AILSA CHANG, HOST:
Perhaps you woke up yesterday morning and found that the website you were trying to browse wasn't working. Or maybe you went to Spotify and that was down or YouTube, or X, or ChatGPT, or even the website Downdetector, which tracks internet outages. All those went down, too. You see, they all rely on Cloudflare, which offers internet infrastructure services. It discovered a bug in one of the services that it provides. And if you're thinking, didn't this just happen? Yeah, it did. Last month, separate outages at Microsoft's cloud service and at Amazon Web Services also led to widespread disruptions.
All of these recent incidents remind us of how much the modern internet depends on a small handful of tech companies. When this sort of thing happens, we often reach out to cybersecurity expert Betsy Cooper at the Aspen Institute. Welcome.
BETSY COOPER: So great to be here.
CHANG: So great to have you here physically. OK, so the CEO of Cloudflare explained that all of this was caused by some internal issue with one of its cybersecurity services, not a cyberattack itself. Let me just ask you, can one bug at one company really lead to global IT consequences like we see?
COOPER: It absolutely can. And I was trying to use ChatGPT when this all went down...
CHANG: (Laughter).
COOPER: ...So that's how I found out about it. I want you to just imagine you're working on a Google Doc, and it's a really, really big Google Doc. You keep adding more information to it. All of a sudden it's no longer functioning, and your computer requires you to restart. That's basically what happened at Cloudflare's internal systems.
CHANG: Wow. That's scary. I mean, how did so much power end up concentrated in so few companies?
COOPER: Well, the companies have a lot of market power, not just on these topics but on others. You mentioned Amazon. Certainly, I use Amazon a lot for shopping, not just for website browsing.
CHANG: Same.
COOPER: Microsoft as well.
CHANG: Yeah.
COOPER: I mean, we use that for our email platforms. So when these companies have the ability to sort of shift resources and have finances that enable them to support these very expensive cloud infrastructure pieces, they're able to come along and get more market share than a smaller company that might not be able to have millions of dollars from other lines of business to support that work.
CHANG: But do you think that's a good thing? I ask because, like, this Cloudflare outage was only, what, four hours? And then it was resolved. But even a short disruption can cripple a business, right? In fact, the CEO of Cloudflare said, I apologize for the pain we caused the internet today. Is there any movement, Betsy, to get the government more involved here, like, to improve the reliability of these private internet companies?
COOPER: So I haven't heard a ton about movement in that direction. And if anything, this week, we've heard about movement in the opposite direction. So consideration of limiting what states can do in terms of regulating AI will potentially come up in the National Defense Authorization. You asked if this was a good thing.
CHANG: Yeah.
COOPER: And I think it's good and bad. So for small businesses that don't have a lot of tech sophistication, it's actually good that you have the security infrastructure of an Amazon or a Google or a Cloudflare supporting your business because if you tried to build your own tech stack to do this work, it probably would be even more problematic.
CHANG: OK.
COOPER: Where I think it gets really hard is for the bigger businesses, you know, the Downdetectors of the world, ChatGPT. For those businesses, you really need to have a backup plan. You need to have a way to move your systems from one place to another to help recover quickly if something like this happens.
CHANG: Sure. Well, then what is the answer to making these things happen less often?
COOPER: So first, scenario-planning. You need to understand your systems and prepare for this eventuality. Like, I would love to have heard Cloudflare talk about how they had prepared for something like this and why they were able to limit the disruption because they'd actually sort of ran a scenario in which they lived that out and figured out who was going to call who and who was on emergency watch to try to identify the file. So if they're not doing that, they definitely need to be doing that.
And then second, we all as a society need to prepare that the internet is not going to be perfect, just like we prepare that our utilities aren't going to be perfect. And so we need the equivalent of digital backup generators. We need to be in a position to plan for, there's going to be an eventual outage. How can you get your most important services moving even if that happens?
CHANG: Betsy Cooper is founding director of the Aspen Policy Academy. Thank you so much for coming in today.
COOPER: So delighted to be here. Thanks again.
CHANG: And a note, both Amazon and Microsoft are financial supporters of NPR. Transcript provided by NPR, Copyright NPR.
NPR transcripts are created on a rush deadline by an NPR contractor. This text may not be in its final form and may be updated or revised in the future. Accuracy and availability may vary. The authoritative record of NPR’s programming is the audio record.
