11.19.08

Gemini version available ♊︎

Liability for Software When Life is at Stake

Posted in Europe, Law, Microsoft, Security, UNIX, Windows at 9:48 am by Dr. Roy Schestowitz

A few months ago we used the London Stock Exchange (LSE) as an example of hugely costly Microsoft failures. The stock market crashed in the technical sense and Microsoft, along with those who are informed or responsible, dodged questions about the problem, which recurs once in several months. That was about money, but this time around it’s about people’s welfare, health, and even lives.

With roughly 320,000,000 zombie PCs out there, how can any sane person put Windows in mission-critical settings like a hospital? Well, that’s just what some people do. They apparently learned nothing from a hospital near Microsoft Corporation turning into a massive botnet and it’s happening again, this time in London. Yesterday’s reports indicate that 3 hospitals were shut down due to Windows virus infections:

BBC: Computer virus affects hospitals

Three London hospitals have been forced to shut down their entire computer systems for at least 24 hours after being hit by a virus.

The Register: PC virus forces three London hospitals into computer shutdown

Three London Hospitals shut down their computer systems on Tuesday in response to a computer virus infection.

[...]

The infection at Barts and London Trust was reportedly caused by the Mytob worm, which contains built-in spyware functionality. Mytob spreads by email and has the ability to plant backdoor software on compromised Windows PCs.

Database leaks are only natural to expect. This means that any person’s personal information and health record can make its way into a hot BitTorrent within hours. It’s wonderful, is it not?

“This means that any person’s personal information and health record can make its way into a hot BitTorrent within hours.”We have already produced and provided some evidence to show that Windows is insecure by design and probably irreparable. Unless it’s overhauled radically or reimplemented from scratch, it can never benefit from several decades of UNIX doctrine, mostly trials and errors which made a robust, scientifically-backed model.

With Microsoft whistleblowers crying foul about critical failures and then getting sacked, one can’t help wondering how Microsoft perceives liability. Appended below are several fairly recent articles about liability, bad software, dangers in healthcare, and questionable EULAs.

For information about the NHS and Microsoft, see this page (to avoid needlessly repeating old references).

_____
[1] Experts are calling for product liability for software

“Product liability does not apply to software,” Gerald Spindler of the Faculty of Law of the University of Göttingen complained. “But what if a whole company comes to a standstill due to faulty software?” he mused.

[2] “Microsoft’s 10Q Risk Factors Lists Conceivable Liability for Data Leaks

Improper disclosure of personal data could result in liability and harm our reputation. We store and process significant amounts of personally identifiable information. It is possible that our security controls over personal data, our training of employees and vendors on data security, and other practices we follow may not prevent the improper disclosure of personally identifiable information. Such disclosure could harm our reputation and subject us to liability under laws that protect personal data, resulting in increased costs or loss of revenue. Our software products also enable our customers to store and process personal data. Perceptions that our products do not adequately protect the privacy of personal information could inhibit sales of our products.

[3] Linux guru argues against security liability

Alan Cox, one of the leading Linux kernel developers, has told a House of Lords hearing that neither open- nor closed-source developers should be liable for the security of the code they write.

[4] New banking code cracks down on out-of-date software

The banking industry has re-affirmed a policy that makes online banking customers responsible for losses if they have out of date anti-virus or anti-phishing protection. New Banking Codes for consumers and businesses took effect on Monday.

[5] Secure web browsing through Live Linux distros

Banking isn’t the be-all and end-all: there’s many other reasons you’d want a secure system, separate from what’s on the hard disk, besides Internet banking. Traveller’s can’t necessarily trust the integrity of a computer in an Internet cafe.

[6] Online banking fraud ‘up 8,000%’

The UK has seen an 8,000% increase in fake internet banking scams in the past two years, the government’s financial watchdog has warned.

The Financial Services Authority (FSA) told peers it was “very concerned” about the growth in “phishing”.

[7] Swedish bank hit by ‘biggest ever’ online heist

Haxdoor typically installs keyloggers to record keystrokes, and hides itself using a rootkit. The payload of the .ki variant of the Trojan was activated when users attempted to log in to the Nordea online banking site. According to the bank, users were redirected to a false home page, where they entered important log-in information, including log-in numbers.

[8] Microsoft confirms OneCare zaps Outlook, Outlook Express e-mail

Microsoft Corp. has acknowledged that a bug in its Windows Live OneCare security suite has been causing users’ e-mail to vanish from Outlook and Outlook Express.

[9] In zombies we trust

A little over a year ago, I wrote an editorial where in back-of-the-envelope style (.pdf) I estimated that perhaps 15-30% of all privately owned computers were no longer under the sole control of their owner. In the intervening months, I received a certain amount of hate mail but in those intervening months Vint Cert guessed 20-40%, Microsoft said 2/3rds, and IDC suggested 3/4ths. It is thus a conservative risk position to assume that any random counterparty stands a fair chance of being already compromised.

[10] Your data or your life

As unlikely and alarmist as this sounds, it could really happen. Intracare is the publisher of a popular practice management system called Dr. Notes. When some doctors balked at a drastic increase in their annual software lease, they were cut off from accessing their own patients? information.

This situation is completely unconscionable. There can be no truly open doctor-patient relationship when an unrelated third party is the de facto owner of and gatekeeper to all related data.

[11] Use Health Vault, Lose Your Rights

Microsoft has announced (NY Times Article) Health Vault. What should have followed here is a review of the service by my actually trying it.

[...]

Heard enough? So had I. I’m absolutely going to pass on Health Vault. In addition to looking like the Microsoft Passport debacle redux, this is a very one-sided contract. They can harm you but you cannot harm them. There is no way for any 3rd party to verify that their privacy and security software works.

[12] Microsoft Healthvault Patient Safety in Question

One topic I’ve not seen addressed is the safety and effectiveness of the data within HV – and I don’t mean “safety” as in the data is secure from unauthorized access or misuse. I mean “safety” as in the utilization of data stored in HV by other applications won’t result in an unsatisfactory patient outcome, you know, like death or injury.

[13] HealthVault: No Commitments and a Sleeping Watchdog.

Has Microsoft committed to keeping the promises that it has already made? No, just the opposite. Their privacy policy concludes:“We may occasionally update this privacy statement”

Which means that when the commitments that Microsoft has made regarding HealthVault become inconvenient, they will simply change them.

[14] HealthVault: Failing the seven generations test

…My mother died of ovarian cancer. My grandmother took a drug while my mother was in utero that increase the chances that my mother would get ovarian cancer. Any consideration given to my mothers genetic propensity to get cancer must take into account this environmental influence…My grandmothers medical record will remain relevant for at least five generations…How long should we be keeping our electronic medical records? We should ensure that they are available for the next seven generations…A private, for-profit, corporation is an inappropriate storehouse for records that the next seven generations will need. Corporations do not last long enough. Consider the Dow Jones Industrial Average, of the original 12 companies that made up the index, only one is still listed…

[...]

But this is still Microsoft we are talking about, which all things being equal, is especially bad. Microsoft has a history of abusing standards, and using those abuses to enable and extend its monopolies. In short they have a history of “being evil” in exactly the sort of way that we cannot afford to have impact our healthcare records.

[15] Bill Gates: Vista is so secure it could run life support systems

While on a visit in Romania, where Bill Gates participated in the celebration of 10 years since the Microsoft branch has been running there, and the launch of Vista, Microsoft?s president declared that, with the right ammount of administration, the new Vista could run life support systems in hospitals.

[16] Do Microsoft’s EULAs have any real legal basis?

“Microsoft has no special exemption from the sale of goods act.” Well, no, probably not – but it might still be selling you “services” instead of “goods”. But the real point to remember is that it doesn’t matter a jot what the “logical” position is, it is what the courts decide that matters.

As far as I know, no one has tested Microsoft’s EULAs in a UK court and, until someone does, Microsoft will just go on assuming that they work. And I don’t fancy the risk of taking on Microsoft’s expensive lawyers in court myself…

[17] EULA La Vista, Baby

Well, I’ve taken a good look at the license agreement — I had insomnia — and I’ve discovered some clauses that will freeze your blood, curl your hair, and do your nails.

[18] Vista’s EULA Product Activation Worries

Mark Rasch looks at the license agreement for Windows Vista and how its product activation component, which can disable operation of the computer, may be like walking on thin ice.

[...]

“Does the Microsoft EULA adequately tell you what will happen if you don’t activate the product or if you can’t establish that it is genuine? Well, not exactly. It does tell you that some parts of the product won’t work – but it also ambiguously says that the product itself won’t work. Moreover, it allows Microsoft, through fine print in a generally unread and non negotiable agreement, to create an opportunity for economic extortion.”

[19] MSN Music Debacle Highlights EULA Dangers

MSN Music’s EULA is a case in point. When active, MSN Music’s webpage touted that customers could “choose their device and know its going to work”.

But when customers went to purchase songs, they were shown legalese that stated the download service and the content provided were sold without warrantee. In other words, Microsoft doesn’t promise you that the service or the music will work, or that you will always have access to music you bought. The flashy advertising promised your music, your way, but the fine print said, our way or the highway.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

3 Comments

  1. David Gerard said,

    November 19, 2008 at 9:58 am

    Gravatar

    I was particularly pleased to see in the Daily Telegraph report mention of the fact that this is a Windows virus. Every time there’s a press report of a computer virus outbreak that doesn’t mention this fact, I think there should be many letters written pointing out that there are no Mac or Linux viruses in the wild, despite repeated attempts at scaremongering by insecurity companies.

  2. Roy Schestowitz said,

    November 19, 2008 at 10:03 am

    Gravatar

    The BBC did not mention this. The Register did. It figures. ;-)

    Microsoft BBC

  3. Needs Sunlight said,

    November 20, 2008 at 9:18 am

    Gravatar

    It’s more than just the viruses that M$ is vulnerable to. The products just aren’t stable for mission critical use. When you look at the server and infrastructure products from M$ it’s even worse.

    Nowadays, pretty much every time I have contact with hospital information systems MS problems rear their ugly head. People I know have on multiple occasions not had their medical records available. Mostly this an annoyance and means they don’t get proper treatment. However, in a different situation, that could mean easily life or death. Hospital staff I interview *lose* over 10 hours per week to Windows-specific failures. That’s the functional equivalent of a > 20% downsizing in service…

    Top heads of departments, already with high workloads and high pressure, go without e-mail and rely on phone and fax. This is because instead of using a mail server (like simta, sendmail, postfix, etc) or collaborative software (like Zimbra, Kolab or Citadel) they use MS. Result? Critical messages lost or delayed.

    In worse cases even the phone is not a refuge. When MS products infect voice mail, replacing mature, stable technologies, then even the phone is not reliable. Again, a phone call, call forwarding and voice mail *are* serious matters of life and death in a hospital. Normally, Asterisk, Meridian, Definity or many other proven systems are used.

    When enough people lose kids, grandparents and elderly parents to lost messages, blocked phones, or unavailable or corrupted medical records, the damage will already have been done.

    Eventually Gates, Ballmer, Allichin, and the whole lot can be said to be party to manslaughter or similar. However, the real blame here and now lands on those making, actively or through inaction, the decision to allow M$ in the hospital.

DecorWhat Else is New


  1. Josef Kratochvìl Rewarded Again for Covering Up EPO Corruption and the EPO Bribes the Press for Lies Whilst Also Lying About Its Colossal Privacy Violations

    Corrupt officials and officials who actively enable the crimes still control the Office and also the body which was supposed to oversee it; it's pretty evident and clear judging by this week's press statements at the EPO's official Web site



  2. [Meme] Sorry, Wrong Country (Or: Slovenia isn't Great Britain)

    Team UPC is trying to go ahead with a total hoax which a high-level European court would certainly put an end to (if or when a referral is initiated)



  3. How Denmark, Iceland, Finland, Norway and Sweden Voted on Patently Unlawful Regulations at the EPO

    We look back and examine what happened 8 years ago when oppressed staff was subjected to unlawful new “regulations” (long enjoyed by António Campinos, the current EPO autocrat)



  4. The EPO’s Overseer/Overseen Collusion — Part XVII: The Non-Monolithic Nordic Bloc

    We start our investigation of how countries in northern Europe ended up voting on the unlawful “Strike Regulations” at the EPO and why



  5. Proof That Windows “11” is a Hoax

    Guest post by Ryan, reprinted with permission



  6. Firefox Becomes as Morally Reprehensible as Apple, Facebook, or Uber

    Guest post by Ryan, reprinted with permission



  7. Links 19/10/2021: GNU dbm 1.22 and Godot 3.4 RC 1

    Links for the day



  8. [Meme] [Teaser] GitHub an Expensive and Dangerous Trap (Also: Misogyny Hub)

    The ongoing Microsoft GitHub exposé will give people compelling reasons to avoid GitHub, which is basically just a subsidised (at a loss) trap



  9. Norway Should Have Voted Against Benoît Battistelli's Illegal (Anti-)'Strike Regulations' at the European Patent Office

    Benoît Battistelli‘s EPO faced no real and potent opposition from Norwegian delegates, who chose to abstain from the vote on the notorious and illegal so-called ‘Strike Regulations’ (they’re just an attack on strikes, an assault on basic rights of labourers)



  10. Links 19/10/2021: Sequoia PGP LGPL 2.0+, Open RAN Adoption

    Links for the day



  11. [Meme] [Teaser] Benoît Battistelli, King of Iceland

    Later today we shall see how the current deputy of the head of the EPO‘s overseeing body was in fact likely rewarded for her complicity in Benoît Battistelli‘s abuses against EPO staff, including staff from Iceland



  12. IRC Proceedings: Monday, October 18, 2021

    IRC logs for Monday, October 18, 2021



  13. Links 19/10/2021: MyGNUHealth 1.0.5 and Ubuntu 22.04 Now Developed

    Links for the day



  14. [Meme] [Teaser] Thrown Under the Bus

    Tomorrow we shall look at Danish enablers of unlawful EPO regulations, Jesper Kongstad and Anne Rejnhold Jørgensen



  15. The World Needs to Know What Many Austrians Already Know About Rude Liar, the Notorious 'Double-Dipper'

    Today we publish many translations (from German) about the Austrian double-dipper, who already became the subject of unfavourable press coverage in his home country; he’s partly responsible for crushing fundamental rights at the EPO under Benoît Battistelli‘s regime



  16. The EPO’s Overseer/Overseen Collusion — Part XVI: The Demise of the Austrian Double-Dipper

    Friedrich ‘Rude Liar’ Rödler is notorious in the eyes of EPO staff, whom he was slandering and scandalising for ages while he himself was the real scandal



  17. Links 18/10/2021: Porteus Kiosk 5.3 and Ventoy 1.0.55

    Links for the day



  18. [Meme] [Teaser] More to Life Than Patents

    Greedy sociopaths oughtn’t be put in charge of patent offices; this is what’s dooming the EPO in recent years (all they think about is money



  19. Microsoft GitHub Exposé — Part II — The Campaign Against GPL Compliance and War on Copyleft Enforcement

    Microsoft contemplated buying GitHub 7.5 years ago; the goal wasn’t to actually support “Open Source” but to crush it from the inside and that’s what Microsoft has been doing over the past 2.5 years (we have some details from the inside)



  20. Links 18/10/2021: Linux 5.15 RC6 and 7 New Stable Kernels

    Links for the day



  21. [Meme] The Austrian School of Friedrich Rude Liar

    With reference to the Austrian School, let’s consider the fact that Friedrich Rude Liar might in fact be standing to personally gain by plundering the EPO‘s staff by demonising them while helping Benoît Battistelli crush them



  22. IRC Proceedings: Sunday, October 17, 2021

    IRC logs for Sunday, October 17, 2021



  23. How (Simple Technical Steps) to Convince Yourself That DuckDuckGo is Just Spyware Connected to Microsoft, Falsely Advertised as 'Privacy'

    In recent days we published or republished some bits and pieces about what DuckDuckGo really is; the above reader dropped by to enlighten us and demonstrate just how easy it is to see what DuckDuckGo does even at the client side (with JavaScript); more people need to confront DuckDuckGo over this and warn colleagues/friends/family (there’s more here)



  24. Austria's Right-Wing Politicians Displaying Their Arrogance to EPO Examiners

    The EPO‘s current regime seems to be serving a money-hungry lobby of corrupt officials and pathological liars; tonight we focus on Austria



  25. [Meme] Friedrich Rödler's Increasingly Incomprehensible Debt Quagmire, Years Before EPO Money Was Trafficked Into the Stock Market

    As it turns out, numerous members of the Administrative Council of the EPO are abundantly corrupt and greedy; They falsely claim or selfishly pretend there’s a financial crisis and then moan about a "gap" that does not exist (unless one counts the illegal gambling, notably EPOTIF, which they approved), in turn recruiting or resorting to scabs that help improve ‘profit margins’



  26. The EPO’s Overseer/Overseen Collusion — Part XV: Et Tu Felix Austria…

    Prior to the Benoît Battistelli and António Campinos regime the EPO‘s hard-working staff was slandered by a corrupt Austrian official, Mr. Rödler



  27. Links 17/10/2021: Blender 2.93.5, Microsoft Bailouts

    Links for the day



  28. Links 17/10/2021: GhostBSD 21.10.16 and Mattermost 6.0

    Links for the day



  29. IRC Proceedings: Saturday, October 16, 2021

    IRC logs for Saturday, October 16, 2021



  30. [Meme] First Illegally Banning Strikes, Then Illegally Taking Over Courts

    The vision of Team Battistelli/Campinos is a hostile takeover of the entire patent system, not just patent offices like the EPO; they’d stop at nothing to get there


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts