Delta Air Lines has lashed out at CrowdStrike in a letter, accusing the security giant of trying to “shift the blame for the IT breakdown caused by its software” – and that CrowdStrike CEO George Kurtz’s offer of support came too little, too late.
Last month, CrowdStrike released a flawed update to its Falcon threat detection system that crashed and disabled more than 8 million Microsoft Windows computers worldwide, including more than 37,000 Delta computers, disrupting the travel plans of more than 1.3 million people, according to a letter from Delta attorney David Boies to CrowdStrike attorney Michael Carlinsky on Thursday.
Shortly after that collapse, Delta threatened legal action against CrowdStrike and Microsoft, claiming the IT fiasco cost them more than $500 million. And indeed, a lawsuit is looking more likely by the minute as the airline ramps up its criticism of the security software developer. Today, Delta laid out its defense for its conduct following the disastrous Falcon update that grounded planes and ruined the plans of millions of Delta customers.
CrowdStrike attempted to “blame the victim” in its Aug. 4 apology letter to the airline, Boies said in his letter today, adding, “There is no basis – none – to believe that Delta was in any way responsible for the faulty software that crashed systems around the world.” CrowdStrike had suggested that Delta was to some extent responsible for the heartache the company suffered in July.
Boies’ latest letter (PDF) cites the software developer’s preliminary post-incident review and root cause analysis, which Boies says proves that “CrowdStrike engaged in grossly negligent, even willful, misconduct with respect to the faulty update.” This is due in part to the software company’s admission that it did not phase in the faulty update.
CrowdStrike is facing a class-action lawsuit from investors for failing to release changes to Falcon in phases. In its two follow-up investigations into the July 19 fiasco, the beleaguered security company promised to improve its testing and release future updates in advance.
But perhaps worse, after CrowdStrike took down Windows machines around the world, the company showed no “sense of urgency or understanding of the scale and scope of the damage” it was responsible for, the letter added. Delta rejected CrowdStrike’s claim that the company worked “tirelessly” to help Delta restore its systems.
The only offer of assistance the airline received during the first 65 hours after the outage was the publicly available fix website, which recommended a manual restart of all affected computers, it said. In addition, the July 21 automatic fix “introduced a second error that prevented many computers from recovering without additional intervention,” the letter said.
When Kurtz called Delta CEO Ed Bastain on the evening of July 22 – and that happened only once, according to Boies – it was “too late.” The call was “unhelpful and ill-timed,” coming nearly four days after the disaster, by which time Delta had already “restored its critical systems and most other machines,” the letter said.
An earlier letter from CrowdStrike to Delta blamed the airline’s “IT decisions” for the fallout, while a similar letter from Microsoft’s lawyer essentially accused Delta of using very old and outdated equipment.
And Delta doesn’t seem to be taking it lightly either. The airline spoke of the “billions of dollars” it has invested in its IT, adding: “The reliance on CrowdStrike and Microsoft was the reason Delta took longer to fully recover compared to its industry peers.”
The following is what the letter says about this allegation:
The letter calls on CrowdStrike to stop trying to “evade responsibility” and to tell customers everything it knows about how and why the disaster occurred. “Everything will come to light in litigation anyway.”
When asked about this August 8 letter from Delta, a CrowdStrike spokesperson said: The Register:
A Delta spokesman said the airline would “have no further comment.” ®