Connect with us

Business

Column: The CrowdStrike meltdown reminds us that the hacking problem doesn't come only from outside

Published

on

Column: The CrowdStrike meltdown reminds us that the hacking problem doesn't come only from outside

Just last Wednesday, I posted a column reporting how our richest corporations, through sheer miserliness and profit-seeking, left millions of Americans vulnerable to technological attacks on their privacy and welfare.

I failed to raise one important question: What if the attacks come from inside the house?

That’s exactly what happened Friday. An ineptly designed update to a program rolled out by the cybersecurity company CrowdStrike and installed automatically on users’ machines instantly crashed millions of computers running Microsoft programs and left them disabled until manual fixes could be undertaken. Some haven’t been fixed yet.

Crowdstrike seemingly borrowed Boeing’s approach to quality control.

— Business blogger Ed Zitron

Advertisement

The fallout reached worldwide and affected people across the modern technological landscape. Thousands of flights were canceled. Doctors couldn’t perform surgeries. Banking transactions were frozen. Emergency 911 lines went silent.

The affected computers displayed what Microsoft Windows users know as the dreaded “blue screen of death.” Typically, this is a baby-blue screen bearing the message that Microsoft’s operating system hadn’t loaded correctly and the machine should be restarted.

That didn’t work this time: The errant CrowdStrike application was burrowed so deep within the Microsoft operating system — as it’s designed to do — that every time a machine restarted, it ran into the same glitch and went dead again in an infinite doom loop.

The CrowdStrike program — irony of ironies — is an anti-hacking application that identifies hacking attempts and fights them off. In the cat-and-mouse game pitting computer users against hackers, such applications have to be updated regularly. They reside in the bowels of the operating system, because in order to be effective, they have to load before almost any other function.

Advertisement

In this case, a coding error in the update delivered an order to the operating system that caused the system to shut down.

That’s a simplified explanation of what happened. Now let’s look at the lessons this episode teaches us — if we’re willing to learn them.

They have to do with our complacency about our dependence on digital systems, including those distributed by developers we’ve never heard of (CrowdStrike, for instance).

What few people are aware of as they go about their lives is how much crucial digital infrastructure is based on Microsoft programs and applications, and how much of those are supplemented by third-party programs and applications.

All of this must work together to work smoothly — or to appear to work smoothly. Here and there something goes wrong, but its ramifications are sufficiently constrained that it can be rectified quickly, and even invisibly.

Advertisement

A great deal of it, furthermore, is automated; it’s designed to run with a minimum of human intervention. In the view of the IT departments that are expected to monitor all this, humans are perpetual money pits — they need days off, get sick, demand raises, quit and must be replaced by newbies needing training, etc., etc. By comparison, machines look like a one-time capital expense — set it and forget it, is the goal.

Microsoft is the hub of these networks because Microsoft made them its business. It created an open architecture for third-party developers to piggyback on; the fundamental idea was that by extending the system’s capabilities, those other developers made Microsoft’s central system more valuable. Microsoft either outsourced some functions to independent developers, or allowed them to design applications that competed with Microsoft’s versions — but those still were designed to work with Microsoft operability.

Among those developers is Austin, Texas-based CrowdStrike, one of countless firms offering cybersecurity services to Windows users. (Microsoft’s own cybersecurity suite is known as Defender.)

Apple computers and devices don’t have the same vulnerabilities because that company does almost all its extensions in-house, and keeps a very close eye on what it allows to interact with its software and hardware; the company doesn’t allow outside applications to interact with its operating system at the fundamental level available with Microsoft’s systems.

But Apple doesn’t have anywhere near as large a footprint in enterprise services as Microsoft. A report issued in March by the government’s Cyber Safety Review Board about a major hacking intrusion into Microsoft’s cloud system in March 2023 asserted that the company’s “ubiquitous and critical products … underpin essential services that support national security, the foundations of our economy, and public health and safety.”

Advertisement

Anyone living in the modern world has to confront the drawbacks of our reliance on digital technology on almost a daily basis. In prehistoric days, back when our household appliances were mechanical or electric, not electronic, a breakdown was easy to diagnose and fix — switch out a tube or tighten a screw.

When a device ceases to function today, it’s often impossible to pinpoint the fault — did my TV go bad, or did the internet go down, or was it just the channel I was watching?

Yet many of us rely on a single company for multiple services. For example, I get my home phone service, broadband internet, and television/video (broadcast and cable channels and streaming) from a single provider. I don’t have much choice, since for most of these it’s the only provider in my neighborhood. But when it goes down, everything goes down.

That provider, Spectrum, has tried to sell me on its mobile phone service too. I’ve refused, because I figure I need at least one thread of access to the outside world that isn’t dependent on its all-in-one monopoly.

Microsoft’s near-dominance of cloud computing — the ecosystem through which all those enterprise computers that went dead last week communicate with each other and with the outside world — should make all of us queasy, because the company’s cybersafety record is atrocious.

Advertisement

The Cyber Safety Review Board investigation concluded that the March 2023 hack occurred because “Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations.”

The board mentioned, among other things, a “cascade of … avoidable errors” in the company’s cybersecurity program, its failure to detect the compromise by hackers of its own “cryptographic crown jewels,” but only acted after a customer — the U.S. State Department — discovered the incursion itself.

The board found that Microsoft’s security practices were inferior to those of “other cloud service providers.” The report mentioned Amazon, Google and Oracle as Microsoft rivals in cloud services with better security systems.

Microsoft pledged to “adopt a new culture of engineering security in our own networks” and said it had “mobilized our engineering teams to identify and mitigate legacy infrastructure, improve processes, and enforce security benchmarks.”

The CrowdStrike crash suggests that those efforts are still works in progress. It’s fair to say that much of the blame belongs to CrowdStrike, which allowed an update to a crucial application to be sent to users for automatic installation without doing the testing necessary to ensure that the update was operationally bulletproof.

Advertisement

Technology blogger Ed Zitron properly tied the disaster to the financialization of Big Business generally, in which pumping ever higher profits to shareholders becomes a higher priority than ensuring that one’s products meet quality standards.

“Crowdstrike seemingly borrowed Boeing’s approach to quality control,” Zitron wrote, “except instead of building planes where the doors fly off at the most inopportune times (specifically, when you’re cruising at 35,000ft), it released a piece of software that blew up the transportation and banking sectors, to name just a few.”

CrowdStrike Chief Executive George Kurtz moved promptly to “sincerely apologize” to all affected users, via a statement and an appearance on the NBC “Today” show. “We quickly identified the issue and deployed a fix, allowing us to focus diligently on restoring customer systems as our highest priority,” Kurtz said in a posting on the company’s website.

Microsoft placed the blame chiefly on CrowdStrike. “Although this was not a Microsoft incident, given it impacts our ecosystem, we want to provide an update on the steps we’ve taken with CrowdStrike and others to remediate and support our customers,” David Weston, a vice president for enterprise and security, wrote on the company’s website.

But Microsoft, plainly, failed to take on board the necessity of vetting every piece of third-party software that could have an effect on its own customers — before it blew up their computer systems.

Advertisement

No software system is immune from errors, especially now that they’re so complex and multilayered that not even their developers may know all their weak spots. (An error at Amazon’s cloud service incapacitated as many as 150,000 websites for several hours in February 2017 — a major problem, but not nearly on the scale of the CrowdStrike crash.)

But as these systems play an ever expanding role in modern life even as they become more complex, it’s incumbent on their providers to make security and safety their top priorities, not merely mouth the concept in marketing material without actually taking it seriously.

Cloud clients also need to pay more attention to what is getting automatically inserted into their systems. Who has the right to gloat over escaping the CrowdStrike meltdown last week? Amusingly, it’s Southwest Airlines. For decades, Southwest resisted Microsoft’s urgings that it upgrade its systems to the latest versions of Windows, relying on Windows 3.1, which is 32 years old — so antique that the CrowdStrike update wouldn’t even work on the airline’s systems.

So while affected carriers such as Delta, United and American had canceled nearly 2,400 flights by 6 p.m. Friday, Southwest had canceled three. (By midday Monday, the number of canceled flights reached beyond 12,300.) That doesn’t mean that Southwest gets everything right. After all, the airline suffered more than its competitors from the ferocious storm in December 2022 that snarled air traffic nationwide — precisely because it had not paid enough attention to keeping its computer systems updated.

In this case, however, Southwest’s cheapskate culture was its savior. That may only put it on the same level as the proverbial blind squirrel that occasionally finds a nut. But it shows that all of our Big Business squirrels need to keep their eyes open, and focused on the perils of inattention.

Advertisement

Business

Supreme Court ruling against Trump’s tariffs leaves Mexico in cautious wait-and-see mode

Published

on

Supreme Court ruling against Trump’s tariffs leaves Mexico in cautious wait-and-see mode

Mexico’s secretary of the economy, Marcelo Ebrard, urged “prudence” Friday in the aftermath of the U.S. Supreme Court ruling invalidating part of President Trump’s sweeping tariff regimen.

“We have to see where this is going,” Ebrard told reporters. “We have to see what measures [Washington] is going to take to figure out how it is going to affect our country. “

Amid widespread concern about tariffs in Mexico — the United States’ major commercial partner, with almost $1 trillion in annual two-way trade — Ebrard cautioned: “I tell you to put yourselves in zen mode. As tranquil as possible.”

Across the globe, nations were assessing how the high court’s ruling might affect them. Some world leaders expressed relief or satisfaction with Friday’s decision.

“The justices have shown that even a US president does not operate in a legal vacuum. Legal boundaries have been set, the era of unlimited, arbitrary tariffs may now be coming to an end,” Bernd Lange, chair of the European Parliament’s International Trade Committee, wrote on X.

Advertisement

Also writing on X, Canada’s trade minister, Dominic LeBlanc, referred to the International Emergency Economic Powers Act, which the Trump administration used to impose tariffs: “The United States Supreme Court’s decision reinforces Canada’s position that the IEEPA tariffs imposed by the United States are unjustified.”

Mexican President Claudia Sheinbaum, when asked about the tariffs, said, “We’ll review the resolution carefully and then gladly give our opinion.”

Ebrard said he plans to travel to the United States next week to clarify matters.

Last year, Ebrard noted, Mexico managed to stave off Trump’s threats to impose a 25% across-the-board levy on all Mexican imports.

However, Mexico has been pushing back against Trump administration tariffs on imports of vehicles, steel and aluminum, among other products.

Advertisement

Among other impacts, the Supreme Court voided so-called fentanyl tariffs on Mexico, China and Canada. The Trump administration said it imposed those levies to force the three nations to crack down on trafficking of the deadly synthetic opioid.

In the aftermath of Friday’s ruling, Trump said he planned to seek alternative legal avenues to impose now-stricken tariffs.

About 85% of Mexican exports to the United States are exempt from tariffs because of the United States-Mexico-Canada Agreement. The accord extended a mostly free-trade regimen among the three nations, replacing the North American Free Trade Agreement.

The three-way pact is scheduled for joint review starting July 1. That date marks six years since the agreement was signed during the first Trump presidential term.

Advertisement
Continue Reading

Business

This company tries to recycle the really difficult plastics

Published

on

This company tries to recycle the really difficult plastics

A start-up recycling company has a message for its potential, environmentally conscious customers: Don’t send your problem garbage to the landfill; put it on your front porch.

The company is Ridwell, and if you drive the residential streets of the San Francisco Bay Area or Los Angeles, you’re likely to see the company’s signature white metal boxes on porches.

The boxes are for empty tortilla chip and plastic produce bags, used clothing, light bulbs and batteries. In some locations, polystyrene peanuts. All the things you’re not supposed to put in the blue recycle bin, but wish you could.

The Seattle-based waste service is geared toward people who worry their waste will end up in the landfill, or get exported to a developing country in Asia. They sort their waste into colorfully labeled canvas bags the company provides, and wait for a Ridwell pickup.

“Sorting is our special sauce,” said Gerrine Pan, the company’s vice president of partnerships. Part of the reason the company is successful at finding markets — or buyers — for its waste, she said, is that it’s sorted and pretty clean (unlike the food-contaminated jumble of waste that gets stuffed in many blue bins).

Advertisement

The company promises to distribute all that waste to specialty recyclers, manufacturers, even thrift shops.

Bagged recyclables sit in boxes at the Ridwell warehouse in San Leandro.

But critics say the boutique waste hauler is not accomplishing anything environmentally useful and is selling the public a myth: that these plastics — multilayer plastic film, plastic bags, polystyrene — can be taken care of responsibly. The service would be benign, they say, if it stuck to the delivery of materials, such as light bulbs and batteries, that can be recycled.

Most local waste haulers don’t accept batteries and light bulbs because they can pose a hazard to workers and equipment.

Advertisement

The base Ridwell membership is $20 a month. For that, a driver will come by every two weeks and take the presorted bags to a warehouse where they’re emptied, the contents stacked and collected, until there’s enough to deliver to a facility that will take it.

In this composite image, various recyclable items

Sorted recyclable items await transport at the Ridwell central warehouse.

Company lore is that founder Ryan Metzger and his son were frustrated that so many things weren’t accepted by their local hauler for recycling. The two sat down and researched where to take the stuff, then decided to scale up and serve their neighbors.

The company has since expanded to Vancouver, Wash.; Portland, Ore.; San Francisco; Los Angeles; Denver; Austin, Texas; Minneapolis and Atlanta. It now boasts more than 130,000 customers nationwide.

Most of the waste is delivered locally. But some of it travels hundreds, if not thousands of miles.

Advertisement

For instance, multilayer plastic bags — those that hold snack chips, candy and coffee beans — are the scourge of municipal garbage haulers because they cannot be recycled, and if put in the blue bins, can damage mechanical sorting machines. Ridwell, however, found Hydroblox, a company that melts the multilayer films into hard, plastic bricks that can be used for drainage projects in landscaping and road construction.

But this arrangement highlights some of the limitations of the nascent industry. Hydroblox owner Ed Greiser said he can take only so many chip bags. The company is growing, but it’s still pretty small, and he’s typically maxed out on the bags.

Workers sift through recyclables

Ridwell workers sift through recyclables.

“This article is going to be a nightmare for me,” he told a Times reporter, because it’s likely to attract a parade of unsolicited garbage trucks looking to dump their bags. “I’m not the solution.”

In addition, Greiser’s two facilities are in Pennsylvania, more than 2,700 miles from most West Coast pickup points, a steep transportation cost for a plastic bag that could instead go 20 miles to a local landfill.

Advertisement

Ridwell also has recently expanded to serve customers outside its pickup cities. It sends special plastic bags to these far-flung subscribers so they can sort their waste and ship it back.

Again, critics say the company’s decision to operate a service that is dependent on plastic bags and requires extensive transport undermines their environmental bona fides. And they worry that a narrative suggesting all waste can be dealt with responsibly is false and misleading. That misconception, they say, contributes to the glut of plastic piling up in our rivers and oceans, and inside our bodies.

“There is typically a reason why a given product isn’t being recycled through curbside collection, and it usually isn’t for lack of effort by cities and counties,” said Nick Lapis, director of advocacy for Californians Against Waste. “Most of the material being collected by boutique collection services like Ridwell are either very difficult to manage or lack strong recycling markets.”

Manufacturers of plastic packaging, not consumers, should pay for recycling products and packaging at the end of their life, he said. For regular people, “having to pay an extra fee to handle the unrecyclable plastic packaging that is thrust upon us every day is antithetical to every concept of producer responsibility.”

Earlier this month, the anti-plastic group Beyond Plastics published a disparaging report on boutique waste haulers, including Ridwell, accusing them of providing cover for plastic and packaging manufacturers who want people to believe their waste is being recycled.

Advertisement
a Ridwell employee inserts a bag of recyclables into a compressing machine

A Ridwell employee inserts a bag of recyclables into a bailer at the San Leandro warehouse.

Ridwell offered a visitor a tour of its Bay Area warehouse in San Leandro. The spacious facility behind a Home Depot and Walmart was crowded with steel drums filled with alternating layers of batteries and fire-retardant pellets, boxes of light bulbs and piles of used clothes, all destined for recyclers, upcyclers and thrift stores.

While the public may think of recycling as a largely physical process, it’s actually a market: a function of how well a material can be profitably turned into something else.

Wearable fabrics are seen in boxes and bins awaiting transport

Boxes of clothing await transport.

Metzger, Ridwell’s chief executive, said some of the material his company collects can be sold. Some of it is given away, “and some we pay to have responsibly processed.” The more technically challenging the plastic, the more likely Ridwell will have to pay to deal with it, he said.

Advertisement

He said the company vets all the places it sends its waste, giving preference to those that use items a second time over those that melt them down or shred them to make them into something else. It also gives preference to partners that are local.

He said his company is “careful not to present plastic recycling as a cure-all,” and it turns away some materials, for example vinyl shower curtains, “because we don’t have a downstream partner we can stand behind.”

And while Metzger agrees with many of Beyond Plastic’s concerns, he has observed that “when customers actively sort and see which items require special handling, it often increases their awareness of where plastic waste is coming from in their own lives … [leading] them to change purchasing habits and avoid certain packaging altogether.”

Advertisement
Continue Reading

Business

Black Altadena fire victims clash with Edison over compensation

Published

on

Black Altadena fire victims clash with Edison over compensation

Outside a hall where Southern California Edison was celebrating Black History Month on Friday, a group of Altadena residents stood on the sidewalk, waving signs and talking of the homes and family members they lost in last year’s Eaton fire.

“They’re in there celebrating Black history and they’ve destroyed a Black town,” said Nicole Vasquez of My Tribe Rise, which helped organize the protest.

The Jan. 7, 2025 fire destroyed thousands of homes, including the majority of homes in west Altadena, a historically Black community. All but one of the 19 people who died were in west Altadena.

“If Edison’s tower did not ignite the fire, Altadena would still be there,” said Trevor Howard Kelley, who lost his 83-year-old mother, Erliene, in the fire.

Kelley, his daughter and two granddaughters had been living with his mother before her home was destroyed, he said.

Advertisement

The Black Altadena residents are part of a larger coalition that is asking Edison to advance each family who lost their home $200,000 in emergency housing assistance. They say that more than a year after the blaze many wildfire survivors are running out of the funds they had received from insurers.

The group protesting Friday also called for transparency from Edison. The company has said it believes it is likely its equipment caused the fire but has continued to deny it did anything wrong.

“We just want the truth,” said Felicia Ford, who lost her house in the fire. “What’s wrong with saying, ‘We got this wrong.’”

Scott Johnson, an Edison spokesperson, said Friday that the company continued to believe its voluntary compensation program was the best way to help victims of the fire. Edison has promised to quickly review each victim’s claim and pay it swiftly if approved.

Families who lost their homes can receive hundreds of thousands of dollars under the program, while those with damaged homes receive lesser amounts.

Advertisement

But many survivors say they don’t believe the offered amounts fully compensate their losses. And to receive the money, victims must agree not to sue — which many are not willing to do.

“We recognize the incredible struggles the community has faced,” Johnson said. “The intent of the program is to reach final settlements to allow the community to rebuild and move on.”

The investigation into the cause of the fire has not yet been released. Edison has said a leading theory is that its century-old transmission line in Eaton Canyon, which had not carried electricity for 50 years, somehow became reenergized and sparked the fire.

Company executives said they did not remove the old line because they believed it would be used in the future.

Tru Williams said he just wants to get his parents back home.

Advertisement

(Myung J. Chun / Los Angeles Times)

In December, state regulators ordered Edison to identify fire risks on its 355 miles of out-of service transmission lines located in areas of high fire risk and tell regulators how executives planned to use the lines in the future.

This week, Edison disclosed that the Los Angeles County district attorney was investigating whether Edison should be criminally prosecuted for its actions in the fire.

West Altadena became one of L.A.’s first middle-class Black neighborhoods in the 1960s, partly because discriminatory redlining practices for years kept Black homebuyers from settling east of Lake Avenue.

Advertisement

Heavenly Hughes, co-founder of My Tribe Rise, told the crowd she had lived in Altadena for 50 years.

“I was raised in a thriving working-class community and they have destroyed that community,” Hughes said, referring to Edison.

Added Ford, “The people making these decisions aren’t suffering at all. They’re still getting their paychecks, bonuses and stock options.”

Advertisement
Continue Reading

Trending