back to Axiomatic Language Home Page
Complaint about MedStar Data Breach Settlement
To: The Parties of the MedStar Settlement
From: Walter W. Wilson
This message is in response to the recent postcard notice
about the settlement for the MedStar cyberattack of October 2022,
of which I may be a victim.
I am a retired computer programmer of CAD applications for
Lockheed Martin in Fort Worth. I want to express my opinion that
the settlement is insufficiently punitive to MedStar.
First, let me thank the plaintiff(s) and plaintiff attorney(s)
for at least bringing this lawsuit. I just wished the settlement cost
to MedStar was several orders-of-magnitude greater. Is there still time?
Having spent years in software development, I have seen a lot of
sloppiness -- inadequate testing, inattention to requirement details,
lack of creativity in risk assessment, unsafe programming languages,
buggy operating systems and utilities, etc.
These deficiencies can cause significant harm and costs.
Some famous examples include the following:
- patients injured/died
Mars Climate Orbiter
- $125M spacecraft lost
Subaru robot bug
- unsafe vehicles had to be destroyed
Had the Subaru robot bug not been caught early, people might have died in
the unsafe vehicles.
Poor-quality software that endangers lives and is costly to
consumers and taxpayers should result in significant financial penalties to
the developers and operators.
Data breaches can usually be traced to system software bugs, bad design,
or bad practices. The 2017 Equifax breach
in which 140+ million Americans had their personal information compromised,
involved all these things and is an example of particularly egregious
corporate behavior, for which victims were insufficiently compensated.
Businesses would probably like to say a breach is entirely
the fault of an evil hacker, but I put equal or more blame
on the companies themselves for their
negligence. An analogy would be a bank that leaves its vault door open
all the time and then gets its customer's money stolen. Sure, give the
thief a long prison sentence, but also give the bank and its
managers fines for their dereliction of duty.
Our future world will see software become even more pervasive
with even greater risks to our lives and property -- self-driving cars,
pilotless airplanes, robotic surgery, software-designed bridges,
3D-printed buildings, etc.
For example, Boeing has a software system called GEODUCK
that can reportedly optimize aircraft structural parts.
But a bug in that optimization could result in a part that is too weak
-- it could fail in flight -- an airliner could crash!
Clearly the developers and operators of critical software
need to be held to a high standard of correctness and
should face significant penalties
when they fail to meet that standard.
I have an interest in the long-term goal of formal verification of software
-- proving that software is correct
(Axiomatic Language and Proof).
I suspect formal verification will become a requirement for
future critical software systems that our lives, finances,
and privacy depend on.
It so happens that formal verification is coming into practice now.
For example, Amazon Web Services uses formal methods in their cloud
Could MedStar have avoided this data breach had they used AWS?
If so, they should be penalized for not doing that.
I think a minimal settlement for this MedStar data breach should
include lifetime credit monitoring since the risk of identity
theft is ongoing and it should include at least $100-$1000 personal
compensation for this risk and the loss of privacy. (Aren't there also
laws against mishandling private medical information?) This
would be in addition to any specific costs that
can be traced to this breach (such as the time I've spent
writing this letter). A larger settlement like this
would set a great precedent. It would send shock waves throughout
the software industry. It would send a message that mediocrity in
software is unacceptable and could be extraordinarily costly.
Businesses would be forced to re-prioritize their
software development and operation practices
in a way that gives greater emphasis to achieving quality.
Large settlements for data breaches would encourage the progress of
formal software verification and its adoption. This could
ultimately be a huge contribution to society.
back to Axiomatic Language Home Page