While auditing a few web apps and websites I uncovered a few serious vulnerabilities which I've since flagged (responsibly, of course). One of the things I noticed was that several development companies had worked on parts of this application and that got me thinking. In the event of a security breach or data leak, who's ultimately responsible for that? I'm UK based so I'm going to refer to UK law here but I'm sure the same could apply in your region.

I'm not talking about cases where dev studios have contracts that absolve them from any vulnerabilities but more in cases where no contract is in place between the developer(s) and the business. For example, one particular application was vulnerable to SQL injection and was worked on by a very junior developer. It's a public facing app, so loads of juicy customer data was stored in the database.

If the database was breached and private customer data exposed, this would constitute a breach of the Data Protection Act 1998. Who's ultimately responsible for that breach? The business as they're the one providing the service? The developer as they're the one that introduced the flaw that allowed access (knowingly or otherwise)? The third party dev company for providing the work? While the business should be ultimately responsible in my opinion for the safety of the customer data, it could be argued that somebody broke the Computer Misuse Act 1990 by introducing a vulnerability knowingly or unknowingly allowing the application to become compromised. My question is it only the business that'd be in the firing line, or would the developers be too?

Also attribution must be considered. If a senior dev picks up the script above, makes changes and doesn't do due diligence to check for vulnerabilities, does that make them now responsible rather than the original developer, or are they both now in the firing line.

Just to clarify - I'm not looking for hard legal advice here, but it's worth asking the question of responsibility.

closed as off-topic by Jens Erat, TildalWave, RoraΖ, Xander, schroeder Jan 15 '15 at 18:22


  • "This question does not appear to be about Information security within the scope defined in the help center." – Jens Erat, TildalWave, RoraΖ, Xander, schroeder

  • 3
    Even the question of responsibility is a legal one. In terms of accidents, any exploit is a consequence of a system of several defects in organization and technology. – Deer Hunter Jan 15 '15 at 11:09

IANAL - I would guess that the business would be liable for the data protection breach since they would usually be the ones in control of the data before its input/uploaded to the system. If they could show that the breach was due to a security failure in the software, they would probably be in a good position to sue the development company for any losses since it would have been their proffessional negligence that caused the breach.

Whether the individual developer that worked on it was junior/senior does not really matter since its the development company that would be the legally responsible entity. Of course the development company could then choose to take disciplinary action against its employee if they find them to be responsible, but I don't think that would have any connection to the legal responsibility (this may be different for the case of company directors and companies without limited liability).

  • I agree. The point of the junior/senior differential was to highlight the attribution problem mainly. Example - junior solo dev develops script, senior solo dev adds to that script but the two work for themselves and are separate. – ScottMcGready Jan 15 '15 at 11:34
  • 1
    I agree too. If the senior dev perceives that that part of the code that he was tasked of changing has security vulnerabilities, it is his duty to correct them, or if he doesn't have the time to do that (tight schedule), to warn his manager or whoever has the responsibility to alert the appropriate people. – DarkLighting Jan 15 '15 at 12:34
  • Whoops, missed a bit - was meaning more if they overlook it (either incompetence or oversight) but still a good response. – ScottMcGready Jan 15 '15 at 13:01

Personal view on this (law might be different):

At the end of the day the business will be responsible in case of a breach or data leak. The main reason behind it is that the business is the one that it is storing the data and other important information and not the development company. This applies if there's no specific contract in place that states that all security exploits have to be patched by the development company.

Some development companies will say that they will fix all the security issues that they find in the code when the code is delivered. What about exploits that become public / known after the code was delivered? If there is no contract in place with the developer it's up to you to maintain the code and this also includes security maintenance.(Making sure you are patched against the latest threats)

In terms of attribution, that's a very interesting topic because security shouldn't fall only on the shoulders of the developers. They are very busy fixing all kinds defects adding requirements already, do you really want them to become your security experts too and find flaws from code written by others before them? My answer for this is: Don't put developers in charge of security. Make them security aware and have someone else to continuously check and address security issues in the applications.

Final answer: 1. Business is responsible for in case of a data leak or security breach. Blaming it on the developers would just reflect the fact that there is no proper security programme in place.
