal Privacy Protection of Genetic Information, 47 Cath. U. L. Rev. 1105, 1135 (1998) (discussing how legislation must take into account the interests of researchers and the public, as well as the donors of any biological material); see also Ram, supra note 41, at 121-22 (noting that researchers and society have strong interests in tissue research, and that the interests of donors, researches, and society as a whole deserve respect and protection).

[128] See Greenberg v. Miami Children’s Hosp. Research Inst., Inc., 264 F. Supp. 2d 1064, 1076 (S.D. Fla. 2003).

[129] See generally id. at 1074-76 (discussing the impact a property right in genetic material would have on research).

[130] See, e.g., Skloot, supra note 1, at 131-33 (describing how the term ‘informed consent’ did not arise until the mid-1900s).

[131] See, e.g., L.L. Wall, The Medical Ethics of Dr. J. Marion Sims: A Fresh Look at the Historical Record, 32 J. Med. Ethics 346, 348 (2006) (describing how the father of gynecology relied on slaves as research subjects).

[132] See Nat’l Conf. of State Legs., supra note 92.

[133] See id.

[134] See N.M. Stat. Ann. § 24-21-6(c)(3) (2016).

[135] See Skloot, supra note 1, at 41.

[136] See Alaska Stat. § 18.13.020 (2016).

[137] See Lawrence Lessig, Code: and Other Laws of Cyberspace 161 (2nd ed. 1999).

[138] See Sonia M. Suter, Disentangling Privacy from Property: Towards a Deeper Understanding of Genetic Privacy, 72 Geo. Wash. L. Rev. 737, 755 (2004).

[139] See id. at 746.

[140] See id. at 758.

[141] See generally Suter, id. at 809. The United States has a culture of deep shame surrounding its history with the slave trade, leading many to feel generally uncomfortable with the idea of selling people, or parts of people, and the coercive effects this could have on the impoverished. See also Ambriscoe, supra note 73, at 1211 (arguing that there is a risk individuals would be coerced into selling their genetic information).

[142] See Restatement (first) of Prop. § 489 cmt. a (1944).

[143] See Suter, supra note 138, at 755.

[144] See id. at 758.

[145] See id.

[146] See Suter, supra note 138, at 757.

[147] See id.

[148] See id.

 

[149] Skloot, supra note 1, at 168.

[150] See Suter, supra note 138, at 748.

[151] See Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193, 193 (1890).

[152] See id. at 193, 197.

[153] See, e.g., Pavesich v. New England Life Ins. Co., 50 S.E. 68, 69-70 (Ga. 1905).

[154] See Suter, supra note 138, at 767; see also J. Madison, Property, in The Papers of James Madison 14:266–68 (William T. Hutchinson, et al. eds., 1792) http://press-pubs.uchicago.edu/founders/documents/v1ch16s23.html, https://perma.cc/J8PH-SBBZ.

[155] See Suter, supra note 138, at 767.

[156] See Ambriscoe, supra note 73 at 1210-11.

[157] See id. at 1193-94.

[158] Agreement with such an assertion is not necessary to ultimately agree with the conclusion that privacy and property are the two pillars necessary to uphold and individual’s right to exercise control over their own genetic information.

[159] See Suter, supra note 138, at 761-62.

[160] See id. at 763.

[161] See Dunn, supra note 4, at 640.

[162] See generally Colo. Rev. Stat. § 10-3-1104.6 (2)(c)(I)(2016) (discussing genetic information and the limitations on disclosure of information, as well as liabilities and legislative components).

 

[163] See Colo. Rev. Stat. § 10-3-1104.7 (2)(b) (2016).

[164] See Colo. Rev. Stat. § 10-3-1104.7 (10)(a) (2016); see also Alaska Stat. § 18.13.010(a)(1) (2016).

[165] See Colo. Rev. Stat. § 10-3-1104.6 (11)-(12) (2016); see also Alaska Stat. § 18.13.020 (2016).

[166] See Alaska Stat. § 18.13.030(a) (2016).

Webb Publication Version PDF

Cite as: K.C. Webb, Products Liability and Autonomous Vehicles: Who’s Driving Whom?, 23 Rich. J.L. & Tech. 9 (2016), http://jolt.richmond.edu/2017/05/13/volume23_issue4_webb/.

 

By: K.C. Webb*

I.  Introduction……………………………………………………………………………… 3

II.  Background……………………………………………………………………………… 6

A.  Background of the Technology and State of the Art……………………… 6

B.  Background of Statutory and Regulatory Reforms……………………… 14

C.  Background of Automotive Products Liability Tort Law…………….. 18

1.  Defects Leading to the First Crash………………………………………… 22

2.  Defects Enhancing Injuries in the Second Crash………………………. 23

III.  How Technology Affects Tort Law…………………………………………….. 25

A.  Drawing Bad Comparisons……………………………………………………… 25

1.  Non-automotive Technology………………………………………………… 26

2.  Automotive Technology………………………………………………………. 27

B.  Applying Outdated Theories and Tests…………………………………….. 29

1.  Consumer Expectation Test………………………………………………….. 30

2.  Risk-utility Test…………………………………………………………………. 31

3.  Crashworthiness Doctrine……………………………………………………. 32

C.  PROPOSAL: Adapting Tort Law Accordingly…………………………… 34

IV.  How Tort Law Affects Technology…………………………………………….. 38

A.  Effecting Design Elements………………………………………………………. 39

1.  Mechanical Components……………………………………………………… 39

2.  Software components………………………………………………………….. 41

B.  Effecting Manufacturer’s Actions…………………………………………….. 46

1.  Applying Some Pressure……………………………………………………… 46

2.  Stopping the Buck………………………………………………………………. 47

C.  PROPOSAL: Limiting, Dividing, and Shifting Liability………………. 49

1.  Going to Capitol Hill…………………………………………………………… 49

2.  Going Dutch………………………………………………………………………. 50

3.  Going it Alone…………………………………………………………………….. 51

V.  Conclusion………………………………………………………………………………… 52

 

 

Today the robot is an accepted fact, but the principle has not been pushed far enough. In the twenty-first century the robot will take the place which slave labor occupied in ancient civilization. There is no reason at all why most of this should not come to pass in less than a century, freeing mankind to pursue its higher aspirations.

-Nikola Tesla, February 9, 1935[1]

 

I. Introduction

[1]       On February 14, 2016, the by-now-famous Google self-driving car crashed itself into a city bus filled with passengers.[2] The car was traveling at two miles-per-hour along a busy road in Mountain View, California, when it turned into the lane of the oncoming bus which was traveling at nearly fifteen miles-per-hour.[3] Thankfully, none of the fifteen passengers aboard the bus or any of the car’s occupants suffered injuries; however, the accident damaged the side of the bus and the car’s front fender, wheel, and driver’s side door.[4]

 

[2]       While California’s regulatory agencies squabbled among themselves about their role in determining liability, Google admitted to bearing some measure of responsibility.[5] The test driver failed to activate the manual override because he believed the bus would slow down and allow the car into the lane.[6] Both the test driver and the car misjudged, because three seconds later the car collided with the bus, marking the first time a self-driving car was directly responsible for a crash on public roads.[7]

 

[3]       This collision turned up the heat on a conversation already simmering among legal scholars, techies, automobile manufacturers, policy makers, Congress, and consumers about the interaction of this technology and tort law.[8] No legal framework currently exists for assigning liability when a self-driving car, like the Google car, crashes itself.[9] Some scholars optimistically predict that tort law will handle the introduction of this new technology easily, pointing to how well tort law has handled new technologies since the dawn of the industrial revolution.[10] Others foretell tort law’s dismal failure to adapt, predicting that all liability will necessarily shift to the manufacturer, stunting the growth of the industry.[11] These doomsday prophets instead pin their hopes on statutory and regulatory reforms.[12]

 

[4]       This comment explores two broad themes present in these conversations and makes two respective proposals. First, this comment discusses how autonomous vehicle technology affects the development of tort law, critiquing the ability of products liability law’s current tests to handle autonomous vehicle technology, and proposes a new test. Second, this comment discusses how tort law affects the development of this technology and proposes steps manufacturers should take to limit their liability with respect to autonomous vehicles.

 

[5]       Part II provides background information, beginning with an overview of how the technology works, to set the stage for a competent discussion of products liability issues. It then lays out the history of statutory and regulatory reforms, and the background of automotive products liability law. Part III presents how technology affects tort law by discussing how self-driving cars would fare under the present automotive products liability tests, and then proposes a new test. Part IV turns the lens around to examine how tort law affects technology. It discusses how liability concerns affect design elements and manufacturers’ actions, and then proposes additional steps that manufacturers should take to limit liability. Finally, Part V is a brief conclusion.

 

II. Background

[6]       This section discusses how autonomous vehicle technology works, statutory and regulatory reforms, and predictions by other scholars on how products liability law will react to autonomous vehicles.

 

A. Background of the Technology and State of the Art

 

[7]       Misconceptions about autonomous vehicles abound.[13] Among them: self-driving cars function through classical computer algorithms (complex if-then decision trees); driver assistance systems will gradually transform cars into completely autonomous vehicles; self-driving cars are programmed to make ethical judgments; and self-driving cars will faithfully follow all traffic regulations.[14]

 

[8]       In reality, the levels of autonomous features range from zero to four.[15] The lower numbers indicate lower levels of autonomy, and many of the features that fall into these categories, like cruise control, have been on the road for a long time.[16]

 

[9]       The higher numbers indicate a greater level of autonomy. Adaptive cruise control, for example, uses radar sensors to measure the distance in front of the vehicle and change speed accordingly to keep a set distance. Although it cannot detect and react to a soft object that appears in front of the car (like a deer) it can come to a complete stop when the vehicle in front of it performs a panic brake. Another semi-autonomous feature, lane assist, uses a camera sensor on the front of the car to detect the white and yellow lines that demarcate lanes. When the car begins to drift in the lane, the car gives a warning, usually audible and visible, sometimes vibrating the seat to wake a sleepy driver; lane keeping assist (the next generation feature of lane assist) helps the car stay in the lane by “continuously applying a small amount of counter-steering force.”[17]

 

[10]     More advanced features offer hands-free driving, like Super Cruise (GM), Autopilot (Tesla), and Traffic Jam Assistant (BMW).[18] These systems employ the use of radar, sensors, cameras, LIDAR,[19] telematics,[20] and GPS[21] to assess the distance to the next car ahead and find the car’s position on the road, and within the lane.[22] Then, like adaptive cruise control and lane assist, the car applies corrective measures to keep itself straight on the road.[23] Information, like road closures, is kept current with firmware updates which are administered wirelessly as needed.[24] FOTA (firmware updates over the air) has served cell phone end users for years, and now the technology has been adapted for updating automobile software.[25] Like a cell phone, the vehicle’s software can be updated sans cables or expensive recalls.[26]

 

[11]     Fully autonomous vehicles (AVs) use all of these technologies, and more. They use sensors and GPS to find the car’s position in the world, and determine what street and what lane the car is in.[27] Software interprets and categorizes the images perceived through sensors, like a cyclist or pedestrian; based on these categorizations, it predicts what the objects will do, like cross the street.[28] The software then selects a speed and trajectory for the car, like shifting lanes to allow extra room for the cyclist.[29]

 

[12]     Contrary to popular belief, the software is not designed using a complex if-then decision tree to anticipate all possible driving scenarios.[30] Instead, it uses an algorithm to categorize the objects it senses.[31] The algorithm is fed with oodles of images containing various objects, like a child chasing a stray ball into the street.[32] Using pattern recognition (from the field of artificial intelligence) to sort and classify the images it senses, when it sees a new image the algorithm occasionally guesses incorrectly.[33] It then alters its internal parameters to increase its sorting accuracy—keeping changes that make the algorithm more accurate, and discarding changes that decrease accuracy.[34] When the algorithm later sees new images, it classifies them with a higher accuracy. The algorithm, after a fashion, teaches itself to become a better driver.[35]

[13]     It is not yet clear how AVs will interact with each other, or with traditional vehicles, to share information through vehicle to vehicle communication (V2V). [36] The National Highway Transportation Safety Administration (“NHTSA”) reserved the 5.9GHz spectrum for V2V anticipating its incorporation into vehicles in the near future.^[37] In the meantime, Google’s car taught itself to become a better driver through refinements to the software in the hope that “[f]rom now on, [their] cars will more deeply understand that buses (and other large vehicles) are less likely to yield . . . than other types of vehicles…”[38]

 

[14]     Since GM unveiled the first fully autonomous concept car at its Futurama exhibition during the 1939 World’s Fair, most major car manufacturers have followed suit, working on their own fully autonomous models, and some have already begun testing on public roads.[39] Google boasted that before the Valentine’s Day crash, its test cars had driven roughly one and a half million miles in autonomous mode.[40] Google estimated that its AVs will be available for consumption by 2018.[41] Other manufacturers targeted 2020 as their release date,[42] and the U.S. Secretary of Transportation predicts driverless cars will be “all over the world” by 2025.[43] AVs promise innumerable benefits to society, like:[44]

• drastically reduced frequency and fatality of crashes, which result in billions of dollars of damage each year and an immeasurable emotional toll on victims’ families;[45]
• increased mobility and access to essential services for those who are unable or unwilling to drive, like minors, the elderly, or disabled persons;[46]
• substantially reduced traffic congestion, which currently exacts costs in terms of time, money, and frustration;[47]
• more efficient land use as people will be more willing to commute longer distances for work, so long as they can reclaim the commute time by engaging in other activities while the car is in motion;[48]
• reduced emissions and increased fuel economy, as cars become less susceptible to collision and thus need less tonnage to remain safe.[49]

 

[15]     Yet for all these benefits, legal liability remains the greatest roadblock to mass adoption of AVs.[50] As this technology proliferates, and the line between car and driver blurs, the law must adapt to accommodate.

 

B. Background of Statutory and Regulatory Reforms

 

[16]     Anticipating that AVs will occupy the roads within the next decade, lawmakers are reacting now to pave the way for these automated machines. Other stakeholders, like insurance companies, are updating their policies to keep pace with the shifting paradigm.[51]

 

[17]     So far, a handful of states have updated their traffic codes to permit AVs to take to public roads as test vehicles.[52] Although these first generation laws provide a rudimentary framework and certain changes or additions will be necessary,[53] a number of states already provide manufacturers with limited protection from liability,[54] and many expert reports suggest limiting manufacturer liability promotes growth of autonomous technology.[55] Some scholars even go as far as recommending federal intervention to grant manufacturers immunity via statute.[56]

 

[18]     AVs are also influencing federal regulations. The NHTSA, eager to realize the benefits of AVs,[57] announced a four-billion-dollar plan to “accelerate the development and adoption of safe vehicle automation through real-world pilot projects,”[58] and published an updated set of policy recommendations.[59] Before publishing the updated recommendations, NHTSA released a statement placing responsibility for accidents on the AV, regardless of whether a human occupies the car.[60]

 

[19]     Consumer watchdog groups, wary of the potential dangers AVs represent, called this outrageous. They state the need for a competent human driver to supervise the car is evident in the number of times Google’s autonomous technology has failed in the past months, prompting the human test driver to take the wheel.[61] This exemplifies the mixed feelings society as a whole has about AVs.[62] On the one hand, driverless cars are safer, more cautious drivers than humans who, in 2014, wrecked 6.1 million times in the United States alone.[63] Over 32,000 people perished with human error being the critical factor 94% of the time.[64] Even though we are desperate to improve these statistics and reclaim the time we forfeit commuting, only about half of us would actually ride in an AV.[65] Of that half, even fewer might be willing to put their children in a driverless car, or send them riding to the park on bicycles, crossing streets teeming with driverless cars.[66]

 

[20]     While policy makers grapple with these conflicting attitudes,[67] they must also wrestle with legal issues like whether there should be a uniform traffic code, or whether federal law should preempt manufacturer liability.[68] NHTSA admitted that it has a limited authority to deal with many of these concerns, [69] and even with NHTSA’s recently published recommendations, it may be years before policymakers sift through the findings and promulgate appropriate laws and rules.[70] Even then, laws and rules may take a number of revisions to perfect, especially when dealing with new technologies.[71] Consequently, tort law must adapt to handle these concerns.

 

C. Background of Automotive Products Liability Tort Law

 

[21]     Generally, a plaintiff claiming injury by an automobile may bring suit under several different theories of liability: (1) negligence, (2) strict liability, (3) breach of warranty, and/or (4) misrepresentation.[72] However strict liability is considered the “dominant legal theory” in products liability litigation, and therefore is the focus of this section.[73]

 

[22]     Products liability’s first case and controversy dates back to England’s Industrial Revolution.[74] In that first case,[75] the court, protective of industry, foreclosed many claims through a legal fiction called “privity,” whereby an insufficient relationship between two parties would bar a lawsuit.[76] Later courts made exceptions to this harsh rule by allowing exceptions for products that were inherently dangerous, eventually expanding the limits of inherent danger to swallow privity altogether.[77] In the 1960’s courts began to recognize that manufacturers could be strictly liable for injuries resulting from the use of their products.[78]

 

[23]     A strict products liability claim requires that the plaintiff prove “(1) that the defendant sold a defective product; and (2) that the defect proximately caused the plaintiff’s harm.”[79] Products liability claims come in three flavors: manufacturing defect, design defect, and warning defect.[80] Manufacturing defects are defects that occur when a product fails to meet the design specification.[81] A design defect occurs when a product is designed in a way that makes it unreasonably dangerous.[82] A warning defect occurs when the manufacturer breaches his duty to provide adequate warning, or instructions to use the car in a safe manner.[83] Additionally, specific to automotive products liability, many jurisdictions recognize some form of “crashworthiness” doctrine.[84] Under this doctrine, courts recognize that accidents are foreseeable by vehicle manufacturers, and vehicles must therefore be designed in a way that minimizes injuries to occupants.[85]

[24]     Autonomous products liability cases are further divided into two species, “(1) accidents caused by automotive defects, and (2) aggravated injuries caused by a vehicle’s failure to be sufficiently ‘crashworthy’ to protect its occupants in an accident.”[86] These species mirror the two crashes resulting from any single accident.[87] In the “first crash” the car collides with an object, like a tree or a city bus.[88] In the “second crash” the car’s occupants collide with the interior.[89] The following sections examine how automotive products liability claims fit within these species and the tests courts apply.

 

1. Defects Leading to the First Crash

 

[25]     Defects causing accidents are typically manufacturing or design defects.[90] “A classic example of a manufacturing defect case would be one in which a tire manufacturer used substandard practices in its plant, resulting in the components of the tire separating and failing later while being used.”[91] Additionally, plaintiffs have prevailed on manufacturing-defect claims in cases where “unintended, sudden[,] and uncontrollable acceleration” causes an accident.[92] In such cases, plaintiffs have been able to recover under a “malfunction theory” which uses a res ipsa loquitur-like inference to allow “deserving plaintiffs to succeed notwithstanding what would otherwise be…[an] insuperable problem of proof” of defect in the product.[93]

 

[26]     Plaintiffs have also prevailed where a design defect causes injury. For example, in the 1970s and 1980s litigation proliferated when vehicles were “designed with a high center of gravity, which increased their propensity to roll over.”[94] The two primary tests used by courts in design defect cases are “the consumer-expectations test and the risk-utility test.”[95]

 

[27]     For a manufacturing defect claim, courts apply the consumer-expectation test to determine whether the product is unreasonably dangerous.[96] Under a design-defect claim, courts apply the consumer-expectation test as well as the risk-utility test. “[U]nder [the consumer-expectation] test, a plaintiff succeeds by proving that the product failed to perform as an ordinary consumer would expect when used in an intended or reasonably foreseeable manner.”[97] Under the risk-utility test, a plaintiff must show the “magnitude of the danger outweighs the utility of the product, as designed.”[98] Additionally, plaintiffs may also seek recovery for injuries sustained in the second crash.

 

2. Defects Enhancing Injuries in the Second Crash

 

[28]     “Litigation can also arise where a plaintiff alleges that the vehicle is not sufficiently ‘crashworthy,’”[99] or in other words, the car fails to adequately protect occupants in a collision from injuries sustained during the “second crash” between the occupants and the interior of the vehicle.[100]

 

[29]     For example, in the landmark case Larsen v. General Motors Corp., the plaintiff drove a 1963 Chevrolet Corvair into a head-on collision, the impact of which fatally “thrust [] the steering mechanism [rearward] into the [plaintiff’s] head.”[101] The court held that even though collisions are not the intended use of an automobile, general negligence principles applied when the manufacturer’s failure to use reasonable care to avoid subjecting the car’s occupants to unreasonable risk of injury either caused the plaintiff’s injuries, or enhanced his injuries.[102] The court went on to state that automobiles do not function solely as a means of transportation, but as “a means of safe transportation” (“or as safe as is reasonably possible under the present state of the art”).[103]

 

[30]     Like Larsen, these claims are typically design defects, and courts apply both the consumer expectation test and the risk utility test. However, “the more complex a product is, the more difficult it is to apply the consumer-expectation test.”[104] Indeed, raising the argument of complexity has become a standard defense in automotive products liability claims.[105] As a result, courts seem to prefer the risk-utility test.[106] However, courts and scholars alike have debated whether or not these tests provide an appropriate “vehicle” for remedy, and if they are appropriate to apply to AVs.[107] The next section explores the application of these current tests to AVs.

 

 

III. How Technology Affects Tort Law

 

[31]     Google’s car crash (described in the Introduction) evokes images of the classic trolley car problem—“an ethical brainteaser” perplexing philosophers since 1967.[108] A runaway trolley barrels toward five innocent people tied to the tracks. If you pull a lever you can divert the trolley and switch the tracks, where the trolley will run over and kill one man. Do you do nothing and allow fate to run its course? Or do you actively decide to kill the one man and spare the five? The trolley car scenario has received renewed attention in the debate surrounding AVs.[109] If an AV is presented with a similar choice, would it divert its path to save a busload of school children, but kill the car’s occupant in the process by colliding with a tree instead? Or save the occupant, but let all the children die? Would the injured party have a products liability claim against the AV’s manufacturer? If so, what test would a court use?

 

[32]     This section explores the bad comparisons drawn between AVs and other technologies, both automotive and otherwise; the inappropriate application of current products liability tests to AVs; and finally, proposes a new test.

 

A. Drawing Bad Comparisons

 

[33]     Some scholars believe that tort law in its current state is perfectly capable of handling this new technology because (1) the application of tort law to AV technology is similar to its application to other non-automotive technology, like elevators and autopilot for ships and airplanes;[110] and (2) products liability law has a good track record of handling other automotive technology, like “seatbelts, airbags, and cruise control.”[111]

 

1. Non-automotive Technology

 

[34]     AVs are not analogous to elevators or autopilot. Elevators operate in a limited fashion, moving in two directions along a single path.[112] They do not make complex and sophisticated decisions, and when an elevator fails, determining liability is a much simpler matter because human intervention is typically not a factor in play.[113] Elevator users are not held liable “unless they are exceptionally negligent.”[114] By comparison, while humans can avoid an elevator by taking the stairs, humans cannot avoid AVs simply by driving a traditional car, walking, or taking the city bus. Therefore, the test in cases where a person is injured by riding a malfunctioning elevator is not appropriate for the passengers of the city bus struck by the Google car.

 

[35]     Nor do AVs fit well into a category with autopilot systems for airplanes and boats, which require human vigilance and intervention.[115] Requiring human vigilance of AVs is incomparable to autopilot systems because pilots are highly trained, air traffic is highly regulated, and there are far less planes in the sky than cars on the road.[116] Moreover, requiring human vigilance in AVs is undesirable.[117] One of the benefits of AV driving is freeing up a driver’s time for other tasks. Yet cognitive science research on distracted driving suggests that human reengagement after periods of occupation with another task is difficult and dangerous.[118] Ergonomic research indicates human brains are not good at routine supervision tasks, so if an AV goes for many miles without incident, the human driver will likely stop paying attention.[119] While some states have required that test vehicles keep a vigilant human driver at the ready, imposing this requirement on consumers forecloses one of the greatest benefits of the technology: mobility for the elderly, minors, and the disabled.[120]

 

2. Automotive Technology

 

[36]     To date, automotive products liability law has adapted to cover new technologies as they entered the stream of commerce. At one time seatbelts, airbags, and cruise control were new technologies.[121] At least one scholar suggests that AVs will be perceived as the next generation of automotive safety features, and the law will treat AVs as it has seatbelts and airbags.[122] However, AVs differ greatly from other safety features in their complexity. AVs have significant implications not just for the vehicle’s occupants, but for the environment outside the vehicle as well—including other drivers and pedestrians (unlike airbags and seatbelts, which primarily affect the car’s internal environment).[123]

 

[37]     Although cruise control draws a closer comparison, because it is a more complex feature and rates a higher level of autonomy,[124] courts have split over which test applies in cruise control cases, applying either the consumer expectation test or the risk utility test.[125] It is unlikely that courts would be any better settled over which test to apply to something even more complex like AVs. However, as the next section explains, neither test is appropriate for application to AVs.

 

B. Applying Outdated Theories and Tests

 

[38]     Even if a good comparison could be drawn, current theories and tests for recovery are inappropriate for application to AVs. For example, recovery under a manufacturing defect theory is inappropriate when the alleged defect is a software error, or an error in the computing algorithms employed by AVs, because software is not a manufactured product.[126] The spin-off malfunction theory[127] may be a more appropriate vehicle to recovery because it allows a plaintiff to show that the defect in the software occurred in the absence of any outside tampering.[128] However, not all jurisdictions recognize this theory, and the courts that do utilize it are hesitant to do so in a widespread fashion.[129]

[39]     It is more likely that when an AV crashes itself the way that Google’s car did, plaintiffs would bring suit under a theory of design defect. Still, the tests courts apply under this theory are not appropriate for application to AVs.

 

1. Consumer Expectation Test

[40]     Courts and scholars have criticized the consumer expectation test as inappropriate under a theory of design defect because of the complexity of traditional automobiles.[130] In fact, the Restatement (Third) rejected this test for design defects altogether.[131] If the consumer expectation test meets criticism for being inappropriate for design defects in general, and traditional vehicles in particular, this test would be even more problematic when applied to AVs which have added layers of complexity over traditional cars.[132] Furthermore, employing this test would place manufacturers in the awkward position of managing consumer expectations and providing adequate warnings for safe use of AVs, while simultaneously encouraging use and advertising the overall increased safety of the product. This forces car companies to talk out of both sides of the mouth—confusing consumers and courts alike.[133]

 

2. Risk-utility Test

 

[41]     Many courts prefer the risk-utility test, which the Restatement (Third) recognizes as the sole test for design defects,^[134] but this test too has drawbacks in the context of AV litigation. For example, even though experts anticipate that mass adoption of AVs will likely drive down the overall cost of automotive products liability cases,[135] the cost of litigating a design defect in an AV’s software may be sky high.[136] Applying the test to an AV’s physical components would likely not look much different than design defect cases for traditional vehicles because litigation of semi-autonomous features adequately explores defects related to the types, placement, and uses of various sensors.[137]

 

[42]     Cases revolving around the design of the software or algorithms specific to AVs, on the other hand, present a much more difficult case to make—in particular showing a safer alternative design at the time of manufacture.[138] Finding an expert witness to testify will likely be difficult and expensive due to the cutting edge nature of the field, making this method of recovery unavailable for widespread use.[139] When manufacturers develop a safer alternative algorithm, firmware updates can be installed over the air, giving car manufacturers every motivation to administer an update promptly because the cost of recall will not need to be factored and weighed.[140] Assuming there was any delay or missed update, depending on the jurisdiction, rules of evidence would bar admission of later software updates that constitute subsequent remedial measures.[141]

 

3. Crashworthiness Doctrine

 

[43]     One scholar speculated that software and algorithm defects cannot be successfully brought under the doctrine of crashworthiness, because software and algorithm defects relate to the “first crash” rather than the “second crash,”[142] but the trolley car scenario teaches otherwise.[143] If an AV was put in a position where a first crash must occur (either a collision with the tree or the children), shouldn’t the car be designed to select the option that gives its occupants the least injury? A failure to do so might give the occupants a crashworthiness claim (among others).[144] Whether an AV can—or should—be so designed is discussed in more detail in the next section.[145] In short, it is merely a matter of time before an AV finds itself in the trolley car scenario, and in such an instance, the doctrine of crashworthiness will not be an appropriate test.

 

[44]     We humans have not solved this brainteaser, and we cannot expect that a car will make a “better” judgment when we do not know or agree which is the better outcome.[146] In other words, when an AV selects either bad outcome (kill the occupant or kill the children), some might suppose this constitutes a design defect.[147] In particular, it might give rise to a claim under the crashworthiness doctrine, which dictates that vehicles must be designed in a way that minimizes injuries to occupants.[148]

 

[45]     However, because society has not decided on a clear preferable outcome to this scenario, it is just as possible that neither outcome could be considered a design defect. A recent study presented respondents with a scenario wherein an AV found itself in a trolley car predicament.[149] Most respondents were willing to sacrifice the driver—if they were not the driver.[150] This study shows that society is unclear how it wants—or expects—an AV to behave under trolley car circumstances. It is therefore hard to argue that either outcome is the result of a defective design, when society is not clear on how it believes AVs should be designed with respect to the trolley problem. Consequently, imposing the doctrine of crashworthiness on AVs means that, at least in the particularly morbid scenario described above, the occupant always wins—and the children always die. This requirement usurps society’s role in determining the best outcome to the trolley car problem, and it is therefore inappropriate to impose the crashworthiness doctrine on AVs, at least in this context. Without an existing products liability principle to apply, scholars are left to speculate over what an appropriate standard might be.

 

C. PROPOSAL: Adapting Tort Law Accordingly

 

[46]     Although the tests described above fall short when it comes to AVs, they do demonstrate the inventiveness and adaptability of tort law. So even though tort law, in its present state, is not currently capable of handling this new technology, tort law will adapt by developing new, more appropriate tests.

 

[47]     This comment proposes one such test: the reasonable car standard. Scholars suggest that AVs should be treated as other automotive innovations (e.g. seat belts, airbags, cruise control),[151] or as non-automotive machines (e.g. elevators, autopilot).[152] This comment proposes treating AVs in a way that is more like the way we treat human drivers: by adopting a reasonable car standard.[153]

 

[48]     A reasonable car standard holds a car manufacturer liable only when the car does not act in a way that another reasonable AV would act. The data collection devices inside these new vehicles capture all the relevant information leading up to a collision.[154] This data would be compared to data derived and compiled from other similarly situated AVs. Allowing the factfinder to compare an AV with a traditional model permits a “false choice” which the reasonable car standard circumvents.[155] This standard presents the added advantage of being applicable regardless of whether the car contained a human occupant, meaning car manufacturers could continue to develop AVs with the goal of eliminating human override capability—which is congruent with current NHTSA policy.[156] However, if a human occupant failed to override the AV, the reasonable car standard does not necessarily foreclose a claim against the negligent human driver.

 

[49]     The reasonable car standard also accounts for the growth of technology. First generation cars will likely not be as “smart” as later generations, and drawing comparisons between generations and across brands would be painting with colossal brush strokes. Nor is it clear yet how much information cars will be able to share with each other.[157] This standard instead allows for the comparison of AVs at the moment the fatal decision is made, and could be applied in a manner that takes V2V[158] capabilities into consideration.

 

[50]     This standard also resolves issues of privity in an inclusive manner. Currently, most automotive products liability litigation involves the plaintiff suing the manufacturer of their own car.[159] The reasonable car standard allows claims to be brought by passengers, occupants of other vehicles, and pedestrians alike.

 

[51]     Additionally, the reasonable car standard leaves room for the trolley car problem. It allows society, by way of a jury, to give input into what the best outcome should be, and compares an AV’s choice to what a reasonable AV would have done under similar circumstances. Although what that outcome would be, and how a jury might judge it, is still uncertain, the reasonable car standard gives society the same input it has when a human driver faces the same decision.

 

[52]     Unfortunately, successful application of the reasonable car standard depends on production of information by car manufacturers regarding the behavior of other cars in similar situations. Manufacturers might be hesitant to reveal this information for a number of reasons (e.g. publicity, consumer privacy, trade secret protection, etc.). However, the normal rules of discovery would compel manufacturers to disclose information necessary to establish the reasonable car standard.

 

[53]     Another flaw in the reasonable car standard applies to the first generation of AVs: small sample size. With a limited number of AVs on the road, ascertaining what a reasonable car would do might be difficult, and the answer may be unreliable.[160] However, as the technology proliferates, this problem will become less profound.

 

[54]     Other scholars have discussed and rejected a reasonableness standard under a negligence theory.^[161] Especially in a trolley car scenario, negligence would be the improper standard when the injury resulted from an intervening act on behalf of the AV. In other words, there is a distinction between “intending” injury and “merely foreseeing it”.[162] Applying the reasonable car standard in the strict liability setting of products liability would be a proper test because products liability does not pivot on this intent/foreseeability distinction, but whether any safer alternative design existed. The reasonable car standard would serve as a threshold to this issue to prevent the floodgates of litigation from opening so wide as to deter innovation. Determining how a reasonable AV would act and comparing it to an allegedly deviant AV would be far less invasive and expensive for the parties than litigating whether a safer alternative design would be implemented by comparing lines of computer code (which would likely be confusing for the factfinder).[163]

 

[55]     In sum, although tort law in its current state lacks an appropriate vehicle for remedy when it comes to AVs, tort law is robust enough to adapt as it always has to new technologies. One means of adapting is by applying a new standard: the reasonable car standard. Just as this new technology will influence the evolution of products liability law, so too products liability law will influence the evolution of technology and the actions of car manufacturers.

 

 

IV. How Tort Law Affects Technology

 

[56]     New technology affects the evolution of law and vice versa. This section explores how automotive products liability law is shaping the technology involved with AVs, from different design components to steps that manufacturers are taking to limit liability without stunting growth. Finally, this section proposes that while it remains unclear how the law will react to AVs, manufacturers may take prospective steps to limit, divide, and shift liability.

 

A. Effecting Design Elements

1. Mechanical Components

 

[57]     Certain design features of AVs are responsive to legal requirements. For example, California law requires that all AVs be equipped with a steering wheel and a driver at the ready.[164] However, it is not just statutory and regulatory reform driving the incorporation of certain design elements. Products liability concerns exert a similar influence.

 

[58]     For example, keeping a “kill-switch” in the car,^[165] whereby an occupant is responsible for assuming control of the vehicle in the event the car encounters conditions it is not mature enough to handle, might provide manufacturers with an escape from liability.^[166] This requires that the car maintain features that permit human control (e.g. steering wheel, pedals, rearview mirror, horn, and emergency brake).^[167] Because, as previously mentioned, this requirement severely limits one of the greatest benefits of the technology—mobility for the elderly, minors, and the disabled—the law should work to alleviate this requirement.^[168] In the meantime, AVs require human supervision—at least for the first generation.[169]

 

[59]     Another example is the “black box” recorder, or event data recorder (EDR).[170] Like the kill switch discussed above, although EDRs are required in AVs by California and Nevada law, tort law exerts a similar pressure to keep accurate records of events leading up to a collision. Doing so brings more benefit than harm to manufacturers. AVs will share the road with traditional models for several generations, and most collisions are the result of human error.[171] Therefore, providing accurate data will shift liability away from the manufacturer and onto the human driver in the vast majority of cases—either the human driver of the traditional vehicle, or the human driver who failed to operate the kill switch in the AV.[172]

 

[60]     Other suggestions yet to be incorporated include colored lighted license plate identifiers, so police may discern when a human driver is in control,[173] and concept cars touting more forward looking features, like reclining[174] or swiveling[175] front seats. To be sure, an AV’s hardware pushes the law to new places—as does its software.

 

2. Software Components

 

[61]     Going back to the trolley car scenario, many people question whether an AV can—or rather, should—be programmed to select a particular outcome.[176] One answer to this is that an AV should, in theory, avoid a trolley car scenario altogether. Daniela Rus, head of the Artificial Intelligence lab at M.I.T. believes that a “capable perception and planning system, perhaps aided by sensors that can detect non-line-of-[sight] obstacles” would provide an AV with sufficient situational awareness and control.[177] Rus explains, “A self-driving car should be able to not hit anybody—avoid the trolley problem altogether!”[178] Currently, the algorithms that drive AVs have not matured enough to handle routine driving scenarios, and struggle with four way stops,[179] snow[180], and apparently driving in urban settings with city buses.[181] These challenges stem in part from the software’s timid nature: abiding by traffic laws and driving defensively amid aggressive human drivers, who do not always come to a complete stop or make room for fellow drivers.[182]

 

[62]     This deficit could be corrected with a little tweaking, but the question then becomes: should AVs be programmed to solve the trolley car problem? And how? As many readers will have guessed, the trolley car problem has no “right answer.”[183] A utilitarian solution would save the greatest number of people, but places the operator (or in the case of AVs, the programmer) in the position of playing God—actively deciding who lives and who dies.[184] Not surprisingly, not all people agree on the best outcome. The public’s conflicting thoughts on AVs is mirrored in the disagreement over the trolley car outcome.[185] As mentioned earlier, most people are willing to sacrifice the driver—so long as they are not the driver.[186]

 

[63]     Simply put, even if the first generation of AVs were able to find a solution to this problem,[187] society has not yet agreed on what that answer should be.[188] Therefore, requiring this capability in AVs is senseless until society decides on the most desirable outcome. Furthermore, it is irrational to forestall the societal benefits AVs present until a solution to the trolley car problem is devised. One insightful writer put it well:

 

Humans are freaking out about the trolley [problem] because we’re terrified of the idea of machines killing us. But if we were totally rational, we’d realize 1 in 1 million people getting killed by a machine beats 1 in 100,000 getting killed by a human. For some reason, we’re more okay with the drunk driver or texting while driving. In other words, these cars may be much safer, but many people won’t care because death by machine is really scary to us given our nature.[189]

 

[64]     Setting aside the trolley car problem, tort law has affected other aspects of AV software, like FOTA; because a safer alternative design would weigh against a manufacturer in a design defect claim,[190] making updates to the software in a timely and cost-effective manner is imperative. FOTA allows manufacturers to send software updates wirelessly as they develop, with little lag time, and at minimal cost.[191]

 

[65]     Additionally, although many state laws provide liability protection for manufacturers in the event that some third-party tampers with the software, hacking is a foreseeable risk, the consequences of which are potentially catastrophic.[192] As a result, data communication security oriented to minimize vulnerability has produced enhanced methods of encrypting communications.[193]

 

[66]     Existing products liability laws have hot-housed other advancements like telematics[194] and V2V communication[195] as well. Telematics refers to “the transfer of data to and from a moving vehicle.”[196] It allows traditional cars and AVs to stay up to date on road conditions by reporting information to a central hub, which in turn communicates the information to other users (think of the traffic app Waze).[197]

 

[67]     V2V uses short wave radio to allow cars to exchange information at a distance of up to 300 meters.[198] This range goes beyond the capabilities of sensors, cameras, and radar in that it can “see around corners” or “through” objects to assess driving conditions well down the road and avoid collisions and traffic jams.[199] For example, if a collision occurs or the roadway is otherwise obstructed, a car slowing down to pass by or rerouted can send the information to a car 300 meters behind it to slow down or avoid the area. That car in turn can relay the message even further, conveying to cars well behind and thereby avoid unnecessary congestion.[200]

 

[68]     Although V2V is not restricted to use in AVs, it has enormous implications for AVs, allowing them to communicate among themselves or with traditional vehicles.[201] That increased communication provides a redundancy in the event of a sensor failure,[202] or, for example, would allow an AV to know for certain that a city bus indeed intended to slow down and let the AV into the lane.[203]

 

[69]     While technology managed to evolve despite the constraints of existing laws, manufacturers have taken other actions to limit their liability and still innovate.

 

B. Effecting Manufacturer’s Actions

1. Applying Some Pressure

 

[70]     In March 2016, AV proponents petitioned Congress to regulate the industry in order to avoid letting states construct a patchwork of laws which could hamper innovation.[204] Chris Urmson, Google’s self-driving car project technical leader stated, “[i]f every state is left to go its own way without a unified approach, operating self-driving cars across state boundaries would be an unworkable situation and one that will significantly hinder safety innovation, interstate commerce, national competitiveness and the eventual deployment of autonomous vehicles.”[205]

 

[71]     On September 19, 2016, the NHTSA delivered on its promise to publish updated recommendations for the treatment of AVs, including a request for states to work together to develop uniform policies.[206] NHTSA has said that it will not prevent states from setting their own standards for AVs (so long as they do not conflict with federal law), but this request signals that the NHTSA expects states to cooperate and strive for uniformity.[207]

 

2. Stopping the Buck

 

[72]     This uncertainty led Volvo to take the drastic step of announcing in October 2015, that it would assume full liability whenever one of its cars is in autonomous mode.[208] Volvo Car Group President and CEO Håkan Samuelsson warned that a lack of federal guidelines for the testing and certification of AVs may cost the U.S. its leading position in the field.[209] He stated, “Europe has suffered to some extent by having a patchwork of rules and regulations. It would be a shame if the U.S. took a similar path to Europe in this crucial area.”[210] Mr. Samuelsson explained that the lack of federal oversight risks slowing the growth and development of AV technologies, “by making it extremely difficult for car makers to test, develop and sell [AVs]. The absence of one set of rules means car makers cannot conduct credible tests to develop cars that meet all the different guidelines of all 50 [] states.”[211]

 

[73]     In a fashion, Volvo self-insured its self-driving cars. By assuming all liability, Volvo expressed confidence in its product, and found a way to more accurately project costs—eventually passing them on to the consumer.[212] Consumers will likely be willing to pay a slightly higher price for the assurance that litigation will be avoided.[213] Since Volvo made this promise, Google and Mercedes Benz followed suit making similar assurances.[214] However, this tactic of cutting out the insurance industry could be considered anti-competitive, and it may cause insurance companies to mobilize in opposition.[215] For conservative manufacturers who are not willing to take such a drastic step, this comment proposes alternative steps to reduce liability.

 

C. PROPOSAL: Limiting, Dividing, and Shifting Liability

 

[74]     This comment proposes that manufacturers who do not voluntarily assume liability may take the following steps to limit liability: petition Congress for preemptive protection, “split the bill” with insurance companies, and develop special training modules as part of the purchase or lease agreement.

 

1. Going to Capitol Hill

 

[75]     Manufacturers could apply additional pressure to state and federal legislative and regulatory bodies to write laws and rules limiting their liability, targeting Congress in particular. In the past, Congress protected industries that provided a good that served a public health interest (like vaccine manufacturers[216]) or provided transportation (like the airline industry[217]).[218]

 

[76]     Manufacturers can argue that AVs provide both a benefit to public health, by reducing the number of accidents due to human error,[219] and a source of transportation, and they are therefore deserving of liability protection via federal action.[220] The social benefits of AVs range from a sharp decrease in traffic related fatalities, to more efficient land use, significantly reduced emissions, reduced social isolation, and access to essential services.[221] Some projections predict AVs could save nearly 300,000 lives over the course of a decade in the U.S. alone—putting AVs in the company of public health benefits like vaccines, which save 42,000 lives per U.S. birth cohort.[222] Moreover, the reduced emotional toll on the families of the 300,000 potential victims is immeasurable.[223]

[77]     Yet, for all these benefits, legal liability remains the greatest roadblock to mass adoption of AVs.[224] Pressure from foreign markets, as Samuelsson pointed out, coupled with pressure from manufacturers may convince Congress to act.

 

2. Going Dutch[225]

 

[78]     Autonomous technology also shakes up the insurance industry, and much has been written predicting reactions.[226] Certainly, if the AV is in autonomous mode when a crash occurs, as the Google car was, insurance companies will seek to shift liability away from the human driver and toward manufacturers.[227] One scholar suggests establishing a national car insurance fund to pay for AV accidents.[228] This comment proposes that manufacturers could lead the effort. A national fund presents the advantage of allowing manufacturers to negotiate with other stakeholders (e.g. NHTSA, insurance companies, and ride sharing companies) to determine a proportional contribution, rather than rolling the dice in court whenever a plaintiff files a products liability claim. Without lawmaker action to completely immunize manufacturers from liability, the next best option may be negotiating liability absent a jury.

 

[79]     Working with the insurance industry may be a better move than working against it. As altruistic as Volvo’s self-insurance model may seem, it has the potential to alienate the insurance industry. As previously mentioned, cutting out insurance companies may create friction and ultimately backfire if the move is deemed anti-competitive.[229]

 

3. Going it Alone

 

[80]     In the face of regulatory drought, manufacturers may take unilateral steps to limit liability. For example, manufacturers could develop and provide special training modules for prospective buyers, making satisfactory completion a part of the purchase or lease agreement. As previously mentioned, manufacturers will want to avoid the awkward position of managing consumer expectations and providing adequate warnings for safe use of AVs, while simultaneously encouraging use and advertising the overall increased safety of the product.[230] Training modules would provide manufacturers with the opportunity to fully verse purchasers in the capabilities and limitations of AVs, allowing manufacturers to fulfill their duty to provide adequate warnings in a controlled environment—somewhat privately, or at least not center stage in front of a public that is already terrified by the idea of death by machine.[231]

 

 

V. Conclusion

[81]     Fully autonomous vehicles already roam public streets, but automotive products liability law lags behind the technology. Tort law in its current state cannot appropriately address concerns arising from the mass adoption of AVs, and while lawmakers ponder the best course of action, manufacturers must be prepared to litigate the necessary changes—like the adoption of a reasonable car standard.

 

[82]     Just as the law reacts to new technology, technology symbiotically reacts to the law. Thus, manufacturers must design accordingly, while consumer demand requires that manufacturers design AVs that push the limits of existing products liability law. Therefore, to ensure that innovation is not unduly hampered, manufacturers must take additional steps like seeking liability protection via legislation, leading the way to establish a national insurance fund, and developing training modules for buyers as part of purchase and lease agreements.

 

[83]     AV cars are here. The law will react. Manufacturers should ready themselves to influence that reaction.

 

 

 

 

 

*J.D., M.P.A., B.A. Political Science. The author thanks Tobias Ogemark for his inspiration and insight into the technical areas of this field, Hiram Molina for his help editing, and JOLT.

[1] Matt Novak, Nikola Tesla’s Amazing Predictions for the 21^st Century, Smithsonian (Apr. 19, 2013), http://www.smithsonianmag.com/history/nikola-teslas-amazing-predictions-for-the-21st-century-26353702/#6s2X63fpuuH1gGWC.99, https://perma.cc/29FU-MRYK.

[2] See Nick Statt, Google’s bus crash is changing the conversation around self-driving cars, Verge (Mar. 15, 2016, 2:56 PM), http://www.theverge.com/2016/3/15/11239008/sxsw2016googleselfdrivingcarprogramgoalsaustin, https://perma.cc/492R-QLBK.

[3] See id.

[4] See id.; see Chris Ziegler, A Google self-driving car caused a crash for the first time, Verge (Feb. 29, 2016, 1:50PM), http://www.theverge.com/2016/2/29/11134344/google-self-driving-car-crash-report, https://perma.cc/Y6U2-A86V.

[5] See Statt, supra note 2; see generally Alissa Walker, What Google’s Self-Driving Car Learned From Hitting That Bus, Gizmodo (Mar. 11, 2016, 7:15 PM), http://gizmodo.com/what-googles-self-driving-car-team-learned-from-hitting-1764409297, https://perma.cc/U4F6-B5V2 (discussing Google’s response to the February crash).

[6] See Statt, supra note 2; see Ziegler, supra note 4.

[7] See Ziegler, supra note 4; see also Chris Ziegler, Watch the moment a self-driving Google car sideswipes a bus, The Verge (Mar. 9, 2016, 11:57 AM) [hereinafter Watch the moment], http://www.theverge.com/2016/3/9/11186072/googleselfdrivingcarbuscrashvideo, https://perma.cc/RN9N-MBWK.

[8] See generally, e.g., James M. Anderson et al., Autonomous Vehicle Technology: A Guide for Policymakers xiii (RAND Corp. 2016) [hereinafter RAND], http://www.rand.org/pubs/research_reports/RR443-2.html, https://perma.cc/UPL6-GE8Y (discussing the policy changes in response to new autonomous vehicle technology); Sven A. Beiker, Legal Aspects of Autonomous Driving, 52 Santa Clara L. Rev. 1145,1146 (2012) (providing an overview of legal issues involving autonomous vehicles); Steve Brachmann, Regulatory issues involving self-driving vehicles begin to take shape, IPWatchdog (Apr. 3, 2015), http://www.ipwatchdog.com/2015/04/03/regulatory-issues-involving-self-driving-vehicles-begin-to-take-shape/id=56207/, https://perma.cc/BT2M-ZURZ (discussing regulatory issues surrounding autonomous vehicles); Frank Douma & Sarah A. Palodichuk, Criminal Liability Issues Created by Autonomous Vehicles, 52 Santa Clara L. Rev. 1157, 1158-59 (2012) (describing the third party liability issues created by autonomous vehicles); Andrew P. Garza, Note, “Look Ma, No Hands!:” Wrinkles and Wrecks in the Age of Autonomous Vehicles, 46 New Eng. L. Rev. 581, 616 (2012) (arguing that liability will fall on manufacturers but that increased safety benefits will decrease liability); Dorothy J. Glancy, Privacy in Autonomous Vehicles, 52 Santa Clara L. Rev. 1171, 1173 (2012); Kyle Graham, Of Frightened Horses and Autonomous Vehicles: Tort Law and its Assimilation of Innovations, 52 Santa Clara L. Rev. 1241, 1243 (2012) (discussing how tort liability evolves with emerging technology); Robert B. Kelly & Mark D. Johnson, Defining a Stable, Protected and Secure Spectrum Environment for Autonomous Vehicles, 52 Santa Clara L. Rev. 1271, 1274 (2012) (discussing autonomous vehicle communication systems); Monica Kleja, Läsarna: Tillverkarna ska ta ansvar för självkörande bilar [Readers: Manufacturers must take responsibility for self-driving cars], NyTeknik (Feb. 24, 2016) (stating that manufactures must take responsibility for self-driving cars); Gary E. Marchant & Rachel A. Lindor, The Coming Collision Between Autonomous Vehicles and the Liability System, 52 Santa Clara L. Rev. 1321, 1339 (2012) (arguing that the vehicle manufacturer should be liable for accidents caused in autonomous mode); Robert W. Peterson, New Technology—Old Law: Autonomous Vehicles and California’s Insurance Framework, 52 Santa Clara L. Rev. 1341, 1342 (2012) (discussing how insurance markets will be effected by autonomous vehicles); Eddie Pröckl, Självkörande bilar känsligast för hackning, Ny Teknik 4–5 (Swed.) (Apr. 6, 2016) (discussing how self-driving cars can be hacked); J.B. Ruhl, Can AI Make AI Obey the Law?, Law 2050 A Forum About the Legal Future, (Feb. 16, 2016, 8:58 PM), https://law2050.com/ (outlining the legal issues stemming from autonomous vehicles); John Villasenor, Products Liability and Driverless Cars: Issues and Guiding Principles for Legislation, Brookings Institution Press, (Apr. 24, 2014) [hereinafter Brookings], http://www.brookings.edu/~/media/research/files/papers/2014/04/products-liability-driverless-cars-villasenor/products_liability_and_driverless_cars.pdf, https://perma.cc/8D5W-8RUY (discussing the liability issues arising from autonomous vehicles).

[9] See Neal Katyal, Disruptive Technologies and the Law, 102 Geo. L.J. 1685, 1689 (2014).

[10] See Garza, supra note 8, at 616; Jeffrey R. Zohn, When Robots Attack: How Should the Law Handle Self-Driving Cars That Cause Damages, 2015 U. Ill. J.L. Tech. & Pol’y 461, 464 (2015) (arguing that “there is enough precedential law to support autonomous vehicle liability and that the law should treat autonomous vehicles like other autonomous machines, not traditional automobiles”); F. Patrick Hubbard, “Sophisticated Robots:” Balancing Liability, Regulation, and Innovation, 66 Fla. L. Rev. 1803, 1872 (2014) (advocating the ability of tort law to balance victim compensation and innovation).

[11] See Roy Alan Cohen, Self-Driving Technology and Autonomous Vehicles: A Whole New World for Potential Product Liability Discussion, 82 Def. Couns. J. 328, 330–31 (2015), reprinted in Products Liability, IADC Committee Newsletter; RAND, supra note 8, at xxii.

[12] See Marchant & Lindor, supra note 8, at 1340. But see Jeffrey K. Gurney, Sue My Car Not Me: Products Liability and Accidents Involving Autonomous Vehicles, 2013 U. Ill. J.L. Tech. & Pol’y 247, 273 (2013) (arguing that “current products liability law will not be able to adequately assess [] fault” for autonomous vehicles and current doctrines should be reconsidered).

[13] See Alexander Hars, Top Misconceptions of Autonomous Cars and Self-Driving Vehicles, Thinking Outside the Box: Inventivio Innovation Briefs 1 (2016), http://www.driverless-future.com/?page_id=774, https://perma.cc/AM7U-R858.

 

[14] See id. at 1, 5.

[15] In 2013, NHTSA established five levels of automation in vehicles:

No-Automation (Level 0): The driver is in complete and sole control of the primary vehicle controls – brakes, steering, throttle, and motive power – at all times.

Function-specific Automation (Level 1): Automation at this level involves one or more specific control functions. Examples include electronic stability control or pre-charged brakes, where the vehicle automatically assists with braking to enable the driver to regain control of the vehicle or stop faster than possible by acting alone.

Combined Function Automation (Level 2): This level involves automation of at least two primary control functions designed to work in unison to relieve the driver of control of those functions. An example of combined functions enabling a Level 2 system is adaptive cruise control in combination with lane centering.

Limited Self-Driving Automation (Level 3): Vehicles at this level of automation enable the driver to cede full control of all safety-critical functions under certain traffic or environmental conditions and in those conditions to rely heavily on the vehicle to monitor for changes in those conditions requiring transition back to driver control. The driver is expected to be available for occasional control, but with sufficiently comfortable transition time. The Google car is an example of limited self-driving automation.

Full Self-Driving Automation (Level 4): The vehicle is designed to perform all safety-critical driving functions and monitor roadway conditions for an entire trip. Such a design anticipates that the driver will provide destination or navigation input, but is not expected to be available for control at any time during the trip. This includes both occupied and unoccupied vehicles.

See Russ Heaps, Self-Driving Cars: Department of Transportation Issues New Classification Levels for Autonomous Cars, Autotrader (Oct. 2016), http://www.autotrader.com/car-shopping/self-driving-cars-department-of-transportation-issues-new-classification-levels-for-autonomous-cars-258322, https://perma.cc/98ZP-PKQV (citing Press Release, Nat’l High. Traf. Safety Admin., Preliminary Statement of Policy Concerning Autonomous Vehicles 4–5 (last visited Apr. 13, 2017) [hereinafter NHTSA Preliminary Statement], http://www.nhtsa.gov/staticfiles/rulemaking/pdf/Automated_Vehicles_Policy.pdf, https://perma.cc/K9VB-5L54; see also Lewis Bass & Thomas Parker Redick, Prod. Liab.: Design and Mfg. Defects § 26:3 (2d ed. 2017).

[16] See id.

 

[17] See Lane Keeping Assist: Helps keep drivers within lanes, Toyota, http://www.toyota-global.com/innovation/safety_technology/safety_technology/technology_file/active/lka.html, https://perma.cc/Q3S2-3V2K (last visited Apr. 22, 2016).

[18] See Aaron M. Kessler & Bill Vlasic, Semiautonomous Driving Arrives, Feature by Feature, N.Y. Times (Apr. 2, 2015), http://www.nytimes.com/2015/04/03/automobiles/semiautonomous-driving-arrives-feature-by-feature.html?_r=0, https://perma.cc/2BMC-NGGZ.

[19] LIDAR, or Laser Illuminating Detection and Ranging, is like radar, but uses lasers to detect objects and build a 3-D map of the car’s surroundings. See Bryan Clark, How Self-Driving Cars Work: The Nuts and Bolts Behind Google’s Autonomous Car Program, MakeUseOf (Feb. 21, 2015), http://www.makeuseof.com/tag/how-self-driving-cars-work-the-nuts-and-bolts-behind-googles-autonomous-car-program/, https://perma.cc/Z76W-6QUE.

[20] “Telematics is a general term that refers to any device which merges telecommunications and informatics. Telematics includes anything from GPS systems to navigation systems. It is responsible for many features in vehicles from OnStar to hands free mobile calling.” See Welcome to Telematics.com, Telematics.com, http://www.telematics.com/, https://perma.cc/7VKQ-MUWM (last visited Apr. 22, 2016).

[21] “The Global Positioning System (GPS) is a satellite-based navigation system made up of at least 24 satellites … Each satellite transmits a unique signal and orbital parameters that allow GPS devices to decode and compute the precise location of the satellite. GPS receivers use this information and trilateration to calculate a user’s exact location.” See What is GPS?, Garmin, https://www8.garmin.com/aboutGPS/, https://perma.cc/2F7D-P39H (last visited Apr. 18, 2017).

 

[22] See generally Steven H. Bayless et al., Intelligence Transp. Soc’y of Am., U.S. Dep’t of Transp., Connected Veh. Insights: Trends in Roadway Domain Active Sensing 2 (Aug. 14, 2013), https://ntl.bts.gov/lib/50000/50600/50696/Trends_in_Active_Sensing_JPO_format_Aug_23_2013__FHWA-JPO-13-086_.pdf, https://perma.cc/BG2B-HRBV.

[23] See Kessler & Vlasic, supra note 18.

 

[24] See Sami Haj-Assaad, Future Cars Will Update Wirelessly To Stay Safe, AutoGuide.com (Oct. 21, 2015), http://www.autoguide.com/auto-news/2015/10/future-cars-will-update-wirelessly-to-stay-safe.html, https://perma.cc/N9TN-7GFE.

 

[25] See Harman, Redbend Software Management Platform Software Update Management, Redbend, http://www.redbend.com/en/products/software-update-and-management, https://perma.cc/93YT-WLGV (last visited Apr. 22, 2016).

[26] See RedBend Software, Updating Car ECUs Over-The-Air (FOTA) (2011) [hereinafter Redbend White Paper] at 10, http://www.redbend.com/data/upl/whitepapers/red_bend_update_car_ecu.pdf, https://perma.cc/G243-XSEL.

[27] See How it works, Waymo, https://www.google.com/selfdrivingcar/how/, https://perma.cc/7V24-BQDL (last visited Apr. 22, 2016) [hereinafter How it works]; Muhammad Azmat & Clemens Schuhmayer, Inst. of Transp. & Logistics Vienna Univ. of Econ. & Bus., at Fed. Procurement Agency Austria Workshop Innovation Platform – E-mobility, Future Scenario: Self Driving Cars—The Future has Already Begun (May 7, 2015), https://www.researchgate.net/profile/Muhammad_Azmat4/publication/278329250_Future_Scenario_Self_Driving_Cars_-_The_future_has_already_begun/links/557f6fcf08aeea18b77962b6.pdf, https://perma.cc/A2SQ-5SQK.

[28] See How it works, supra note 27.

[29] See id.

[30] See Hars, supra note 13, at 4.

 

[31] See id.

 

[32] See id.; see also How it works, supra note 27.

[33] See How it works, supra note 27.

 

[34] See id.

 

[35] See Hars, supra note 13; see also Dorothy J. Glancy, Legal Outlook for Autonomous, Automated, and Connected Cars, Fed’n of Def. & Corp. Couns. Ann. Meeting (July 25-Aug. 1, 2015) http://www.thefederation.org/documents/04.Glancy%20-%20AutonomousCars.pdf, https://perma.cc/NT9Z-9D9P.

[36] V2V communication systems use short range radio to “talk” to each other. The Department of Transportation estimates V2V will avoid 76% of roadway crashes. Self-Driving Cars and Insurance, Ins. Info. Institute (July 2016) [hereinafter Insurance Information Institute], http://www.iii.org/issue-update/self-driving-cars-and-insurance, https://perma.cc/LW5H-AVJP. But see RAND, supra note 8, at xx; and Brachmann, supra note 8; and Dorothy J. Glancy, Autonomous and Automated and Connected Cars-Oh My! First Generation Autonomous Cars in the Legal Ecosystem, 16 Minn. J.L. Sci. & Tech. 619, 648 (2015) (“What remains uncertain is whether NHTSA’s narrow definition of connected vehicles to include only DSRC V2V communications in passenger cars and light trucks, will be a required feature of first generation autonomous cars.”)[hereinafter Autonomous and Automated and Connected Cars-Oh My!].

[37] See Press Release, Nat’l Highway Traffic Safety Admin., Transp. Sec. Foxx announces steps to accelerate road safety innovation (May 13, 2015), http://www.nhtsa.gov/About+NHTSA/Press+Releases/2015/nhtsa-will-accelerate-v2v-efforts, https://perma.cc/XA3C-CPS7.

[38] David Shepardson, Google says it bears ‘some responsibility’ after self-driving car hot bus, Reuters (Feb. 29, 2016), http://www.reuters.com/article/us-google-selfdrivingcar-idUSKCN0W22DG, https://perma.cc/3GET-93C2.

[39] See Self-Driving Cars: Past, Present and Future, GEICO (Dec. 4, 2015), https://www.geico.com/more/driving/auto/car-safety-insurance/self-driving-cars-past-present-and-future/, https://perma.cc/BP3H-9WT6.

 

[40] See id.; see Mike Ramsey, Google Self-Driving Car Hits Bus, Wall St. J. (Mar. 1, 2016, 8:47 AM), http://www.wsj.com/articles/google-self-driving-car-hits-bus-1456777567, https://perma.cc/6F9K-JUA4.

[41] See Azmat & Schuhmayer, supra note 27, at 10.

[42] See id.

[43] Jan Hauser, Amerika schaltet auf Autopilot [America switches to Autopilot], Frankfurter Allgemeine Zeitung (Sep. 19, 2015), http://www.faz.net/aktuell/wirtschaft/unternehmen/verkehrsminister-foxx-selbstfahrende-autos-in-10-jahren-standard-13811022.html, https://perma.cc/5WVU-PXDD.

[44] See Rand, supra note 8, at 9 (discussing these benefits and exhaustively listing the promises and perils related to AVs).

[45] See id. at 15.

 

[46] See id. at 9.

 

[47] See id. at 17.

 

[48] See id. at 28.

 

[49] See Rand, supra note 8, at 28.

 

[50] See Insurance Information Institute, supra note 36.

[51] See Driverlessuser, HDI Gerling first insurance company to insure a driverless car, Driverless car market watch (Mar. 26, 2012) [hereinafter HDI Gerling], http://www.driverless-future.com/?p=171, https://perma.cc/58RW-4P74 ; Insurance Information Institute, supra note 36; Carrie Schroll, Splitting the Bill: Creating A National Car Insurance Fund to Pay for Accidents in Autonomous Vehicles, 109 Nw. U.L. Rev. 803, 814 (2015).

[52] “Nevada was the first state to authorize the operation of autonomous vehicles in 2011. Since then, ten other states—Alabama, California, Florida, Louisiana, Michigan, North Dakota, Pennsylvania, Tennessee, Utah and Virginia—and Washington D.C. have passed legislation related to autonomous vehicles. Governors in Arizona and Massachusetts issued executive orders related to autonomous vehicles.” Autonomous Vehicles – Self-Driving Vehicles Legislation, Nat’l Conf. of State Legislatures (Feb. 23, 2016), http://www.ncsl.org/research/transportation/autonomous-vehicles-legislation.aspx#Enacted Autonomous Vehicle Legislation, https://perma.cc/YD9K-LAP5 (“[In 2016], 20 states introduced legislation. Sixteen states introduced legislation related to autonomous vehicles in 2015, up from 12 states in 2014, nine states and D.C. in 2013, and six states in 2012.”).

[53] For example, AVs cannot be programmed to break the law. California requires that the test vehicle and driver must obey all provisions of the state Vehicle Code and the local highway laws. See Cal. Code Regs. tit. 13, § 227.18(c) (2017). However, not giving an AV that same discretion to break a minor traffic regulation (like driving on the shoulder) to avoid a collision, would create unnecessary risk and could be a potential design defect. See Patrick Lin, The Ethics of Autonomous Cars, Atlantic (Oct. 8, 2013), http://www.theatlantic.com/technology/archive/2013/10/the-ethics-of-autonomous-cars/280360, https://perma.cc/2J4S-8GR2; Alexander Hars, Supervising autonomous cars on autopilot: A hazardous idea, Inventivio Innovation Briefs, Issue 2013-09, http://www.inventivio.com/innovationbriefs/2013-09/Supervised-Autonomous-Driving-Harmful.2013-09.pdf, https://perma.cc/VJ3Y-7XW4 [hereinafter Supervising Autonomous Cars]. Programming AVs to break the law is perhaps not the wisest way to solve the problem. Instead, the traffic code could be updated to allow for an otherwise illegal maneuver to be deemed legal under certain conditions. Compare Autonomous and Automated and Connected Cars-Oh My!, supra note 36, at 653–54 (2015) (stating that traditional traffic laws should apply to first generation autonomous vehicles, but perhaps not later generations); with Benjamin I. Schimelman, How to Train A Criminal: Making Fully Autonomous Vehicles Safe for Humans, 49 Conn. L. Rev. 327, 330 (2016) (advocating that autonomous vehicles be developed to strategically break the rules of the road so they blend more easily into the existing ecosystem of human drivers).

[54] See U. Wash. Tech, Law & Pol’y Clinic, Autonomous Vehicle Law Report and Recommendations to the ULC 20 [hereinafter AV Team, Law Report] (unpublished report) (on file with University of Washington School of Law), https://www.law.washington.edu/clinics/technology/Reports/AutonomousVehicle.pdf, https://perma.cc/ZF52-AXFC (“Nevada, Florida, and Michigan require: If a third party makes changes to an AV and those changes cause harm, the manufacturer is not liable for damages unless the defect was present when originally manufactured.”); see also Nev. Rev. Stat. § 482A.090 (2017); Fla. Stat. § 316.86 (2017); D.C. Code § 50-2353 (2017); Mich. Comp. Laws § 257.817 (2017).

[55] See RAND, supra note 8, at 138; see Insurance Information Institute, supra note 36.

[56] See M. Ryan Calo, Open Robotics, 70 Md. L. Rev. 571, 602–07 (2011) (proposing limited immunity from liability for manufacturers of autonomous systems); see Marchant & Lindor, supra note 8, at 1337 (providing the rationale and case law for such legislative intervention).

[57] See Insurance Information Institute, supra note 36.

[58] Secretary Foxx Unveils President Obama’s FY17 Budget Proposal of Nearly $4 Billion for Automated Vehicles and Announces DOT Initiatives to Accelerate Vehicle Safety Innovations, U.S. Dep’t Transp. (Jan. 14, 2016), https://www.transportation.gov/briefing-room/secretary-foxx-unveils-president-obama%E2%80%99s-fy17-budget-proposal-nearly-4-billion, https://perma.cc/L3K9-NZWN. NHTSA has the authority to update the Federal Motor Vehicle Safety Standards, and set emissions standards. Rules related to meeting those emissions standards are promulgated by the Environmental Protection Agency.

[59] See Nat’l Highway Traffic Safety Admin., “DOT/NHTSA Policy Statement Concerning Automated Vehicles” 2016 Update to “Preliminary Statement of Policy Concerning Autonomous Vehicles” (2016) [hereinafter 2016 Update], https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/autonomous-vehicles-policy-update-2016.pdf, https://perma.cc/78QA-3KLA; Autonomous Vehicles – Self-Driving Vehicles Legislation, supra note 52.

[60] See Richard Adhikari, Feds Put AI in the Driver’s Seat, TechNewsWorld (Feb. 11, 2016, 10:19 AM), http://www.technewsworld.com/story/83102.html, https://perma.cc/8BRZ-8F8B. This puts liability squarely on the manufacturer by way of the AV. The updated recommendations leave liability determinations up to the states. See Kelsey D. Atherton, What You Need To Know About The New Federal Rules For Driverless Cars, Popular Sci. (Sept. 21, 2016), http://www.popsci.com/read-federal-rules-for-driverless-cars, https://perma.cc/JHS6-QLB9.

[61] See Adhikari, supra note 60.

[62] See Insurance Information Institute, supra note 36.

[63] See Nat’l High. Traf. Safety Admin., 2014 Crash Data Key Findings (Nov. 2015) [hereinafter 2014 Crash Data].

[64] See Press Release, Nat’l Highway Traf. Safety Admin., Traf. Fatalities Fall in 2014, but Early Estimates Show 2015 Trending Higher (Nov. 24, 2015) http://www.nhtsa.gov/About+NHTSA/Press+Releases/2015/2014-traffic-deaths-drop-but-2015-trending-higher, https://perma.cc/8JD4-JJR3.

[65] See Adrienne Lafrance, One Thing Baby Boomers and Millennials Agree On: Self-Driving Cars, Atlantic (Oct. 16, 2015), http://www.theatlantic.com/technology/archive/2015/10/snake-people-cars/410923/, https://perma.cc/9GN4-JR77.

[66] See Claire Cain Miller, When Driverless Cars Break the Law, N.Y. Times (May 13, 2014), http://www.nytimes.com/2014/05/14/upshot/when-driverless-cars-break-the-law.html, https://perma.cc/QG7V-H4EK (As Bryant Walker Smith, a fellow at Stanford University’s Center for Automotive Research, succinctly stated, “It’s the one headline, ‘machine kills child,’ rather than the 30,000 obituaries we have every year from humans killed on the roads. It’s the fear of robots. There’s something scarier about a machine malfunctioning and taking away control from somebody. We saw that in the Toyota unintended acceleration cases, when people would describe their horror at feeling like they could lose control of their car.”).

[67] See Andrew Hawkins, Voices Clash at First Public Hearing on Self-Driving Cars, Verge (Apr. 8, 2016), http://www.theverge.com/2016/4/8/11394454/self-driving-cars-nhtsa-dot-hearing-dc-regulations, https://perma.cc/97E4-L8TG (commenting that NHTSA’s first public hearing on AVs lasted seven hours, ranging from “this is the best thing ever” to “ban self-driving cars before they kill us all.”).

[68] See id.

 

[69] See generally 2016 Update, supra note 59.

[70] See supra note 58.

 

[71] See Garza, supra note 8, at 589 (“Because ‘[e]rror in legislation is common, and never more so than when the technology is galloping forward,’ it is important to avoid attempts to ‘match an imperfect legal system to an evolving world that we understand poorly.’”).

[72] See Derek H. Swanson et al., U.S. Automotive Prod. Liab. Law 3 (McGuireWoods, 2nd ed. 2009), https://www.mcguirewoods.com/news-resources/publications/us-automotive-products-liability.pdf, https://perma.cc/M25C-DCHQ.

[73] See Garza, supra note 8, at 589; Am. L. Prod. Liab. 3d § 31:10 (“In manufacturing defect cases, strict liability and negligence are distinct theories and are based on different factual predicates. While strict liability rests on a showing only of a product defect, negligence requires a showing of fault leading to a product defect.”); see generally Glancy, supra note 35, at 26; Brookings, supra note 8, at 7–8 (“While the landscape is somewhat in flux with respect to the specific theories of liability that can be invoked to pursue claims regarding manufacturing defects, design defects, and failure to warn, all three remain central to products liability law.”).

[74] See David G. Owen, The Evolution of Products Liability Law, 26 Rev. Litig. 955, 956 (2007) (stating that products liability dates back even further, “at least to Roman law, which imposed an implied warranty of quality against defects on sellers of certain goods, a rule that may be traced to ancient Babylon, one or two thousand years before”).

[75] In Winterbottom v. Wright, Mr. Winterbottom was injured when the mail coach he drove collapsed because of shoddy construction. Winterbottom’s employer, the Postmaster General, had purchased the mail coach from Mr. Wright, the manufacturer. Winterbottom sued Wright, but his case was dismissed based on a general rule that a product seller cannot be sued—even for proven negligence—by someone with whom he has not contracted, or in other words, someone with whom he is not “in privity.” See Winterbottom v. Wright, 10 M & W 109, 114 (1842), see Vernon Palmer, Why Privity Entered Tort – Tort An Historical Reexamination of Winterbottom v. Wright, XXVII Am. J. Legal Hist. 85, 92 (1983).

[76] “The connection or relationship between two parties, each having a legally recognized interest in the same subject matter.” PRIVITY, Black’s Law Dictionary (10th ed. 2014).

[77] See MacPherson v. Buick Motor Co., 111 N.E. 1050, 1053 (N.Y. 1916) (enlarging “inherent danger” to swallow the general rule of privity). Justice Cardozo wrote, “We hold, then, that the principle of [inherent danger] is not limited to poisons, explosives, and things of like nature, to things which in their normal operation are implements of destruction. If the nature of a thing is such that it is reasonably certain to place life and limb in peril when negligently made, it is then a thing of danger. Its nature gives warning of the consequences to be expected. If to the element of danger there is added knowledge that the thing will be used by persons other than the purchaser, and used without new tests, then, irrespective of contract, the manufacturer of this thing of danger is under a duty to make it carefully.” Id.

[78] See William L. Prosser, The Fall of the Citadel (Strict Liability to the Consumer), 50 Minn. L. Rev. 791, 791 (1966) (suggesting that Henningsen v. Bloomfield Motors, Inc., 121 A.2d 69, 90 (1960) marked the “fall of the citadel of privity”); see also Greenman v. Yuba Power Products, Inc., 377 P.2d 897 (Cal. 1963) (wherein Justice Traynor famously writes, “To establish the manufacturer’s liability it was sufficient that plaintiff proved he was injured while using the [product] in a way it was intended to be used as a result of a defect in the design and manufacture of which the plaintiff was not aware that made the [product] unsafe for its intended use.”).

[79] David G. Owen, Prod. Liab. L. 257 (3d ed. 2015). Although the Restatement (Second) of Torts uses the language “defective condition unreasonably dangerous,” Owen argues that most courts and commentators encapsulate this phrase with the use of the term “defective,” which simply means that a product is “more dangerous than it properly should be.” See id., at 258.

[80] Am. L. Prod. Liab. § 17:3 (3d ed. 2017).

[81] See id.

[82] See id.; “Allegations of defective design can also be made under any theory of liability. In negligence, the plaintiff must prove the breach of a design standard. In warranty, the question is whether the design renders the automobile unfit for its ordinary purposes. In strict liability, the issue is framed in terms of a defect that renders an automobile unreasonably dangerous. The strict liability standard is often left to the jury solely on the instruction that a defect exists if the automobile is more dangerous than an ordinary consumer would have expected.” Swanson et al., supra note 72, at 8.

[83] See Am. L. Prod. Liab. § 17:3 (3d ed. 2017).

[84] Larsen v. General Motors Corp. was the landmark case for crashworthiness doctrine. In Larsen, the steering column of the Corvair caused head trauma above and beyond that which would have been sustained in the crash alone. See Larsen v. General Motors Corp., 391 F.2d 495, 502–03 (8th Cir. 1968). Crashworthiness doctrine is also recognized in The Restatement (Third) of Torts, which specifically adopts the theory under another name: the so-called enhanced injury doctrine. See Restatement (Third) of Torts: Prod. Liab. § 16(a) (Am. Law Inst.1998); see also 63A. Am. Jur. 2d Prod. Liab. § 931 (2d. ed. 2017).

[85] See Larsen, 391 F.2d at 502.

[86] Garza, supra note 8, at 590 (citing Owen, supra note 74, at 1056–57).

[87] See id. at 594.

 

[88] See id.

 

[89] See id.

 

[90] See Owen, supra note 74, at 1056–28.

[91] Auto Products Liability, Conley Griggs Partin, http://www.conleygriggs.com/auto-products-liability, https://perma.cc/GBM2-ZQ85 (last visited Apr. 21, 2017).

[92] Consalo v. Gen. Motors Corp., 609 A.2d 75, 76 (N.J. Super. Ct. App. Div. 1992).

[93] Restatement (Third) of Torts: Prods. Liab. § 2 cmt. a (Am. Law Inst. 1998) (“Strict liability . . . performs a function similar to the concept of res ipsa loquitur . . . .”).

[94] Garza, supra note 8, at 591.

 

[95] Id.

[96] See Restatement (Second) of Torts § 402A (Am. Law Inst. 1979); Salerno v. Innovative Surveillance Tech., Inc., 932 N.E.2d 101, 109 (Ill. App. Ct. 1st Dist. 2010); Linda Sharp, Annotation, Products Liability: Consumer Expectation Test, 73 A.L.R. 5th 75, *3 (1999).

[97] Sharp, supra note 96; see Salerno, 932 N.E.2d at 109.

[98] Baley v. Fed. Signal Corp., 982 N.E.2d 776, 790 (App. Ct. 1st Dist. 2012).

[99] See Garza, supra note 8, at 593.

 

[100] See id., at 593–94.

[101] Larsen v. General Motors Corp., 391 F.2d 495, 496–97.

[102] See id. at 502.

[103] Id.

[104] Garza, supra note 8, at 591; Bruce K. Ottley, Rogelio A. Lasso & Terrence F. Kiely, Understanding Products Liability Law 137–38 (2d ed. 2013).

[105] See, e.g., Jackson v. General Motors Corp., 60 S.W.3d 800, 804 (Tenn. 2001).

[106] See Garza, supra note 8, at 601–02; Gurney, supra note 12, at 261 (“Because of the complexity of traditional automobiles, some courts hesitate to apply the consumer expectations test to most automotive accidents.”); but see Aubin v. Union Carbide Corp., 177 So. 3d 489, 493–94 (Fla. 2015) (applying consumer expectation test, rather than risk utility test, applied to design defect claim against asbestos manufacturer); Jackson, 60 S.W.3d at 806 (citing Cunningham v. Mitsubishi Motors Corp., No. C-3-88-582, 1993 U.S. Dist. LEXIS 21299, at *14 (S.D. Ohio June 16, 1993)) (“This Court is simply not willing to . . . preclud[e] the use of the consumer expectation test in a situation involving a familiar consumer product which is technically complex or uses a new process to accomplish a familiar function. Many familiar consumer products involve complex technology.”).

[107] See Garza, supra note 8, at 601–02; Gurney, supra note 12, at 261; but see Aubin v. Union Carbide Corp., 177 So. 3d 489, 493–94 (Fla. 2015) (applying consumer expectation test, rather than risk utility test, applied to design defect claim against asbestos manufacturer); Jackson, 60 S.W.3d at 806 (citing Cunningham v. Mitsubishi Motors Corp., No. C-3-88-582, 1993 U.S. Dist. LEXIS 21299, at *14 (S.D. Ohio June 16, 1993)).

 

[108] Corey Doctorow, The Problem with Self-driving Cars: Who Controls the Code?, Guardian (Dec. 23, 2015, 7:00 PM), https://www.theguardian.com/technology/2015/dec/23/the-problem-with-self-driving-cars-who-controls-the-code, https://perma.cc/LE5H-P5B9 (noting that the Trolley Problem was first posed by Philippa Foot).

[109] See Jared Newman, How to Make Driverless Cars Behave, Time (June 6, 2014), http://time.com/2837472/driverless-cars-ethics-morality/,https://perma.cc/ER8X-SWFM.

[110] See Zohn, supra note 10, at 464 (examining how civil liability will attach to autonomous vehicle accidents).

[111] Garza, supra note 8, at 595 (discussing the application of products liability law in accidents by autonomous vehicles).

[112] See How do elevators work, DiscoveryKids, http://discoverykids.com/articles/how-do-elevators-work/, https://perma.cc/RQ38-T9Z4 (last visited Apr. 15, 2017).

 

[113] See Kyle Colonna, Autonomous Cars and Tort Liability, 4 Case W. Res. J.L. Tech. & Internet 81, 93 (2012) (distinguishing between elevators and AVs, but concluding strict liability would apply to both).

[114] Zohn, supra note 10, at 483; see Willoughby v. Montgomery Elevator Co., 87 S.W.3d 509, 512 (Tenn. Ct. App. 2002); see also Cent. of Ga. Ry. Co. v. Lippman, 36 S.E. 202, 207 (Ga. 1900) (stating that common carriers usually cannot avoid liability for negligence).

[115] See Supervising Autonomous Cars, supra note 53, at 2.

[116] See Jerry Hirsch, 253 million cars and trucks on U.S. roads; average age is 11.4 years, L.A. Times (June 9, 2014), http://www.latimes.com/business/autos/la-fi-hy-ihs-automotive-average-age-car-20140609-story.html, https://perma.cc/7AL3-KFHC;

Rose Eveleth, A Map of Every Passenger Plane in the Skies at This Instant, Smithsonian Mag. (Sept. 17, 2012), http://www.smithsonianmag.com/smart-news/a-map-of-every-passenger-plane-in-the-skies-at-this-instant-39070996/, https://perma.cc/7HD7-F648.

 

[117] In fact, Elon Musk, co-founder of Tesla, predicted that human driving will be outlawed within twenty years. See Josh Lowensohn, Elon Musk: Cars You Can Drive Will Eventually be Outlawed, Verge (Mar. 17, 2015, 2:40 PM), http://www.theverge.com/transportation/2015/3/17/8232187/elon-musk-human-drivers-are-dangerous, https://perma.cc/FQA4-WVEY.

[118] See RAND, supra note 8, at xx.

[119] See Supervising Autonomous Cars, supra note 53, at 1.

[120] See id. at 1-2; Zohn, supra note 10, at 482 (arguing the elimination of “appeal of this product to elderly, disabled, or other individuals that would otherwise struggle with operating an automobile” is a necessary evil to assure a competent driver remains ready to take the wheel of an AV).

[121] See History of Seat Belts in the U.S., Bisnar Chase, http://www.bestattorney.com/auto-defects/defective-seatbelts/history-of-seat-belts.html, https://perma.cc/3FKY-Z42P (last visited Apr. 18, 2017).

 

[122] See Garza, supra note 8, at 603 (“While analogizing vehicle restraint and air bag statistics to OAVs is admittedly an apples-to-oranges affair, these statistics may be indicative of how the benefits of autonomous vehicle technologies are likely to be perceived.”).

[123] See generally Karinna Hurley, How Pedestrians Will Defeat Autonomous Vehicles, Sci. Am. (Mar. 21, 2017), https://www.scientificamerican.com/article/how-pedestrians-will-defeat-autonomous-vehicles/, https://perma.cc/FF3V-9E7P (discussing the implications of autonomous vehicles on pedestrians and traffic flow).
[124] Seatbelts and airbags rate a level 0, but cruise control rates at level 1 and adaptive cruise control at level 2. See Heaps, supra note 15, at 3-5.

[125] Cruise control is also a mechanical feature but a complex one that courts have had a mixed reaction over, allowing either consumer-expectation or risk-utility, leaning away from consumer expectation. See Garza, supra note 8, at 600–03.

[126] See Cohen, supra note 11, at 332. “Manufacturing defects claims in the autonomous vehicle context face a significant complication: courts have not applied the manufacturing defect doctrine to software because nothing tangible is manufactured. Because of this, a plaintiff will not be able to allege under a manufacturing defect theory that the software erred, rather the plaintiff will want to allege that the autonomous technology did not meet manufacturing specifications. This will be tricky for a plaintiff to do if the defect is really a software error (algorithm).” Gurney, supra note 12, at 259; see also Jessica S. Brodsky, Autonomous Vehicle Regulation: How an Uncertain Legal Landscape May Hit the Brakes on Self-Driving Cars, 31 Berkeley Tech. L.J. 851, 863–64 (2016) (discussing that because software is not a product “courts have used the economic loss doctrine to limit liability when an economic loss is suffered due to software failure but have also allowed tort actions to proceed when software glitches lead to actual physical harm.”).

[127] A “malfunction theory” which uses a “res ipsa loquitur like inference to infer defectiveness in strict liability where there was no independent proof of a defect in the product.” Garza, supra note 8, at 591.

[128] See id.

 

[129] “Some jurisdictions do not recognize the malfunction doctrine. Courts that do apply the doctrine hesitate to apply it to claims in a widespread fashion and typically require a showing of unique circumstances before applying it. When applying the doctrine to traditional vehicles, some courts require that the vehicle was relatively new and that the vehicle part was not repaired. An expert is usually required to show that the accident could not have been caused by anything other than the alleged defect. These limitations, along with the fact that some jurisdictions do not recognize the malfunction doctrine, limit the usefulness of the doctrine, making it difficult to apply for autonomous vehicles.” Gurney, supra note 12, at 260.

[130] See Garza, supra note 8, at 591–92; Gurney, supra note 12, at 260–61; Cohen, supra note 11, at 332–33.

[131] See Restatement (Third) of Torts: Prods. Liab. § 2 cmt. g (Am. Law Inst.1998) (“[C]onsumer expectations do not constitute an independent standard for judging the defectiveness of product designs.”).

[132] But see Gurney, supra note 12, at 261 (“Although autonomous technology could be considered complex,’ developing consumer expectations does not require knowledge of the complexity.”).

[133] It could be argued that other manufacturers are similarly situated without confusing consumers or courts. For example, cigarette manufacturers must place warnings on their products, all the while advertising and selling their wares. The effects of tobacco use are widely known, and even though manufacturers must now place a warning on their products, they were not the first decry the unhealthy effects of tobacco use. Conversely, the perils of AV use are not widely known (although they may be widely assumed by consumers, either accurately, or without any factual basis). Making AV manufacturers responsible for disseminating detrimental information about a fledgling technology (which carries substantial societal benefits) is therefore not akin to requiring cigarette makers place a warning on their product (which do not carry a substantial societal benefit)—which they did only after their addictive product was established in the marketplace, and after years of litigation. AV manufacturers would have little incentive to fully disclose potential risks, because even though doing so might allow manufacturers to present an assumption of risk defense, the defense would only extend to occupants of the AV, not to victims outside the AV, and courts often refuse to recognize this defense, instead lumping it in to a comparative negligence analysis. See Marchant & Lindor, supra, note 8, at 1336–37.

[134] See Gurney, supra note 12, at 262; Restatement (Third) of Torts: Prods. Liab. § 2(b) (Am. Law Inst.1998).

[135] See RAND, supra note 8, at xxii (noting AV technology would bring about a “decreased number of crashes and associated lower insurance costs”); see also Brookings, supra note 8, at 2 (noting AV technology would “increase safety on highways by reducing both the number and severity of accidents”).

[136] See Glancy, supra note 35, at 26 (“To the extent that such litigation does occur, it is likely to be technologically challenging and more than usually expensive”).

[137] See Brookings, supra note 8, at 8–9.

 

[138] See, e.g., Burden of Proving Feasibility of Alternative Safe Design in Products Liability Action Based on Defective Design, 78 A.L.R. 4th 154, *3.

[139] See Gurney, supra note 12, at 265–66.

[140] See Redbend white paper, supra note 26, at 2.

[141] See Owen, supra note 74, at 400 (discussing that state jurisdictions are split as to whether to admit into evidence subsequent remedial measures); see also Fed. R. Evidence 407; see also Christopher B. Mueller, Laird C. Kirkpatrick & Charles H. Rose., Evidence Practice Under the Rules 231 (3d ed. 2009) (“FRE 407 bars evidence of subsequent remedial measures to prove negligence, culpable conduct, product or design defects, or the need for a warning or instruction.”).

[142] See Gurney, supra note 12, at 257–58 (“[S]ince this analysis is focusing on Google Cars and crashworthiness is concerned with the structure and design of the vehicle, the analysis of a vehicle’s crashworthiness would be the same for a vehicle with autonomous technology and one without autonomous technology”).

[143] See Newman, supra note 109.

[144] See generally Nicholas Stringfellow, Law and the Problem of Autonomous Cars, Colum. Sci. & Tech. L. Rev. (Nov. 22, 2015), http://stlr.org/2015/11/22/law-and-the-problem-of-autonomous-cars/, https://perma.cc/93JP-6D99 (raising the issue that autonomous cars should be able to account for minimizing loss or injury when a crash is inevitable).

[145] See discussion infra Part IV.

[146] See Stringfellow, supra note 144; see also Jonathan O’Callaghan, Should a Self-Driving Car Kill its Passengers in a “Greater Good” Scenario?, IFLScience (Oct. 26, 2015), http://www.iflscience.com/technology/should-self-driving-car-be-programmed-kill-its-passengers-greater-good-scenario, https://perma.cc/L3P5-LCPC (reporting the results of Amazon’s Mechanical Turk, an online crowdsourcing tool, which presented respondents with a modern trolley car scenario: “on the whole, people were willing to sacrifice the driver in order to save others, but most were only willing to do so if they did not consider themselves to be the driver. While 75% of respondents thought it would be moral to swerve, only 65% thought the cars would actually be programmed to swerve”).

[147] See Stringfellow, supra note 144; see O’Callaghan, supra note 146.

 

[148]See Larsen v. General Motors Corp., 391 F.2d 495, 502 (8th Cir. 1968).

[149] See Jean-François Bonnefon, Azim Shariff & Iyad Rahwan, Autonomous Vehicles Need Experimental Ethics: Are We Ready for Utilitarian Cars?, ARXIV, at 10 (Oct. 13, 2015), http://arxiv.org/pdf/1510.03346v1.pdf, https://perma.cc/4ZTL-VVH3.

[150] See id. at 8; see also O’Callaghan supra note 146.

[151] See supra note 121 and accompanying text.

[152] See Colonna, supra note 113, at 93, 97, 99.

[153] See Nick Belay, Note, Robot Ethics and Self-Driving Cars: How Ethical Determinations in Software Will Require a New Legal Framework, 40 J. Legal Prof. 119, 129 (2015) (advising a legislative solution with a reasonableness standard).

[154] See Nat’l Highway Traffic Safety Admin., Event Data Recorders, 24, 28 (2006) (codified at 49 C.F.R. pt. 563), https://www.gpo.gov/fdsys/pkg/CFR-2011-title49-vol6/pdf/CFR-2011-title49-vol6-part563.pdf, https://perma.cc/Y3RE-MFP5.

[155] Garza, supra note 8, at 604; see also Marchant & Lindor, supra note 8, at 1333; see also Jeremy Levy, No Need to Reinvent the Wheel: Why Existing Liability Law Does Not Need to be Preemptively Altered to Cope with the Debut of the Driverless Car, 9 J. Bus. Entrepreneurship & L. 355, 381 (2016) (discussing a comparison of human drivers to AVs under a consumer expectation test).

[156] See U.S. Dep’t of Transp., Nat’l Highway Traffic Safety Admin., Fed. Automated Vehicles Policy, 1, 5 (2016).

 

[157] NHTSA has reserved the 5.9GHz spectrum for V2V (“vehicle-to-vehicle”) communication. Press Release, Nat’l Highway Traffic Safety Admin., Transportation Sec. Foxx Announces Steps to Accelerate Road Safety Innovation (May 13, 2015), https://www.nhtsa.gov/press-releases/transportation-sec-foxx-announces-steps-accelerate-road-safety-innovation, https://perma.cc/2YVK-SMNE.

[158] V2V communication systems use short range radio to “talk” to each other. The Department of Transportation estimates V2V will avoid 76% of roadway crashes. See Insurance Information Institute, supra note 36. But see RAND, supra note 8, at xx; see also Brachmann, IPWatchdog, supra note 8.

[159] See Marchant & Lindor, supra note 8, at 1339-40.

[160] See Zohn, supra note 10, at 477 (finding this flaw in applying the risk-utility test to self-driving cars); see also Paul A. Eisenstein, Driver Becomes ‘Co-Pilot’ in the Self-Drive Car, NBC News (Aug. 28, 2013, 11:17 AM), http:// www.nbcnews.com/business/driver-becomes-co-pilot-self-drive-car-8C11022532, https://perma.cc/2D6H-9ATN (discussing the Nissan Leaf autonomous vehicle being developed).

[161] But see Jeffrey K. Gurney, Crashing into the Unknown: An Examination of Crash-Optimization Algorithms Through the Two Lanes of Ethics and Law, 79 Alb. L. Rev. 183, 227 (2016) [Crashing into the Unknown] (stating that intent cannot be inferred from AV software for purposes of an intentional tort because, “certainly if the manufacturer had its choice, no one would ever be harmed by its car”); see also Nathan A. Greenblatt, Self-Driving Cars Will Be Ready Before Our Laws Are, IEEE Spectrum, (Jan. 19, 2016), http://spectrum.ieee.org/transportation/advanced-cars/selfdriving-cars-will-be-ready-before-our-laws-are, https://perma.cc/Z535-PDN9 (arguing for an application of ordinary negligence laws to AVs).

[162] Patrick Lin, The Ethics of Autonomous Cars, The Atlantic, (Oct. 8, 2013), https://www.theatlantic.com/technology/archive/2013/10/the-ethics-of-autonomous-cars/280360/, https://perma.cc/4VXY-XTDZ.

[163] See Levy, supra note 155, at 382 (“The burden of expert testimony in such cases evaluating the technology would also be high, and could result in challenges due to protection of trade secrets in scrutinizing a company’s technology.”); Crashing into the Unknown, supra note 161, at 236 (discussing how a safer crash-optimization algorithm would require various experts). Compare Chris Savoie, IoT, the Internet of Threats? Novel Liability Issues for Connected, Autonomous Vehicles and Intelligent Transportation Systems, 12 NO. 3 ABA SciTech Lawyer 12, 15 (Spring 2016) (stating that finding the reasonableness of a decision making matrix in AVs would involve complex expert testimony which would be confusing to jurors and expensive to litigants creating “a disincentive for lawyers to take on relatively small cases (small to the attorney but significant to the injured party)”), with Matt McFarland, Who’s responsible when an autonomous car crashes?, CNNTech, (Jul. 7, 2016, 2:00 PM), http://money.cnn.com/2016/07/07/technology/tesla-liability-risk/, https://perma.cc/9G2X-L3VE (stating that design defect litigation may open up new class action lawsuits brought by consumers alleging a design defect in AV software damages the resale value of the AV).

[164] See Cal. Code Regs. tit. 13, § 227.18 (2014). Most traffic codes do not have this requirement presumably because the traffic code was written for traditional vehicles possessing these features. However, in “California, Nevada, Michigan, and Florida, test drivers must be able to reassume immediate control at any time in the event of an AV failure or emergency, which requires two things: [1] There must be a driver’s seat with a steering wheel and pedals; [and] [2] The driver must be in the driver’s seat and monitoring safe operation at all times.” AV Team, Law Report, supra note 54, at 4; see also Nev. Rev. Stat. § 482A.060 (2013); Mich. Comp. Laws Serv. § 257.665(1) (2016) (LexisNexis 2016); Additionally, insurance policies require a driver remain at the ready. see HDI Gerling, supra note 51.

[165] See Zohn, supra note 10, at 478 (“All autonomous vehicles that are currently being designed have an emergency override switch that will enable drivers to manually take over driving should they feel it is necessary.”); Andrew R. Swanson, Comment, ‘‘Somebody Grab the Wheel!”: State Autonomous Vehicle Legislation and the Road to a National Regime, 97 Marq. L. Rev. 1085, 1091 (2014) (describing the override function on autonomous vehicles).

[166] See Robert Sykora, The Future of Autonomous Vehicle Technology as A Public Safety Tool, 16 Minn. J.L. Sci. & Tech. 811, 818 (2015) (“Kill-switch complications continued to vex insurers, however. Multiple occupants in a single AV created a ‘who’s in charge?’ confusion when each thought the other to have responsibility to hit the kill-switch. With no pedals and no wheel, there was no clear ‘driver’s seat,’ so actual responsibility remained somewhat ambiguous.”) Additionally, a “number of states already have statutes that impose liability on registered owners of run-away vehicles, which are often described in the statutes as ‘driverless vehicles.’ These ‘driverless car’ statutes impose liability on registered owners as presumed ‘drivers’. Since there may be no humans at all in autonomous cars used to transport only cargo, either these statutes or some form or vicarious liability may impose damages liability on either the autonomous car’s owner or its operator.” Glancy, supra note 35, at 27-28.

[167] “Allowing the operation of an autonomous vehicle without a driver aboard is risky this early in the development of the technology. While the goal may be to enable things like the parking of the vehicle after a human has been dropped off, there are many foreseeable situations in which the vehicle will incorrectly interpret road signs, parking-garage signs, or subtle communications with another driver in the tight quarters of a parking garage – all situations in which human intervention may be required. While these challenges are likely surmountable in the medium to long-term, regulators should be wary of allowing [autonomous vehicles] to operate without humans aboard in the near future.” AV Team, Law Report, supra note 54, at 21-22.

[168] See supra text accompanying notes 44, 120.

 

[169] See Zohn, supra note 10, at 482 (“[A]t least in the early years of this technology, it is reasonable to impose the expectation on autonomous cars to make sure the owners are using it responsibly.”); but see Glancy, supra note 35, at 4, (“It is unclear whether there will still be some form of dashboards, steering wheels, accelerator and brake pedals.”).

[170] See generally CAL. VEH. CODE § 38750(c)(1)(G) (2017) (requiring California to have crash data recorders for autonomous vehicles sold to the public with detailed requirements for their use, but not requiring them for testing); but see Nev. Rev. Stat. Ann. §482A.060 (2017) (requiring Nevada to have recorders on autonomous vehicles used for testing as well as autonomous vehicles offered for sale to the public); NHTSA Preliminary Statement, supra note 15, at 14 (stating that NHTSA recommends test vehicles have crash-data recorders); see also Dr. Sven A. Beiker, Legal Aspects of Autonomous Driving, 52 Santa Clara L. Rev. 1145, 1152 (2012) (proposing data recorders in AVs should be mandatory).

[171] See generally 2014 Crash Data, supra note 63 (reporting that over 32,000 people perished with human error being the critical factor 94% of the time).

[172] See Gurney, supra note 12, at 267-68 (discussing the applicability and weaknesses of this comparative-fault defense).

[173] See AV Team Law Report, supra note 54, at 11.

[174] See Matt McFarland, Here’s Volvo’s concept of a self-driving car’s interior, Wash. Post, (Nov. 18, 2015), https://www.washingtonpost.com/news/innovations/wp/2015/11/18/heres-volvos-concept-of-a-self-driving-cars-interior/?tid=ptv_rellink, https://perma.cc/JSY3-D8VL.

[175] See Jim Motavalli, Automakers Rethink Seats for Self-Driving Cars, N.Y. Times, (Jan. 15, 2015), http://www.nytimes.com/2015/01/16/automobiles/automakers-rethink-seats-for-self-driving-cars.html?_r=0, https://perma.cc/4AFU-Q6SG.

[176] See Stringfellow, supra note 144 and accompanying text.

[177] See Joel Achenbach, Driverless cars are colliding with the creepy Trolley Problem, Wash. Post, (Dec. 29, 2015), https://www.washingtonpost.com/news/innovations/wp/2015/12/29/will-self-driving-cars-ever-solve-the-famous-and-creepy-trolley-problem/, https://perma.cc/DC5K-LBPP.

 

[178] Id.

[179] See Matt Richtel & Conor Dougherty, Google’s Driverless Cars Run Into Problem: Cars With Drivers, N.Y. Times, (Sept. 1, 2015), http://www.nytimes.com/2015/09/02/technology/personaltech/google-says-its-not-the-driverless-cars-fault-its-other-drivers.html, https://perma.cc/3R3Y-QG8M.

[180] See Achenbach, supra note 177.

[181] See Statt, supra note 2.

[182] See Richtel & Dougherty, supra note 179.

[183] Stringfellow, supra note 144; Achenbach, supra note 177.

[184] See id.

[185] Stringfellow, supra note 144; See also Jonathan O’Callaghan, Should A Self-Driving Car Kill Its Passengers In A “Greater Good” Scenario?, IFLScience, (Oct. 25, 2015), http://www.iflscience.com/technology/should-self-driving-car-be-programmed-kill-its-passengers-greater-good-scenario, https://perma.cc/2SF9-JBQP (reporting the results of Amazon’s Mechanical Turk, an online crowdsourcing tool, which presented respondents with a modern trolley car scenario: “on the whole, people were willing to sacrifice the driver in order to save others, but most were only willing to do so if they did not consider themselves to be the driver. While 75% of respondents thought it would be moral to swerve, only 65% thought the cars would actually be programmed to swerve.”); see also Bonnefon, Utilitarian Cars, supra note 149.

[186] Supra note 150 and accompanying text.

[187] See e.g., Programming Safety into Self-Driving Cars, Nat’l Sci. Found. (Feb. 2, 2015), http://www.nsf.gov/discoveries/disc_summ.jsp?cntn_id=134033&org=IIS, https://perma.cc/MY8E-YBU8 (introducing algorithms designed to incorporate adequate safety controls in semi-autonomous vehicles).

[188] See e.g., Why Self Driving Cars Must be Programmed to Kill, MIT Tech. Rev. (Oct. 22, 2015), https://www.technologyreview.com/s/542626/why-self-driving-cars-must-be-programmed-to-kill/, https://perma.cc/3TF3-P96A (discussing findings that show “[p]eople are in favor of cars that sacrifice the occupant to save other lives—as long they don’t have to drive one themselves”).

[189] Achenbach, supra note 177. Notably, in 2016 Joshua Brown died when his Tesla autopilot system failed to recognize a tractor-trailer turning in front of his Model S and collided. The NHTSA is investigating the incident, but there has been no indication that this fatal crash has stymied demand for AVs. See Matt McFarland, Who’s responsible when an autonomous car crashes?, CNNTech (Jul. 7, 2016, 2:00 PM), http://money.cnn.com/2016/07/07/technology/tesla-liability-risk/, https://perma.cc/U2XX-9M45.

[190] This defense may also apply to claims of design defect as to the algorithm itself. A plaintiff could allege that the algorithm could have been written better, but the manufacturer could argue that assessing a new risk that precipitates the accident was technologically infeasible at the time. See Gurney, supra note 12, at 269.

[191] See Redbend White Paper, supra note 21 and accompanying text.

[192] See Pröckl, Självkörande bilar, supra note 8, at 4-5 (discussing how AVs can be hacked).

[193] See id.

[194] See RAND, supra note 8, at xxi. “Telematics is a general term that refers to any device which merges telecommunications and infomatics. Telematics includes anything from GPS systems to navigation systems. It is responsible for many features in vehicles from OnStar to hands free mobile calling.” What is Telematics?, Telematics (last visited Apr. 18, 2017), http://www.telematics.com/uses-of-telematics-technology/, https://perma.cc/K5MU-3XUP [hereinafter Telematics].

[195] V2V communication systems use short range radio to “talk” to each other. The Department of Transportation estimates V2V will avoid 76% of roadway crashes involving at least one light vehicle. See NHTSA, Frequency of Target Crashes for IntelliDrive Safety Systems, 1, 6 (2010), https://www.nhtsa.gov/DOT/NHTSA/NVS/Crash%20Avoidance/Technical%20Publications/2010/811381.pdf,. https://perma.cc/UD89-MM2N; but see RAND, supra note 8, at xx; see also AV Team Law Report, supra note 54, at 14-21.

[196] RAND supra note 8, at 75.

[197] Id.

[198] Nat’l Highway Traffic Safety Admin., V2V Fact Sheet, http://www.safercar.gov/v2v/index.html, https://perma.cc/2AXT-6RVW (last visited Apr. 11, 2017).

[199] Id.

[200] See id.

[201] Id.

 

[202] RAND supra note 8, at 76.

[203] Id. at 75.

 

[204] Nathan Bomey, Self-driving Car Leaders ask for National Laws, USA Today, (March 15, 2016, 10:27 PM), http://www.usatoday.com/story/money/cars/2016/03/15/google-alphabet-general-motors-lyft-senate-commerce-self-driving-cars/81818812/, https://perma.cc/V5XZ-ELQU.

[205] Id.

[206] See BI Intelligence, NHTSA releases self-driving car guidelines, Bus. Insider, (Sept. 21, 2016, 2:24 PM), http://www.businessinsider.com/nhtsa-releases-self-driving-car-guidelines-2016-9, https://perma.cc/S2E6-9428.

 

[207] See id.

[208] See Press Release, US urged to establish nationwide Federal guidelines for autonomous driving, Volvo Car Group (Oct. 7, 2015), https://www.media.volvocars.com/global/en-gb/media/pressreleases/167975/us-urged-to-establish-nationwide-federal-guidelines-for-autonomous-driving, https://perma.cc/5N85-D5UM [hereinafter Volvo Press Release]; see also Kirsten Korosec, Volvo CEO: We will accept all liability when our cars are in autonomous mode, Fortune (Oct. 7, 2015, 3:34 PM), http://fortune.com/2015/10/07/volvo-liability-self-driving-cars/, https://perma.cc/GK49-8TWP.

[209] See Volvo Press Release, supra note 208.

[210] Id.

[211] Id.; see Korosec, supra note 208.

[212] See Gurney, supra note 12, at 272 (stating that manufacturers could “adjust the price of the autonomous vehicles to compensate them for the cost of liability”).

[213] See id. at 273 (stating that “[p]eople would probably be willing to pay more for autonomous cars knowing that the manufacturer will be liable for accidents caused while the vehicle is in autonomous mode”).

[214] See Mark Harris, Why You Shouldn’t Worry About Liability for Self-Driving Car Accidents, IEEE Spectrum (Oct. 12, 2015 8:00PM), http://spectrum.ieee.org/cars-that-think/transportation/self-driving/why-you-shouldnt-worry-about-liability-for-selfdriving-car-accidents, https://perma.cc/2YHZ-LAVP.

[215] See Alexander Hars, Volvo’s liability promise for autonomous mode may cut out insurance companies and independent repair shops, Driverless car market watch (Oct. 24, 2015), http://www.driverless-future.com/?p=856, https://perma.cc/Q5AM-EYV4 [hereinafter Volvo’s liability promise].

[216] See Marchant & Lindor, supra note 8, at 1331.

[217] See id. at 1338.

[218] One critique of total preemption is that it may lead to victims subsidizing corporations. See Christopher B. Dolan, Self-Driving Cars & the Bumpy Road Ahead, Trial (February 2016), https://www.justice.org/what-we-do/enhance-practice-law/publications/trial-magazine/self-driving-cars-and-bumpy-road-ahead, https://perma.cc/D6J8-JQ3T.

[219] See Sophia H. Duffy & Jamie Patrick Hopkins, Sit, Stay, Drive: The Future of Autonomous Car Liability, 16 SMU S Ci. & Tech. L. Rev. 453, 479 (2013) (arguing that negligent driving can, in effect, be eliminated by autonomous cars).

[220] See RAND, supra note 8, at xxii (asserting that Congress could preempt state tort law to limit manufacturer liability, or in the alternative create an non-rebuttable presumption of human control in AVs); see also Marchant & Lindor, supra note 8, at 1338-39 (discussing preemption of state tort action by the Federal Motor Vehicle Safety Standards).

[221] See generally RAND, supra note 8 (listing numerous benefits of autonomous vehicles).

[222] See Adrienne LaFrance, Self-Driving Cars Could Save 300,000 Lives Per Decade in America, Atlantic (Sept. 29, 2015), http://www.theatlantic.com/technology/archive/2015/09/self-driving-cars-could-save-300000-lives-per-decade-in-america/407956/?utm_source=SFTwitter, https://perma.cc/F63V-QKZH; see also Morbidity and Mortality Weekly Report, CDC (May 20, 2011), http://www.cdc.gov/mmwr/preview/mmwrhtml/mm6019a5.htm, https://perma.cc/C8UF-PTK9.

[223] See LaFrance, supra note 222.

[224] See Insurance Information Institute, supra note 36.

[225] See generally Schroll, supra note 51 (utilizing the metaphor “splitting the bill” to describe a national car insurance fund to pay for accidents involving AVs).

[226] See id.; see generally Sophia H. Duffy & Jamie Patrick Hopkins, Sit, Stay, Drive: The Future of Autonomous Car Liability, 16 SMU S Ci. & Tech. L. Rev. 453 (2013); see Garza, supra note 8; see Marchant & Lindor, supra note 8, at 1327-28; see generally Julie Goodrich, Comment, Driving Miss Daisy: An Autonomous Chauffeur System, 51 Hous. L. Rev. 265, 269-70 (2013).

[227]See Schroll, supra note 51, at 810.

[228] Id. at 822.

[229] See Volvo’s liability promise, supra note 215.

[230] See Achenbach, supra note 177.

 

[231] See id.