I honestly hope that company will be fined to the oblivion, and for criminal charges for that, but i doubt it will happen.
> A day of train downtime in the workshop costs over 1000 USD in contractual penalties, and there are several trains stuck, so the tension level in the SPS is rising.
Also LSR, because evidently they were interested in holding a tender before and so likely don't want to be forced by Newag into overpriced maintenance contracts?
This of assumes that the owner of the train company has the skills to do this. In reality they probably would need outside help and that company might fall foul of copyright issues. (when they are distributing the modified code back to the train company, for example)
But the real problem of course is that all of this code is very likely safety critical. Can they modify it? Probably. Is it a good idea? Not really.
Rather, the companies with botched trains should demand from Newag to remove their locks, for free, and on the side sue them.
This is the way.
Who in their right mind would buy kind of equipment from a Polish company knowing that this kind of nonsense is both widespread and that their legal system has no solution?
Hoestly, "Dieselgate" is not a fitting corollary for this travesty. This is considerably more sinister. Hopefully whatever happens from here will be an agent of change for the better.
Which is why any government funding for new trains should come with the requirement for open source firmware.
Well better yet would be to abolish or reform copyright to be more aligned with the interests of society at large but international pressure makes that even less likely.
I mean - how is "let's mess with something on purpose so that trains won't run" NOT sabotage, since such time as railways exist?
If anything, us software developers should be held liable for more of the damages that we cause.
This is why it would only be a contract dispute; they will argue that the contract did not state up front that if they failed to pay the developer that the software wouldn’t work. The MMO certainly has pages and pages of legalese that everyone knows lets the MMO’s developer get away with anything they want. The independent contractor needs explicit language in their contract to specify exactly what will happen if they aren’t paid on time. That should include late fees, but probably also software that refuses to work until someone fills out a credit card payment form.
It doesn't matter whether the act was committed as part of a company's operations or as an individual's private endeavour.
To all software engineers: please refrain from engaging in criminal activities. If you are instructed to do something illegal, it is important to report it to the relevant authorities.
Yes, developers shouldn't knowingly write code to commit crime, but developers don't tend to receive instructions that directly. Unsurprisingly, the company doesn't mention to every employee that they are knowingly breaking the law.
Instead, developers receive a request to build a feature, and it typically won't be at all obvious that the intended use of that feature is to commit a crime. There might even be a legitimate use of the feature, and then someone finds it can be abused to commit a crime.
Hey Janusz, can you build a safety feature that prevents the train from operating under certain conditions. We don’t know all the conditions yet, so leave it flexible.
Hey Czesław, I cannot leave it flexible, because it's a train that can run over 100km/h with 500 passengers inside, so I need to know the details to perform the required safety analysis. All in all, my name will be in the commit log if someone runs... git blame.
GIT_AUTHOR_NAME=Czeslaw GIT_AUTHOR_EMAIL=czeslaw@januszex.com git commit
(obviously, just kidding)
Back in the 90s, when market economy started here, many many businesses' names had the "-ex" suffix, as apparently it sounded western.
And Janusz is a popular first name, which became a meme for a specific type of a businessman, I suspect that because years ago when the meme started, many of those businessman actually had that name (i.e. it was very popular in that generation).
Now, when you open januszex.com, what's there is a meme of "Janusz Alfa" [1] (I think it should be self-explicable), and a related long-nosed monkey meme (I guess they could be thought of as "Janusz Beta" ot sth like that).
EDIT: [1] The real person from the photo is a Polish politician. I couldn't find if he somehow "triggered" the whole meme situation, so I guess it was just a coincidence--someone stumbled upon his photo, used it, and the rest is history.
Art. 254a. Disruption of a network; damage. Anyone who takes, destroys, damages or renders unfit for use an element of a water supply, sewage, heating, electricity, gas or telecommunications network, or a railway, tramway, trolley bus or metro line, thereby causing a disturbance in the operation of all or part of such network or line, is liable to imprisonment for six months to eight years.
I certainly think that this malware meets the criteria set forth in that law: "renders unfit for use an element of ... a railway ... , thereby causing a disturbance in the operation of all or part of such network or line".
Seems pretty cut & dry to me. I hope some people face real jail time for this. As another comment mentioned, it will probably be a "fall guy" (perhaps a middle manager) but that will still deter future managers from authorizing such fraud, even if the orders come from above. Future managers might reject such orders since it's not worth jail time.
Have you seen The Incredibles (pixar film). This scene is exactly what I'm talking about:
What we have in this case is a company doing something that is wrong, not an individual. To sentence somebody with the statute you and the parent are referring to you need to have a case against an individual, not a company. Secondly, except for this specific statute you have to take into consideration the general rules of the penal code (Zasady odpowiedzialności karnej) and in this case you have to assign blame, find out that the intent, the knowledge of what they were doing etc.
In general, in best case this will be a breach of contract, a civil case, there probably won't be jail time. Don't get your hopes up.
Don't get me wrong, what they did is nefarious, but at the same time I don't think there should be Jail time, just huge fines and some scrutiny (maybe NIK, ABW, CBA etc. - other polish three later agencies) on Newag, maybe barring them from some future deals.
Source: I might be a lawyer...
"To all software engineers; please refrain from engaging in criminal activities. If you are instructed to do something illegal, it is important to report it to the relevant authorities."
Seems more like malicious denial of service, with the goal of enriching the malicious actor.
A motivated legal team would likely be able to find Serious Charges that could apply. Especially if these specific trains / locomotives happen to be "Critical Infrastructure" (not guaranteed).