6

I recently discovered a publicly accessible web interface to a highly sensitive bit of lab equipment, the malfunction of which would result in potential loss of life or serious health concerns to a large number of people. Thankfully, the IT team at the lab in question were very receptive, and quickly found a way to disable the remote interface.

However, this got me thinking - what if they hadn't been so receptive, and had ignored me? What if they'd simply decided not to fix the issue? Obviously I wouldn't want to jump straight to full disclosure, since that would almost certainly result in disaster. But on the other hand, the public has a right to know about the potential danger they were/are in, and ensuring that a fix is put in place is critical.

What's the best way to handle security issues where a potential loss of life is involved, but the vendor is uncooperative?

Improve this question
3
  • Are you sure telling this to, say, FDA is off-limits for you? FAA for aviation software, NRC for nuclear power plants, and maybe other appropriate three-letter combinations...
    – Deer Hunter
    Dec 13, 2012 at 3:23
  • Is it too much to ask, to satisfy our morbid curiosity, what basic type of lab equipment this was? I could imagine a few ways that, for instance, a Merrifield peptide synthesizer could pose a threat to anyone in the building and a two-mile radius beyond.
    – KeithS
    Dec 13, 2012 at 20:31
  • @KeithS It was an environmental control unit with an air scrubber built in. You can infer the rest yourself ;)
    – Polynomial
    Dec 13, 2012 at 21:51

3 Answers 3

Reset to default
3

Okay you have two problems here:

  • if things go bad, they will result in the loss of life
  • if you make this public you are a whistleblower (this might have an effect on your career)

Disclosing to the public can be dangerous and should only be used as a last resort. Some other options you might want to think of first:

  • go to the N+1 if the vendor is part of a larger entity you can try to send a very clear message that one of their smaller entities is threatening the image of the whole company (because this is what companies fear, but never do this: FIX IT OR I'LL DISCLOSE IT, not directly anyway, because that's blackmail)
  • go to a governmental institution, here in Belgium we have CERT, which is the Cyber Emergency Response Team. You can report to them anonymously and they will try to contact the entity. If that fails they are also still in contact with the Federal Computer Crime Unit.

If this all fails disclose it maybe even anonymously (tell the company anonymously that the problem will be disclosed on date X, they will be forced to fix it by then, you will release it regardless if they fixed the issue or not). It's a death sentence for the vendor, but I personally prefer a few guys losing some money over a few people losing their lives because someone was being ignorant.

Anyway, this is my personal opinion.

Improve this answer
1
  • "Blackmail" is a bit harsh, and jurisdiction-dependent. There is no financial gain inherent for the OP in the "Fix it" part of the ultimatum. Anyone can blow the whistle; doesn't have to be an employee (though employees generally get the protection from retaliation as they are generally both the best sources of information on illegal or unsafe business practices, as well as the must vulnerable should they disclose them). The threat of "fix it or I'll disclose it" is really no different in this case than "fix it or I'll arrange a boycott". Whether either of those are legal for the OP depends.
    – KeithS
    Dec 13, 2012 at 20:31
2

If there is no governmental agency to go to bring pressure down, I would look at 3 measures:

  • end user
  • media
  • regulators

For medical equipment, I might go to a hospital or hospital group that uses the product and demonstrate the issue to them. The pressure that they can bear is greater than what you can bear alone.

Otherwise, I would go to the media specific to the vendor or end-user, and explain it to them without permitting the details of the issue to be made public. The media pressure brings much more leverage, and you have not disclosed the details and risked lives yourself.

If the product affects lives, there is likely a regulatory body that provides oversight. Contacting them could be tricky (and lengthy), but it IS what they exist for.

I, personally, was in a very similar situation and the vendor was not co-operative at all. I did not have access to the end-users, but calling around to magazines in the vendor's industry to get reporters to start asking questions was effective to get the vendor to change.

Improve this answer
1

Talk to your lawyer first. If you do not have one, get one. Any other advice is not very relevant.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .