That many websites went offline on Wednesday was not a cyberattack but an emergency repair. The real warning lies elsewhere: Flanders stood by powerless and had to wait for others to solve the problem, writes Dennis Vanden Auweele, AI and data ethicist at the knowledge centre Data & Society (IMEC-SMIT, VUB). He specialises in digital sovereignty and digital rights.
The more critical points there are in the cyber security chain, the greater the chance that something will go wrong somewhere. This week, everything fortunately ended well with the security vulnerability in the PHP programming language, but that offers no guarantee for the future. Flanders must work towards greater control over its own cyber security.
On Wednesday, many websites went offline. Not because of a cyberattack, but because a security measure compelled the non-profit PHP Foundation to swiftly carry out a security update. The two serious vulnerabilities in the PHP programming language were discovered, among others, by the security company Calif with the help of an OpenAI AI model, and in the wrong hands could have caused significant damage. They reported this to the PHP Foundation, an entire chain was set in motion, decisive responses followed, and problems were avoided.
On VRT NWS, Steven Latré (imec) praises this decisiveness and warns that such vulnerabilities will be found more frequently with the help of AI. He concludes that, for the time being, the largest companies managing our most important data are taking the appropriate security measures and that we may feel reassured about that.
Dennis Vanden Auweele
Endless list
I am rather concerned myself. A disaster has been averted this time, but what if a malicious group of Russian hackers had found the vulnerability? The consequences would have been significant: the school platform Smartschool would have been inactive for weeks, judicial proceedings would have faced further delays because court websites would have been inaccessible, citizens would have been difficult to reach because media channels would have been down, and a table for Sunday lunch could not have been booked because Tablefever would have been inactive. This list is almost endless.
The biggest problem is not that you are vulnerable to cyberattacks. That is always the case. The worst part is that you are completely dependent on third parties to detect and resolve the problem. In this entire story, scarcely any Flemish or European actors come to the fore. Flanders mainly had to wait for the problem to be solved elsewhere.
Recent legislation, such as the European NIS2 Directive, requires providers of critical and essential services to retain sufficient control over their cyber security. That does not alter the fact that Flemish technological infrastructure remains dependent on third parties. The PHP Foundation is a non-profit organisation, but large parts of Flemish society rely on American technology companies such as Microsoft, Amazon and Google. Those same companies, as studies by the Insikt Group show year after year, are the primary targets of cyberattacks, probably because they are strongly associated with the American administration.
Those companies undoubtedly have a substantial capacity to detect cyber security vulnerabilities and, where necessary, remedy them. Microsoft deployed around 34,000 engineers at the end of 2023 for what it described as the largest cyber security project of all time. Google acquires a great deal of cyber security expertise, for example through Wiz, which helped investigate the PHP vulnerability.
Poison and cure
What if, due to geopolitical tensions, cyberattacks in Flanders suddenly cease to be a priority for these companies? What if Flemish companies are denied access to the most advanced AI cyber security models, or have to pay extremely high costs for them? US President Trump has already imposed embargoes on AI models developed by Anthropic.
The emergence of even more advanced AI models will intensify this problem. These models are both poison and cure: they can detect problems, but they can also exploit them. If the tech broligarchy surrounding the American president continues on its anti-European course, the price of our cyber security will quickly become unaffordable.
Although everything turned out well this time, the risk posed by the PHP programming language should serve as a wake-up call for Flanders, and by extension Europe. When cyber security becomes a value chain with so many points at which something crucial can go wrong, you need to take control of it yourself. For our most critical infrastructure, we must be able to act independently.
And, for that matter, for our restaurant reservations too.