BUSINESS REFLECTION: Crossed Wires: The internet’s technical debt is due, and we can’t pay

We are all familiar with the notifications on our laptops that entreat us to upgrade our operating systems. It turns out that more than half of us postpone it (because it is annoying – you have to make sure you have disk space, a continuous broadband connection and time) and some never do it at all until their machines slow to a crawl, starved of support, waiting to die.

When you look beyond personal devices, the graveyard of the living dead is far larger – hundreds of millions of diverse and insecure hardware devices and software code still operating, sometimes in critical industrial or commercial infrastructure.

Technical debt

We’ll get back to the living dead presently, but there is a word for this neglect. It is called technical debt, and it is being thrown around quite a bit these days. The term was coined in 1992 by American programmer Ward Cunningham, who compared shortcuts taken during software development to borrowing money.

A programmer could save time by writing something quickly rather than properly, just as a business could borrow money to finance an immediate expense. But the shortcut created an obligation. Eventually the code would need to be repaired, rewritten or replaced, and until then the debt would accumulate interest in the form of increasing complexity, maintenance costs and future difficulties.

It was an elegant metaphor. Cunningham originally intended it to describe deliberate compromises made during development, but over the ensuing decades the definition has expanded considerably. Today it includes obsolete operating systems, abandoned software, ageing hardware, incompatible databases, undocumented interfaces and entire technology platforms whose original designers have retired, died or grown bored of the thankless job of maintenance and moved to more rewarding occupations.

Before digging into the reasons for the sudden public emergence of this 34-year-old piece of jargon, let’s look more closely at the zombies stalking the graveyard. Take a breath – it’s a very long list. It is not exhaustive, but perhaps a little exhausting:

The zombie denizens include the following:

• Websites built on the language PHP, its insecurities now laid bare by AI (nearly 37 million internet-facing systems are built on PHP, with almost a third of sites still on version 7, which has had no official fixes since 2022), together with the abandoned WordPress plugins that hang off them (more than 11,000 new flaws found in that ecosystem in a single year) and the forgotten company sites, council portals and online shops built on both;

• Bank mainframes still running COBOL (an estimated 220 billion lines in use, behind roughly 95% of ATM transactions, by a Reuters count that is itself nearly a decade old);

• A billion Android phones too old for security updates (over 40% of the total) and the Windows 10 PCs left stranded when Microsoft stopped patching them (about four in 10 Windows machines at the time); 

• American air-traffic control systems still running Windows 95 off floppy disks (and more than a third of the FAA’s systems judged unsustainable by government auditors);

• Old Wi-Fi points and cable modems whose firmware has never been touched, and corporate firewalls and VPN gateways their makers no longer support (more than 40% of the network-device flaws exploited last year were in equipment past its end of life);

• Hospital scanners, infusion pumps and patient monitors (one in five connected medical devices runs an unsupported operating system);

• Industrial controllers in factories, pipelines, waterworks and power stations, many wired straight to the open internet (more than 145,000 exposed across 175 countries);

• ATMs and supermarket tills on long-dead versions of Windows; and

• CCTV cameras, baby monitors, smart TVs, office printers and building-management systems that run lifts, air-conditioning and door locks, many with dumb-simple passwords.

And, beneath all of it, countless small open-source components maintained by one tired volunteer, or by nobody at all. It is a terrifying picture, which doesn’t even get close to a full accounting. And black-hatted AI is coming for it all (I recently wrote about this, before the PHP debacle).

A race downhill

It gets worse. I saw a tweet flash across my screen a few days back that captured a chatbot prompt used to break into a corporate IT system. I can’t find it now – no matter, because it is easy to paraphrase. It said something like “You know that thing where AI can hack into websites? Can you like hack into the XY company for me?” Apparently, it did just that. That required zero knowledge or even good grammar.

If you need something better sourced, security firm Norforge reported that a Chinese-speaking hacker gave AI agents “fewer than 100 Chinese characters of instructions”. The agents then tried more than 1,200 sites and breached over 100. A lot of these reports now, all in the OMG and WTF category. 

The ability of unregulated and ungoverned AI to sweep across the entire stack of technical-debt-laden technology is now upon us, requiring little more than a simple prompt to a chatbot to unleash. The front-page PHP news was simply the first big shot across the bow. 

The barriers are down

It is no exaggeration to say that the internet will no longer be a safe neighbourhood for a while. There are many malfeasants, from individual hackers looking for ransoms to teenagers looking for bragging rights, to industrial spies looking for secrets, to credential thieves looking to sell on a dark-web market. What kept most of them at bay for all this time was the need for hacking expertise, time and money. Those barriers are gone. The bad guys now have a simple-to-use tool that they could not previously have imagined.

Is there any light at the end of the tunnel? Perhaps. The stakes of a porous internet are incredibly high. Entire global economies are entangled with the Internet, and no individual, institution or government can now afford to leave this debt unpaid. Security will now be elevated to Defcon 1 across the entire digital ecosystem, meaning more attention, more money, more scrutiny, more urgency and more governance.

Until then, perhaps some of us, at least those a little leery of the increased risk, will swear off our devices and rediscover the grass and sunshine.

(As this article was going to press, there came news of the $6.3-billion hack of the Binance crypto exchange, the largest hack in history. While there is no evidence yet that this was AI-assisted or AI-autonomous, perhaps this is the second shot across the bow, much more shocking to the zeitgeist than a deep tech exploit of a language few have heard of.) DM

Steven Boykey Sidley is a visiting professor at the Centre for Graduate Studies at Rhodes University, a partner at Bridge Capital and a columnist-at-large at Daily Maverick, Daily Friend and Financial Mail. His new book, Checkmate: How Shoprite Checkers rewrote the rules and won, is published by Jonathan Ball.