• The CrowdStrike issue enters its legal phase.
• Company hopes to persuade those affected to hold off legal action.
• Lawyers begin their knife sharpening activities.

CrowdStrike’s response to the massive outage it caused in July has been mixed. Speaking at the Citi 2024 Global TMT Conference, the company’s CFO, Burt Podbere, stated that as of September 4, 2024, none of its customers had begun any legal action against it.

Yet Delta Air Lines, which is estimated to have lost more than $500m during the outage, has stated that it intends to pursue potential claims against CrowdStrike and Microsoft. The company has hired David Boies (of Boies Schiller Flexner), a lawyer who has previously represented the US government in an antitrust case against Microsoft.

Podbere appears more optimistic than when speaking on an earnings call a week earlier, when the legal situation around the CrowdStrike issue was less clear: “The outcome of litigation is inherently difficult to predict, particularly in the early stages. It is still too early for us to estimate any potential legal exposure we may have at this time.”

Podbere also stated that in addition to insurance policies CrowdStrike holds that will help mitigate any financial losses due to potential legal action, CrowdStrike’s agreements with its customers limit its liability.

According to attorney Michael Carlinsky, representing CrowdStrike, CrowdStrike’s liability to Delta is “capped at an amount in the single-digit millions.”

There is also the possibility that CrowdStrike might compensate affected customers to head off any tendency to take legal action. In a letter from David Boies to Carlinsky, Boies said, “If CrowdStrike genuinely seeks to avoid a lawsuit by Delta, then it must accept real responsibility for its actions and compensate Delta for the severe damage it caused to Delta’s business, reputation, and goodwill.”

During the Citi interview with Fatima Boolani, Burt Podbere was at pains to list several new large contracts for CrowdStrike services that had landed since the outage on July 19.

“We had a nine-figure total contract value deal that closed. And they wanted to go all in on CrowdStrike. Best tech [for] their needs. We also had an eight-figure deal that closed that also wanted to do the exact same thing. We had another eight-figure deal that had two different SIEM products and we placed it with ISO.”

Customer commitment package

CrowdStrike has announced a ‘customer commitment package’ offering up to $60m to its customers. That may be insufficient for some, but it may reduce the number of cases brought for damages from CrowdStrike or limit the scope of class actions brought by groupings of smaller companies affected financially by the outage.

Disgruntled CrowdStrike customers may also expect the company to offer what it can to ensure their continued business and presumably help persuade them to refrain from expressing any bad feelings in the courts.

“We’ll give you some more products for free. Try them for the length of your contract or for a year. It depends, very bespoke […]. It could be anything from training. […] It could be more time on your contract. So there’s a whole variety of things, including, by the way, flexible payment terms,” Podbere said at the Citi TMT conference.

Financial commentators have noted that the required outlay for the customer commitment package will negatively affect CrowdStrike’s share price and that although the company’s performance on the markets has rallied since its loss in value immediately following the incident, CrowdStrike’s direct competitors’ values have risen. The entire CrowdStrike issue may, therefore, bring some much-needed variation in the enterprise cybersecurity list of go-to providers.

The Windows 3.1 claim

The technology press has been quick to pick up on a rogue Tweet that claimed (or joked, as it transpired) that Southwest Airlines was unaffected by the configuration update that caused some eight million Windows-based devices to enter a blue-screen-of-death boot loop, because its systems are based on Windows 3.1.

However, the story seems to have emanated from an article in The Dallas Morning News that said, “Southwest uses internally built and maintained systems […] instead of using more standard programs that others have used. […] Some systems even look historic like they were designed on Windows 95.”

The kernel of the CrowdStrike issue

The massive problems in July were caused by the CrowdStrike servers sending out an update addressing 21 input fields to Falcon Sensor agents running at kernel level on affected Windows systems. Falcon Sensor software was written to accept only 20 such inputs at any one time, so causing the machines’ operating systems to crash.

CrowdStrike’s methods – embedding its code at the core levels of the operating system – are justified by the company as being necessary to catch malware similarly designed to run at the core.

The company’s code affected customers running on Linux Debian 12 and Rocky Linux (a fork of Red Hat Enterprise Linux) for several months from April 2024, causing users to be unable to boot machines.

Therefore, the common thread running through these stories is not the arguable unsuitability of Windows to run mission-critical enterprise systems but the use of a product from a cybersecurity company that needs to examine its software release procedures.

Those intending to take legal action may be persuaded not to proceed, but the incident has significantly besmirched the CrowdStrike brand and hopefully made the IT sector consider the implications of centralising cybersecurity by using just a handful of large vendors.