> I think the question is, how come an attack on a hospital does not have the optics of an attack on infrastructure?

An attack on a hospital affects someone if they work there or are using that hospital. A pipeline attack affects people who drive cars places and need gas. The latter group is much larger than the former.

More apt comparison would be:

Hospital affects workers who work there and people using that hospital VS Pipeline affects workers who work there and people currently refilling their cars with gas from there

Or

Hospital affects workers who work there and everyone within a radius who could need it at any moment VS Pipeline affects works who work there and people who generally rely on that gas to drive

Suddenly the groups seems much similarly sized, while one being important for staying alive VS the other being a nice-to-have, if we consider it being offline for a week or two only.

I know which one I would consider being worse if I was a country. But then we're also talking about a country who's fascination for oil is like no other, so this is hardly surprising.

I mean, the pipeline in question provides half of the gas to the US East coast. You don’t have to love oil to see that losing 40% of the supply to more than 100m people overnight would be a public safety (what if emergency vehicles can’t buy fuel?) and economic risk.

The number of people reliant on this pipeline is several orders of magnitude greater than would be impacted by taking a single hospital offline. You’d need to have many hospitals impacted to create a similar level of risk. The only big difference is that taking out hospital infrastructure can kill people immediately whereas the impact of a pipeline failure won’t generally be felt for days or weeks.

Edit: Based on your other response it sounds like we are on the same page.

Yeah, I understand this and agree with you. Compare one of the biggest oil pipelines in the country with one hospital, of course one will be worse than the other.

But if you instead compare 40% of the hospitals going offline VS 40% loosing access to gas, with similar conditions, I think the mortality will be higher by attacking hospitals. I think the government could probably somehow logistically ration oil if shit really hits the pan too, so essentials can keep running. Probably worse situation with hospitals, even though the military could probably help out there a bit.

That's why it's weird to not react when people are attacking hospitals, vs oil pipelines. But as said before in my other comment, maybe not too weird.

I guarantee if a ransomware attack shut down 40 percent of the hospitals in the United States at the same time, we'd have an Iraq War situation on our hands.

If 40% of the hospitals shutdown the majority of people would not notice if you somehow kept it out of the news. It would be a disaster for those who need a hospital right then, but the average person doesn't even visit a hospital once a year.

The average person fills their gas tank once a month, so they are much more likely to notice personally.

Sure it's "nice to have" unless it does go on longer and suddenly nobody can get to the stores to buy food and the stores don't have any food to sell because the trucks that deliver it can't get fuel.

Thanks for expanding, that was exactly what I meant. Ok for smaller duration, while a hospital without functioning equipment is almost useless (compared to it's original status) immediately.

Oil is flowing constantly and continuously into every corner of the country. The storage capacity is negligible and the need is critical. Unlike a single hospital there is very little room to shift excess capacity relative to usage and the knock on effects are potentially catastrophic (we lose power to every hospital in 500 miles and nobody can run the generator).

Destroying logistic infrastructure is how you defeat a country. Petroleum is critical to the functioning of modern economies, if you cut that off things go badly. They really kicked the hornets nest on this one.

Indeed: I have to think it was not a planned or desirable outcome to anybody.

If the intended situation is to be able to (for instance) set up a coup attempt on the target country, have it come off well enough to produce chaos, and THEN have your tame cybercriminals knock out key infrastructure, that would be an extremely effective act of war.

Freaking people out while not destroying the target country is a bad, bad misstep. They did indeed kick the hornets' nest, but so ineffectively that the best response would be to try and cover the whole thing up and pretend it was nothing. Might work for some, but I doubt the US government is amused.

I think the point people are missing is that hospitals don't just stop providing services when they are hit by ransomware, at least not in my admittedly limited experience. There's a ton of paper involved even today and life could move on with ballpoint pens and forms.

The game was changed when Colonial closed the valves and services were impacted.

There is actually a counterexample to this that is happening right now. The Scripps hospital system in San Diego was hit with ransomware about two weeks ago and has been more or less down since then. Patients are not able to make new appointments, medical records are unavailable. My understanding is that doctors are still seeing patients if they have existing appointments, but surgeries are getting performed at other hospitals in other health systems.

And downtime procedures. They’re not perfect, but like pipelines, they existed and operated before computers.

Hospitals themselves aren't really "infrastructure." All hospitals can operate independently from each other, so holding one for ransom only affects the one. If you can actually shut down a pipeline, you affect everywhere it ships to.

Hospitals obviously do rely on infrastructure, so you'd see much more panic if someone could disrupt a national supply of blood plasma or insulin or something.

In addition to the other comments, there's a difference in scale here. Shutting down _a_ hospital would be like shutting down, say, several dozen gas stations in one part of a city. That would not have a lot of national visibility either. If they simultaneously shut down every hospital between Texas and New Jersey, it would have national optics.

Oil does require infrastructure. What you put in your car is several steps removed from what is pumped out of the ground.

Nor can you store gasoline for long unless you stabilize it (and even then), and certainly not safely in most residences. Classic car owners run into this issue, as do the diesel tanks for generators in datacenters (diesel is much more stable than gasoline)

I think the parent's point was that if oil infrastructure is completely disrupted, consumers won't even be affected for a few days and the short-term consequences will be somewhat minor (some percentage of drivers won't be able to drive, deliveries may be delayed).

If a hospital is shut down, then people will start dying immediately. The consequences are much more direct and severe.

I think this is simplistic and overlooks logistics and flexibility.

If a hospital closes, patients can be moved. If there's no gas, patients can't get to any hospital.

At least in the cities I've lived in, there tends to be a lot of internetworking in the local hospitals. If my local hospital, CRMC, were to be hit by ransomware or otherwise taken down it's likely that a good chunk of the city's health infra would be out or at least at risk too. Not to mention the damage an attacker could do to the data stored in an EHR system like Epic.

My point (which wasn't well made, admittedly) is that a closed hospital has immediate and material effects. Disrupted petroleum infrastructure isn't going to affect consumers for days.

What if you attack the hospital in the middle of, lets say a covid outbreak, where no excess capacity is available. Now you've likely caused a significant number of deaths.

hospitals without IT don't just kill all their patients and shut down. They slow down and loose capacity and capability while the realtively low-tech business of doctoring continues.

lolwut? this is insane. If oil infrastructure is completely disrupted it would be beyond catastrophic. Oil is completely foundational to our economy

Critical Infrastructure as Govt defines it

https://www.cisa.gov/critical-infrastructure-sectors

I'm not sure what point this comment is trying to make, according to CISA emergency services are a critical infrastructure sector. Therefore attacks on hospitals are attacks on critical infrastructure just like a pipeline.

  Five distinct disciplines compose the ESS, encompassing a wide range of emergency response functions and roles:

* Law Enforcement

* Fire and Rescue Services

* Emergency Medical Services

* Emergency Management

* Public Works

Emergency Medical Services ≠ Hospital

I agree with you that an attack on a hospital is an attack on infrastructure, though I disagree with your arguments regarding oil infrastructure.

The difference is response is a matter of impact scale. Usually, the infrastructure of a small group of hospitals is at stake. This time an entire state is hoarding gasoline. Both are infrastructure but the latter is causing nationwide effects.

A single hospital is not major infrastructure. We can operate medical services out of tents if necessary.

Oil pipelines that serve everything from energy to transportation to manufacturing are far more integral to keeping all aspects of society running for magnitudes more people.

Implicit in your question is the idea that the reason there was a stronger response here was because of optics—because a large mass of US citizens demanded it.

I think a more likely answer is that optics had little to do with it. Attack a hospital and you've got angry hospital administrators mad at you. Attack an oil pipeline and you've got billionaire oil executives and shareholders who have much of the US government in their pocket mad at you.

You really don't want to anger people who can buy US elections.

Because when you attack oil it will be considered as an act of war and they will counter with their war powers. Which they did. No civilian police action against Sergey followed, but military style seizures, bitmix closure and Bitcoin retrieval. This was not the FBI, but their criminal higher ups. Military style, with no civilian oversight.

Which is somewhat disturbing, because first the industry is still considered more important than civil services (city councils, hospitals). And second they will still continue using Windows services in their backbones. I have nothing against using Windows as frontends, but in the backbone of a critical company it's criminal negligence. Easy to hack, no backups, untrained admins with no idea about security. Wasting billions on money on theatre, and not working servers, groupware and email.

I hate Windows with a firey passion and use linux top to bottom on all my projects and devices, but I have to disagree with you. Windows can be quite secure, as is evidenced by the last several decades of most corporate and military IT systems using it. Not having backups and untrained admins are platform agnostic security issues.