When technology fails us...is life in danger?

Katia Habib, a 55-year-old Syrian woman who has lived in north London for more than three years, did not expect a malfunction in a banking app to disrupt her day or hamper her arrival to an important medical appointment before undergoing surgery.

Katya was relying on the Revolut app for her daily transactions, but she was surprised that it stopped when she tried to pay the train fare, which hindered her from arriving to her appointment on time.

Security vulnerabilities in PHP software - an open source programming language used to develop websites and electronic applications and run their back-end functions - raised concerns about the security of websites and servers, and a malfunction in one of Google Cloud’s data centers caused the interruption of a number of digital services and platforms in the United Kingdom, including the Revolut banking platform, Lloyds Banks, and HSBC.

Habib had to return home to get a replacement payment card, before arriving for her appointment two hours late.

Although the situation ended and she later met the surgeon, the stress and exhaustion that accompanied her throughout the day led her to rethink the extent of her reliance on one banking application, she said.

Habib's experience may seem at first glance to be just an inconvenience resulting from a technical malfunction, but it reveals part of a broader problem: What happens when the digital systems on which the details of our daily lives depend have stopped? What if the impact of the malfunction was not limited to delaying a flight or disrupting a payment process, but rather extended to threatening patient safety, destroying food supplies, or disrupting vital services?

Risks beyond the digital world

This possibility is no longer hypothetical. During last October and the beginning of this November, Europe witnessed technical failures and electronic attacks that affected multiple sectors, revealing the extent of the repercussions that could result from the failure of digital systems.

In one incident, a cyber attack targeted the refrigeration and freezing systems in dozens of major stores in seven European countries, including Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland. This led to the destruction of food supplies valued at millions of euros, according to local media.

In early November, the attacks spread to a more sensitive sector, as blood banks in France were subjected to an attack targeting cold room monitoring and control systems. However, the French Ministry of Health confirmed that the safety of the blood supply was maintained thanks to warning systems and precautionary measures.

So, digital malfunctions are no longer just a technical problem, but rather they are capable of causing damage that affects the lives, safety, and rights of individuals.

Here the question arises: Who bears responsibility when the impact of digital systems failure exceeds material losses to threaten people’s health and interests?

Two women affected by these malfunctions narrated their experiences to BBC News Arabic, and revealed how their repercussions went beyond the boundaries of applications and service institutions, affecting the details of daily life, and sometimes even placing patients and medical teams in critical situations that require urgent decisions to be made in light of the inability to access the digital systems on which they depend.

Digital glitches confuse medical intervention decisions

Mezgin Fiqh, a Syrian nurse working in a nursing home in the northern Netherlands, says that a digital malfunction in Mademo - a web-based system used for electronic prescriptions, medication records and monitoring - made it difficult to verify dosage rates and when patients were given them.

She explains to us how the medical staff had to rely on memory and communication between its members to know the medications that patients received and when to administer them, especially sensitive medications, such as blood thinners and strong painkillers, which require careful monitoring to avoid medication errors.

The nurse told BBC News Arabic that the situation became more complicated when one of the residents of the home suffered an emergency that left him paralyzed, as the staff was unable to see his previously documented treatment wishes, which included refusing resuscitation with electric shocks and transportation to the hospital, and his preference to remain in the nursing home until his time came.

She added that the patient was taken to the hospital and resuscitated, before it later became clear that he had previously expressed his desire to avoid such medical interventions and remain in the care home due to his own desires and beliefs, she said.

The incident highlights that the disruption of digital systems not only threatens the safety of patients, but may also prevent their treatment decisions and prior wishes from being respected, especially at critical moments.

Who bears legal responsibility?

Dr. Ilse de Bucer, associate professor of information law at the University of Amsterdam, who specializes in digital justice, human rights and technology, told BBC News Arabic that the European Union has adopted the Network and Information Systems Security (NIS2) directives with the aim of strengthening the cybersecurity of critical infrastructures, noting that the scope of its application may include care homes, depending on their size.

It explains that these directives impose on the institutions covered by them two basic obligations: the first of which is the duty of care, which includes protecting data and systems and ensuring continuity of operations by taking measures such as backup, controlling access to data, and training employees on cybersecurity. The second obligation is to report essential security incidents to the competent authorities.

De Busser warns that failure to comply with these obligations may expose institutions to fines of up to 10 million euros, or the equivalent of 2 percent of their total global annual revenues.

For her part, Professor Sharona Hoffman, professor of law and bioethics at Case Western Reserve University in the United States, and co-director of the university's Center for Law and Medicine, believes that healthcare institutions may bear legal responsibility if they are proven to have failed to protect data and electronic systems.

She explains that this negligence may be manifested in not taking adequate measures to store data securely, or failing to develop backup plans that ensure dealing with computer system malfunctions and continuing to provide care.

But Hoffman stresses that the occurrence of a security incident does not necessarily mean that the institution is proven responsible, as it may be exposed to an electronic hacking despite taking recognized security measures, and in this case it may not be legally responsible if it proves impossible to prevent the incident.

She adds that proving negligence in such cases requires proof that the institution did not adhere to due standards of care when managing electronic health records, and that this failure caused actual harm to the patient.

How can we reduce the risks of digital malfunctions?

Dr. Daniel Gardam, lecturer at the Surrey Center for Cybersecurity at the University of Surrey in the UK, and co-director of the Academic Center of Excellence in Cybersecurity Education, told BBC News Arabic: “One of the most significant sources of risk is organizations relying on highly interconnected systems, where the failure of one component leads to a cascade of failures that spill over into other services.”

He believes that organizations should design their systems with the assumption that failures are likely to occur, rather than assuming that everything will always work as it should. This includes isolating critical systems, providing backup alternatives to them, performing regular backups of data, and ensuring easy recovery when needed.

Gardam stresses that digital resilience does not mean completely preventing malfunctions, but rather preventing a limited malfunction from turning into a larger problem whose effects extend to multiple services.

In the healthcare sector, he warns that stopping vital services, such as electronic patient records, medication management systems and appointment booking platforms, could quickly turn into a medical emergency.

Therefore, Gardam stresses the need for hospitals and healthcare institutions to take previously tested measures to deal with periods of system downtime, including using paper records as a backup alternative or providing alternative digital systems that ensure continuity of care delivery. He also stresses the importance of training employees on these procedures, because an emergency plan that remains just a written document without practical testing does not provide a real safety net.

How do organizations protect individuals when their services are disrupted?

Previous experiences reveal that the risks of digital malfunctions are not limited to the disruption of services and material losses, but may extend to the health, safety and rights of individuals, and even to crucial decisions related to their lives.