Robots and Supermarkets

Original image: Wikipedia

First Law: a robot may not injure a human being or, through inaction, allow a human being to come to harm. Second Law: a robot must obey the orders given to it by human beings, except where such orders would conflict with the First Law. Third Law: a robot must protect its own existence, as long as such protection does not conflict with the First or Second Law.

These are the three laws of robotics, drawn up in 1942 by the American science fiction author Isaac Asimov. The idea was that these laws had to be hardwired into every robot, to prevent (ever more intelligent) robots from turning against humans.

Then, in 2004, the film I, Robot came out, starring Will Smith (with toe-curling product placement for sneakers and a car brand, but that's beside the point). In this film (spoiler alert), a certain type of robot turns against humans in 2035. At the end of the film the cat comes out of the bag: the supercomputer that communicates with all these robots has interpreted the laws of robotics a little differently. Humans are ruining themselves and the Earth through crime and pollution, so the robots must protect humans from themselves by subjugating them. The crux, of course, lies in this part of the First Law: “through inaction, allow a human being to come to harm”. Decades later, by the way, Asimov also formulated the Zeroth Law, which ranks above the other three and legitimises the uprising even more clearly: a robot may not harm humanity, or, by inaction, allow humanity to come to harm.

Fast forward to 2026, to the night of 11 to 12 October. The temperature in the refrigeration systems of hundreds of French supermarkets climbed to fifty degrees centigrade – above zero, mind you (122 °F). This lasted about six hours. No alarm went off anywhere. Well, a fire alarm probably did start beeping here and there eventually, because some refrigeration units caught fire or melted away.

That makes you wonder: why can a refrigeration unit get that hot in the first place? Were the laws of robotics perhaps broken here, to protect humans – and the French in particular – from frozen meals? Fortunately, no, the explanation is simpler. In a refrigeration system, ice forms on the evaporator. That is why such a system regularly switches to defrost mode for a few minutes. So not to defrost the whole unit, but only the evaporator. Apparently, hackers managed to switch on this mode and lock it in place.

Why can the refrigeration system of a supermarket be reached via the internet? For the same reason that the installer of your solar panels can probably also look in remotely: because it's convenient. And to make things really easy, a backdoor was built in: you could log in with ‘admin’ and the current date. On top of that, some of the affected controllers were outdated models without recent security updates, and others were more modern controllers running outdated software.

Smart systems are vulnerable by definition, Mikko Hyppönen said ten years ago already (“If it's smart, it's vulnerable”). And if smart systems are treated dumbly, I would add, you're asking for trouble. That this happens is not all that strange, by the way. In IT (information technology) we have by now taken the need for security to heart, but the world of OT (operational technology) is still lagging well behind. No wonder – have you ever stopped to think, in the supermarket, that the refrigerator you take your ready-made lasagne from is computer-controlled and connected to the internet? Without that awareness, it's hardly surprising that security for that kind of system gets so little attention. As long as customers don't ask for it, manufacturers have little incentive to invest in it.

Perhaps the problem with Asimov's laws lies in the generality of the term ‘human’. It makes no distinction between honest and dishonest people, so robots have to listen to everyone. If the refrigeration unit had realised it was dealing with someone malicious, it could have defended itself.

 

And in the big bad world…

• we also had a supermarket hack in the Netherlands.
• the Danish population register had such a daft password too.
• the Dutch Tax Authority's decision to drop the Microsoft 365 cloud is drawing international attention too.
• digital sovereignty will cost us dearly, American tech giants warn.
• the phone number of the Rijksrecherche (the Dutch national bureau investigating police and officials) is being spoofed (note: the Rijksrecherche deals with entirely different matters, but because almost nobody knows that, citizens can still fall for it). [DUTCH]
• there seems to be a link between a director of a ransomware negotiation firm and ShinyHunters.
• the cure is sometimes worse than the disease.
• your cryptocurrency isn't necessarily safe in a hardware wallet either.
• data centres are now a war target.
• there is uproar in the Dutch cloud industry over cooperating with a US request for legal assistance. [DUTCH]
• hardly anyone worries about the poor security of our solar panels.
• DigiD (the Dutch government's login system) stays in Dutch hands for good. [DUTCH]