> The file or files were altered in spite of rules that prohibit those kind of changes on a live system.
Can anyone here argue that, given arbitrary write access, intimate knowledge of the system, and the ability to disable any deployment and runtime checks I want, I wouldn’t be able to take out their production system?
I just realized I have never disabled cell access on my watch.
It isn't clear to me why airplane mode is requested on airplanes. It doesn't reinforce crew control, it reinforces complete lack of crew control, i.e. crew control theatre.
What should they have done in this case that didn't involve flat out preventing it?
There has to be a limit to this reasoning, though. There is a threshold where an organization is so negligent that they can’t concentrate the blame on an individual, regardless of whether there was a policy violation.
I'm reminded of the punchline to an old joke:
"Doctor, it hurts when I do this!"
"Don't do that."
It does suggest a big lapse in oversight: if this wasn’t the first time they did this, their security monitoring should have picked it up.
My guess is that this is going to be one of those situations where someone broke the rules in a way their immediate management knew about but sanctioned because the official process was dysfunctional. In those cases it’s really common to crucify the operator and ignore the larger problem.