You are not bound by a contract you are not a party to
So, in general, an agreement between two parties to limit one's liability to the other will have no effect on another person's cause of action.
However, ...
Almost all such claims will be founded in the tort of negligence, which requires, among other things, that the defendant:
- owes a duty of care to the plaintiff, and
- that they breached their duty.
The terms on which they offer their goods and services to their customers may be relevant to both issues.
There are well-established classes of people to whom a duty of care is owed - for example, drivers owe a duty of care to other road users. However, in the CrowdStrike circumstances, "the customers of my customers" are not such a class in general.
Each common law jurisdiction has its own case law to establish who owes a duty of care to whom, but the legal test set out in the English case of Caparo Industries PLC v Dickman [1990] UKHL 2 is illustrative of the general approach:
- harm must be reasonably foreseeable as a potential result of the defendant's conduct (as established in Donoghue v Stevenson),
- the parties must be in a relationship of proximity, and
- it must be fair, just and reasonable to impose liability.
The US position that someone who has suffered only economic loss cannot recover in negligence is a manifestation of the last two points - there is not sufficient "proximity", and it's not "fair, just and reasonable" to hold tortfeasors responsible for losses that are not physical. Even in jurisdictions where such recovery is possible (like England), showing that a duty of care exists is much harder in cases of pure economic loss.
The duty owed is what a reasonable person in the defendant's position would do to minimize or eliminate the harm their acts and omissions can cause.
The terms in their contracts with their customers are relevant because they go to the foreseeability of both who might be affected and the harm that they might suffer. For example, the CrowdStrike terms say:
The offerings and CrowdStrike tools are not fault-tolerant and are not designed or intended for use in any hazardous environment requiring fail-safe performance or operation. Neither the offerings nor crowdstrike tools are for use in the operation of aircraft navigation, nuclear facilities, communication systems, weapons systems, direct or indirect life-support systems, air traffic control, or any application or installation where failure could result in death, severe physical injury, or property damage.
That means that people who might be affected by the customer's misuse of the product in those circumstances are not people that CrowdStrike could reasonably foresee as being affected - because they're not supposed to be in the firing line for the product. This is similar to where a manufacturer of a truck rated for a 2-tonne load would not be liable if the truck failed and injured someone while loaded to 3 tonnes.
In circumstances where there was a more foreseeable risk, say, software running medical diagnostic or treatment machines, an attempt to argue that the patients were not someone to whom a duty of care was owed would fail - they are self-evidently going to be affected by any software failure. Contract clause that amount to " we're not responsible if the thing doesn't do the thing its explicitly meant to do" are not going to help here.
