LAST Friday, the unthinkable happened: a flawed update application caused 8.5 million computers around the world to seize up. In what is arguably the worst cyber event ever, banks, airports, hospitals, media outlets, and scores of businesses with Windows-based computer systems crashed, triggering a global technology catastrophe.
Almost 30,000 flights were delayed worldwide, and nearly 7,000 were canceled. At the Ninoy Aquino International Airport, thousands of passengers were stranded, and long lines formed at check-in counters as flight information screens blanked out.
The online services of several banks in the Philippines were also affected.
The outage also forced Tesla to halt some production lines in Texas and Nevada. And in Paris, the accreditation of athletes and media representatives for the Olympic Games, which starts in the French capital this week, was temporarily suspended.
Less than 1 percent of all Windows devices were affected, but the scale of havoc and disruption from the outage shocked the experts.
Microsoft, which developed and markets the Windows operating system, identified the glitch as a software from CrowdStrike, a US-based cybersecurity company, that was supposed to update computer systems’ defenses against hacking. Instead, the faulty code in the software touched off a cyber nightmare.
Microsoft has since turned the heat on CrowdStrike for not running enough control checks on its updates before releasing them.
One security researcher says that ideally, an update “would have been rolled out to a limited pool first. That’s a safer approach to avoid a big mess like this.”
Following the outage, questions have resurfaced about what the New York Times describes as the “global economy’s fragile dependence on certain software and the cascading effect it can have when things go wrong.”
It is a given that in today’s increasingly complex technological ecosystem, things will go wrong. The question is when and whether we are prepared to handle it.
The massive IT crash “is a reminder of how complex and intertwined our global computing systems are and how vulnerable they are to a mistake and an error,” notes senior software analyst Gil Luria.
But another, perhaps bigger, threat has emerged. There are warnings online that cybercriminals are exploiting the situation to launch phishing campaigns and distribute malware-laden links.
With CrowdStrike’s flaws exposed, hackers will no doubt waste no time to develop more sophisticated technology that will be more difficult to detect.
The outage is also expected to fuel debate on the risk of global overdependence on cloud computing, where companies use servers run by tech giants for their computing needs instead of their own systems.
As more economic activity takes place in the “cloud,” the risk that the platforms on which it is based could collapse increases.
Rohit Chopra, director of the US Consumer Financial Protection Bureau, said that with Friday’s crash, “we’re just getting a taste of some potential effects of real reliance by the financial sector and sectors across the economy on a handful of cloud companies and other key systems.”
Andrius Minkevicius, a cybersecurity expert, warns businesses of the downside to outsourcing their technology to the big vendors. “Today, we’re seeing an example of those who relied mostly on vendor-offered cyber protection without additional contingency plans and are now suffering reputational and financial damage,” Minkevicius said in an interview with CNBC.
Michael Daniel, who heads the Cyber Threat Alliance, said businesses must ponder: “How do you balance the benefits of having everybody on the same operating system with the concentration risk that poses?”
The answer could be governance. Technological empires like Microsoft and Google have long resisted efforts by governments to subject them to regulations. The outage could ratchet up pressure for them to agree to regulatory jurisdiction.
A law in the European Union bars big tech companies from badgering smaller rivals. Google has been forced to reduce the sharing of personal data of its European clients with other search platforms.
In the US, the federal government has brought antitrust cases against Microsoft and Google.
Unless the major players in the digital information economy agree to governance, there is no guarantee that last Friday’s global outage would be the last.