A Fridge Frozen

Yesterday, Reuters reported that hackers attacking supermarket refrigerators in France had forced up the temperature to 50°C. Hundreds of shops were affected, food was thrown away, fires were reported. The attack exploited refrigeration management systems made by the Danish company Danfoss, which said the affected units were running outdated firmware and that for a long time they had advised the affected companies to update them.¹

»We have quietly accepted that more connectivity is better, that products should be released early and corrected later, and that the customer should be responsible for maintenance. But those aren’t laws of nature«

A lot of people will instinctively feel that the obvious question is why the systems hadn’t been updated. But let’s take a step back and ask the more interesting one: why does a refrigerator need to be updated in the first place?

The answer is efficiency. A retailer managing thousands of refrigerators can monitor and adjust them without sending technicians to every store. The manufacturer saves money; the customer absorbs the cost, in time, attention and risk. This is the pattern that security economist Ross Anderson has long pointed to, in which the party best placed to prevent a failure is rarely the party who pays for it.²

A refrigerator has a pretty stable job: it moves heat out of a box, and the laws of thermodynamics rarely change beneath it. But these ones in France had been given a network connection. That turned them into what legal scholar Jonathan Zittrain calls »tethered appliances«, reachable by whoever controls – or compromises – that connection, exposing them to adversaries that their original purpose never required them to face.³ The connection gave the fridges a potential enemy.

Cybernetician W. Ross Ashby’s Law of Requisite Variety offers a useful principle here: a control system needs enough adaptability to cope with the disturbances in its environment, and no more.⁴ A calendar application must contend with changing operating systems, competing apps, and evolving threats – what the biologist Leigh Van Valen called a Red Queen race, in which standing still means falling behind.⁵ The name comes from a character in Lewis Carroll’s Through the Looking-Glass, who has to keep running just to stay in the same spot.⁶ A refrigerator clearly has rather less to contend with. Adaptability is good, but we might want to ask how much of it a particular thing needs, and what risk we take by giving it more.

We could, for instance, design a refrigerator that can report its temperature to a dashboard but can’t receive any commands in return. If it needs to be updated, a technician pays a visit and connects a laptop. Wouldn’t that be slower and more expensive? Yes. But it would also make remote attacks considerably harder, and – importantly – leave the cost of fixing the manufacturer’s own mistakes with the manufacturer, rather than transferring it to the customer.

There’s a name for the underlying idea, from economist Thomas Schelling: a commitment device.⁷ In Homer’s Odyssey, Ulysses preemptively has himself tied to the mast so that he can’t act on his future desire to follow the singing of the Sirens.⁸ He deliberately gives up the freedom to change his mind, and that restraint makes the arrangement work. We recognise the same principle in a piggy bank that must be broken to get the coins out, or a contract that restricts the future choices of those who sign it. Those aren’t defective systems waiting for an upgrade. Their limitations are part of their purpose.

Why not design products this way? A refrigerator that can’t be remotely altered becomes more trustworthy precisely because it has fewer capabilities. Changing its behaviour would require a deliberate, physical intervention. A manufacturer could sell this as a guarantee of integrity, renewed every year it remains untouched by anyone but the technician. Instead of a fast and cheap release that makes corrections necessary, it would profit from creating a product that doesn’t need to be corrected. It would benefit from shipping a finished product.

We don’t need to stop at refrigeration. How would cars change if manufacturers competed on how long they could remain secure without remote intervention, rather than on how quickly they could push an update? What about pacemakers? Is remote control really worth the risk of getting hacked, for a device that regulates your heart?

We have quietly accepted that more connectivity is better, that products should be released early and corrected later, and that the customer should be responsible for maintenance. But those aren’t laws of nature. They are choices shaped by the economics of the companies that make our products.

Perhaps we’re overlooking entire markets by not going against the prevailing sentiment. Progress includes the ability to choose which capabilities not to build. Sometimes that choice makes a product better in a way its competitors have forgotten to offer.

Perhaps the next advance in refrigeration isn’t a smarter fridge, but one that knows what it doesn’t need to be able to do.

References