Microsoft outage exposes risks of digital dependence

A failure in Microsoft services showed how disruptions to online systems can threaten essential services, writes Andrés Magnússon for mbl.is.

For many people, the disruption was brief and inconvenient. But it also put some infrastructure at risk. In Britain, staff at the electricity network brought out old landline phones and fax machines to prevent power cuts. That backup worked, although fax machines are now rare, landlines have disappeared from many homes and many organisations’ phone systems rely on cloud services.

Emergency phone numbers were disrupted in Iceland and elsewhere. In other places, people could not pay bills, not because secure banking systems had failed but because verification codes did not arrive by email.

Security can become a weakness

The Microsoft failure showed that systems can be paralysed without a cyberattack. As more services move online, organisations have focused on security, encryption and authentication. But many rely on authentication services run by a small number of companies. If one of those services fails, users can be locked out even when a company’s own systems are working, its data is safe and its computers are running normally.

Other problems can also arise. More services are hosted in the cloud, in distant data centres that depend on reliable electricity, cooling and communications. A failure in any of those can cause serious disruption. Recently, Amazon data centres on the Arabian Peninsula were hit by an Iranian drone attack. The power went out, and firefighting efforts caused water damage. Submarine cables are also vulnerable to sabotage, both on the seabed and where they come ashore.

Cloud services nevertheless have significant advantages. They are generally distributed across countries, with backup routes and multiple copies of data. The Royal United Services Institute, a British defence institute, said in a recent report that cloud hosting had made a crucial difference in helping Ukraine maintain public services during wartime.

An arms race in cyberspace

Cyber threats can come from lone hackers, criminal groups or agents of hostile states, and sometimes from a combination of them. The consequences can extend beyond computer screens. Iceland’s cyber security team, CERT-IS, recently warned of attacks on refrigeration and freezer units in European grocery stores that caused large quantities of food to spoil. Similar equipment is used widely across Western countries. Healthcare systems are also targets.

Anne Neuberger, a former deputy national security adviser to the US president, recently noted that artificial intelligence has sharply shortened the time between a vulnerability being discovered and being exploited in an attack. The process can move so quickly that human defenders cannot keep up. At the same time, AI can help find and fix vulnerabilities, creating a new arms race between attack and defence.

European countries face a challenge. Some fear that the European Union’s AI rules, which are planned for implementation in Iceland, could leave Europe further behind the United States and China. If the rules also slow down cyber defences, the consequences could be severe. Attackers will not wait for approval from Brussels.

When connections fail

Iceland has practised responses to cyberattacks on energy infrastructure, submarine cable cuts and other disruptions. Transmission routes have increased, and more are planned.