10 ms·
Two things can be true at the same time. In this case, that the malware authors are responsible, and that the hospital/management were negligent. Negligent cir
by Someone1234 6y ago
Two things can be true at the same time. In this case, that the malware authors are responsible, and that the hospital/management were negligent.
Negligent circumstances seems controllable, whereas having no bad actors in the world (particularly the international world, including rogue states) seems nearly insurmountable.
Every time this happens, I'm going to keep saying the same thing: Management let this happen. The dangers are known, the risk mitigation is known, and their failure to act is tantamount to negligence. This didn't "have" to happen, they allowed it to happen.
But as I said at the start: Two things can be true at the same time, management's negligence let someone die and the malware authors are responsible for the death.
- nomoreusernames 6y agowhile i wholeheartedly understand your point. i would ask you to keep in mind that not even nurses are paid what they should. IT is not getting any money before them. i dont know who does the IT stuff but ill give them the benefit of the doubt that they have their hands full? or am i naive?
- burrows 6y agoHow does one calculate the amount someone “should” be paid?
- alextheparrot 6y agoThere’s a distinction between blaming the front-line staff and the management/hospital as an entity. The likely argument is that it is the management’s role to ensure the IT department is staffed appropriately.
- Someone1234 6y agoThat's why I never placed blame on IT. This is a management problem, not an IT problem, front line staff do as they've told. It is management's responsibility to assess the risks and to decide where money should be spent (in this case on patient critical infrastructure). To use another poster's example: It is like them failing to upkeep their sprinkler system and part of the hospital burning down.
- leetcrew 6y agoisn't median wage for a nurse somewhere around $35/hr? this is around the 75th percentile for income in the US, assuming they work forty hours a week.
- mullingitover 6y agoI look at it like this: if the hospital were being extorted by arsonists, we wouldn't be standing around blaming the architect of the hospital for using wood in its construction as the hospital burned.
- alextheparrot 6y agoA counter-equivalence could be that banks build vaults, because they understand the importance of what they hold. I see your point, but it isn’t as clean as stated.
- ceejayoz 6y agoYou might criticize the builders if the hospital had no sprinklers or smoke alarms, though.
- watwut 6y agoThose are regulated amd everyone who builds building knows. Especially in Germany. Software industry hates idea of regulation.
- deleted 6y ago[deleted]
- heavyset_go 6y agoThis doesn't absolve the owners from running a hospital that doesn't meet fire code, however.
- eunos 6y agoThen do we have IT code? Pun not intended.
- throwaway894345 6y agoNot sure about Germany, but in the US we have HIPAA which sets security standards (physical and electronic) that everyone in the healthcare industry must meet.
- longtom 6y agoInfrastructure only gets second or third grade people, especially in Germoney. The best go to the U.S. as the lower taxes ensure highest bang for the IQ. The next best go into some of the hyped and promising fields like AI. The lowest tier does local infrastructure with minimal reach and prestige in a globalist, centralized world.
- umvi 6y ago> Two things can be true at the same time Heck, three things can be true at the same time. For example, in the Uber self-driving car death: - uber's safety systems failed to recognize a human in the road - the backup human driver failed to pay attention - the woman in the middle of the street failed to pay attention There can be N failures that all contributed to a given disaster, and it's important to consider all points of failure which can be mitigated in the future, not just the most controversial point of failure.
- pooper 6y ago> There can be N failures that all contributed to a given disaster, and it's important to consider all points of failure which can be mitigated in the future, not just the most controversial point of failure. For the Uber thing, what incentive does the management have to do the right thing?
- nickff 6y agoMoney damages, potential criminal lawsuits, and reputational harm which is real and costly (though I know HN is skeptical of it).
- pintxo 6y agoFunny that being ethical and prioritizing to not do harm is not on the list.
- nickff 6y ago'Prioritizing to not do harm' is an ethical consideration, and ethics are subjective, so I didn't consider them 'incentives'. If the question had been about 'motives' or 'considerations', I would have included 'potential ethical beliefs'.
- warent 6y agoThe reason why is that presenting facts and concrete logic is more compatible with a greater array of people, whereas ethics and morals are subjective. Using a moral argument is not going to be as persuasive in business (particularly if, generally speaking, leadership is largely comprised of sociopaths, which is just a reality of this world)
- amelius 6y agoThree things: Bitcoin allowed malware authors to have a viable business model. Technology isn't neutral. The world is too complicated to hide behind that argument. We must think about the consequences of the things we build.
- mormegil 6y agoScott Alexander: > The latest development in the brave new post-Bitcoin world is crypto-equity. At this point I’ve gone from wanting to praise these inventors as bold libertarian heroes to wanting to drag them in front of a blackboard and making them write a hundred times “I WILL NOT CALL UP THAT WHICH I CANNOT PUT DOWN” https://slatestarcodex.com/2014/07/30/meditations-on-moloch/ https://slatestarcodex.com/2014/07/30/meditations-on-moloch/
- Hermel 6y agoThanks for the link. Very interesting. Fortunately, Scott is wrong on this. Crypto does not only subvert old forms of coordination, it also allows new forms of coordination. Whether this will is a net win remains to be seen.
- driverdan 6y agoThat's like saying cash enabled drug and arms trade, or that encryption enables terrorists to communicate. Cash, Bitcoin, and encryption are neutral technologies that can be used in negative ways.
- amelius 6y agoAnalogies are usually not the correct way to proceed in an argument. Let me quote from [1]: > Weak analogy > Definition: Many arguments rely on an analogy between two or more objects, ideas, or situations. If the two things that are being compared aren’t really alike in the relevant respects, the analogy is a weak one, and the argument that relies on it commits the fallacy of weak analogy. > Example: “Guns are like hammers—they’re both tools with metal parts that could be used to kill someone. And yet it would be ridiculous to restrict the purchase of hammers—so restrictions on purchasing guns are equally ridiculous.” While guns and hammers do share certain features, these features (having metal parts, being tools, and being potentially useful for violence) are not the ones at stake in deciding whether to restrict guns. Rather, we restrict guns because they can easily be used to kill large numbers of people at a distance. This is a feature hammers do not share—it would be hard to kill a crowd with a hammer. Thus, the analogy is weak, and so is the argument based on it. In this case the distinction between cash and Bitcoin is exactly what enables criminals to benefit from their crimes. [1] https://writingcenter.unc.edu/tips-and-tools/fallacies/ https://writingcenter.unc.edu/tips-and-tools/fallacies/
- trash3 6y agoIn this context, the malware hackers are probably going to save lives in the future by setting a modern precedent for negligence at hospitals and it systems will be updated. Surely they should be patted on the back for such efforts?
- deleted 6y ago[deleted]
- CivBase 6y agoHere's a simple analogy: You buy a sprinkler system from Acme. Acme cheaps out and installs defective sprinklers. An arson lobs a molotov cocktail through your window to set your house on fire, but the sprinklers fail and your house burns down as a result. The arson caused the fire, but Acme is simultaneously responsible for the defective sprinklers. The analogy breaks down in the context of the law (as most analogies seem to) because in this case the hospital was not explicitly selling you a product to protect against hackers. However, I think it stands up from a purely ethical point of view.
- baddox 6y agoIt's pretty easy to establish the malware attackers' responsibility. But the extent of the hospital's responsibility is much harder to establish, especially across all types of potential attacks. Basically, it's not easy to establish precisely which types of attacks a hospital needs to be prepared for in order for them to not be considered negligent. In this case, I don't see many details, but it does sound like they simply couldn't access patient data and thus were transferring patients. I find it hard to believe that they couldn't have continued to provide emergency treatments that don't require networked computerized machinery. But I'd want to know more about the attack before I could conclude that the hospital was negligent. Surely for every hospital there is some attack with sufficient sophistication to disrupt service at the hospital.
- kbenson 6y agoWell, the article notes: Even attacks that target patient data, and don’t directly impact medical devices, can hurt patient outcomes: one study found that a hospital’s death rate from heart attacks goes up in the years after a data breach. That’s probably because hospitals have to divert resources to respond to the attack or upgrade software in a way that changes how doctors operate. There are tough choices to be made here. An attach that spurs them to divert resources to security causing deaths means that diverting resources to security before the breach would cause deaths also. Knowing exactly how much to spend on things other than patient care is tricky. We can say they were negligent because they didn't spend the money, but there weren't any attributable deaths yet, so they would have been spending money with an idea it would probably cause some adverse patient outcomes and not knowing if it was actually needed. That's a hard position to be in.