| Recurring |
one_organization |
(a) The software failure incident related to the cyberattack on the subcontractor working with US Customs and Border Protection (CBP) happened at the same organization, CBP. This incident involved the theft of sensitive data, including government agency contracts, budget spreadsheets, and Powerpoint presentations from the CBP subcontractor, Perceptics [86015].
(b) There is no information in the provided article about the software failure incident happening again at multiple organizations. |
| Phase (Design/Operation) |
design |
(a) The software failure incident in this case can be attributed to a design-related issue. The subcontractor, Perceptics, transferred images from the CBP to its own network, which is where the cyberattack occurred. This transfer was deemed a violation of CBP's policies, indicating a flaw in the design or implementation of the system's data transfer process [86015].
(b) The operation of the system did not seem to be the primary contributing factor to the software failure incident reported in the articles. The focus was more on the unauthorized transfer of data by the subcontractor, Perceptics, rather than on operational misuse of the system [86015]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident involving the cyberattack on the subcontractor working with US Customs and Border Protection was primarily due to factors originating from within the system. The article mentions that the subcontractor, Perceptics, transferred images from the CBP to its own network, which is where the attack occurred. This transfer was stated to be a violation of the agency's policies, indicating an internal system issue [86015].
(b) outside_system: The software failure incident also involved factors originating from outside the system. Hackers were able to breach the system and steal sensitive data, including government agency contracts, budget spreadsheets, and Powerpoint presentations. The stolen data was later found on the dark web, indicating an external threat that exploited vulnerabilities in the system [86015]. |
| Nature (Human/Non-human) |
non-human_actions |
(a) The software failure incident in this case occurred due to non-human actions, specifically a cyberattack on the subcontractor's network where sensitive data was stolen by hackers [86015]. The attack resulted in the theft of various types of data beyond just photographs, including government agency contracts, budget spreadsheets, and Powerpoint presentations. The stolen data was later found on the dark web, indicating that the breach was not caused by human error but rather by external malicious actors. |
| Dimension (Hardware/Software) |
hardware, software |
(a) The software failure incident in Article 86015 occurred due to contributing factors that originate in hardware. The subcontractor, Perceptics, responsible for the license plate scanners used at the US border, transferred images from the CBP agency to its own network, where the cyberattack took place. This transfer of images from the hardware (license plate scanners) to the subcontractor's network was a violation of CBP's policies, leading to the breach and theft of sensitive data [86015].
(b) The software failure incident in Article 86015 also had contributing factors that originated in software. The cyberattack on the subcontractor's network resulted in the theft of sensitive data, including government agency contracts, budget spreadsheets, and Powerpoint presentations. This indicates a vulnerability in the software systems or network security of the subcontractor, allowing hackers to access and steal such critical information [86015]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The software failure incident in Article 86015 was malicious in nature. Hackers conducted a cyberattack on a subcontractor working with US Customs and Border Protection, stealing sensitive data including government agency contracts, budget spreadsheets, and Powerpoint presentations. The stolen data was later found on the dark web, indicating malicious intent to harm the system [86015]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions |
(a) The software failure incident involving the cyberattack on the subcontractor working with US Customs and Border Protection was partly due to poor decisions. The subcontractor, Perceptics, transferred images from the agency to its own network, which was against CBP's policies. This decision to transfer sensitive data to its network contributed to the vulnerability that led to the cyberattack [86015]. |
| Capability (Incompetence/Accidental) |
accidental |
(a) The software failure incident in Article 86015 does not directly point to development incompetence as the cause of the cyberattack. It primarily focuses on the cyberattack itself and the stolen data from the subcontractor working with US Customs and Border Protection.
(b) The software failure incident in Article 86015 seems to be more aligned with an accidental failure. The cyberattack on the subcontractor, Perceptics, where sensitive data including government agency contracts and budget spreadsheets were stolen, appears to have occurred unintentionally. The article does not suggest that the cyberattack was a result of intentional actions by the subcontractor or CBP. |
| Duration |
temporary |
The software failure incident reported in Article 86015 was temporary. The incident involved a cyberattack on a subcontractor working with US Customs and Border Protection, resulting in the theft of sensitive data such as government agency contracts, budget spreadsheets, and Powerpoint presentations. The stolen data was found on the dark web after the attack occurred. The incident is being actively investigated by CBP, and measures are being taken to monitor for any unauthorized disclosure of data. This indicates that the failure was temporary and not permanent [86015]. |
| Behaviour |
other |
(a) crash: The software failure incident in the article does not specifically mention a crash where the system loses state and does not perform any of its intended functions [86015].
(b) omission: The incident does not describe a failure due to the system omitting to perform its intended functions at an instance(s) [86015].
(c) timing: The incident does not involve a failure due to the system performing its intended functions correctly, but too late or too early [86015].
(d) value: The software failure incident in the article does not involve a failure due to the system performing its intended functions incorrectly [86015].
(e) byzantine: The incident does not describe a failure due to the system behaving erroneously with inconsistent responses and interactions [86015].
(f) other: The behavior of the software failure incident in the article is related to a cyberattack where hackers stole sensitive data from the CBP subcontractor, including government agency contracts, budget spreadsheets, and Powerpoint presentations. This behavior falls under the category of a security breach rather than a specific software failure mode [86015]. |