title: Cyber-attacks highlight growing vulnerability of us all
content: In 2010 , an agreement between Microsoft and the NHS to provide almost all Microsoft software to the service for one single fee and to keep the software updated with new releases was not renewed by the incoming coalition government ( NHS targeted in global cyber-attack , 14 May ) . It cost a few billion , but the budget for it was there , and it saved many billions more . Microsoft also liked it , of course , as it saved it the hassle of organising multiple sales with the many different parts of the service . As I understood it , the Cabinet Office stopped it dead .
  At the time , I was one of a group of NHS users consulted by those preparing the case for the arrangement to be continued . We were all shocked when it wasn ’ t renewed . Many people argued it was a mistake at the time . This relatively basic IT ( Windows , Office , Mail , SQL server , and so forth ) cost the NHS far more as a result . Further , the lack of the single agreement effectively moved the cost of upgrades on to individual hospitals , community providers , GPs and commissioners , and no new money was made available by the coalition government to help these individual units close the gap .
  Obviously , directors of finance looked sceptically at new requests to upgrade systems that seemed to be working perfectly OK , and with the huge pressures on NHS budgets that we all know about , it is perhaps understandable that other local priorities were addressed first . I suspect this goes some way to explain why the NHS was hit harder than many organisations by the recent malware attack – as a result of that single bad decision , the service contains far more older systems which can ’ t be or haven ’ t been updated .
  • The “ ransomware ” attacks targeted PCs which use Windows XP – this is an old operating system and has security flaws . Many organisations have still not completed the upgrade from XP to Windows 7 or 10 – which is a logistical nightmare , very expensive and takes years . Microsoft stopped issuing security patches for XP in 2014 , which means that organisations who use XP have major security risks .
  The real question is this : who is holding whom to ransom ? Is it the criminal hackers who use ransomware – or is it Microsoft , which put pressure on organisations to do costly upgrades from XP to Windows 7 ( or 10 ) by withdrawing support from XP so that they are then running on insecure operating systems ?
  • Every IT specialist in the NHS knows that the recent cyber-attack was not just bad luck – it was occasioned by criminal negligence and any patients affected should be able to sue the government . Microsoft issued almost daily warnings not to continue using the XP operating system back in 2014 when it withdrew all support for this , and almost all NHS staff upgraded their own systems at home . The only reason the service as a whole did not take the necessary action was that managers preferred to invest incredible sums of money in a vast centralised computer network which failed to materialise while completely ignoring these warnings , and remedial action will now be very expensive , not to mention the cost of this failure to patient ’ s lives .
  • Top civil servants in Whitehall have been pushing government organisations like the NHS into keeping computer records only , without any paper alternative or back up , for the best part of a decade . More and more services such as legal aid and the courts are scrapping the paper version of their applications and records . With these cyber-attacks , we see the way Whitehall has left us all vulnerable . Top civil servants have had a ridiculous faith in modern technology , now seen to be hopelessly misplaced . This was all entirely foreseeable and they have been warned for years . They just would not listen to professionals who told them this would happen . Thankfully there are just enough long-serving civil servants left working to put all the old systems back in place again for them . A complete reversal of policy is urgently needed as clearly demonstrated by the last few days . Plainly we still need the postal service along with our landlines .
  • The blame for these cyber-attacks can be laid squarely at the door of the US National Security Agency . It identified the weakness in Microsoft Windows which was exploited by the attack . But instead of telling Microsoft about it so the vulnerability could be fixed , it appears the agency kept it secret to use it for its own espionage activities . When the details became public after a large cache of NSA documents was posted on the internet , it was inevitable that criminal actors would make use of it . Spying organisations such as the NSA and our own GCHQ suffer a fundamental conflict of interest between their duty to defend their own populations against cyber-attack and practising their own attacks against perceived enemies . Because of the pervasive and instantaneous nature of the internet , if your attack method leaks out it can be used immediately against you . It is the same with encryption : if you once try to weaken it so that security services can break into private data , you eventually weaken it for everyone and everything becomes vulnerable , including the safety of online payments systems . Therefore the hoarding of software vulnerabilities by the agencies must cease . They should concentrate solely on defending systems from attack . Indeed , this was one feature of Microsoft ’ s recent proposal of a digital Geneva convention to tone down the cyber arms race and make the internet a safer place – an initiative we would do well to encourage .
  • The global chaos caused by the recent ransomware attacks is only possible because of the impregnable anonymity of bitcoin . The ideology of bitcoin deserves deeper analysis but it reflects the US libertarian belief that maximum anonymity in financial transactions is always a good thing . However , commerce is a social activity and there are many reasons why society should be in a position , with due safeguards , to investigate suspect transactions and , where necessary , identify both payers and payees . Many of the other claimed benefits of bitcoin are also spurious . Its much-touted security is based on the ownership of a unique key which , because it can never be tied to an individual or recovered by its rightful owner , is just as vulnerable to robbery or theft as cash , with even less chance of recovery . So it is time to stop accepting bitcoin and , while we are at it , to tear down the cloak of darkness that hides far too much of the world ’ s financial activities
  • The rows of frozen NHS screens should serve as a warning to those who advocate online voting in parliamentary elections , not to mention enthusiasts for a cashless society .
  • Didn ’ t I read in ███ that our Trident fleet is still using XP ? Should the Royal Navy be laying aside some bitcoins ?
content_original: In 2010, an agreement between Microsoft and the NHS to provide almost all Microsoft software to the service for one single fee and to keep the software updated with new releases was not renewed by the incoming coalition government (NHS targeted in global cyber-attack, 14 May). It cost a few billion, but the budget for it was there, and it saved many billions more. Microsoft also liked it, of course, as it saved it the hassle of organising multiple sales with the many different parts of the service. As I understood it, the Cabinet Office stopped it dead.
  
  At the time, I was one of a group of NHS users consulted by those preparing the case for the arrangement to be continued. We were all shocked when it wasn’t renewed. Many people argued it was a mistake at the time. This relatively basic IT (Windows, Office, Mail, SQL server, and so forth) cost the NHS far more as a result. Further, the lack of the single agreement effectively moved the cost of upgrades on to individual hospitals, community providers, GPs and commissioners, and no new money was made available by the coalition government to help these individual units close the gap.
  
  Obviously, directors of finance looked sceptically at new requests to upgrade systems that seemed to be working perfectly OK, and with the huge pressures on NHS budgets that we all know about, it is perhaps understandable that other local priorities were addressed first. I suspect this goes some way to explain why the NHS was hit harder than many organisations by the recent malware attack – as a result of that single bad decision, the service contains far more older systems which can’t be or haven’t been updated.
  
  Graham Head
  
  London
  
  • The “ransomware” attacks targeted PCs which use Windows XP – this is an old operating system and has security flaws. Many organisations have still not completed the upgrade from XP to Windows 7 or 10 – which is a logistical nightmare, very expensive and takes years. Microsoft stopped issuing security patches for XP in 2014, which means that organisations who use XP have major security risks.
  
  The real question is this: who is holding whom to ransom? Is it the criminal hackers who use ransomware – or is it Microsoft, which put pressure on organisations to do costly upgrades from XP to Windows 7 (or 10) by withdrawing support from XP so that they are then running on insecure operating systems?
  
  Gordon Kennedy
  
  Bolton
  
  • Every IT specialist in the NHS knows that the recent cyber-attack was not just bad luck – it was occasioned by criminal negligence and any patients affected should be able to sue the government. Microsoft issued almost daily warnings not to continue using the XP operating system back in 2014 when it withdrew all support for this, and almost all NHS staff upgraded their own systems at home. The only reason the service as a whole did not take the necessary action was that managers preferred to invest incredible sums of money in a vast centralised computer network which failed to materialise while completely ignoring these warnings, and remedial action will now be very expensive, not to mention the cost of this failure to patient’s lives.
  
  Dr Richard Turner
  
  Harrogate, North Yorkshire
  
  • Top civil servants in Whitehall have been pushing government organisations like the NHS into keeping computer records only, without any paper alternative or back up, for the best part of a decade. More and more services such as legal aid and the courts are scrapping the paper version of their applications and records. With these cyber-attacks, we see the way Whitehall has left us all vulnerable. Top civil servants have had a ridiculous faith in modern technology, now seen to be hopelessly misplaced. This was all entirely foreseeable and they have been warned for years. They just would not listen to professionals who told them this would happen. Thankfully there are just enough long-serving civil servants left working to put all the old systems back in place again for them. A complete reversal of policy is urgently needed as clearly demonstrated by the last few days. Plainly we still need the postal service along with our landlines.
  
  Nigel Boddy
  
  Darlington
  
  • The blame for these cyber-attacks can be laid squarely at the door of the US National Security Agency. It identified the weakness in Microsoft Windows which was exploited by the attack. But instead of telling Microsoft about it so the vulnerability could be fixed, it appears the agency kept it secret to use it for its own espionage activities. When the details became public after a large cache of NSA documents was posted on the internet, it was inevitable that criminal actors would make use of it. Spying organisations such as the NSA and our own GCHQ suffer a fundamental conflict of interest between their duty to defend their own populations against cyber-attack and practising their own attacks against perceived enemies. Because of the pervasive and instantaneous nature of the internet, if your attack method leaks out it can be used immediately against you. It is the same with encryption: if you once try to weaken it so that security services can break into private data, you eventually weaken it for everyone and everything becomes vulnerable, including the safety of online payments systems. Therefore the hoarding of software vulnerabilities by the agencies must cease. They should concentrate solely on defending systems from attack. Indeed, this was one feature of Microsoft’s recent proposal of a digital Geneva convention to tone down the cyber arms race and make the internet a safer place – an initiative we would do well to encourage.
  
  Ron Mitchell
  
  Coventry
  
  • The global chaos caused by the recent ransomware attacks is only possible because of the impregnable anonymity of bitcoin. The ideology of bitcoin deserves deeper analysis but it reflects the US libertarian belief that maximum anonymity in financial transactions is always a good thing. However, commerce is a social activity and there are many reasons why society should be in a position, with due safeguards, to investigate suspect transactions and, where necessary, identify both payers and payees. Many of the other claimed benefits of bitcoin are also spurious. Its much-touted security is based on the ownership of a unique key which, because it can never be tied to an individual or recovered by its rightful owner, is just as vulnerable to robbery or theft as cash, with even less chance of recovery. So it is time to stop accepting bitcoin and, while we are at it, to tear down the cloak of darkness that hides far too much of the world’s financial activities
  
  Dr Kevin Ryan
  
  Limerick, Ireland
  
  • The rows of frozen NHS screens should serve as a warning to those who advocate online voting in parliamentary elections, not to mention enthusiasts for a cashless society.
  
  Brian Moss
  
  Tamworth, Staffordshire
  
  • Didn’t I read in the Guardian that our Trident fleet is still using XP? Should the Royal Navy be laying aside some bitcoins?
  
  Mike Jones
  
  Exeter
  
  • Join the debate – email guardian.letters@theguardian.com
  
  • Read more Guardian letters – click here to visit gu.com/letters