6 ms·

It's probably been raised before, but the CrowdStrike terms of use (https://www.crowdstrike.com/software-terms-of-use/ https://www.crowdstrike.com/software-term

It's probably been raised before, but the CrowdStrike terms of use (https://www.crowdstrike.com/software-terms-of-use/ https://www.crowdstrike.com/software-terms-of-use/), section 6.1, have the usual blurb on them (emphasis mine): > Neither the software or any other Crowdstrike offerings are for use in the operation or aircraft navigation, nuclear facilities, communication systems, weapons systems, DIRECT OR INDIRECT LIFE-SUPPORT SYSTEMS, air traffic control, or any application OR INSTALLATION WHERE FAILURE COULD RESULT IN DEATH, SEVERE PHYSICAL INJURY, or property damage. SOFTWARE USER agrees that it is SOFTWARE USER’S RESPONSIBILITY TO ENSURE SAFE USE OF SOFTWARE AND ANY OTHER CROWDSTRIKE OFFERING IN SUCH APPLICATIONS AND INSTALLATIONS. We don't really think long and hard enough about isolation of systems, and what levels of access they actually need to be able to do their tasks. It's entirely practical to build completely isolated networks. US Government (and most major governments) operate classified networks with air gaps, network diodes and the like. We don't have to make everything actually internet accessible, while still retaining the ability to get data in to such isolated networks.

nneonneo 2y ago
I suspect that if the operators of such facilities obeyed all of the terms of use for every product they wanted to use, they’d be using pen and paper for everything…
- niemandhier 2y ago
  No, that’s why medical and aviation products are expensive and these are difficult markets to penetrate. The degree of reliability that is required is insane, I cannot read the article since I am outside the US, BUT if these are the terms of service and the product was used in any area the was excluded under these terms, the entity that used the product might very well be guilty of gross negligence.
Frieren 2y ago
and it was not. No plane was flying with that software. It was booking services and similar needs. Planes could fly just fine, it was impossible to book people, thou. My guess is that it's similar in this case. (Site is down)
- TeMPOraL 2y ago
  Hospital networks and computers running Epic are very much indirect life-support systems, faulire of which can cause lots of injuries and deaths - as we're learning now in real-time.
  - SoftTalker 2y ago
    I'm hearing that most hospital cybersecurity insurance requires Crowdstrike (or a product like it) on all the endpoints, so if that's true the liability might fall back on them. It will be a protracted argument for sure.
    - tammer 2y ago
      This is likely the case in a lot of places. We're still in the midst of ransomware groups targeting hospitals.
lainga 2y ago
Now comes the important question: did CrowdStrike's sales team try to sell solutions to operators of such critical systems? If so, how hard did they push?
- lambdaone 2y ago
  Given this: https://www.theregister.com/2024/07/19/crowdstrike_update_nhs_it_outages/ https://www.theregister.com/2024/07/19/crowdstrike_update_nh... someone has certainly been selling Crowdstrike software to be used on life-critical systems.
- stackskipton 2y ago
  Been in Hospital IT, yes they did. Sure, they talked about not putting on "Life Critical Systems" but just about every system at Hospital is life critical. This is extremely common in IT because I'm sure Microsoft Windows has similar clause. Hell, I bet Epic (Electronic Medical Records) has some clause about "Make sure you have backups" when their whole pitch is "throw out the paper!"
  - cameronh90 2y ago
    I have seen first hand the mental gymnastics that finance/MBA leadership will go through to pretend to themselves (and the regulators) that a particular IT system isn’t “critical”. “We have a tested backup paper procedure” - Yes, but have you tested being able to access that document when the system is down? Have you tested it when everyone’s workload is 5x normal during a real life incident, given that doing it on paper takes much longer and everyone’s already at the edge of their capacity on a normal day? Have you considered in a real life disaster scenario that something like 20% of the employees might just call out sick? Of course not, but nobody asks that, so they just tick the “risk mitigated” box and don’t allocate any engineering effort to ensuring the system is robust.
- blackeyeblitzar 2y ago
  Of course they did. This type of fine print is meaningless and only there to push responsibility onto their customers. This type of issue shouldn’t happen at large companies. We need regulations that create penalties and jail time for larger companies that have security incidents or other issues like this one.
nullindividual 2y ago
NT 4 EULA had a similar note, but it was limited in scope to JAVA. > 8. NOTE ON JAVA SUPPORT. THE SOFTWARE PRODUCT CONTAINS SUPPORT FOR PROGRAMS WRITTEN IN JAVA. JAVA TECHNOLOGY IS NOT FAULT TOLERANT AND IS NOT DESIGNED, MANUFACTURED, OR INTENDED FOR USE OR RESALE AS ON-LINE CONTROL EQUIPMENT IN HAZARDOUS ENVIRONMENTS REQUIRING FAIL-SAFE PERFORMANCE, SUCH AS IN THE OPERATION OF NUCLEAR FACILITIES, AIRCRAFT NAVIGATION OR COMMUNICATION SYSTEMS, AIR TRAFFIC CONTROL, DIRECT LIFE SUPPORT MACHINES, OR WEAPONS SYSTEMS, IN WHICH THE FAILURE OF JAVA TECHNOLOGY COULD LEAD DIRECTLY TO DEATH, PERSONAL INJURY, OR SEVERE PHYSICAL OR ENVIRONMENTAL DAMAGE.
- netsharc 2y ago
  I wonder if that's MS's Java or Sun's. If it's from a third party they probably copy-pasted the relevant paragraphs. Quicktime also has a paragraph about not using them to operate nuclear facilities...
  - minton 2y ago
    QuickTime? The video stuff from Apple?
    - netsharc 2y ago
      Yeah, the one we had to install on Windows 98 to play MOV files. Which, I learnt yesterday[1]/[2], is the video format that turned to MP4. [1] https://obsproject.com/blog/obs-studio-hybrid-mp4 https://obsproject.com/blog/obs-studio-hybrid-mp4 [2] https://news.ycombinator.com/item?id=40951187 https://news.ycombinator.com/item?id=40951187
  - kmeisthax 2y ago
    The Quicktime nuclear clause also got copied into the iTunes EULA, which is extremely funny.
    - cranberryturkey 2y ago
      Well shit, I guess I have to pivot. I was going to operate my nuclear facility with Quicktime.
Wytwwww 2y ago
I don't think an EULA absolves you of any possible liability. Courts can more or less decide to ignore it if they see sufficient reasons to.
- akira2501 2y ago
  Why does the hospital get a pass? They have critical care equipment, with no redundancies, and no plan to deal with an outcome so predictable it's been in EULAs for decades. These lessons need to cut in all directions. If you want to profit off of treating disease you should be held to a much higher standard. Passing the buck off to your AV provider is convenient in the current atmosphere but it's incredibly short sighted.
  - vkou 2y ago
    > If you want to profit off of treating disease you should be held to a much higher standard. The consequences of which will be even higher costs for an incredibly marginal improvement in outcomes. We spend ~$13,500/year/person at the moment, what's another few thousand to that number, for an average gain in a few life-days-per-person? At some point, you have to accept that medicine is an unlimited money hole, and that it can always do better, and that people are going to die, and that you're going to have to draw the line at some arbitrary cost/benefit limit.
    - Wytwwww 2y ago
      > and that you're going to have to draw the line at some arbitrary cost/benefit limit. Well US is spending significantly more money than all other highly-developed countries with (on average across population) worse outcomes than many of them to show for it. Also there is a lot of variance inside the country (i.e. the cost of identical treatment might vary wildly depending on health/insurance/etc. provider) making cost/benefit analysis semi meaningless.
- Simon_ORourke 2y ago
  If you've got a defendant with a war chest of several billion USD there's going to be a very drawn out legal process.
awinter-py 2y ago
with larger corp users there is often an MSA that overrides the TOS; no idea if that's the case here, but give hospital GC benefit of the doubt re due diligence also would be interesting if crowdstrike was installed by a reseller who specializes in healthcare / airlines, not the hospital or airline itself waivers not always enforced, per [1] > Courts will hold overbroad liability waivers unenforceable on public policy grounds. ... injurers routinely ignore these holdings and persist in requiring would-be plaintiffs to sign such unenforceable waivers anyway at least one federal case in florida[2] saying advertising a product as safe doesn't defeat the EULA, but it's florida 1. https://wp0.vanderbilt.edu/lawreview/wp-content/uploads/sites/278/2023/03/Unenforceable-Waivers.pdf https://wp0.vanderbilt.edu/lawreview/wp-content/uploads/site... 2. https://casetext.com/case/justtech-llc-v-kaseya-us-llc https://casetext.com/case/justtech-llc-v-kaseya-us-llc
aaron695 2y ago
[dead]
downrightmike 2y ago
That's only legal until a court throws it out
Cheer2171 2y ago
> communication systems So anything connected to the Internet? Shame on these lawyers.

nneonneo 2y ago

I suspect that if the operators of such facilities obeyed all of the terms of use for every product they wanted to use, they’d be using pen and paper for everything…

niemandhier 2y ago
No, that’s why medical and aviation products are expensive and these are difficult markets to penetrate. The degree of reliability that is required is insane, I cannot read the article since I am outside the US, BUT if these are the terms of service and the product was used in any area the was excluded under these terms, the entity that used the product might very well be guilty of gross negligence.

Frieren 2y ago

and it was not. No plane was flying with that software. It was booking services and similar needs. Planes could fly just fine, it was impossible to book people, thou. My guess is that it's similar in this case. (Site is down)

TeMPOraL 2y ago
Hospital networks and computers running Epic are very much indirect life-support systems, faulire of which can cause lots of injuries and deaths - as we're learning now in real-time.
- SoftTalker 2y ago
  I'm hearing that most hospital cybersecurity insurance requires Crowdstrike (or a product like it) on all the endpoints, so if that's true the liability might fall back on them. It will be a protracted argument for sure.
  - tammer 2y ago
    This is likely the case in a lot of places. We're still in the midst of ransomware groups targeting hospitals.

lainga 2y ago

Now comes the important question: did CrowdStrike's sales team try to sell solutions to operators of such critical systems? If so, how hard did they push?

lambdaone 2y ago
Given this: https://www.theregister.com/2024/07/19/crowdstrike_update_nhs_it_outages/ https://www.theregister.com/2024/07/19/crowdstrike_update_nh... someone has certainly been selling Crowdstrike software to be used on life-critical systems.
stackskipton 2y ago
Been in Hospital IT, yes they did. Sure, they talked about not putting on "Life Critical Systems" but just about every system at Hospital is life critical. This is extremely common in IT because I'm sure Microsoft Windows has similar clause. Hell, I bet Epic (Electronic Medical Records) has some clause about "Make sure you have backups" when their whole pitch is "throw out the paper!"
- cameronh90 2y ago
  I have seen first hand the mental gymnastics that finance/MBA leadership will go through to pretend to themselves (and the regulators) that a particular IT system isn’t “critical”. “We have a tested backup paper procedure” - Yes, but have you tested being able to access that document when the system is down? Have you tested it when everyone’s workload is 5x normal during a real life incident, given that doing it on paper takes much longer and everyone’s already at the edge of their capacity on a normal day? Have you considered in a real life disaster scenario that something like 20% of the employees might just call out sick? Of course not, but nobody asks that, so they just tick the “risk mitigated” box and don’t allocate any engineering effort to ensuring the system is robust.
blackeyeblitzar 2y ago
Of course they did. This type of fine print is meaningless and only there to push responsibility onto their customers. This type of issue shouldn’t happen at large companies. We need regulations that create penalties and jail time for larger companies that have security incidents or other issues like this one.

nullindividual 2y ago

NT 4 EULA had a similar note, but it was limited in scope to JAVA. > 8. NOTE ON JAVA SUPPORT. THE SOFTWARE PRODUCT CONTAINS SUPPORT FOR PROGRAMS WRITTEN IN JAVA. JAVA TECHNOLOGY IS NOT FAULT TOLERANT AND IS NOT DESIGNED, MANUFACTURED, OR INTENDED FOR USE OR RESALE AS ON-LINE CONTROL EQUIPMENT IN HAZARDOUS ENVIRONMENTS REQUIRING FAIL-SAFE PERFORMANCE, SUCH AS IN THE OPERATION OF NUCLEAR FACILITIES, AIRCRAFT NAVIGATION OR COMMUNICATION SYSTEMS, AIR TRAFFIC CONTROL, DIRECT LIFE SUPPORT MACHINES, OR WEAPONS SYSTEMS, IN WHICH THE FAILURE OF JAVA TECHNOLOGY COULD LEAD DIRECTLY TO DEATH, PERSONAL INJURY, OR SEVERE PHYSICAL OR ENVIRONMENTAL DAMAGE.

netsharc 2y ago
I wonder if that's MS's Java or Sun's. If it's from a third party they probably copy-pasted the relevant paragraphs. Quicktime also has a paragraph about not using them to operate nuclear facilities...
- minton 2y ago
  QuickTime? The video stuff from Apple?
  - netsharc 2y ago
    Yeah, the one we had to install on Windows 98 to play MOV files. Which, I learnt yesterday[1]/[2], is the video format that turned to MP4. [1] https://obsproject.com/blog/obs-studio-hybrid-mp4 https://obsproject.com/blog/obs-studio-hybrid-mp4 [2] https://news.ycombinator.com/item?id=40951187 https://news.ycombinator.com/item?id=40951187
- kmeisthax 2y ago
  The Quicktime nuclear clause also got copied into the iTunes EULA, which is extremely funny.
  - cranberryturkey 2y ago
    Well shit, I guess I have to pivot. I was going to operate my nuclear facility with Quicktime.

Wytwwww 2y ago

I don't think an EULA absolves you of any possible liability. Courts can more or less decide to ignore it if they see sufficient reasons to.

akira2501 2y ago
Why does the hospital get a pass? They have critical care equipment, with no redundancies, and no plan to deal with an outcome so predictable it's been in EULAs for decades. These lessons need to cut in all directions. If you want to profit off of treating disease you should be held to a much higher standard. Passing the buck off to your AV provider is convenient in the current atmosphere but it's incredibly short sighted.
- vkou 2y ago
  > If you want to profit off of treating disease you should be held to a much higher standard. The consequences of which will be even higher costs for an incredibly marginal improvement in outcomes. We spend ~$13,500/year/person at the moment, what's another few thousand to that number, for an average gain in a few life-days-per-person? At some point, you have to accept that medicine is an unlimited money hole, and that it can always do better, and that people are going to die, and that you're going to have to draw the line at some arbitrary cost/benefit limit.
  - Wytwwww 2y ago
    > and that you're going to have to draw the line at some arbitrary cost/benefit limit. Well US is spending significantly more money than all other highly-developed countries with (on average across population) worse outcomes than many of them to show for it. Also there is a lot of variance inside the country (i.e. the cost of identical treatment might vary wildly depending on health/insurance/etc. provider) making cost/benefit analysis semi meaningless.
Simon_ORourke 2y ago
If you've got a defendant with a war chest of several billion USD there's going to be a very drawn out legal process.

awinter-py 2y ago

with larger corp users there is often an MSA that overrides the TOS; no idea if that's the case here, but give hospital GC benefit of the doubt re due diligence also would be interesting if crowdstrike was installed by a reseller who specializes in healthcare / airlines, not the hospital or airline itself waivers not always enforced, per [1] > Courts will hold overbroad liability waivers unenforceable on public policy grounds. ... injurers routinely ignore these holdings and persist in requiring would-be plaintiffs to sign such unenforceable waivers anyway at least one federal case in florida[2] saying advertising a product as safe doesn't defeat the EULA, but it's florida 1. https://wp0.vanderbilt.edu/lawreview/wp-content/uploads/sites/278/2023/03/Unenforceable-Waivers.pdf https://wp0.vanderbilt.edu/lawreview/wp-content/uploads/site... 2. https://casetext.com/case/justtech-llc-v-kaseya-us-llc https://casetext.com/case/justtech-llc-v-kaseya-us-llc

aaron695 2y ago

[dead]

downrightmike 2y ago

That's only legal until a court throws it out

Cheer2171 2y ago

> communication systems So anything connected to the Internet? Shame on these lawyers.