Tort law provides awards of punitive damages for reasons of deterrence and retribution. In light of a recent decision by the U.S. Supreme Court in Phillip Morris USA v. Williams, the retributive rationale for punitive damages will inevitably come under heightened scrutiny. The case involves a punitive award of $79.5 million, which is ninety-seven times greater than the compensatory damages, making it constitutionally suspect for exceeding the single-digit ratio between punitive and compensatory damages. The Court, though, has never addressed the constitutional issue in a case involving serious bodily injury or death, and so Williams poses a number of new questions. How can compensatory damages provide an appropriate baseline for evaluating punitive damages in a case of wrongful death, given that monetary damages provide no compensation to a dead person? What is the appropriate baseline? Any future deterrence provided by a punitive award cannot protect the decedent’s tort right, and so the award must be justified exclusively in terms of retribution. Is retribution inherently subjective and arbitrary, unless constrained by some objective measure such as the single-digit ratio between the punitive and compensatory damages? Or is there some way to translate retribution into dollars? These questions are not limited to wrongful death cases and must be resolved by any court trying to determine whether a punitive award is unconstitutional for exceeding the single-digit ratio. These questions can all be answered once retribution is tied to the inherent limitations of compensatory damages, which yields a method for quantifying this form of punitive damages. Based on government data and methodology for quantifying the social cost of a premature death, this method shows why vindication of the decedent’s tort right in Williams justifies the $79.5 million punitive award. When formulated in this manner, vindictive damages satisfy the requirements of both substantive and procedural due process and provide a baseline for reviewing courts to determine whether any given punitive award, like one based on general deterrence, is excessive in violation of substantive due process. This method fully accounts for the reprehensibility factors that determine the constitutionality of a punitive award, while also explaining why the Court could defensibly rely on procedural due process to reverse and remand Williams back to state court.

In January 2003, the Slammer worm hit the Internet. Five of the Internet’s thirteen root-name servers shut down. Three hundred thousand cable modems in Portugal went offline, all of South Korea’s cell phone and Internet services went down, and Continental Airlines cancelled flights from its Newark hub due to its inability to process tickets. It took only six months after the disclosure of a security flaw for a virus writer to write the 376 byte virus. When it unleashed, it took ten minutes to infect ninety percent of vulnerable systems.

The flaw was a buffer overflow in the Microsoft SQL Server 2000 software. Because the code is embedded in other Microsoft products, not all users were even aware that their systems were running a version of SQL Server. Unfortunately, this was a well-known, preventable security flaw. Moreover, Microsoft had released a patch for the flaw exploited by Slammer six months before the attack. Despite the widespread effects, no flood of lawsuits ensued.

A defining problem of the Information Age is securing computer databases of ultrasensitive personal information. These reservoirs of data fuel our Internet economy but endanger individuals when their information escapes into the hands of cyber-criminals. This juxtaposition of opportunities for rapid economic growth and novel dangers recalls similar challenges society and law faced at the outset of the Industrial Age. Then, reservoirs collected water to power textile mills: the water was harmless in repose but wrought havoc when it escaped. After initially resisting Rylands v. Fletcher’s strict-liability standard as undermining economic development, American courts and scholars embraced it once the economy matured and catastrophes such as the Johnstown Flood made those hazards impossible to ignore.

Public choice analysis suggests that a meaningful public law response to insecure databases is as unlikely now as it was in the early Industrial Age. The Industrial Age’s experience can, however, help guide us to an appropriate private law remedy for the new risks and new types of harm of the early Information Age. Just as the Industrial Revolution’s maturation tipped the balance in favor of early tort theorists arguing that America needed, and could afford, a Rylands solution, so too the Information Revolution’s deep roots in American society and many strains of contemporary tort theory support strict liability for bursting cyber-reservoirs of personal data instead of a negligence regime overmatched by fast-changing technology. More broadly, the early Industrial Age offers valuable lessons for addressing other important Information Age problems.

“Duty” occupies an odd place in contemporary negligence law. On the one hand, it is hornbook law that duty – along with breach, actual and proximate cause, and injury – is one of the elements of a plaintiff’s prima facie case. As the first element of a plaintiff’s case – and the only element whose existence is a matter of law for the court – duty seems to stand out even among the elements of the prima facie case. If a plaintiff cannot establish that the defendant was under a duty to exercise at least some care to ensure that its actions did not impose an unreasonable risk of injury on the plaintiff, then we need not ask if the defendant breached its duty of care and if that breach was the actual and “proximate” cause of the plaintiff’s injury. Duty, in short, seems important.

From 1950 to 1980 the California Supreme Court set as one of its main tasks the project of modernizing negligence law. This program had two main facets. With respect to substantive doctrine, the court sought to purge what it regarded as vestiges of politically regressive common law, particularly limited-duty or “no duty” rules that governed premises liability claims, nonphysical harm claims, and claims alleging nonfeasance. In terms of method, the court adopted and advocated an antiformalist, reductively instrumentalist approach to judicial decisionmaking.