&gt; Specific security regulation is not necessary, because the solution is simple: liability<p>That would be simple if companies weren&#x27;t able to lawyer up and weasel out of any and all liability that doesn&#x27;t come with explicit standards required by ... regulation.  What makes the definition of &quot;defective&quot; vs &quot;not defective&quot; in determining liability is regulation.  Regulations don&#x27;t have to be &quot;fine X will be levied if Y&quot; it can be &quot;Y is required for product Z&quot;.  That is regulation and it is how we define liability in the legal system.  What you are proposing -- establishing bad design -- is the basic definition of regulation.