6 ms·
Its insane how brazen this is. Code that 'bricks' the train locomotive if its gps coordinates remain with bounds of a competing repair facility for more than te
by dzdt 3y ago
Its insane how brazen this is. Code that 'bricks' the train locomotive if its gps coordinates remain with bounds of a competing repair facility for more than ten days! This is way beyond putting information barriers to repair, like undocumented interfaces or even crypto-signed firmware. This is actively malicious destruction of property. I don't know anything about the legal system in Poland, but I can't imagine how this gets by.
- toomuchtodo 3y agoIf an individual did this, they'd go to prison.
- throwbadubadu 3y agoAnd if it is a big or even state company we need to save and ensure workplaces, or "hello dear lobbyist with that big suitcase!" :D
- mcv 3y agoCompanies are made up of individuals. I'm all for holding everybody who contributed to this malware accountable.
- praptak 3y agoI don't believe the Polish judicial systems has experience in dealing with corporate crime, especially of the tech-related kind. I'm a bit afraid of disappointment here.
- Piskvorrr 3y agoDoes it have experience in dealing with...sabotage? Specifically, a country that has a war on its eastern doorstep? I mean - how is "let's mess with something on purpose so that trains won't run" NOT sabotage, since such time as railways exist?
- matkoniecz 3y agoNo, we do not have. Sabotage is rare to nonexisting and cases in past were rare and of "teenager builds device to control switch on tram tracks, derails tram for fun" type.
- ARandomerDude 3y agoWait, what? You don’t think a country with a population of 41M has experience with corporate crime?
- praptak 3y ago38M and no, not this kind of corporate crime. Plain financial fraud - sure. This case is much more complicated though.
- kwhitefoot 3y agoThe country does I'm sure but my guess would be that the judiciary probably doesn't because the judicial tools to deal with are quite likely absent or quite recently enacted and because there have been few prosecutions.
- dexterdog 3y agoUnfortunately that is why fall guys were invented. I never liked the idea of punishing a company based on their revenue, but in this kind of case that is the only way to get the actual owners of the company to listen and punish the people actually responsible.
- mhh__ 3y agoYou could very seriously start a war by doing things like this.
- hulitu 3y agoIt's funny how, in the western world, as a company, you can commit crimes and take a pat on the wrist, but, as an individual, you get to jail for the same crimes.
- bee_rider 3y agoSadly, the general populace didn’t hire lobbyists to represent them. Our representatives were supposed to be built into the system, but that unfortunately made them part of the game, rather than some of the players.
- WesolyKubeczek 3y agoCan’t you create an NGO that will collectively represent and lobby on behalf of the group, hiring lobbyists from membership fees and other fundraisers? Holy hell, maybe create a political party?
- bee_rider 3y agoMe personally? No, I don’t think I have the connections, patience, or talent for that. If I did I’d probably do it for a big company instead, they pay better than “we the people,” I think.
- vagrantJin 3y agoor once you have enough money to not care about it as much , you can focus on "we the people" but I doubt thats likely .
- lostlogin 3y agoIt’s simpler than that. A rich company or individual can often avoid jail. A poor company can just fold. It’s the poor individuals who suffer.
- read_if_gay_ 3y agorules for thee but not for me is not a western invention
- db48x 3y agoNo, they would not. It would be entirely a civil matter that would be resolved in litigation.
- deleted 3y ago[deleted]
- masfuerte 3y agoA contractor in the UK put a time-lock in the software he was contracted to write because he was concerned about non-payment. He didn't get paid and the software duly stopped working. He was successfully prosecuted under the Computer Misuse Act. He had some justification (unlike the Polish train manufacturer) but it didn't help him avoid prosecution. I've no idea what the law in Poland says.
- db48x 3y agoThat’s pretty ridiculous.
- account42 3y agoWhy? Tolerating that kind of behavior is what is ridiculous. If anything, us software developers should be held liable for more of the damages that we cause.
- db48x 3y agoSo it’s ok when a megacorp like Microsoft does it, but if an individual developer does it then it’s a crime? When you fail to pay for Windows, it turns off various features, does it not? When you stop paying for your MMO, it stops letting you play the game, right? So if I am contracted to develop some accounting software and they fail to pay me, why shouldn’t it stop working? This is why it would only be a contract dispute; they will argue that the contract did not state up front that if they failed to pay the developer that the software wouldn’t work. The MMO certainly has pages and pages of legalese that everyone knows lets the MMO’s developer get away with anything they want. The independent contractor needs explicit language in their contract to specify exactly what will happen if they aren’t paid on time. That should include late fees, but probably also software that refuses to work until someone fills out a credit card payment form.
- jakozaur 3y agoArticle 254a of the Polish Penal Code addresses the obstruction of railway operations and other critical infrastructure. Violating this law can result in a prison sentence ranging from 6 months to 8 years. It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour. To all software engineers: please refrain from engaging in criminal activities. If you are instructed to do something illegal, it is important to report it to the relevant authorities.
- blowski 3y ago> Dear software engineers, please do not commit a crime Yes, developers shouldn't knowingly write code to commit crime, but developers don't tend to receive instructions that directly. Unsurprisingly, the company doesn't mention to every employee that they are knowingly breaking the law. Instead, developers receive a request to build a feature, and it typically won't be at all obvious that the intended use of that feature is to commit a crime. There might even be a legitimate use of the feature, and then someone finds it can be abused to commit a crime.
- upwardbound 3y agoSometimes it may not be obvious but the feature still might seem super suspicious. For example, suppose that the malware discussed in this article was broken down into two sub-features assigned to different people: geofencing detection, and bricking the train. The person writing the "bricking the train" part should have realized that there is practically no legitimate reason for that code to be written, and if they ask their manager for a reason and are told "don't worry about why, just write the code", they should report this suspicious activity to law enforcement. There are many reasons that law enforcement would want to know, including that the engineer's manager might not even be acting in the company's own interests but might have taken a bribe from a hostile foreign power.
- blowski 3y ago> The person writing the "bricking the train" part should have realized that there is practically no legitimate reason for that code to be written Hey Janusz, can you build a safety feature that prevents the train from operating under certain conditions. We don’t know all the conditions yet, so leave it flexible.
- gorkish 3y agoAn individual did do this. Companies do not suddenly grow arms and brains and learn to code, at least not quite yet.
- deleted 3y ago[deleted]
- Xelbair 3y agoIt will be stuck in legal hell due to conflicts of interests. Trains already exist, and they need to work - but maintenance/repair companies cannot legally modify software of them due to copyrights. It's a catch22 situation. I honestly hope that company will be fined to the oblivion, and for criminal charges for that, but i doubt it will happen.
- dontlaugh 3y agoThe only practical solution is to re-nationalise this company.
- xg15 3y agoSupposedly tho the maintenance company would want to sue to at least dispute their contractual penalties? > A day of train downtime in the workshop costs over 1000 USD in contractual penalties, and there are several trains stuck, so the tension level in the SPS is rising. Also LSR, because evidently they were interested in holding a tender before and so likely don't want to be forced by Newag into overpriced maintenance contracts?
- db48x 3y agoOf course laws vary, and Polish copyright law might be completely crazy, but around here copyright only covers distribution of copies. It does not make it illegal to modify software that you own. It only limits distribution of copies of that software, modified or otherwise. If the owner of the train wants to modify the software then there is probably nothing stopping them.
- krisoft 3y ago> If the owner of the train wants to modify the software then there is probably nothing stopping them. This of assumes that the owner of the train company has the skills to do this. In reality they probably would need outside help and that company might fall foul of copyright issues. (when they are distributing the modified code back to the train company, for example) But the real problem of course is that all of this code is very likely safety critical. Can they modify it? Probably. Is it a good idea? Not really.
- justinclift 3y ago> This is actively malicious destruction of property. Seems more like malicious denial of service, with the goal of enriching the malicious actor. A motivated legal team would likely be able to find Serious Charges that could apply. Especially if these specific trains / locomotives happen to be "Critical Infrastructure" (not guaranteed).
- deleted 3y ago[deleted]