Connect with us

Business

Column: The CrowdStrike meltdown reminds us that the hacking problem doesn't come only from outside

Published

on

Column: The CrowdStrike meltdown reminds us that the hacking problem doesn't come only from outside

Just last Wednesday, I posted a column reporting how our richest corporations, through sheer miserliness and profit-seeking, left millions of Americans vulnerable to technological attacks on their privacy and welfare.

I failed to raise one important question: What if the attacks come from inside the house?

That’s exactly what happened Friday. An ineptly designed update to a program rolled out by the cybersecurity company CrowdStrike and installed automatically on users’ machines instantly crashed millions of computers running Microsoft programs and left them disabled until manual fixes could be undertaken. Some haven’t been fixed yet.

Crowdstrike seemingly borrowed Boeing’s approach to quality control.

— Business blogger Ed Zitron

Advertisement

The fallout reached worldwide and affected people across the modern technological landscape. Thousands of flights were canceled. Doctors couldn’t perform surgeries. Banking transactions were frozen. Emergency 911 lines went silent.

The affected computers displayed what Microsoft Windows users know as the dreaded “blue screen of death.” Typically, this is a baby-blue screen bearing the message that Microsoft’s operating system hadn’t loaded correctly and the machine should be restarted.

That didn’t work this time: The errant CrowdStrike application was burrowed so deep within the Microsoft operating system — as it’s designed to do — that every time a machine restarted, it ran into the same glitch and went dead again in an infinite doom loop.

The CrowdStrike program — irony of ironies — is an anti-hacking application that identifies hacking attempts and fights them off. In the cat-and-mouse game pitting computer users against hackers, such applications have to be updated regularly. They reside in the bowels of the operating system, because in order to be effective, they have to load before almost any other function.

Advertisement

In this case, a coding error in the update delivered an order to the operating system that caused the system to shut down.

That’s a simplified explanation of what happened. Now let’s look at the lessons this episode teaches us — if we’re willing to learn them.

They have to do with our complacency about our dependence on digital systems, including those distributed by developers we’ve never heard of (CrowdStrike, for instance).

What few people are aware of as they go about their lives is how much crucial digital infrastructure is based on Microsoft programs and applications, and how much of those are supplemented by third-party programs and applications.

All of this must work together to work smoothly — or to appear to work smoothly. Here and there something goes wrong, but its ramifications are sufficiently constrained that it can be rectified quickly, and even invisibly.

Advertisement

A great deal of it, furthermore, is automated; it’s designed to run with a minimum of human intervention. In the view of the IT departments that are expected to monitor all this, humans are perpetual money pits — they need days off, get sick, demand raises, quit and must be replaced by newbies needing training, etc., etc. By comparison, machines look like a one-time capital expense — set it and forget it, is the goal.

Microsoft is the hub of these networks because Microsoft made them its business. It created an open architecture for third-party developers to piggyback on; the fundamental idea was that by extending the system’s capabilities, those other developers made Microsoft’s central system more valuable. Microsoft either outsourced some functions to independent developers, or allowed them to design applications that competed with Microsoft’s versions — but those still were designed to work with Microsoft operability.

Among those developers is Austin, Texas-based CrowdStrike, one of countless firms offering cybersecurity services to Windows users. (Microsoft’s own cybersecurity suite is known as Defender.)

Apple computers and devices don’t have the same vulnerabilities because that company does almost all its extensions in-house, and keeps a very close eye on what it allows to interact with its software and hardware; the company doesn’t allow outside applications to interact with its operating system at the fundamental level available with Microsoft’s systems.

But Apple doesn’t have anywhere near as large a footprint in enterprise services as Microsoft. A report issued in March by the government’s Cyber Safety Review Board about a major hacking intrusion into Microsoft’s cloud system in March 2023 asserted that the company’s “ubiquitous and critical products … underpin essential services that support national security, the foundations of our economy, and public health and safety.”

Advertisement

Anyone living in the modern world has to confront the drawbacks of our reliance on digital technology on almost a daily basis. In prehistoric days, back when our household appliances were mechanical or electric, not electronic, a breakdown was easy to diagnose and fix — switch out a tube or tighten a screw.

When a device ceases to function today, it’s often impossible to pinpoint the fault — did my TV go bad, or did the internet go down, or was it just the channel I was watching?

Yet many of us rely on a single company for multiple services. For example, I get my home phone service, broadband internet, and television/video (broadcast and cable channels and streaming) from a single provider. I don’t have much choice, since for most of these it’s the only provider in my neighborhood. But when it goes down, everything goes down.

That provider, Spectrum, has tried to sell me on its mobile phone service too. I’ve refused, because I figure I need at least one thread of access to the outside world that isn’t dependent on its all-in-one monopoly.

Microsoft’s near-dominance of cloud computing — the ecosystem through which all those enterprise computers that went dead last week communicate with each other and with the outside world — should make all of us queasy, because the company’s cybersafety record is atrocious.

Advertisement

The Cyber Safety Review Board investigation concluded that the March 2023 hack occurred because “Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations.”

The board mentioned, among other things, a “cascade of … avoidable errors” in the company’s cybersecurity program, its failure to detect the compromise by hackers of its own “cryptographic crown jewels,” but only acted after a customer — the U.S. State Department — discovered the incursion itself.

The board found that Microsoft’s security practices were inferior to those of “other cloud service providers.” The report mentioned Amazon, Google and Oracle as Microsoft rivals in cloud services with better security systems.

Microsoft pledged to “adopt a new culture of engineering security in our own networks” and said it had “mobilized our engineering teams to identify and mitigate legacy infrastructure, improve processes, and enforce security benchmarks.”

The CrowdStrike crash suggests that those efforts are still works in progress. It’s fair to say that much of the blame belongs to CrowdStrike, which allowed an update to a crucial application to be sent to users for automatic installation without doing the testing necessary to ensure that the update was operationally bulletproof.

Advertisement

Technology blogger Ed Zitron properly tied the disaster to the financialization of Big Business generally, in which pumping ever higher profits to shareholders becomes a higher priority than ensuring that one’s products meet quality standards.

“Crowdstrike seemingly borrowed Boeing’s approach to quality control,” Zitron wrote, “except instead of building planes where the doors fly off at the most inopportune times (specifically, when you’re cruising at 35,000ft), it released a piece of software that blew up the transportation and banking sectors, to name just a few.”

CrowdStrike Chief Executive George Kurtz moved promptly to “sincerely apologize” to all affected users, via a statement and an appearance on the NBC “Today” show. “We quickly identified the issue and deployed a fix, allowing us to focus diligently on restoring customer systems as our highest priority,” Kurtz said in a posting on the company’s website.

Microsoft placed the blame chiefly on CrowdStrike. “Although this was not a Microsoft incident, given it impacts our ecosystem, we want to provide an update on the steps we’ve taken with CrowdStrike and others to remediate and support our customers,” David Weston, a vice president for enterprise and security, wrote on the company’s website.

But Microsoft, plainly, failed to take on board the necessity of vetting every piece of third-party software that could have an effect on its own customers — before it blew up their computer systems.

Advertisement

No software system is immune from errors, especially now that they’re so complex and multilayered that not even their developers may know all their weak spots. (An error at Amazon’s cloud service incapacitated as many as 150,000 websites for several hours in February 2017 — a major problem, but not nearly on the scale of the CrowdStrike crash.)

But as these systems play an ever expanding role in modern life even as they become more complex, it’s incumbent on their providers to make security and safety their top priorities, not merely mouth the concept in marketing material without actually taking it seriously.

Cloud clients also need to pay more attention to what is getting automatically inserted into their systems. Who has the right to gloat over escaping the CrowdStrike meltdown last week? Amusingly, it’s Southwest Airlines. For decades, Southwest resisted Microsoft’s urgings that it upgrade its systems to the latest versions of Windows, relying on Windows 3.1, which is 32 years old — so antique that the CrowdStrike update wouldn’t even work on the airline’s systems.

So while affected carriers such as Delta, United and American had canceled nearly 2,400 flights by 6 p.m. Friday, Southwest had canceled three. (By midday Monday, the number of canceled flights reached beyond 12,300.) That doesn’t mean that Southwest gets everything right. After all, the airline suffered more than its competitors from the ferocious storm in December 2022 that snarled air traffic nationwide — precisely because it had not paid enough attention to keeping its computer systems updated.

In this case, however, Southwest’s cheapskate culture was its savior. That may only put it on the same level as the proverbial blind squirrel that occasionally finds a nut. But it shows that all of our Big Business squirrels need to keep their eyes open, and focused on the perils of inattention.

Advertisement
Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Business

Altadena ICE raid highlights fears that roundups will stymie rebuilding efforts

Published

on

Altadena ICE raid highlights fears that roundups will stymie rebuilding efforts

When ICE agents raided the construction site of a burned property in Altadena earlier this month, they made no arrests. The man they were after was not there. But the mere specter of them returning spooked the workers enough to bring the project to a temporary halt.

The next day, half of the 12-man team stayed home. The crew returned to full strength by the end of the week, but they now work in fear, according to Brock Harris, a real estate agent representing the developer of the property. “It had a chilling effect,” he said. “They’re instilling fear in the workers trying to rebuild L.A.”

Harris said another developer in the area started camouflaging his construction sites: hiding Porta Potties, removing construction fences and having workers park far away and carpool to the site so as not to attract attention.

The potential of widespread immigration raids at construction sites looms ominously over Los Angeles County’s prospects of rebuilding after the two most destructive fires in its history.

A new report by the UCLA Anderson Forecast said that roundups could hamstring the colossal undertaking to reconstruct the 13,000 homes that were wiped away in Altadena and Pacific Palisades on Jan. 7 — and exacerbate the housing crisis by stymieing new construction statewide.

Advertisement

“Deportations will deplete the construction workforce,” the report said. “The loss of workers installing drywall, flooring, roofing and the like will directly diminish the level of production.”

A house under construction in Altadena.

(Myung J. Chun / Los Angeles Times)

The consequences will spread far beyond those who are deported, the report said. Many of the undocumented workers who manage to avoid ICE will be forced to withdraw from the labor force. Their specialties are often crucial to getting projects completed, potentially harming the fortunes of remaining workers who can’t finish jobs without their help.

Advertisement

“The productive activities of the undocumented and the rest of the labor force are often complementary,” the report said. “For example, home building could be delayed because of a reduction in specific skills” resulting in “a consequent increase in unemployment for the remaining workforce.”

Jerry Nickelsburg, the director of the Anderson Forecast and author of the quarterly California report released Wednesday, said the “confusion and uncertainty” about the rollout of both immigration and trade policies “has a negative economic impact on California.”

Contractors want to hire Americans but have a hard time finding enough of them with proper abilities, said Brian Turmail, a spokesperson for the Associated General Contractors of America trade group.

“Most of them are kind of in the Lee Greenwood crowd,” he said, referring to a county music singer known for performing patriotic songs. “They’d rather be hiring young men and women from the United States. They’re just not there.”

“Construction firms don’t start off with a business plan of, ‘Let’s hire undocumented workers,’” Turmail said. “They start with a business plan of, ‘Let’s find qualified people.’ It’s been relatively easy for undocumented workers to get into the country, so let’s not be surprised there are undocumented workers working in, among other things, industries in construction.”

Advertisement

The contractors’ trade group said government policies are partly to blame for the labor shortage. About 80% of federal funds spent on workforce development go to encouraging students to pursue four-year degrees, even though less than 40% of Americans complete college, Turmail said.

“Exposing future workers to fields like construction and teaching them the skills they need is woefully lacking,” he said. “Complicating that, we don’t really offer many lawful pathways for people born outside the United States to come into the country and work in construction.”

A home under construction in Altadena, where immigration agents visited earlier this month.

A home under construction in Altadena, where immigration agents visited earlier this month.

(Myung J. Chun / Los Angeles Times)

The recently raided Altadena project had plenty of momentum before the raid, Harris said. The original house burned in the Eaton fire, but the foundation survived, so the developer, who requested anonymity for fear of ICE retribution, purchased the lot with plans to rebuild the exact house that was there.

Advertisement

Permits were quickly secured, and the developer hoped to finish the home by December. But as immigration raids continue across L.A., that timeline could be in jeopardy.

“It’s insane to me that in the wake of a natural disaster, they’re choosing to create trouble and fear for those rebuilding,” Harris said. “There’s a terrible housing shortage, and they’re throwing a wrench into development plans.”

Los Angeles real estate developer Clare De Briere called raids “fearmongering.”

“It’s the anticipation of the possibility of being taken, even if you are fully legal and you have your papers and everything’s in order,” she said. “It’s an anticipation that you’re going to be taken and harassed because of how you look, and you’re going to lose a day’s work or potentially longer than that.”

De Briere helped oversee Project Recovery, a group of public and private real estate experts who compiled a report in March on what steps can be taken to speed the revival of the Palisades and Altadena as displaced residents weigh their options to return to fire-affected neighborhoods.

Advertisement

The prospect of raids and increased tariffs has increased uncertainty about how much it will cost to rebuild homes and commercial structures, she said. “Any time there is unpredictability, the market is going to reflect that by increasing costs.”

The disappearance of undocumented workers stands to exacerbate the labor shortage that has grown more pronounced in recent years as construction has been slowed by high interest rates and the rising cost of materials that could get even more expensive due to new tariffs.

“In general, costs have risen in the last seven years for all sorts of construction” including houses and apartments, said Devang Shah, a principal at Genesis Builders, a firm focused on rebuilding homes in Altadena for people who were displaced by the fire. “We’re not seeing much construction work going on.”

The slowdown has left a shortage of workers as many contractors consolidated or got out of the business because they couldn’t find enough work, Shah said.

“When you start thinking about Altadena and the Palisades,” he said, “limited subcontractors can create headwinds.”

Advertisement
Continue Reading

Business

Commentary: Social Security is still in good shape but faces challenges — from Trump

Published

on

Commentary: Social Security is still in good shape but faces challenges — from Trump

The annual reports of the Social Security and Medicare trustees provide yearly opportunities for misunderstandings by politicians, the media, and the general public about the health of these programs. This year is no exception.

A case in point is the response by House Budget Committee Chairman Jodey Arrington (R-Tex.) to the Social Security and Medicare trustees’ projections about the depletion of the programs’ reserves: “Doing nothing to address the solvency of these programs will result in an immediate, automatic, and catastrophic cut to benefits for the nearly 70 million seniors who rely on them.”

The reports say nothing about an “immediate” cut to benefits. They talk about cuts that might happen in 2034 and 2033, when there still would be enough money coming in to pay 89% of scheduled Medicare benefits and 81% of scheduled Social Security benefits.

The Trump administration’s actions are weakening the country’s economic outlook and Social Security’s financial footing.

— Kathleen Romig, Center on Budget and Policy Priorities

Advertisement

House Ways and Means Committee chairman Jason Smith (R-Mo.) used the release of the reports to plump for the budget resolution that the House narrowly passed on orders from President Trump and that is currently being masticated by several Senate committees.

The reports, Smith said, make clear “how much we need pro-growth tax and economic policies that unleash our nation’s growth, increase wages, and create new jobs.” The budget bill “would do just that,” he said.

Neither Arrington nor Smith mentioned the leading threats to the programs coming from the White House. In Social Security’s case, that’s Trump’s immigration, taxation and tariff policies, which work directly against the program’s solvency. For Medicare, the major threat is a rise in healthcare costs.

But those have flattened out as a percentage of gross domestic product since 2010, when the enactment of the Affordable Care Act brought better access to medical care to millions of Americans.

Advertisement

That trend is jeopardized by Republican healthcare proposals, which encompass throwing millions of Americans off Medicaid. Policy proposals by Health and Human Services Secretary Robert F. Kennedy Jr. such as discouraging vaccinations can only drive healthcare costs higher.

Let’s take a closer look. (The Social Security trustees are Kennedy, Treasury Secretary Scott Bessent, Labor Secretary Lori Chavez-DeRemer and newly confirmed Social Security Commissioner Frank Bisignano, all of whom serve ex officio; two seats for public trustees are vacant. The Medicare trustees are the same, plus Mehmet Oz, administrator of the Centers for Medicare and Medicaid Services.)

The trust funds are built up from payroll taxes paid by workers and employers, along with interest paid on the treasury bonds the programs hold.

At the end of this year, the Medicare trust fund will hold about $245 billion, and the Social Security fund — actually two funds, consisting of reserves for the old-age and disability programs, but typically considered as one — more than $2.3 trillion.

Trump has consistently promised that he won’t touch Social Security and Medicare, but actions speak louder than words. “Trump’s tariffs and mass deportation program will accelerate the depletion of the trust fund,” Kathleen Romig of the Center on Budget and Policy Priorities observed after the release of the trustees’ reports this week. “The Trump administration’s actions are weakening the country’s economic outlook and Social Security’s financial footing.”

Advertisement

Immigration benefits the program in several ways. Because “benefits paid out today are funded from payroll taxes collected from today’s workers,” notes CBPP’s Kiran Rachamallu, “more workers paying into the system benefits the program’s finances.” In the U.S., he writes, “immigrants are more likely to be of working age and have higher rates of labor force participation, compared to U.S.-born individuals.”

The Social Security trustees’ fiscal projections are based on average net immigration of about 1.2 million people per year. Higher immigration will help build the trust fund balances, and immigration lower than that will “increase the funding shortfall.” All told, “the Trump administration’s plans to drastically cut immigration and increase deportations would significantly worsen Social Security’s financial outlook.”

A less uplifting aspect of immigration involves undocumented workers. To get jobs, they often submit false Social Security numbers to employers — so payroll taxes are deducted from their paychecks, but they’re unlikely ever to be able to collect benefits. In 2022, Rachamallu noted, undocumented workers paid about $25.7 billion in Social Security taxes.

Trump’s tariffs, meanwhile, could affect Social Security by generating inflation and slowing the economy. Higher inflation means larger annual cost-of-living increases on benefits, raising the program’s costs. If they provoke a recession, that would weigh further on Social Security’s fiscal condition.

Trump also has talked about eliminating taxes on Social Security benefits. But since at least half of those tax revenues flow directly into Social Security’s reserves, they would need to be replaced somehow. Trump has never stated where the substitute revenues could be found.

Advertisement

Major news organizations tend to focus on the depletion date of the trust funds without delving too deeply into their significance or, more important, their cause. It’s not unusual for otherwise responsible news organizations to parrot right-wing tropes about Social Security running out of money or “going broke” in the near future, which is untrue but can unnecessarily unnerve workers and retirees.

The question raised but largely unaddressed by the trustee reports is how to reduce the shortfall. The Republican answer generally involves cutting benefits, either by outright reductions or such options as raising the full retirement age, which is currently set between 66 and 67 for those born in 1952-1959 and 67 for everyone born in 1960 or later.

As I’ve reported, raising the retirement age is a benefit cut by another name. It’s also discriminatory, for average life expectancy is lower for some racial and ethnic groups than for others.

For all Americans, average life expectancy at age 65 has risen since the 1930s by about 6.6 years, to about 84 and a half. The increase has been about the same for white workers. But for Black people in general, the gain is just over five years, to an average of a bit over 83, and for Black men it’s less than four years and two months, to an average of about 81 and four months.

Life expectancy is also related to income: Better-paid workers have longer average lifespans than lower-income workers.

Advertisement

The other option, obviously, is to leave benefits alone but increase the programs’ revenues. This is almost invariably dismissed by the GOP, but its power is compelling.

The revenue shortfall experienced by Social Security is almost entirely the product of rising economic inequality in the U.S. At Social Security’s inception, the payroll tax was set at a rate that would cover about 92% of taxable wage earnings. Today, rising income among the rich has reduced that ratio to only about 82%. That could mean hundreds of billions of dollars in lost revenues.

The payroll tax is highly regressive. Those earning up to $176,100 this year pay the full tax of 12.4% on wage earnings (half deducted directly from their paychecks and half paid by their employers).

Those earning more than that sum in wages pay nothing on the excess. To put it in perspective, the payroll tax bite on someone earning $500,000 in wages this year would pay not 12.4% in payroll tax (counting both halves of the levy), but about 4.4%.

Eliminating the cap on wages, according to the Social Security actuaries, would eliminate half to three-quarters of the expected shortfall in revenues over the next 75 years, depending on whether benefits were raised for the highest earners. Taxing investment income — the source of at least half the income collected by the wealthiest Americans — at the 12.4% level rather than leaving it entirely untaxed for Social Security would reduce the shortfall by an additional 38%. Combining these two options would eliminate the entire shortfall.

Advertisement

Social Security has already been hobbled by the Trump administration, Trump’s promises notwithstanding. Elon Musk’s DOGE vandals ran roughshod through the program, cutting staff and closing field offices, and generally instilling fears among workers and retirees that the program might not be around long enough to serve them. In moral terms, that’s a crime.

Those are the choices facing America: Cutting benefits is a dagger pointed directly at the neediest Americans. Social Security benefits account for 50% or more of the income nearly 42% of all beneficiaries, and 90% or more of the income of nearly 15% of beneficiaries.

The wealthiest Americans, on the other hand, have been coasting along without paying their fair share of the program. Could the equities be any clearer than that?

Advertisement
Continue Reading

Business

Driverless disruption: Tech titans gird for robotaxi wars with new factory and territories

Published

on

Driverless disruption: Tech titans gird for robotaxi wars with new factory and territories

As three key players vie for dominance, the race to put driverless taxis on roads across the country is heating up.

Waymo, owned by Google’s parent company Alphabet, already offers paid autonomous rides in a handful of cities, including San Francisco and Los Angeles. Amazon’s robotaxi effort, known as Zoox, opened a new production facility in the Bay Area this week. The company has been testing its unique pill-shaped vehicles in California and Nevada since 2023.

Meanwhile, in Austin, Texas, Elon Musk just started testing driverless Teslas with the hopes of launching a commercial service soon. Musk unveiled a prototype for Tesla’s Cybercab late last year, touting his vision for an autonomous future and “an age of abundance.”

The arrival of self-driving tech could eventually affect society as much as the internet and smartphones did years ago, some experts predict. With Waymo leading the way and Tesla and Zoox trying to catch up quickly, a new status quo could be on the horizon, said Karl Brauer, an analyst with iSeeCars.com.

Advertisement

“Tesla has tried to catch up, and Zoox is a more recent competitor that’s hoping to be a serious player,” he said. “Waymo has been slow and steady and, as a result, is winning the race.”

According to some industry insiders, the U.S. is about 15 years from seeing widespread use of robotaxis, Brauer said. While Waymo taxis have become a common sight in the cities where they operate, weather conditions and charging infrastructure still limit their expansion.

On Wednesday, Waymo expanded its service area in Los Angeles County, where its vehicles now roam an area of more than 120 square miles. The company also increased its service area in San Francisco, expanding access to suburbs and Silicon Valley.

Days after Waymo’s announcement, Zoox opened a 220,000-square-foot facility in Hayward, Calif., that the company says will be able to produce 10,000 robotaxis per year. Zoox is preparing to launch its public ride-hailing service in Las Vegas and San Francisco this year.

Unlike Waymo vehicles, which are retrofitted Jaguars, Zoox is developing a purpose-built taxi with no steering wheel or gas pedals.

Advertisement

Zoox also has a manufacturing plant in Fremont, Calif., where the company develops its test fleets of retrofitted Toyota Highlanders. Tesla has a manufacturing facility in Fremont as well.

Musk has promised for years to deliver autonomous vehicles and a robust ride-hailing service. Lawmakers in Austin requested this week that he delay the rollout of his service in the city.

Tesla, Zoox and Waymo are the three remaining major U.S. companies in what was once a more crowded field, Brauer said. General Motors’ autonomous taxi company Cruise suspended operations in 2023 after one of its vehicles struck and dragged a pedestrian in San Francisco. Last year, Uber and Cruise announced a partnership that could put Cruise vehicles back on the road.

A company called Argo AI, backed by Ford and Volkswagen, was also developing driverless technology until it shut down in 2022.

The continued expansion of robotaxis depends on safe and successful testing, Brauer said. There have been several incidents related to Tesla’s Full Self-Drive mode, a technology currently available but still in development. Waymo has issued recalls of some of its vehicles on multiple occasions.

Advertisement

“If there’s a tragic result for any of these three companies during the testing and development process, it would likely slow down the entire industry,” Brauer said.

Continue Reading

Trending