> Two things can be true at the same time

Heck, three things can be true at the same time. For example, in the Uber self-driving car death:

- uber's safety systems failed to recognize a human in the road

- the backup human driver failed to pay attention

- the woman in the middle of the street failed to pay attention

There can be N failures that all contributed to a given disaster, and it's important to consider all points of failure which can be mitigated in the future, not just the most controversial point of failure.

I believe there's still another failure: Uber's systems didn't ensure that the backup driver was paying attention, when it was highly foreseeable that their attention would lapse (although granted watching a show on your phone is more than a lapse of attention).

Why stop at three? What about Arizona's lawmakers for allowing this in the first place, or not demanding that certain safety measures are met?

Careful. If you think about this too much, you might end up realizing how absurd “justice” systems everywhere are.

Maybe say everything has one cause: the initial conditions on the differential equation that governs all existence.

That assumes that the state has a responsibility to micro-manage every activity, with prohibitions on activity that doesn't follow the prescribed regiment, to prevent negligence.

The individuals involved in an activity are the only ones responsible for avoiding negligent behavior in a society based on the liberal democratic principles of individual rights and responsibilities.

However, to give due credit to your musing, the Uber situation is somewhat different in being on public roads, which lawmakers do have some responsibility to govern an individual's use of, for the safety of others who share public roads with the individual.

We allow the state to micromanage the activities of individuals all the time, such as with drug, prostitution, and porn laws.

Or even the voters for voting for said lawmakers.

I learned recently this is sometimes visualized by something called the "Swiss Cheese Model": https://en.wikipedia.org/wiki/Swiss_cheese_model

Regarding self driving cars: I was once told that a big reason for the safety of fly-by-wire systems (when planes first moved from directly attached controls) is that the engineers who built those systems had to take the first flights, so they made sure their systems were good. That is probably the case for self-driving cars too, but falling out of the sky feels more viscerally unsafe than driving on a highway, and the gradual nature of the changeover probably isn't helping either.

This is the reason for “root cause analysis” being obsolete and against best practices for complex systems. The practice seems to be something that less sophisticated management wants for a political scapegoat rather than to actually solve problems.

> There can be N failures that all contributed to a given disaster, and it's important to consider all points of failure which can be mitigated in the future, not just the most controversial point of failure.

For the Uber thing, what incentive does the management have to do the right thing?

Money damages, potential criminal lawsuits, and reputational harm which is real and costly (though I know HN is skeptical of it).

> reputational harm which is real and costly (though I know HN is skeptical of it).

Largely because the world keeps demonstrating that reputational harm just doesn't happen to large companies. Uber included in this particular case.

Here's the Uber trips per quarter (in millions) since Q2 2017 (source https://www.businessofapps.com/data/uber-statistics)

Q2 2017 889

Q3 2017 985

Q4 2017 1,088

Q1 2018 1,136

Q2 2018 1,242

Q3 2018 1,348

Q4 2018 1,493

Q1 2019 1,550

Q2 2019 1,677

Q3 2019 1,770

Q4 2019 1,907

Q1 2020 1,658

The probable reason for the Q1 dip was the pandemic. The number of riders just keeps on rising.

You can see the same with Target etc. Large breaches happen, major negative incidents, and at best you might see a blip. The large majority of people just don't give a shit, so companies are given permission to not give a shit either.

Funny that being ethical and prioritizing to not do harm is not on the list.

'Prioritizing to not do harm' is an ethical consideration, and ethics are subjective, so I didn't consider them 'incentives'. If the question had been about 'motives' or 'considerations', I would have included 'potential ethical beliefs'.

The reason why is that presenting facts and concrete logic is more compatible with a greater array of people, whereas ethics and morals are subjective. Using a moral argument is not going to be as persuasive in business (particularly if, generally speaking, leadership is largely comprised of sociopaths, which is just a reality of this world)

Thats pretty much what I meant with "funny".

I look at it like this: if the hospital were being extorted by arsonists, we wouldn't be standing around blaming the architect of the hospital for using wood in its construction as the hospital burned.

I have a background in civil engineering with a focus on structural / geotechnical / construction engineering. Standards for hospitals are much stricter than they are for houses. In fact, for buildings like hospitals we have specific parts of the law that limit damages. I don't know the details of this specific hack well enough to comment on where it falls on the spectrum of incompetence, but things like bollards are required by law between a hospital and a street. There are also limits on the amount that one can sue for when they're exposed.

Fundamentally though, this is a failure of the tech community to engage policy makers and a failure of policy makers to engage / listen to the tech community. It took me (and others?) years to get self-driving car regulations enacted in Canada. And even there, we're just getting started with the basics. Not enough programmers are politically engaged and the field is moving so fast that it is tough for regulators to keep up. I'm not surprised that people are dying. Quite the opposite, really. I'm surprised so few have died given how horrible our security is for industrial systems and other fuddy-duddy sub-industries of software. Yes it's a lot better today than it was five or ten years ago, but the offensive tools are much better as well. It's literally an arms race and sometimes it looks like only one side recognizes it as such.

The circumstances that led up to this failure of organizational security are a combo of IT apathy and vendor lock-in.

IMO you should not be running windows on hardware whose failure could cause deaths. Maybe windows could be secured to prevent this but that would require IT staff to keep things updated which does not always happen.

A much better solution is to run locked down Linux or BSD.

Now go and try to explain that to the doctors. We all know that they could roll out Gentoo (chromebook style) and be supersecure, but the reality is nothing will change until hospitals stop using proprietary software that requires Windows.

I can't agree with your about the tech community engaging policy makers. Every single time I've seen tech tell policy makers something is bad, or that it will work exactly the reverse of the intended, policy makers do just the thing they were cautioned against. In the last 2 years Australia (for instance) has gone against at least 3 major objections by tech. Costing jobs and security.

If they shirked building regulations and built the whole thing out of kindling and made it available to any arsonist anywhere in the world, we probably would blame the architect. Of course, if we have to torture the analogy to make it fit reality, it's probably not a very good analogy.

This doesn't absolve the owners from running a hospital that doesn't meet fire code, however.

Then do we have IT code? Pun not intended.

Yes Germany has both general IT guidelines and specific codes for hospitals. Also high levels of IT security are required by law for hospitals. And those standards, guidelines and analysis of industry sector typical problems are made publicly available by a government agency funded with tax money.

However: Despite a law being in place since 2015 many hospitals are still underdeveloped when it comes to IT and IT security in particular.

Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability. "We met all the standards, we shouldn't be accountable."

If the brakes go out on your care, and you smash into a building, even though it was recently serviced to whatever 'standards' are you liable? Yes. And then it will be up to you to pursue the manufacturer of the car, who will claim they met all standards, so they're not liable. See how it works?

I would need to give you a very deep dive into how europa and germany especially handle this so you can understand it ... I often forget how different the way people think about regulations is in the USA. On the surface: There is a joint initiative of the Federal Office of Civil Protection and Disaster Assistance (BBK) and the Federal Office for Information Security (BSI) which work with domain experts to define the abstract standards for critical infrastructure. There are more specialized sets where the German Hospital Federation (DKGeV) has more influence in how to make it happen for hospitals in particular. The whole regulation is set up to focus on continuous improvement, risk management, escalation processes, investigation of breaches and the like. It is related to ISO27001, but goes beyond that.

Maybe comparing it to MilSpec makes it understandable to citizens of the USA: we want our hospitals IT infrastructure to be like the navy wants its warships: made out of steel, with redundant systems and sane compartmentalization so it can withstand most attacks. And we are willing to invest billions of tax money to get our existing hospitals up to these standards, because many are like viking longboats: they stay afloat and cure disease, but they are not protected against torpedoes. A hospital looses most of its infrastructure to a some ransomware? There is an investigation by the supervisory body into the technical and organizational details of the specific security incident and they really don't care about certifications printed by some private company that claims to have audited the hospital. The expected result is a "how this hospital intents to prevent this type of incident in the future" document. These standards are not about certifications of industry sector mediocrity waved around to shift blame and win liability cases in court. Also I don't think liability cases work that way over here, but i am not a lawyer.

> Some places, the 'code' is merely a tool for businesses or other organizations to avoid liability.

And that's important. You have to have some place to draw the line between "we did nothing and we're all out of ideas" and "what do you mean you didn't write your own operating system from scratch and hire fifteen security experts to continuously analyze it for un-patched zero-day exploits?"

That's where industry standard "best practices" come in. Once some sort of standard is issued (by regulation) or accepted (by industry), it becomes the thing that a Reasonable Person does. Meeting that standard is then usually sufficient to avoid charges of (or additional liability for) negligence.

> If the brakes go out on your car, and you smash into a building

In this case, you're liable because you carry strict liability for your actions as a driver. However, proof that you've kept the car in working order would be sufficient to escape any criminal charges (dangerous operation of a vehicle, for example)

So did the hospital violate it?

They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere.

What do you think?

I don't think there is a single hospital that completely fulfills those standards. The bar is very high and the umbrella organization of hospitals says there must be millions per hospital invested to reach the requirements.

In unrelated news: a new law was passed today, after years of preparation, that includes a 4.3 billion euro investment of tax money into hospital IT systems.

> They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere.

> What do you think?

I don't understand why this apparently seems so obvious to you. I think I would need more information about the attack, the hospital's preparations for such an attack, and the legal and industry-standard security expectations for such a hospital.

The simple fact that an attack took down a hospital's computer systems is not sufficient to conclude that the hospital was negligent in its security. Surely a sufficiently sophisticated actor (e.g. a state) could take down the computers at most hospitals if they chose to.

I did not say that the hospital was negligent

> What do you think?

I think you can follow all the laws and still get hacked, so I don't think the fact that they got hacked tells us much about whether they were following the rules

> They got dozens of servers with patient data hacked and encrypted and had to shutdown their intensive care and reroute patients elsewhere.

Wouldn't simply using a cloud-based B2B service with something like Chrome OS / Cloudready instead of Windows solve the entire problem?

If that wouldn't work for data privacy or network availability reasons, it could be an open-source self-hosted server application, accessible locally only through a REST API.

And the server security? Just use something like self-updating RHEL CoreOS with a bunch of isolated containers, which greatly limits the entire attack surface.

> I don't think there is a single hospital that completely fulfills those standards.

Why can't a single technical solution be designed and supported for all state-owned hospitals in Germany?

The problem is not in any particular stack. It’s system design overall. All your mentioned alternatives could just as easily fail if not properly secured.

> The problem is not in any particular stack. It’s system design overall.

Are you aware that unlike Windows, Chromium OS has been designed from the ground up with security in mind[1]? And that it can run on almost any hardware[2]?

> All your mentioned alternatives could just as easily fail if not properly secured.

Software has to be designed and chosen with security in mind from the beginning.

If a hospital is running Windows Server instead of automatically-updating, minimal Container Linux[3], it has a much larger attack vector space.

These two factors alone (a proper client OS, and a proper server OS) can reduce the probability of a successful ransomware attack to almost zero.

[1] https://www.chromium.org/chromium-os/chromiumos-design-docs/...

[2] https://get.neverware.com/healthcare/

[3] https://getfedora.org/en/coreos

What about credentials? Access? Administration? DDOS attacks?

I think you can’t tell the attack space from a glance like that. And there’s ways to properly lock down Windows installations too, patched or not. Careful systems design and planning is key, regardless of exact components.

> What about credentials? Access? Administration?

That has been a solved problem, at least in Chromium OS[1]. Even hardware-based two-factor authentication can be required for all users by a click of a button.

> DDOS attacks?

If it's self-hosted by a hospital locally, most parts of the system should not be available on an open network. If it's not self-hosted locally, the largest European hosting provider, OVH, can survive a 1.1 Tbps DDoS attack[2].

> Careful systems design and planning is key, regardless of exact components.

If the solution is not designed around up-to-date technical components, it can fail regardless of careful planning.

[1] https://support.google.com/chrome/a/answer/1289314?hl=en

[2] https://arstechnica.com/information-technology/2016/09/botne...

You list technical solutions, but I'm talking about organisational failure. What about using too simple password, posting passwords on some semi-public forum, using the same password for several people, using the same account for several people and so on.

In large organisations, the problems are always found in the organisation itself, seldom in whatever tech stack is used. That they used unpatched Windows installations is not the disease, it's a symptom of the disease.

You can enthusiastically treat the symptoms and improve the condition of the patient, but unless you go to the root causes, the patient will find new ways to be ill and you can 't be there to band-aid everything, all the time.

1: I have far too few information to even speculate on how to improve this particular hospitals infrastructure.

2: because Germany is federal-social-democratic, not stalinist.

> because Germany is federal-social-democratic, not stalinist

Ah, "federal" is the right answer here. In many smaller EU countries, there is a single central social-democratic government, which can just fund an open-source solution for all regions to use.

well we can fund an OSS, but i have this feeling you underestimate the complexity of all possible hospitals.

I probably do. In any case, I would design a fundamental core system with an open API for extensions, that could be developed and maintained by third-parties, based on additional requirements by each hospital.

No, not in the general sense. Only for specific kinds of data/applications (mostly centered around securing PII, health data, and the like). But the general IT infrastructure has no foundational standard we require people to achieve.

And after about 60 years of IT, I don't know that we ever will. Efforts to certify systems/processes are often bogus (participate in a CMMI appraisal for a good example of this). Legitimate efforts to certify them are drowned out by the charlatans. And very few in the IT industry would desire personal certifications along the lines of PEs. Either they don't want the legal and financial liability, or they truly believe there's no value in it.

Except for very specific areas (security of vital systems in general) I believe the ability of Subject A to deliver service (including making software) to a Subject B should be strictly a business between consenting adults (bar tax reporting). We are supposed to be a "free" world.

I can mostly agree with this sentiment, but care has to be taken when the system involves people who aren't party to the design decisions, but whose information is stored within the system.

Not sure about Germany, but in the US we have HIPAA which sets security standards (physical and electronic) that everyone in the healthcare industry must meet.

People generally don't die as a result of failure to meet HIPAA standards, though. To boot, HIPAA covers security standards for the protection of PII--it doesn't cover security standards for network intrusion.

Preventing network intrusion seems pretty critical to protect PII.

Someone can be on the network and fail to crack encrypted data and you'd be in compliance. HIPAA is only about information leaks, not about operational health.

A lot of times these standards can be satisfied by relatively simple mechanisms like access control lists which prevent legitimate users from performing illegitimate actions (like a nurse or doctor shouldn't be able to pull up any patient record) paired with extra-technological controls like stating that only the listed non-medical personnel can access a particular patient's records (like adding your spouse or parents as valid recipients of test results and health status information). These do nothing to actually ensure the security of the system with regard to external actors.

Additionally, you can often satisfy these things with policy statements rather than technological solutions. A weekly review of record access reports may satisfy in some cases, without needing to implement an ACL mechanism.

We have best practices, laws like HIPAA and standards like PCI DSS.

You might criticize the builders if the hospital had no sprinklers or smoke alarms, though.

Those are regulated amd everyone who builds building knows. Especially in Germany.

Software industry hates idea of regulation.

A counter-equivalence could be that banks build vaults, because they understand the importance of what they hold. I see your point, but it isn’t as clean as stated.

We might change our minds if fires could be started remotely by someone halfway around the world who doesn't even know the hospital exists.

In that case, the active threat begins to look more like a random-chance natural disaster than the kind of event the human justice system can bring to heel. By all means use the justice system, but if the justice system is failing? Plan for fire.

(Seems like there's a lesson to be applied here to architecture in California, now that I think about it...)

If we lived in a world where drive-by arson was a common pastime, we'd blame hospital operators for building hospitals that aren't really hard to set on fire.

A better analogy might be if the hospital had a known defect which, if un-repaired, could lead to someones death. And then it did. As pointed out in the article: "... cybersecurity experts have warned for years that most hospitals aren’t prepared."

Unfortunately, hospitals have a complex and expensive job ahead. I wonder if anyone has developed a blueprint for how to proceed?

The wood is not the problem. It's the lack of evacuation plan.

This is more akin to thieves robbing Hospital equipment. If the hospital had inadequate locks and security they'd still be partly to blame.

But if someone attacked others in a hospital, we might blame them for lack of security.

We don't generally expect every public business to have security to protect patrons from physical attack by random people.

I agree we probably shouldn't hold them legally responsible in general, but we in some cases we do.

https://reason.com/2020/08/22/do-threatened-businesses-and-i...

probably not. we don't generally have high expectations for physical security in hospitals, outside of controlled medications perhaps. at most hospitals you just have to give your name, the name of someone you claim to be visiting, and then you can go pretty much anywhere you want.

Arson is a physically violent act, hacking is not. For any reasonable moral standpoint those things are very different.

It depends on what you hack, doesn't it? If your hack causes physical harm, it is a physically violent act. You wouldn't say that someone firing a gun didn't commit a physically violent act just because all they did was pull a trigger.

There must be a distinction between:

1. Actions that are physically violent

2. Actions that cause physical harm, but the action itself is not physically violent

If 1 and 2 were the same, it would imply that voting for a politician that decides to kill people is just as bad as killing people yourself. The consequences of that wouldn't be good.

> You wouldn't say that someone firing a gun didn't commit a physically violent act just because all they did was pull a trigger.

If the gun is their property, it's their fault that their property is attacking someone. It's not pulling the trigger that's wrong, its that their property attacked someone else. Same idea applies to killer robots.

If the gun is not their property, then it's their fault that they used someone else's property.

If you reasonably know that the politician would murder someone then you absolutely are equally bad if you vote for them

Arson is not physically violent by this nonsensical distinction. It's just a chemical reaction that spreads on its own.

If you hacked with the intention of harming/killing persons then it sure is violent act as the intent matters. Obviously in that particular case hackers did not really want to physically harm.

Attacking hospital, including machines handling life support is still a violent act.

I see no real moral difference between arson and launching ransomware attacks.

The only difference I see is that hacking is always premeditated, making this a much worse instance of murder by definition.

Here's a simple analogy:

You buy a sprinkler system from Acme. Acme cheaps out and installs defective sprinklers. An arson lobs a molotov cocktail through your window to set your house on fire, but the sprinklers fail and your house burns down as a result.

The arson caused the fire, but Acme is simultaneously responsible for the defective sprinklers.

The analogy breaks down in the context of the law (as most analogies seem to) because in this case the hospital was not explicitly selling you a product to protect against hackers. However, I think it stands up from a purely ethical point of view.

while i wholeheartedly understand your point. i would ask you to keep in mind that not even nurses are paid what they should. IT is not getting any money before them. i dont know who does the IT stuff but ill give them the benefit of the doubt that they have their hands full? or am i naive?

There’s a distinction between blaming the front-line staff and the management/hospital as an entity. The likely argument is that it is the management’s role to ensure the IT department is staffed appropriately.

That's why I never placed blame on IT. This is a management problem, not an IT problem, front line staff do as they've told.

It is management's responsibility to assess the risks and to decide where money should be spent (in this case on patient critical infrastructure).

To use another poster's example: It is like them failing to upkeep their sprinkler system and part of the hospital burning down.

isn't median wage for a nurse somewhere around $35/hr? this is around the 75th percentile for income in the US, assuming they work forty hours a week.

How does one calculate the amount someone “should” be paid?

Well, the article notes:

Even attacks that target patient data, and don’t directly impact medical devices, can hurt patient outcomes: one study found that a hospital’s death rate from heart attacks goes up in the years after a data breach. That’s probably because hospitals have to divert resources to respond to the attack or upgrade software in a way that changes how doctors operate.

There are tough choices to be made here. An attach that spurs them to divert resources to security causing deaths means that diverting resources to security before the breach would cause deaths also. Knowing exactly how much to spend on things other than patient care is tricky. We can say they were negligent because they didn't spend the money, but there weren't any attributable deaths yet, so they would have been spending money with an idea it would probably cause some adverse patient outcomes and not knowing if it was actually needed. That's a hard position to be in.

It's pretty easy to establish the malware attackers' responsibility. But the extent of the hospital's responsibility is much harder to establish, especially across all types of potential attacks. Basically, it's not easy to establish precisely which types of attacks a hospital needs to be prepared for in order for them to not be considered negligent.

In this case, I don't see many details, but it does sound like they simply couldn't access patient data and thus were transferring patients. I find it hard to believe that they couldn't have continued to provide emergency treatments that don't require networked computerized machinery.

But I'd want to know more about the attack before I could conclude that the hospital was negligent. Surely for every hospital there is some attack with sufficient sophistication to disrupt service at the hospital.

In this context, the malware hackers are probably going to save lives in the future by setting a modern precedent for negligence at hospitals and it systems will be updated. Surely they should be patted on the back for such efforts?

By that measure, hijackers who shoot some passengers or crash an aircraft might 'save lives' by motivating the implementation of more rigorous security measures at an airport. I think this is patently absurd.

You could make this same argument about every criminal act.

Three things: Bitcoin allowed malware authors to have a viable business model.

Technology isn't neutral. The world is too complicated to hide behind that argument. We must think about the consequences of the things we build.

That's like saying cash enabled drug and arms trade, or that encryption enables terrorists to communicate.

Cash, Bitcoin, and encryption are neutral technologies that can be used in negative ways.

Analogies are usually not the correct way to proceed in an argument. Let me quote from [1]:

> Weak analogy

> Definition: Many arguments rely on an analogy between two or more objects, ideas, or situations. If the two things that are being compared aren’t really alike in the relevant respects, the analogy is a weak one, and the argument that relies on it commits the fallacy of weak analogy.

> Example: “Guns are like hammers—they’re both tools with metal parts that could be used to kill someone. And yet it would be ridiculous to restrict the purchase of hammers—so restrictions on purchasing guns are equally ridiculous.” While guns and hammers do share certain features, these features (having metal parts, being tools, and being potentially useful for violence) are not the ones at stake in deciding whether to restrict guns. Rather, we restrict guns because they can easily be used to kill large numbers of people at a distance. This is a feature hammers do not share—it would be hard to kill a crowd with a hammer. Thus, the analogy is weak, and so is the argument based on it.

In this case the distinction between cash and Bitcoin is exactly what enables criminals to benefit from their crimes.

[1] https://writingcenter.unc.edu/tips-and-tools/fallacies/

Scott Alexander:

> The latest development in the brave new post-Bitcoin world is crypto-equity. At this point I’ve gone from wanting to praise these inventors as bold libertarian heroes to wanting to drag them in front of a blackboard and making them write a hundred times “I WILL NOT CALL UP THAT WHICH I CANNOT PUT DOWN”

https://slatestarcodex.com/2014/07/30/meditations-on-moloch/

Thanks for the link. Very interesting.

Fortunately, Scott is wrong on this. Crypto does not only subvert old forms of coordination, it also allows new forms of coordination. Whether this will is a net win remains to be seen.

Infrastructure only gets second or third grade people, especially in Germoney. The best go to the U.S. as the lower taxes ensure highest bang for the IQ. The next best go into some of the hyped and promising fields like AI. The lowest tier does local infrastructure with minimal reach and prestige in a globalist, centralized world.