What the Future Holds: a Terrifying Glimpse into the Global Computer Collapse

When CrowdStrike CEO (soon to be ex-CEO) George Kurtz said Friday morning that “this is not a security incident or cyber attack,” you should not have been reassured.

This was hours after an update to their antivirus software had caused well over a billion Windows computers to cease to function completely, taking out crucial services at hospitals, airports, city services, and everything from jails to subways.

As these systems visibly collapsed on Friday into Windows “blue screens of death,” they did so not from malicious actors, but from small, ordinary human error.

And the failure is massive: over a billion computers now need individual attention, since there’s no longer a way to communicate with any of these computers remotely.

“A fix has been deployed,” Kurtz said, neglecting to mention that the broken computers are not able to receive that fix.

The damage will likely be far greater than it seems right now.

Even now, many hours after the initial failures, there is no clear agreement on how it happened or where oversight had been or should have been — nor even how best to fix it.

In recent years, there have been an increasing number of widescale internet outages, whether from Amazon’s cloud platform collapsing, misconfigurations in fundamental network infrastructure, or actual hardware.

The CrowdStrike outage was worse than any of these because it didn’t just hit the backbone of the internet, but individual endpoint computers, knocking out crucial services not just from a central failure, but by taking down everything it touches.

It is also not an anomaly. Lawmakers and tech mavens will make much of the oversights that caused this disaster, but there will be less talk of the more difficult problem: its inevitability.

No matter what steps are taken, at the end of the day this sort of mistake only has to happen a single time to cause a catastrophe.

Yet in a hyper-networked world like ours, the number of possible catastrophes are so great that we cannot hope to anticipate and protect against them all.

Two things make the increased fragility of our systems inevitable.

The first is the increasingly dense network of computational systems that organize and support our societies.

Introducing a new piece into this network connects it to all the other pieces, not just one.

The second cause of fragility is, ironically, how we try to consolidate all these individual pieces of technology to reduce that complexity.

Twenty years ago, the internet was a mishmash of competing and barely compatible standards and providers.

As giants like Amazon, Google, and Microsoft dominate and standardize the practices, they only bind these systems more tightly together.

Friday’s outage “only” affected Windows computers, but that is cold comfort when they make up a majority of desktops and servers in the world today.

There will be many recriminations in the upcoming weeks, none of which will feel sufficient or satisfactory. While individual actors and negligent companies may be punished or fined, no one will walk away from this feeling safe that it won’t happen again — because it will.

We must change our attitude to one in which such potentially catastrophic changes move more slowly and more carefully through our dense, interconnected networks.

Updates, even the safest ones, should never be global or simultaneous.

The next CrowdStrike is coming, but if we slow things down, for a moderate cost of inefficiency, we can gain invaluable hours to minimize its damage a thousand-fold.

David B. Auerbach is a software engineer and author of “Meganets: How Digital Forces Beyond Our Control Commandeer Our Daily Lives and Inner Realities.”