Hacker News Reader

Comment by rrggrr | Hacker News Reader

Fault will be leveled against Bitcoin for facilitating the ransom, against Microsoft, against NHS budget underfunding... everywhere EXCEPT where the blame belongs. Products liability law applied to IT security would put a quick end to most vulnerabilities.

View on HN

Seems strange to not mention the ransomers as having culpability.

I'm 100% in favor of better systems/processes/technology to prevent exploits, but I'm also 100% in favor of blaming the perpetrators of the ransom also.

In the real world we don't accept the argument that the victim is primarily at fault.

  * leaving your car unlocked doesn't mean that is OK for someone to steal it and demand a ransom for its return

  * leaving your house/apartment unlocked doesn't mean that it is OK for someone to swap out the locks and demand ransom for the new keys

And it really isn't about being locked/unlocked. Doors and locks can generally be easily broken or bypassed, doesn't mean that everyone should have to purchase industrial strength doors and locking systems (and windows, and...).

Leaving your car or house unlocked means that you're negligent, not that the attack is your fault.

Exactly, and if you had someone's important confidential information sitting on the seat (or even on an un-encrypted laptop), you would be liable for that loss.

The thief would still be hold accountable if caught. That is what g is saying, that we just gloss over the thief in this case.

Well said.

+2 for that ;)

Of course the ransomware authors/controllers should be (and are) culpable.

But when financially lucrative attacks can be carried out with very little risk of being caught, and the results are so bad, organizations who don't take security very seriously are at fault for not recognizing the threat landscape, and government is at fault for not recognizing that the market isn't solving this problem, stepping in and requiring higher quality assurance or liability for software.

> In the real world we don't accept the argument that the victim is primarily at fault.

If you're worried about X, and Y promises to prevent X for a cost, you seek recourse against Y.

X: I can't miss this flight. Y: Pay this surcharge to reserve a seat. Overbooking ensues. I'm blaming Y and not the other passengers.

X: Really don't want this disease to kill me. Y: Take these pills to not die. Death ensues. I'm (well somebody else is) blaming Y and not the disease.

In life we can't always control the cause so we aim to minimize the effect. Thus, while the ransomers are culpable for the blast, IT security are accountable for the size of the blast radius.

You are downgrading and equating intentional criminal acts to normal day-to-day unpredictability.

They're not the same but when you can't control the cause what's the difference?

Due to the nature of the web, unless you unplug from the Internet, the risk is persistent. So although a cybercrime-free world would be swell, until that day arrives we must control the effects.

> unless you unplug from the Internet

I'm not convinced this isn't the answer. What are we gaining by putting hospital networks on the Internet? Are those gains worth the cost in increased vulnerability?

The only thing I think we gain is we're able to track patients better.

How we talk about these situations and the expectations we have are very important. If we collectively signal that extortion is OK and just something everyone needs to get used to then you are de-stigmatizing criminal behavior. I don't think that is a good idea.

I agree, extortion is not OK. Simply saying that this could have been mitigated and if there's someone's job to mitigate things like this, it's on them.

You don't have to look hard to find criminal activity referred to as an epidemic.

Which is to say, that public health countermeasures and similar modes of risk-mitigation apply.

Of course they're culpable, but crime is an environmental problem you have to deal with, just like bad weather. No amount of shaking your fist at the clouds is going to mitigate the problem of a leaky roof.

I'm am explicitly rejecting that analogy. Human behavior is not like weather at all. The expectations that we set for our community/society is important.

Bad weather is indifferent to the shaking fists. It won't get worse or more frequent if people fail to shake their fist. But human behavior is very much responsive to feedback from other humans. I'm arguing that we should all be shaking our fists when we see extortionists at work as well as tracking them down and punishing them. And we should also take care to protect ourselves from them. It isn't a binary choice.

The first words I wrote were 'of course they're culpable.' Human behavior is very much like the weather in that our actions today shape the environment of tomorrow, albeit by long and often obscure causal chains.

Nowhere id I assert that it's a binary choice, and that interpretation of ym words only make sense if you ignore chunks of what I'm saying. Over the near term, you're not going to eliminate crime by moral suasion so it's important to have a strategy to mitigate its predictable incidence while we also work on the problem of how to reduce crime through deterrence, reducing incentives, and so on.

You can explicitly reject the analogy.

That doesn't make you correct.

https://www.ncbi.nlm.nih.gov/pubmed/9532958

Crime is a public health issue. It shares common causes with ill health, particularly poverty, and fear of violent crime is itself a major cause of anxiety. Community development in pre-school education, parental education, and among ethnic minorities, both reduces crime and promotes better health, for example in reducing the effects of alcohol and illicit drugs. Health workers should contribute in full to community development.

I note that I'm standing with my earlier characterisation of a public health domain rather than weather, but both carry very strong similarities, including a risk / forecast / mitigations approach.

There is not international community which regulates acceptable behavior for international criminal organizations.

You're confusing ethics with legal liability. Nobody is saying IT is ethically responsible, they're saying they are legally responsible since the entire reason they get a paycheck is to prevent these sorts of things. Reduce it to a contractual matter if that assuages your conscience.

If you hire a bodyguard and still get shot while the bodyguard is on his phone both the perpetrator goes to jail and the bodyguard gets fired/pays restitution. Not that unheard of. It's not like one person gets all of the legal and ethical blame and everyone else is entirely absolved.

I'm not confusing things. I'm saying that public discussion seems to migrate towards prevention/mitigation and de-emphasizes the criminality. I'm arguing that we not forget that and pointing out that it was missing from the post I responded to.

In your bodyguard example I don't think in that type of a situation that people fixate on the quality of the security detail. They rightly demand that the shooter be tracked down.

What's the point of discussing criminality? The criminal justice system is centralized and functions independent of public interest in getting results from it. (And, in fact, functions better when the public is mostly unaware of crime, re: jury selection.)

The civic justice system, on the other hand, is completely driven by public interest—nothing gets done to change things unless somebody (or some class) bothers to sue.

> What's the point of discussing criminality?

Well, for one thing, we could try to think of ways how to catch these criminals, how to help law enforcement.

We have the same likelihood of bringing the criminals to justice as someone who left a laptop on a bench at an international airport for several days and then went back to look for it.

We can blame the criminals, but we will always have criminals when the crime is easy.

Those who are really responsible here are the ones who allowed themselves to become dependent on an ancient and insecure operating system.

To me, the buck should stop with the head of the hospitals.

People talk about it that way because locking your doors is more pragmatic than eliminating every criminal in the world for all time? Because the purpose of conversation about preventable injuries should be constructive, rather than idle? Because whether someone should do bad things should be a discussion between people who do bad things, but people who are victims should be discussing how not to be victims? Because when someone trusts you to protect something, there's 1) an assumption that that thing could be damaged, or else no reason to have hired you to protect it, and 2) a moral responsibility as the person entrusted with guarding it to do a good job, or else your taking money is wasteful and your promise made in order to get it is fraud?

Any number of reasons all boiling down to the same reason: what does calling bad people bad accomplish? Best for people who want to be good to talk about how to be good.

Very few people would argue that it's "OK" to commit crimes that you are capable of getting away with. It's the victim's "fault" as it is the fault of a person who doesn't wear a seatbelt and dies a preventable death in a car accident that they died i.e. not a moral failure, just a failure.

In both those situations whilst it isn't the victims fault, it will invalidate their insurance and any loss is theirs to sort out. So when buying IT services you need to include in the contract the security of it too, a Ransomware attack such as this (and not just because one user infects one machine) would be the fault of the IT provider

Apparently some blame should also go to the NSA, whose leaked hacking tools were used for this:

https://mobile.nytimes.com/2017/05/12/world/europe/uk-nation...

> everywhere EXCEPT where the blame belongs

The NSA?

So if I lose my gun on the street and someone (18+) picks it up and shoots somebody, the blame belongs to me?

Not saying that the NSA is innocent as a child, but please don't put all on them.

If I would have a zero-day I wouldn't go out and encrypt people computers.

I'd eschew the gun metaphor because rifht to bear arms, etc.

But if you find a cooler with a vial of Ebola on the street, take it home instead of turning it in, then have it stolen and have that strain implicated in an outbreak?

Yeah... that's definitely at least partly on your hands.

The right to bear arms can also extend to cyber arms. And I mean it seriously.

I never thought about it like that before. Interesting.

The 'arms' in 'right to bear arms' is not clearly defined, and the founders would not have had any concept of software or weaponised software, but I can't think of an argument against people owning malicious software if the argument for owning firearms is also in play.

> So if I lose my gun on the street and someone (18+) picks it up and shoots somebody, the blame belongs to me?

I would say this is closer to having your guns stolen from your home while you're asleep and then used in a crime.

It's more like finding out you can shoot someone's door knob off with your gun, creating a documented process to make that easier, and hiding it from the public despite your pledge to disclose door knob vulnerabilities.

It shouldn't be a surprise when someone else starts shooting off doorknobs.

How do product liability laws cover vulnerabilities no one knew exist. Let's say it isn't a case of lack of forethought or ignoring bug and vulnerability reports, how do these laws treat it then?

>Products liability law

Wouldn't that hold Microsoft liable then?

Depends. And that's exactly why it's easy to say "we need product liability law", but very difficult to say how it would work in practice.

Maybe, but a patch for this issue being exploited has been out for quite some time. What's happened is that unpatched versions are being exploited.

>Products liability law applied to IT security would put a quick end to most vulnerabilities

No, it would make IT security about as expensive as good lawyers. Just to cover the losses. A method to reliably produce vulnerability-free software is not invented yet.

> A method to reliably produce vulnerability-free software is not invented yet.

I beg to differ. We have formal methods, ranging from type systems to full blown verification. This isn't a technical problem, it's an economic one.

Had these methods been applied to security aspect of software development? Any examples?

On the lower end of the spectrum, sound type systems prevent a class of vulnerabilities including buffer overflows. On the upper end, https://sel4.systems/, a formally verified microkernel, is used in security-critical systems.

> A method to reliably produce vulnerability-free software is not invented yet

That's not the goal. Well it is, but it's unachievable. We need to get people to care about security beyond ensuring that teenagers can't trivially get in—the current state of affairs for enterprise IT.

A law would at least require companies to give a fuck beyond the "can the CEO's niece break in" level.

Reply on news.ycombinator.com