The deaths if any where probably indirect. E.g. ambulances not turning up in time etc. due to paper and pen fallbacks.

With all the hospitals victim of the attack, I would be surprised if the amount of patients that died are zero.

> E.g. ambulances not turning up in time etc. due to paper and pen fallbacks

Sure. Did this happen?

Why were the “emergency management downtime procedures” insufficient [1]?

[1] https://www.healthcaredive.com/news/crowdstrike-outage-hits-...

If they were equally good as the non-emergency procedures, why wouldn't we use them all the time?

> why wouldn't we use them all the time?

Because they’re more expensive. They’re all not “equally good,” they’re good enough to keep people alive. (You repurpose resources from elective and billing procedures, et cetera.)

This belies a lack of understanding.

What resources are you repurposing from elective procedures exactly? Your patient load hasn’t changed, and day surgical instruments and supplies are from the same pool. There’s no “well this pile of equipment is only for elective procedures”.

I’m not even sure what “billing procedures you’d repurpose (especially in your context of “keeping people alive”).

> Your patient load hasn’t changed, and day surgical instruments and supplies are from the same pool

The outage didn’t change any of these things either.

> not even sure what “billing procedures you’d repurpose

At Mount Sinai, billing staff were redirected to watch newborn babies. Apparently the electronic doors stopped working during the outage.

> The outage didn’t change any of these things either.

Never said that it did. I just don't think your idea of emergency downtime procedures at a hospital are what they are. There's paper and offline charting, most meds can be retrieved similarly, and so on. I heard a claim (from someone here) that an ER was unable to do CPR due to the outage, which could not be remotely true. Crash carts are available and are specifically set up to not require anything else but a combination. Drugs, IV/IO access, etc.

> At Mount Sinai, billing staff were redirected to watch newborn babies.

That sounds like something I would have imagined security doing. To be clear, what they most likely meant here is in the sense of "avoiding abduction of a newborn", not any kind of access to observe and oversee neonates.

I would expect them to be good enough to prevent "obvious" deaths-from-failed-procedures, but deliver a slightly lower quality of care, so that if out of 100 very seriously ill people 50 survived during normal operation, this would turn into e.g. 49.

All of this without the person obviously dying due to the alternative procedures - just e.g. the doctor saw the patient less often and didn't notice some condition as early as they would have under normal procedures.

Would you consider this assumption to be wrong? (I am a layperson, not familiar with how hospitals work except from being a patient.)

Probably because our incredibly inefficient, burdened, and splintered healthcare system barely functions as is, and they do not have the time nor resources to pause and put in place an emergency downtime operating protocol that works as well as their 15 year old windows cobweb

> because our incredibly inefficient, burdened, and splintered healthcare system barely functions as is, and they do not have the time nor resources to pause and put in place an emergency downtime operating protocol

You just responded to an article about the implementation of emergency downtime protocols by speculating, baselessly, that such protocols cannot possibly exist because your mental model of our healthcare system prohibits it. Ironically, all within the context of why software development doesn’t hold itself to the rigors of engineering.

"In Alaska, both non-emergency and 911 calls went unanswered at multiple dispatch centers for seven hours.

Some personnel were shifted to the centers that were still up and running to help with their increased load of calls, while others switched to analog phone systems, Austin McDaniel, state public safety department spokesperson, told USA TODAY in an email. McDaniel said they had a plan in place, but the situation was "certainly unique.”

Agencies in at least seven states reported temporary outages, including the St. Louis County Sheriff's Office, the Faribault Police Department in Minnesota, and 911 systems in New Hampshire, Fulton County, Indiana, and Middletown, Ohio. Reports of 911 outages across the country peaked at more than 100 on Friday just before 3 a.m., according to Downdetector.

In Noble County, Indiana, about 30 miles northwest of Fort Wayne, 911 dispatchers were forced to jot down notes by hand when the system went down in the early morning hours, according to Gabe Creech, the county's emergency management director."

https://eu.usatoday.com/story/news/nation/2024/07/19/crowdst...

I mean, even if the dispatch could handle it in some sense, certainly it was a problem, that might have increased average time to site for the ambulance or fire fighters. I've haven't seen any report of any direct death.

> I've haven't seen any report of any direct death

Exactly. Contrast that with a bridge collapse. It isn’t a mystery or statistical exercise to deduce who died and why.

There were numerous bridge collapses without casualties. Naturally if one company could suddenly collapse 80% of Earth's bridges, direct deaths would be assured. It's great there isn't one for some reason!

> were numerous bridge collapses without casualties

In how many of those cases were criminal charges brought? (It’s not zero. But it’s more limited.)

Because energencx downtime is not supossed to be local and global. Dont worry your startup will not eat those riscs, but neither will those customers stay once insurrance rewrites the guidlines. All that can happen,has already happened, its just consequences propagating now. Nothing we can do with simple blameshifting tactics.

I have argued for years every business should have an analogue operations guide tested every once in a while like a fire drill down to pre-printed carbon copypaper forms. A Lights Out Phones Off Business Continuity Plan would have helped American Airlines too.

Hospitals and doctor’s offices were paralyzed by the outage. Transplant organs are often delivered by couriers on commercial flights. Many pharmacies were unable to fulfill prescriptions.

It wasn’t just vacation travelers that were affected by Crowdstrike’s incompetence.

Hospitals were affected too, I don't think it's that far fetched to think some people died, or at least some could not have been saved due to this incident.

> Hospitals were affected too, I don't think it's that far fetched to think some people died

Absent evidence I’d say it is.

Hospitals have emergency downtime procedures [1]. From what I can tell, the outage was stressful, not deadly.

[1] https://www.npr.org/2024/07/21/nx-s1-5046700/the-crowdstrike...

Apply additional stress to a sufficiently large system that human lives depend on, and someone, somewhere will die.

> Apply additional stress to a sufficiently large system that human lives depend on, and someone, somewhere will die

Sure. Who did?

When a bridge collapses, this isn’t a tough problem. We don’t need to reason from first principles to derive the dead bodies. That’s the difference.

I am positive that people in hospitals died as a direct result of this incident.

> I am positive that people in hospitals died as a direct result of this incident

Do you have clinical or hospital administration experience? A source with evidence, even circumstantial?

Yes

> Do you have clinical or hospital administration experience? A source…

>> Yes

You managed a hospital and failed to implement emergency downtime procedures? (Because that is actually criminal.) Or do you have a source?

Deft goalpost shifting, nice.

Are you the orangutan doctor from futurama?

The commenter said they did not believe hospitals “have the time nor resources to pause and put in place an emergency downtime operating protocol” [1]. That is a reasonable guess. It’s not something one would expect from someone with “clinical or hospital administration experience.”

It’s a glib response, but so is “yes” to a request for attribution.

[1] https://news.ycombinator.com/item?id=41217683

Apropos of anything else, “emergency downtime procedures” do not guarantee the same level of care as normal operations. I’ve worked in and out of hospitals as a critical care paramedic for years.

> “emergency downtime procedures” do not guarantee the same level of care as normal operations

Agreed. It’s also plausible someone had a heart attack due to the stress of flight cancellations. Do we have any evidence of either?

The difference between a bridge collapsing and everything we’re discussing is there isn’t much of a discussion around who died and why.

> I am positive that people in hospitals died as a direct result of this incident.

I'm less positive than you, just because my experience of healthcare infosec is that all a doctor has to do is say "I cannot be slowed down or prevented from doing x or people will die" and that's the end of any process or technical controls on x.

Same with utilities. I've seen the ICS engineers say "No you cannot put a password on this console because I may need instant access to prevent a blackout / explosion" and that pretty much ends the discussion.

Often that's not even wrong. Of course when there is a security incident there'll be a kneejerk reaction to that, and of course that's why ransomware groups love healthcare, but in the meantime, those risks seem reasonable.

Which means I'm guessing Crowdstrike killed a lot of healthcare billing but not a lot of critical care systems because it got ripped off those 30 seconds after install if it was ever installed at all.

Small reminder that the law already has a way of deciding liability for damages, and you don't have to directly drop a bridge on someone to get in trouble.