Homicideware

Matwyshyn opens with the 25th anniversary of the Y2K remediation effort and the Melissa virus, which the FBI described as foreshadowing modern threats. She argues that computer security policy and legal thinking have not caught up. Outages now cause large financial losses and can threaten public safety, critical infrastructure and national security, yet the field still frames much of the problem narrowly around confidentiality breaches.

The middle of the talk presents early research on more than 120 engineering catastrophes that involved deaths. She identifies recurring failure patterns, including unaddressed technical debt, ignored warnings, designs that assume flawless human operation, neglected maintenance, rushed schedules and changing conditions. A 1919 Boston molasses tank collapse illustrates how a known defect was concealed and how the resulting liability reshaped engineering practice. She contrasts this with the Y2K response, which passed two statutes, narrowed liability, excluded physical injury claims and let judges appoint technical experts. The recent CrowdStrike update disruption serves as a current example of how an availability failure can be treated as a safety emergency.

She argues that courts will judge incidents by context, harm and knowledge, meaning what a person in a given role should have known, not only what they admit knowing. Market forces alone will not fix this, she says, so she proposes a dedicated technology safety body with enforcement, policy coordination, foresight and pilot functions. For practitioners, the takeaway is to threat model foreseeable failures and to explain security work in terms that non-specialists understand.