| Recurring |
one_organization, multiple_organization |
(a) The software failure incident having happened again at one_organization:
- The Federal Reserve detected more than 50 cyber breaches between 2011 and 2015, with several incidents described internally as "espionage" [Article 44579].
- In eight information breaches between 2011 and 2013, Fed staff wrote that the cases involved "malicious code," referring to software used by hackers [Article 44579].
- Four hacking incidents in 2012 were considered acts of "espionage," according to the records [Article 44579].
(b) The software failure incident having happened again at multiple_organization:
- Cyber thieves have targeted large financial institutions around the world, including America’s largest bank JPMorgan, as well as smaller players like Ecuador’s Banco del Austro and Vietnam’s Tien Phong Bank [Article 44579].
- Hacking attempts were cited in 140 of the 310 reports provided by the Fed’s board, indicating a widespread issue across various organizations [Article 44579]. |
| Phase (Design/Operation) |
operation |
(a) The articles do not provide specific information about a software failure incident related to the design phase, where contributing factors are introduced by system development, system updates, or procedures to operate or maintain the system.
(b) The articles mention incidents related to the operation phase, where contributing factors are introduced by the operation or misuse of the system. The incidents reported involve cyber breaches at the U.S. Federal Reserve between 2011 and 2015, suspected to be caused by hackers or spies. The breaches involved espionage and malicious code, indicating failures in the operation of the Fed's computer systems [44579, 43946]. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident related to the Federal Reserve cyber breaches between 2011 and 2015 involved factors originating from within the system. The incidents included cases of "malicious code" used by hackers [44579, 43946]. The Fed's national team of cybersecurity experts identified 51 cases of "information disclosure" involving the Fed's board, indicating breaches within the system [44579, 43946]. Additionally, the National Incident Response Team (NIRT) created incident reports to address software vulnerabilities within the system [44579, 43946].
(b) outside_system: The software failure incident was also influenced by factors originating from outside the system. The incidents involved suspected hackers or spies targeting the Fed's computer systems from external sources [44579, 43946]. The breaches were part of cyber-attacks on the Fed, indicating external threats to the system [44579, 43946]. The incidents of espionage could involve foreign governments or private entities attempting to gain unauthorized access to Fed information [44579, 43946]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident occurring due to non-human actions:
- The articles mention that there were 51 cases of "information disclosure" involving the Fed's board, which could include unauthorized access to Fed information through hacking attacks or other non-human actions [44579, 43946].
- In some incidents, the cases involved "malicious code," referring to software used by hackers, indicating a non-human factor contributing to the failure [44579].
- The articles also highlight that the Fed's national team of cybersecurity experts identified cases of "information disclosure," which could involve breaches caused by non-human actions such as cyber-attacks [44579, 43946].
(b) The software failure incident occurring due to human actions:
- The articles mention that espionage incidents could involve spying by individuals like British activist Lauri Love, who infiltrated a server at a regional Fed branch in 2012, indicating human actions contributing to the failure [44579, 43946].
- It is noted that the Fed was under constant assault and compromised frequently, suggesting that human actions, such as inadequate cybersecurity measures or vulnerabilities introduced by employees, could have played a role in the software failure incidents [44579, 43946].
- An internal audit criticized the central bank for cybersecurity shortcomings, indicating potential human actions contributing to the failure, such as inadequate scanning of databases for vulnerabilities or insufficient restrictions on system access [44579, 43946]. |
| Dimension (Hardware/Software) |
software |
(a) The articles do not provide specific information about a software failure incident occurring due to hardware-related contributing factors.
(b) The software failure incidents mentioned in the articles are primarily related to cybersecurity breaches, hacking attempts, and espionage activities targeting the Federal Reserve's computer systems. These incidents involve malicious code, espionage acts, information disclosure, and hacking attempts, indicating failures originating in software vulnerabilities and security weaknesses [44579, 43946]. |
| Objective (Malicious/Non-malicious) |
malicious, unknown |
(a) The articles mention incidents involving "malicious code" used by hackers in eight information breaches between 2011 and 2013 [44579, 43946]. Additionally, four hacking incidents in 2012 were considered acts of "espionage," with information being disclosed in at least two of those incidents [44579, 43946]. These incidents suggest a malicious intent to harm the system by unauthorized access and disclosure of information.
(b) The articles do not provide specific examples or details of non-malicious software failure incidents. |
| Intent (Poor/Accidental Decisions) |
unknown |
The articles do not provide specific information about the intent of the software failure incident in terms of whether it was due to poor decisions or accidental decisions. The focus of the articles is on cybersecurity breaches and espionage activities targeting the Federal Reserve, with an emphasis on hacking incidents and information disclosure. Therefore, it is unknown whether the software failure incidents were a result of poor decisions or accidental decisions based on the information provided in the articles [44579, 43946]. |
| Capability (Incompetence/Accidental) |
accidental |
(a) The articles do not provide specific information about the software failure incident occurring due to development incompetence.
(b) The software failure incidents reported in the articles were primarily due to cyber breaches and hacking attempts, indicating failures introduced accidentally by external malicious actors rather than by development incompetence [44579, 43946]. |
| Duration |
unknown |
The articles do not provide specific information about the duration of the software failure incident related to the cybersecurity breaches at the Federal Reserve. The incidents mentioned in the articles primarily focus on cyber breaches and espionage activities targeting the Fed's computer systems, but they do not specify whether the failures were permanent or temporary. Therefore, it is unknown whether the software failure incidents were permanent or temporary based on the information provided in the articles [Article 44579, Article 43946]. |
| Behaviour |
omission, other |
(a) crash: The articles do not specifically mention a software failure incident related to a crash where the system loses state and does not perform any of its intended functions.
(b) omission: The articles mention incidents where the Fed's computer systems were breached by hackers, leading to information disclosure. In some cases, information was disclosed, while in others, it was unclear whether there was a breach, indicating an omission in the system's intended function to protect sensitive information [44579, 43946].
(c) timing: The articles do not mention a software failure incident related to timing, where the system performs its intended functions correctly but too late or too early.
(d) value: The articles do not mention a software failure incident related to value, where the system performs its intended functions incorrectly.
(e) byzantine: The articles do not mention a software failure incident related to a byzantine behavior, where the system behaves erroneously with inconsistent responses and interactions.
(f) other: The behavior of the software failure incident in this case involves security breaches and information disclosure due to hacking attempts, espionage, and malicious code, indicating a failure in the system's security mechanisms [44579, 43946]. |