Why Self-Driving Cars Must Be Programmed to Kill