Rosemary Rivas, a partner at Gibbs Law Group leading the class-action investigation on behalf of small businesses — both CrowdStrike customers and those indirectly affected by the outage — declined to comment on the challenges posed by CrowdStrike’s terms and conditions, saying only that the firm is “speaking to a wide range of businesses” as part of its investigation.
Meanwhile, businesses without a direct contractual relationship with CrowdStrike, while unaffected by the restraint clause, “probably wouldn’t have a claim in the first place,” McMahon says. They won’t be able to sue for breach of contract because there isn’t one. They also could not sue for negligence because the relevant laws only apply to bodily injury or property damage, not economic loss.
CrowdStrike’s situation, MacMahon says, is similar to that of the company whose container ship destroyed a bridge in Baltimore in March. While the collapse would have been costly for any business that would have otherwise used the bridge, the losses are purely financial – and likewise for the businesses disrupted by the IT outage in July. “They have no pretensions, I’m sure,” says McMahon.
However, the various barriers will not prevent lawsuits against CrowdStrike, experts say, given the extent of the financial losses. There are several landmark lawsuits that are testing the types of liability limitations included in software contracts, says Brian Fox, chief technology officer at software supply chain company Sonatype, creating an opportunity for CrowdStrike clients to challenge them. “This could be a watershed moment,” he says.
“The fun and challenge of law is that you and I can negotiate a contract in which I exclude [from liability] everything under the sun, but you don’t know if it’s going to work until you find out in court,” McGrath says. “It’s possible for a court to decide that what you agreed to in the contract is simply not allowed within the confines of the law in a given jurisdiction.”
There are also separate reasons why an organization may take legal action. In the very public back-and-forth between Delta and CrowdStrike, for example, there may be an element of posturing, McGrath says. “Whatever game you play through litigation, sometimes it’s about making sure you get the remedy you think you’re due. But sometimes it’s about PR and publicity. I suspect that there is a careful discussion in large commercial companies about which of the two imperatives is more pressing.’
