Europol and the NHS are both warning people going back to work after the weekend to start up their computer with care. The cyber-attack on the UK health service, which also brought down systems in at least 150 countries, is an illustration of the vulnerability of the networks and software on which societies and economies now depend. In an ironical twist, it appears that the unknown writers of the “WannaCry” malware had themselves left a security hole in their creation, which allowed the attack to be halted once their mistake was discovered.
We do not yet know how much damage WannaCry caused. People may have died; trauma units have been shut down and operations postponed. The attack serves, among other things, as a warning that nothing and nowhere is really secure.
The crucial weakness in Microsoft Windows that allowed the infection to spread had been identified years ago by the National Security Agency in Washington (and no doubt shared with Britain’s surveillance agency GCHQ). It seems to have informed no one else. Had it seen its duty primarily as defending friendly computer networks, as Edward Snowden has suggested it does, it might have issued a warning. It did not. Only when the hacking toolkit was itself stolen and published on the web did Microsoft respond with a patch that offered protection.
Up-to-date computer systems were safe, but many others were not. The NHS, which has tens of thousands of computers running the obsolete Windows XP system, had not renewed its support contract with Microsoft. Despite the demand of the national data guardian, Dame Fiona Caldicott, they had not been upgraded. It’s clear from Dame Fiona’s letter that some of the system’s insecurities are the results of its users working their way around measures they find obstructive; but some must also be the result of financial pressure, which does not just affect the cost of software licences but the enormous expense of retraining and supporting users. The blame for software failures is thus widely distributed.
However, the costs fall entirely on the victims. In no other industry could the manufacturers take so little legal responsibility for the safety and reliability of the goods they sell. If the NHS had bought a fleet of ambulances whose only flaw was that the left front wheel fell off every time it hit a pothole, the makers would be sued. But if the manufacturer were a software company, it would simply charge extra for upgrading the wheels.
Computer software is difficult and complex. In the case of some neural networks, not even the programmers can trace, still less understand, how the conclusions emerge from the inputs. Yet we live in a world that depends on it. The connectivity that makes us vulnerable also knits the economy together. The strong encryption that is used to lock the files so that a ransom can be paid also underlies the security of a properly administered banking system.
The assault on the NHS is part of a growing pattern of international lawlessness that shows how optimistic were the libertarian dreams of the early internet culture. What has emerged instead is a kind of feudal system, where not just individuals but even powerful companies, banks and government agencies in their operations in cyberspace are no more than unarmed peasants dependent on Microsoft, Google or the other great baronies to protect them from the robbers and bandits waiting to exploit weakness. In exchange for this vital protection, they own our virtual lives. All of the obvious measures to guard us against the next attack – which is certainly coming – must be taken.
This is not the first ransomware attack on the NHS but it must be the last one that is successful. Though it will cost money, it is essential that the government takes digital security as seriously as it takes hygiene in hospitals. In the long run, however, we must also work for democratic control over the wider system of digital feudalism.
