8 ms·

I look at it like this: if the hospital were being extorted by arsonists, we wouldn't be standing around blaming the architect of the hospital for using wood in

I look at it like this: if the hospital were being extorted by arsonists, we wouldn't be standing around blaming the architect of the hospital for using wood in its construction as the hospital burned.

alextheparrot 6y ago
A counter-equivalence could be that banks build vaults, because they understand the importance of what they hold. I see your point, but it isn’t as clean as stated.
ceejayoz 6y ago
You might criticize the builders if the hospital had no sprinklers or smoke alarms, though.
- watwut 6y ago
  Those are regulated amd everyone who builds building knows. Especially in Germany. Software industry hates idea of regulation.
deleted 6y ago
[deleted]
heavyset_go 6y ago
This doesn't absolve the owners from running a hospital that doesn't meet fire code, however.
- eunos 6y ago
  Then do we have IT code? Pun not intended.
  - throwaway894345 6y ago
    Not sure about Germany, but in the US we have HIPAA which sets security standards (physical and electronic) that everyone in the healthcare industry must meet.
    - Jtsummers 6y ago
      A lot of times these standards can be satisfied by relatively simple mechanisms like access control lists which prevent legitimate users from performing illegitimate actions (like a nurse or doctor shouldn't be able to pull up any patient record) paired with extra-technological controls like stating that only the listed non-medical personnel can access a particular patient's records (like adding your spouse or parents as valid recipients of test results and health status information). These do nothing to actually ensure the security of the system with regard to external actors. Additionally, you can often satisfy these things with policy statements rather than technological solutions. A weekly review of record access reports may satisfy in some cases, without needing to implement an ACL mechanism.
    - AdmiralAsshat 6y ago
      People generally don't die as a result of failure to meet HIPAA standards, though. To boot, HIPAA covers security standards for the protection of PII--it doesn't cover security standards for network intrusion.
      - ceejayoz 6y ago
        Preventing network intrusion seems pretty critical to protect PII.
        slowmovintarget 6y ago
        Someone can be on the network and fail to crack encrypted data and you'd be in compliance. HIPAA is only about information leaks, not about operational health.
  - Jtsummers 6y ago
    No, not in the general sense. Only for specific kinds of data/applications (mostly centered around securing PII, health data, and the like). But the general IT infrastructure has no foundational standard we require people to achieve. And after about 60 years of IT, I don't know that we ever will. Efforts to certify systems/processes are often bogus (participate in a CMMI appraisal for a good example of this). Legitimate efforts to certify them are drowned out by the charlatans. And very few in the IT industry would desire personal certifications along the lines of PEs. Either they don't want the legal and financial liability, or they truly believe there's no value in it.
    - FpUser 6y ago
      Except for very specific areas (security of vital systems in general) I believe the ability of Subject A to deliver service (including making software) to a Subject B should be strictly a business between consenting adults (bar tax reporting). We are supposed to be a "free" world.
      - Jtsummers 6y ago
        I can mostly agree with this sentiment, but care has to be taken when the system involves people who aren't party to the design decisions, but whose information is stored within the system.
  - Jon_Lowtek 6y ago
    Yes Germany has both general IT guidelines and specific codes for hospitals. Also high levels of IT security are required by law for hospitals. And those standards, guidelines and analysis of industry sector typical problems are made publicly available by a government agency funded with tax money. However: Despite a law being in place since 2015 many hospitals are still underdeveloped when it comes to IT and IT security in particular.
    - linuxftw 6y ago
      Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. "We met all the standards, we shouldn't be accountable." If the brakes go out on your care, and you smash into a building, even though it was recently serviced to whatever 'standards' are you liable? Yes. And then it will be up to you to pursue the manufacturer of the car, who will claim they met all standards, so they're not liable. See how it works?
      - Majromax 6y ago
        > Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. And that's important. You have to have some place to draw the line between "we did nothing and we're all out of ideas" and "what do you mean you didn't write your own operating system from scratch and hire fifteen security experts to continuously analyze it for un-patched zero-day exploits?" That's where industry standard "best practices" come in. Once some sort of standard is issued (by regulation) or accepted (by industry), it becomes the thing that a Reasonable Person does. Meeting that standard is then usually sufficient to avoid charges of (or additional liability for) negligence. > If the brakes go out on your car, and you smash into a building In this case, you're liable because you carry strict liability for your actions as a driver. However, proof that you've kept the car in working order would be sufficient to escape any criminal charges (dangerous operation of a vehicle, for example)
      - Jon_Lowtek 6y ago
        I would need to give you a very deep dive into how europa and germany especially handle this so you can understand it ... I often forget how different the way people think about regulations is in the USA. On the surface: There is a joint initiative of the Federal Office of Civil Protection and Disaster Assistance (BBK) and the Federal Office for Information Security (BSI) which work with domain experts to define the abstract standards for critical infrastructure. There are more specialized sets where the German Hospital Federation (DKGeV) has more influence in how to make it happen for hospitals in particular. The whole regulation is set up to focus on continuous improvement, risk management, escalation processes, investigation of breaches and the like. It is related to ISO27001, but goes beyond that. Maybe comparing it to MilSpec makes it understandable to citizens of the USA: we want our hospitals IT infrastructure to be like the navy wants its warships: made out of steel, with redundant systems and sane compartmentalization so it can withstand most attacks. And we are willing to invest billions of tax money to get our existing hospitals up to these standards, because many are like viking longboats: they stay afloat and cure disease, but they are not protected against torpedoes. A hospital looses most of its infrastructure to a some ransomware? There is an investigation by the supervisory body into the technical and organizational details of the specific security incident and they really don't care about certifications printed by some private company that claims to have audited the hospital. The expected result is a "how this hospital intents to prevent this type of incident in the future" document. These standards are not about certifications of industry sector mediocrity waved around to shift blame and win liability cases in court. Also I don't think liability cases work that way over here, but i am not a lawyer.
  - heavyset_go 6y ago
    We have best practices, laws like HIPAA and standards like PCI DSS.
deleted 6y ago
[deleted]
throwaway894345 6y ago
If they shirked building regulations and built the whole thing out of kindling and made it available to any arsonist anywhere in the world, we probably would blame the architect. Of course, if we have to torture the analogy to make it fit reality, it's probably not a very good analogy.
dtech 6y ago
This is more akin to thieves robbing Hospital equipment. If the hospital had inadequate locks and security they'd still be partly to blame.
comboy 6y ago
The wood is not the problem. It's the lack of evacuation plan.
zucker42 6y ago
But if someone attacked others in a hospital, we might blame them for lack of security.
- leetcrew 6y ago
  probably not. we don't generally have high expectations for physical security in hospitals, outside of controlled medications perhaps. at most hospitals you just have to give your name, the name of someone you claim to be visiting, and then you can go pretty much anywhere you want.
- cortesoft 6y ago
  We don't generally expect every public business to have security to protect patrons from physical attack by random people.
  - zucker42 6y ago
    I agree we probably shouldn't hold them legally responsible in general, but we in some cases we do. https://reason.com/2020/08/22/do-threatened-businesses-and-institutions-have-heightened-legal-obligations-to-provide-security/ https://reason.com/2020/08/22/do-threatened-businesses-and-i...
young_unixer 6y ago
Arson is a physically violent act, hacking is not. For any reasonable moral standpoint those things are very different.
- FpUser 6y ago
  If you hacked with the intention of harming/killing persons then it sure is violent act as the intent matters. Obviously in that particular case hackers did not really want to physically harm.
- matkoniecz 6y ago
  Attacking hospital, including machines handling life support is still a violent act. I see no real moral difference between arson and launching ransomware attacks.
- cortesoft 6y ago
  It depends on what you hack, doesn't it? If your hack causes physical harm, it is a physically violent act. You wouldn't say that someone firing a gun didn't commit a physically violent act just because all they did was pull a trigger.
  - young_unixer 6y ago
    There must be a distinction between: 1. Actions that are physically violent 2. Actions that cause physical harm, but the action itself is not physically violent If 1 and 2 were the same, it would imply that voting for a politician that decides to kill people is just as bad as killing people yourself. The consequences of that wouldn't be good. > You wouldn't say that someone firing a gun didn't commit a physically violent act just because all they did was pull a trigger. If the gun is their property, it's their fault that their property is attacking someone. It's not pulling the trigger that's wrong, its that their property attacked someone else. Same idea applies to killer robots. If the gun is not their property, then it's their fault that they used someone else's property.
    - harimau777 6y ago
ben0x539 6y ago
If we lived in a world where drive-by arson was a common pastime, we'd blame hospital operators for building hospitals that aren't really hard to set on fire.
shadowgovt 6y ago
We might change our minds if fires could be started remotely by someone halfway around the world who doesn't even know the hospital exists. In that case, the active threat begins to look more like a random-chance natural disaster than the kind of event the human justice system can bring to heel. By all means use the justice system, but if the justice system is failing? Plan for fire. (Seems like there's a lesson to be applied here to architecture in California, now that I think about it...)
3pt14159 6y ago
I have a background in civil engineering with a focus on structural / geotechnical / construction engineering. Standards for hospitals are much stricter than they are for houses. In fact, for buildings like hospitals we have specific parts of the law that limit damages. I don't know the details of this specific hack well enough to comment on where it falls on the spectrum of incompetence, but things like bollards are required by law between a hospital and a street. There are also limits on the amount that one can sue for when they're exposed. Fundamentally though, this is a failure of the tech community to engage policy makers and a failure of policy makers to engage / listen to the tech community. It took me (and others?) years to get self-driving car regulations enacted in Canada. And even there, we're just getting started with the basics. Not enough programmers are politically engaged and the field is moving so fast that it is tough for regulators to keep up. I'm not surprised that people are dying. Quite the opposite, really. I'm surprised so few have died given how horrible our security is for industrial systems and other fuddy-duddy sub-industries of software. Yes it's a lot better today than it was five or ten years ago, but the offensive tools are much better as well. It's literally an arms race and sometimes it looks like only one side recognizes it as such.
- rayhendricks 6y ago
  The circumstances that led up to this failure of organizational security are a combo of IT apathy and vendor lock-in. IMO you should not be running windows on hardware whose failure could cause deaths. Maybe windows could be secured to prevent this but that would require IT staff to keep things updated which does not always happen. A much better solution is to run locked down Linux or BSD.
  - type0 6y ago
    Now go and try to explain that to the doctors. We all know that they could roll out Gentoo (chromebook style) and be supersecure, but the reality is nothing will change until hospitals stop using proprietary software that requires Windows.
- baash05 6y ago
  I can't agree with your about the tech community engaging policy makers. Every single time I've seen tech tell policy makers something is bad, or that it will work exactly the reverse of the intended, policy makers do just the thing they were cautioned against. In the last 2 years Australia (for instance) has gone against at least 3 major objections by tech. Costing jobs and security.
mgleason_3 6y ago
A better analogy might be if the hospital had a known defect which, if un-repaired, could lead to someones death. And then it did. As pointed out in the article: "... cybersecurity experts have warned for years that most hospitals aren’t prepared." Unfortunately, hospitals have a complex and expensive job ahead. I wonder if anyone has developed a blueprint for how to proceed?

alextheparrot 6y ago

A counter-equivalence could be that banks build vaults, because they understand the importance of what they hold. I see your point, but it isn’t as clean as stated.

ceejayoz 6y ago

You might criticize the builders if the hospital had no sprinklers or smoke alarms, though.

watwut 6y ago
Those are regulated amd everyone who builds building knows. Especially in Germany. Software industry hates idea of regulation.

deleted 6y ago

[deleted]

heavyset_go 6y ago

This doesn't absolve the owners from running a hospital that doesn't meet fire code, however.

eunos 6y ago
Then do we have IT code? Pun not intended.
- throwaway894345 6y ago
  Not sure about Germany, but in the US we have HIPAA which sets security standards (physical and electronic) that everyone in the healthcare industry must meet.
  - Jtsummers 6y ago
    A lot of times these standards can be satisfied by relatively simple mechanisms like access control lists which prevent legitimate users from performing illegitimate actions (like a nurse or doctor shouldn't be able to pull up any patient record) paired with extra-technological controls like stating that only the listed non-medical personnel can access a particular patient's records (like adding your spouse or parents as valid recipients of test results and health status information). These do nothing to actually ensure the security of the system with regard to external actors. Additionally, you can often satisfy these things with policy statements rather than technological solutions. A weekly review of record access reports may satisfy in some cases, without needing to implement an ACL mechanism.
  - AdmiralAsshat 6y ago
    People generally don't die as a result of failure to meet HIPAA standards, though. To boot, HIPAA covers security standards for the protection of PII--it doesn't cover security standards for network intrusion.
    - ceejayoz 6y ago
      Preventing network intrusion seems pretty critical to protect PII.
      - slowmovintarget 6y ago
        Someone can be on the network and fail to crack encrypted data and you'd be in compliance. HIPAA is only about information leaks, not about operational health.
- Jtsummers 6y ago
  No, not in the general sense. Only for specific kinds of data/applications (mostly centered around securing PII, health data, and the like). But the general IT infrastructure has no foundational standard we require people to achieve. And after about 60 years of IT, I don't know that we ever will. Efforts to certify systems/processes are often bogus (participate in a CMMI appraisal for a good example of this). Legitimate efforts to certify them are drowned out by the charlatans. And very few in the IT industry would desire personal certifications along the lines of PEs. Either they don't want the legal and financial liability, or they truly believe there's no value in it.
  - FpUser 6y ago
    Except for very specific areas (security of vital systems in general) I believe the ability of Subject A to deliver service (including making software) to a Subject B should be strictly a business between consenting adults (bar tax reporting). We are supposed to be a "free" world.
    - Jtsummers 6y ago
      I can mostly agree with this sentiment, but care has to be taken when the system involves people who aren't party to the design decisions, but whose information is stored within the system.
- Jon_Lowtek 6y ago
  Yes Germany has both general IT guidelines and specific codes for hospitals. Also high levels of IT security are required by law for hospitals. And those standards, guidelines and analysis of industry sector typical problems are made publicly available by a government agency funded with tax money. However: Despite a law being in place since 2015 many hospitals are still underdeveloped when it comes to IT and IT security in particular.
  - linuxftw 6y ago
    Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. "We met all the standards, we shouldn't be accountable." If the brakes go out on your care, and you smash into a building, even though it was recently serviced to whatever 'standards' are you liable? Yes. And then it will be up to you to pursue the manufacturer of the car, who will claim they met all standards, so they're not liable. See how it works?
    - Majromax 6y ago
      > Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. And that's important. You have to have some place to draw the line between "we did nothing and we're all out of ideas" and "what do you mean you didn't write your own operating system from scratch and hire fifteen security experts to continuously analyze it for un-patched zero-day exploits?" That's where industry standard "best practices" come in. Once some sort of standard is issued (by regulation) or accepted (by industry), it becomes the thing that a Reasonable Person does. Meeting that standard is then usually sufficient to avoid charges of (or additional liability for) negligence. > If the brakes go out on your car, and you smash into a building In this case, you're liable because you carry strict liability for your actions as a driver. However, proof that you've kept the car in working order would be sufficient to escape any criminal charges (dangerous operation of a vehicle, for example)
    - Jon_Lowtek 6y ago
      I would need to give you a very deep dive into how europa and germany especially handle this so you can understand it ... I often forget how different the way people think about regulations is in the USA. On the surface: There is a joint initiative of the Federal Office of Civil Protection and Disaster Assistance (BBK) and the Federal Office for Information Security (BSI) which work with domain experts to define the abstract standards for critical infrastructure. There are more specialized sets where the German Hospital Federation (DKGeV) has more influence in how to make it happen for hospitals in particular. The whole regulation is set up to focus on continuous improvement, risk management, escalation processes, investigation of breaches and the like. It is related to ISO27001, but goes beyond that. Maybe comparing it to MilSpec makes it understandable to citizens of the USA: we want our hospitals IT infrastructure to be like the navy wants its warships: made out of steel, with redundant systems and sane compartmentalization so it can withstand most attacks. And we are willing to invest billions of tax money to get our existing hospitals up to these standards, because many are like viking longboats: they stay afloat and cure disease, but they are not protected against torpedoes. A hospital looses most of its infrastructure to a some ransomware? There is an investigation by the supervisory body into the technical and organizational details of the specific security incident and they really don't care about certifications printed by some private company that claims to have audited the hospital. The expected result is a "how this hospital intents to prevent this type of incident in the future" document. These standards are not about certifications of industry sector mediocrity waved around to shift blame and win liability cases in court. Also I don't think liability cases work that way over here, but i am not a lawyer.
- heavyset_go 6y ago
  We have best practices, laws like HIPAA and standards like PCI DSS.

deleted 6y ago

[deleted]

throwaway894345 6y ago

If they shirked building regulations and built the whole thing out of kindling and made it available to any arsonist anywhere in the world, we probably would blame the architect. Of course, if we have to torture the analogy to make it fit reality, it's probably not a very good analogy.

dtech 6y ago

This is more akin to thieves robbing Hospital equipment. If the hospital had inadequate locks and security they'd still be partly to blame.

comboy 6y ago

The wood is not the problem. It's the lack of evacuation plan.

zucker42 6y ago

But if someone attacked others in a hospital, we might blame them for lack of security.

leetcrew 6y ago
probably not. we don't generally have high expectations for physical security in hospitals, outside of controlled medications perhaps. at most hospitals you just have to give your name, the name of someone you claim to be visiting, and then you can go pretty much anywhere you want.
cortesoft 6y ago
We don't generally expect every public business to have security to protect patrons from physical attack by random people.
- zucker42 6y ago
  I agree we probably shouldn't hold them legally responsible in general, but we in some cases we do. https://reason.com/2020/08/22/do-threatened-businesses-and-institutions-have-heightened-legal-obligations-to-provide-security/ https://reason.com/2020/08/22/do-threatened-businesses-and-i...

young_unixer 6y ago

Arson is a physically violent act, hacking is not. For any reasonable moral standpoint those things are very different.

FpUser 6y ago
If you hacked with the intention of harming/killing persons then it sure is violent act as the intent matters. Obviously in that particular case hackers did not really want to physically harm.
matkoniecz 6y ago
Attacking hospital, including machines handling life support is still a violent act. I see no real moral difference between arson and launching ransomware attacks.
cortesoft 6y ago
It depends on what you hack, doesn't it? If your hack causes physical harm, it is a physically violent act. You wouldn't say that someone firing a gun didn't commit a physically violent act just because all they did was pull a trigger.
- young_unixer 6y ago
  There must be a distinction between: 1. Actions that are physically violent 2. Actions that cause physical harm, but the action itself is not physically violent If 1 and 2 were the same, it would imply that voting for a politician that decides to kill people is just as bad as killing people yourself. The consequences of that wouldn't be good. > You wouldn't say that someone firing a gun didn't commit a physically violent act just because all they did was pull a trigger. If the gun is their property, it's their fault that their property is attacking someone. It's not pulling the trigger that's wrong, its that their property attacked someone else. Same idea applies to killer robots. If the gun is not their property, then it's their fault that they used someone else's property.
  - harimau777 6y ago

ben0x539 6y ago

If we lived in a world where drive-by arson was a common pastime, we'd blame hospital operators for building hospitals that aren't really hard to set on fire.

shadowgovt 6y ago

We might change our minds if fires could be started remotely by someone halfway around the world who doesn't even know the hospital exists. In that case, the active threat begins to look more like a random-chance natural disaster than the kind of event the human justice system can bring to heel. By all means use the justice system, but if the justice system is failing? Plan for fire. (Seems like there's a lesson to be applied here to architecture in California, now that I think about it...)

3pt14159 6y ago

I have a background in civil engineering with a focus on structural / geotechnical / construction engineering. Standards for hospitals are much stricter than they are for houses. In fact, for buildings like hospitals we have specific parts of the law that limit damages. I don't know the details of this specific hack well enough to comment on where it falls on the spectrum of incompetence, but things like bollards are required by law between a hospital and a street. There are also limits on the amount that one can sue for when they're exposed. Fundamentally though, this is a failure of the tech community to engage policy makers and a failure of policy makers to engage / listen to the tech community. It took me (and others?) years to get self-driving car regulations enacted in Canada. And even there, we're just getting started with the basics. Not enough programmers are politically engaged and the field is moving so fast that it is tough for regulators to keep up. I'm not surprised that people are dying. Quite the opposite, really. I'm surprised so few have died given how horrible our security is for industrial systems and other fuddy-duddy sub-industries of software. Yes it's a lot better today than it was five or ten years ago, but the offensive tools are much better as well. It's literally an arms race and sometimes it looks like only one side recognizes it as such.

rayhendricks 6y ago
The circumstances that led up to this failure of organizational security are a combo of IT apathy and vendor lock-in. IMO you should not be running windows on hardware whose failure could cause deaths. Maybe windows could be secured to prevent this but that would require IT staff to keep things updated which does not always happen. A much better solution is to run locked down Linux or BSD.
- type0 6y ago
  Now go and try to explain that to the doctors. We all know that they could roll out Gentoo (chromebook style) and be supersecure, but the reality is nothing will change until hospitals stop using proprietary software that requires Windows.
baash05 6y ago
I can't agree with your about the tech community engaging policy makers. Every single time I've seen tech tell policy makers something is bad, or that it will work exactly the reverse of the intended, policy makers do just the thing they were cautioned against. In the last 2 years Australia (for instance) has gone against at least 3 major objections by tech. Costing jobs and security.

mgleason_3 6y ago

A better analogy might be if the hospital had a known defect which, if un-repaired, could lead to someones death. And then it did. As pointed out in the article: "... cybersecurity experts have warned for years that most hospitals aren’t prepared." Unfortunately, hospitals have a complex and expensive job ahead. I wonder if anyone has developed a blueprint for how to proceed?