How is something deliberately planned and executed, by a military intelligence agency, for weeks or months, an accident?
And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?
"And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?"
If the insurance claim is ~$1.3bn, we can safely say that the NotPetya cleanup isn't a trivial thing for them.
How many companies have we heard about who were totally screwed after a ransomware outbreak, because their only backups were online - network connected? Does anybody have offline backups anymore?
Is corporate IT negligent where it appears to have no disaster recovery plan?
Is corporate IT negligent where it appears to have no disaster recovery plan?
Arguably, yes. Merck isn't a small time start-up. They've been on the Fortune 500 list for 60+ years. They can afford whatever layers of backup and redundancy they need.
Does anybody have offline backups anymore?
Previous gigs, for large ISPs and related orgs, did. This was on a team-by-team basis, though.
Any large organization that doesn't, at a bare minimum, implement NSA's Top Ten Cybersecurity Mitigation Strategies[1], ASD's Essential Eight[2], etc. is grossly negligent; and an insurance carrier willing to write a policy not conditional on implementing those strategies is equally negligent. The insurance carriers in this case could very well be attempting to deny payment under the acts-of-war exclusion because they're too incompetent or greedy to correctly write a cybersecurity policy.
> too incompetent or greedy to correctly write a cybersecurity policy
Don't discount the insurers just yet. The act of war exclusion is likely preferable for the insurers because it would seem to broadly cover the entire incident and because it really doesn't require a whole lot of detailed discovery into Merck's internal processes. But if that fails, then the insurers will, most likely, once again try to deny the claim, this time focusing on the details of the cybersecurity-based policy exclusions.
My guess, with no evidence to back it up, is that the policy is very detailed and specific, and upon investigating its application, the insurers will reveal a lack of proper defense and mitigation processes by Merck, just as you describe.
Are you serious? They planned to launch the equivalent of a digital bomb, knowing full well there would be plenty of collateral damage. Hell no it isn't an "accident"
I will put it another way. I feel quite confident the 9/11 bombers did not know, or specifically target, my friends and acquaintances who died in those towers. Therefore, are you going to claim 9-11 was an accident?
If I intend to rob a convenience store, and in the process of doing so, my gun goes off and the clerk is shot and killed, was it just an accident?
Yes I am serious. Are you? How about we keep this respectful and do away with the condescending tone, which is not really welcome here on Hacker News?
9/11 was presumably intended to damage as much property and kill as many people as possible. So no, the people who died as a result of that terrorist attack against the US were not killed by accident.
Yes, if your gun accidentally goes off during a robbery, that is by definition an accident. An accident that could have been avoided if different choices had been made, but still an accident.
If the intended target in this case was the Ukraine, and companies in the USA suffered immense damages it's reasonable to ask if those unintended consequences were accidental. Similar to how a bomb dropped on an Italian border in WWII might accidentally kill ally French citizens on the other side of the border. With cyber warfare it becomes much more interesting, because those accidents don't respect physical distance.
I never said the gun went off "accidentally", you added that word to support your otherwise baseless argument. Guns go off during robberies because the robber got nervous or impatient, because there was a melee, because a third party got involved. By deliberately bringing the gun into the situation, the subsequent claim of an "accidental" firing is nullified.
A guy drinks two quarts of whisky at his favorite bar then drives home. On the way in his drunken state he runs a red light, smashes into a school bus and kills a 9 year old he never met named Mikey. Whoops, sorry Mikey's mom and dad, it was just an accident! Because Tchaffee says so.
Great example. Killing someone while drunk is called involuntary manslaughter. Because it's an accident. It was not planned. It wasn't intentional. I never once claimed that accidents can't be horrible. Or that reckless behavior that results in an accident should not be punished. I never said it was "just" an accident. That's you putting words in my mouth. What I said is very simple: if it wasn't part of the plan, it was an accident.
It's only false if you are willing to be a victim of confirmation bias.
"DUI manslaughter charges are more common than DUI murder charges. Simply put, an intoxicated driver is arrested after causing an accident that resulted in the death of another person. The driver did not intend to cause the death, but it happened as a result of drunk driving."
It would be child's play for anyone at this point to use a search engine to dig up loads of examples of people convicted for involuntary manslaughter as a result of killing someone while drunk driving.
You get points for tenacity, I'll concede that. But your argument is simply wrong. You stated: "Killing someone while drunk is called involuntary manslaughter" Of course, most of the time it is. But you didn't qualify with "usually" or "often" (or with "while driving", for that matter). A single example of killing someone while drunk NOT equating to involuntary manslaughter, is sufficient to prove your statement to be false, same as if you had said "prime numbers are odd."
The flaw in your logic this whole time is your insistence that anything unintended = accident. Things can be unintended but also not an accident. All the previous examples. Involuntary manslaughter laws tend to use the word "unintentional" but not "accidental." How about the Free Solo guy -- certainly he didn't intend to die, but had he slipped and fell, when the whole point of the climb was to do it without any safety equipment, it couldn't be classified as an accident. Car "accidents" are rarely accidents -- in most cases, one party failed to follow a safety signal or violated some rule. And yes, if you deliberately drop a bomb near a border, you can't claim the allies you killed on the other side were accidental. Collateral damage, yes, accidental, no.
If you cannot see that, or that it isn't "accidental" when a serial drunk driver kills someone, or a gun getting fired during a robbery also isn't accidental -- or when a government unleashes a computer virus that it knows will likely affect hundreds/thousands of computers owned by people or companies it doesn't care about -- well, you're maintaining a position about which few people would agree.
You're being pedantic. It is called involuntary manslaughter. And it's most often called that. And sometimes it is called other things. There is nothing false about my statement.
same as if you had said "prime numbers are odd."
Not really. Same as if I had said "ALL prime number are odd". Which I did not say. "Prime number are odd" is a true statement. So is "prime numbers are even".
The flaw in your logic this whole time is your insistence that anything unintended = accident
I never claimed that everything unintended is an "just" an accident, but at this point you are just being pedantic. Your original claim was that something deliberately planned cannot result in accidents. That if something is planned, then the outcome itself must have also been planned. That's the flaw in your logic.
If the Russian government intended to attack Ukraine and a US company was unintentionally damaged, then no, that result was not planned.
In your original comment you claimed "knowing full well there would be plenty of collateral damage". Do you have proof that they knew there would be collateral damage? Do you have proof that they took no steps to try to contain the damage to Ukraine but they simply got it wrong?
it isn't "accidental" when a serial drunk driver kills someone
How did the drunk driver all of a sudden become a serial drunk driver?
a government unleashes a computer virus that it knows will likely affect hundreds/thousands of computers
Where is your evidence that they knew this?
you're maintaining a position about which few people would agree.
So what? Does majority consensus determine logical consistency? And I'll claim the same thing: you are the one who is maintaining a position about which few people would agree. It's that easy.
Wait, didn't even reach the absurd final paragraph. If I have a bomb with a blast radius of say, 200 meters, which I drop 50 meters inside an Italian border, knowing full well the blast radius extends into France, you are still claiming deaths in France from my bomb are just an accident?
Please point out where I said you know the blast radius and which direction it heads. Not to mention it's an analogy and I'm not a bombing expert. You can probably figure out my point.
That would be an impossibility with WWII technology. It's irrelevant -- the scenario you described already acknowledged the bomb crossing the border and killing French citizens on the other side.
That's called manslaughter... You don't get to walk when you rob a place and "accidentally" shoot someone. A sassy judge should ask "Did you accidentally rob the place too?"
To be more specific, involuntary manslaughter. Which is broadly speaking an accident that occurred while committing a crime. Or due to some other negligence. We are still firmly in the territory of accident, regardless of the legal consequences.
You still get punished for it... That's the whole argument. Even it's an accident, it's not the same kind of accident as turning a corner and spilling coffee on them.
The thread is not about whether or not whoever did it gets punished. The question is whether or not it was accidental or if damaging Merck was an intentional act. Based on the evidence so far, it sure seems like damaging Merck was a result of negligence and not intentional.
Releasing a computer virus intended to replicate and spread on any machine it can... like... wtf are you arguing for? The whole point to the thing was to cause massive damage to whoever the intended target was, with little care for collateral damage. It was meant to spread hard and fast and cause damage. If you infected a Merck employee with weaponized ebola and that employee traveled to the USA while the strain was still in incubation, then got USA citizens sick with ebola, "Oh, it's okay, it was just an accident. No worries! You didn't mean to hurt the USA. Want to have some cheesecake with us?" Replace the USA with Germany, Japan, Chile, Mexico, South Sudan, I don't care. I'd feel just as strongly about this. It's not a Russia-USA issue. It's a "Russia literally gives zero fucks what happens to the world." I don't see bags of rice given out to poor countries with the Russian flag on it.
It was intentional even if Merck wasn't targeted. Negligence and accident aren't magic words to hide behind if your initial goal is to cause harm in the first place. Stuxnet at least had a bunch of parameters and was highly specialized so it only deploy on its intended target with little to no chance of opening up its payload on an unintended target. I'm not going to argue whether or not Stuxnet was morally in the right. But, it sure as shit proves there is a format of trying to make sure unintended targets don't get harmed in the process of widespread release of cyber warfare.
like... wtf are you arguing for? You seem to be upset that negligence is a word that describes irresponsible behavior with unintentional results. It's still an accident. It wasn't planned. That is my initial and only point.
Not arguing with you. But I think a digital bioweapon is a better analogy than a bomb. Since it spreads without control after release, like a... well... virus. If a country released a bioweapon somewhere and it affected "un-intended targets" there's going to be a lot of international problems with that.
I kind of feel, and I'm not going to pretend I'm an expert, that digital warfare should be treated closer to biological warfare than just your typical bombs and bullets kind. Generally, and holy shit I know someone is going to flip their shit for me saying this, but generally a regular bomb (not nuke) is an acute type of problem. After it goes off, it's GENERALLY harmless after that. Yes, structure collapse, contamination, gas leaks and other after effects. But not really more booms from the bomb. Weaponized ebloa can still make more people sick, not affected by the original release. Same with NotPetya and other cyber attacks. After deployed, it can affect more and more targets as time goes on.
Comments
How is something deliberately planned and executed, by a military intelligence agency, for weeks or months, an accident?
And how are you so sure Merck's IT team didn't fail to have backups, redundancy, security patches, etc. to prevent an attack of any sort from being such a big deal?
If the insurance claim is ~$1.3bn, we can safely say that the NotPetya cleanup isn't a trivial thing for them.
How many companies have we heard about who were totally screwed after a ransomware outbreak, because their only backups were online - network connected? Does anybody have offline backups anymore?
Is corporate IT negligent where it appears to have no disaster recovery plan?
Arguably, yes. Merck isn't a small time start-up. They've been on the Fortune 500 list for 60+ years. They can afford whatever layers of backup and redundancy they need.
Previous gigs, for large ISPs and related orgs, did. This was on a team-by-team basis, though.
Any large organization that doesn't, at a bare minimum, implement NSA's Top Ten Cybersecurity Mitigation Strategies[1], ASD's Essential Eight[2], etc. is grossly negligent; and an insurance carrier willing to write a policy not conditional on implementing those strategies is equally negligent. The insurance carriers in this case could very well be attempting to deny payment under the acts-of-war exclusion because they're too incompetent or greedy to correctly write a cybersecurity policy.
[1] https://www.nsa.gov/Portals/70/documents/what-we-do/cybersec...
[2] https://www.cyber.gov.au/publications/essential-eight-explai...
Don't discount the insurers just yet. The act of war exclusion is likely preferable for the insurers because it would seem to broadly cover the entire incident and because it really doesn't require a whole lot of detailed discovery into Merck's internal processes. But if that fails, then the insurers will, most likely, once again try to deny the claim, this time focusing on the details of the cybersecurity-based policy exclusions.
My guess, with no evidence to back it up, is that the policy is very detailed and specific, and upon investigating its application, the insurers will reveal a lack of proper defense and mitigation processes by Merck, just as you describe.
Did that military agency plan for it to damage Merck? Or was that an accident?
Are you serious? They planned to launch the equivalent of a digital bomb, knowing full well there would be plenty of collateral damage. Hell no it isn't an "accident"
I will put it another way. I feel quite confident the 9/11 bombers did not know, or specifically target, my friends and acquaintances who died in those towers. Therefore, are you going to claim 9-11 was an accident?
If I intend to rob a convenience store, and in the process of doing so, my gun goes off and the clerk is shot and killed, was it just an accident?
Yes I am serious. Are you? How about we keep this respectful and do away with the condescending tone, which is not really welcome here on Hacker News?
9/11 was presumably intended to damage as much property and kill as many people as possible. So no, the people who died as a result of that terrorist attack against the US were not killed by accident.
Yes, if your gun accidentally goes off during a robbery, that is by definition an accident. An accident that could have been avoided if different choices had been made, but still an accident.
If the intended target in this case was the Ukraine, and companies in the USA suffered immense damages it's reasonable to ask if those unintended consequences were accidental. Similar to how a bomb dropped on an Italian border in WWII might accidentally kill ally French citizens on the other side of the border. With cyber warfare it becomes much more interesting, because those accidents don't respect physical distance.
I never said the gun went off "accidentally", you added that word to support your otherwise baseless argument. Guns go off during robberies because the robber got nervous or impatient, because there was a melee, because a third party got involved. By deliberately bringing the gun into the situation, the subsequent claim of an "accidental" firing is nullified.
A guy drinks two quarts of whisky at his favorite bar then drives home. On the way in his drunken state he runs a red light, smashes into a school bus and kills a 9 year old he never met named Mikey. Whoops, sorry Mikey's mom and dad, it was just an accident! Because Tchaffee says so.
Great example. Killing someone while drunk is called involuntary manslaughter. Because it's an accident. It was not planned. It wasn't intentional. I never once claimed that accidents can't be horrible. Or that reckless behavior that results in an accident should not be punished. I never said it was "just" an accident. That's you putting words in my mouth. What I said is very simple: if it wasn't part of the plan, it was an accident.
Absolutely false.
Dec. 2: https://www.oregonlive.com/crime/2019/12/drunk-driver-who-ki...
Nov 14: https://www.inquirer.com/news/david-strowhouer-sentence-dui-...
Nov 8: https://eccalifornian.com/drunk-driver-given-second-degree-m...
Nov 15: https://www.pressconnects.com/story/news/public-safety/2019/...
first-degree manslaughter, third-degree murder, second-degree murder, first-degree vehicular manslaughter
"Involuntary" isn't in any of these. And these are just the first few search results.
It's only false if you are willing to be a victim of confirmation bias.
"DUI manslaughter charges are more common than DUI murder charges. Simply put, an intoxicated driver is arrested after causing an accident that resulted in the death of another person. The driver did not intend to cause the death, but it happened as a result of drunk driving."
https://dui.findlaw.com/dui-charges/dui-manslaughter-and-dui...
It would be child's play for anyone at this point to use a search engine to dig up loads of examples of people convicted for involuntary manslaughter as a result of killing someone while drunk driving.
You get points for tenacity, I'll concede that. But your argument is simply wrong. You stated: "Killing someone while drunk is called involuntary manslaughter" Of course, most of the time it is. But you didn't qualify with "usually" or "often" (or with "while driving", for that matter). A single example of killing someone while drunk NOT equating to involuntary manslaughter, is sufficient to prove your statement to be false, same as if you had said "prime numbers are odd."
The flaw in your logic this whole time is your insistence that anything unintended = accident. Things can be unintended but also not an accident. All the previous examples. Involuntary manslaughter laws tend to use the word "unintentional" but not "accidental." How about the Free Solo guy -- certainly he didn't intend to die, but had he slipped and fell, when the whole point of the climb was to do it without any safety equipment, it couldn't be classified as an accident. Car "accidents" are rarely accidents -- in most cases, one party failed to follow a safety signal or violated some rule. And yes, if you deliberately drop a bomb near a border, you can't claim the allies you killed on the other side were accidental. Collateral damage, yes, accidental, no.
If you cannot see that, or that it isn't "accidental" when a serial drunk driver kills someone, or a gun getting fired during a robbery also isn't accidental -- or when a government unleashes a computer virus that it knows will likely affect hundreds/thousands of computers owned by people or companies it doesn't care about -- well, you're maintaining a position about which few people would agree.
Actually your argument is simply wrong.
You're being pedantic. It is called involuntary manslaughter. And it's most often called that. And sometimes it is called other things. There is nothing false about my statement.
Not really. Same as if I had said "ALL prime number are odd". Which I did not say. "Prime number are odd" is a true statement. So is "prime numbers are even".
I never claimed that everything unintended is an "just" an accident, but at this point you are just being pedantic. Your original claim was that something deliberately planned cannot result in accidents. That if something is planned, then the outcome itself must have also been planned. That's the flaw in your logic.
If the Russian government intended to attack Ukraine and a US company was unintentionally damaged, then no, that result was not planned.
In your original comment you claimed "knowing full well there would be plenty of collateral damage". Do you have proof that they knew there would be collateral damage? Do you have proof that they took no steps to try to contain the damage to Ukraine but they simply got it wrong?
How did the drunk driver all of a sudden become a serial drunk driver?
Where is your evidence that they knew this?
So what? Does majority consensus determine logical consistency? And I'll claim the same thing: you are the one who is maintaining a position about which few people would agree. It's that easy.
Wait, didn't even reach the absurd final paragraph. If I have a bomb with a blast radius of say, 200 meters, which I drop 50 meters inside an Italian border, knowing full well the blast radius extends into France, you are still claiming deaths in France from my bomb are just an accident?
Please point out where I said you know the blast radius and which direction it heads. Not to mention it's an analogy and I'm not a bombing expert. You can probably figure out my point.
"On an Italian border." Where else could the blast possibly go, except on both sides of the border?
The other possibility is one side of the border.
That would be an impossibility with WWII technology. It's irrelevant -- the scenario you described already acknowledged the bomb crossing the border and killing French citizens on the other side.
It's not impossible. Some of that border has steep mountains. Bombs don't always drop where you plan. Which is called an accident.
That's called manslaughter... You don't get to walk when you rob a place and "accidentally" shoot someone. A sassy judge should ask "Did you accidentally rob the place too?"
To be more specific, involuntary manslaughter. Which is broadly speaking an accident that occurred while committing a crime. Or due to some other negligence. We are still firmly in the territory of accident, regardless of the legal consequences.
You still get punished for it... That's the whole argument. Even it's an accident, it's not the same kind of accident as turning a corner and spilling coffee on them.
The thread is not about whether or not whoever did it gets punished. The question is whether or not it was accidental or if damaging Merck was an intentional act. Based on the evidence so far, it sure seems like damaging Merck was a result of negligence and not intentional.
Releasing a computer virus intended to replicate and spread on any machine it can... like... wtf are you arguing for? The whole point to the thing was to cause massive damage to whoever the intended target was, with little care for collateral damage. It was meant to spread hard and fast and cause damage. If you infected a Merck employee with weaponized ebola and that employee traveled to the USA while the strain was still in incubation, then got USA citizens sick with ebola, "Oh, it's okay, it was just an accident. No worries! You didn't mean to hurt the USA. Want to have some cheesecake with us?" Replace the USA with Germany, Japan, Chile, Mexico, South Sudan, I don't care. I'd feel just as strongly about this. It's not a Russia-USA issue. It's a "Russia literally gives zero fucks what happens to the world." I don't see bags of rice given out to poor countries with the Russian flag on it.
It was intentional even if Merck wasn't targeted. Negligence and accident aren't magic words to hide behind if your initial goal is to cause harm in the first place. Stuxnet at least had a bunch of parameters and was highly specialized so it only deploy on its intended target with little to no chance of opening up its payload on an unintended target. I'm not going to argue whether or not Stuxnet was morally in the right. But, it sure as shit proves there is a format of trying to make sure unintended targets don't get harmed in the process of widespread release of cyber warfare.
like... wtf are you arguing for? You seem to be upset that negligence is a word that describes irresponsible behavior with unintentional results. It's still an accident. It wasn't planned. That is my initial and only point.
Not arguing with you. But I think a digital bioweapon is a better analogy than a bomb. Since it spreads without control after release, like a... well... virus. If a country released a bioweapon somewhere and it affected "un-intended targets" there's going to be a lot of international problems with that.
I kind of feel, and I'm not going to pretend I'm an expert, that digital warfare should be treated closer to biological warfare than just your typical bombs and bullets kind. Generally, and holy shit I know someone is going to flip their shit for me saying this, but generally a regular bomb (not nuke) is an acute type of problem. After it goes off, it's GENERALLY harmless after that. Yes, structure collapse, contamination, gas leaks and other after effects. But not really more booms from the bomb. Weaponized ebloa can still make more people sick, not affected by the original release. Same with NotPetya and other cyber attacks. After deployed, it can affect more and more targets as time goes on.