This October, PBS reported on a ransomware attack that hit a county health hospital in Wisconsin.
“Campbell County Health reported systemwide crippling of their computers that affected its flagship hospital and nearly 20 clinics located in the city of Gillette. For eight hours, the hospital’s emergency department was forced to transfer patients even though the next nearest hospital was located 70 miles away. The health care system stopped admitting new patients, labs were shuttered, and some surgeries were postponed. It took 17 days to restore normal order.”
For many of these patients, an hour delay could have meant death. That much time between incident and treatment has a huge impact on the outcome of a heart attack or a stroke, for example.
The initial deaths weren’t the only ones that happened. Research found that the death rate increased among patients in the months following the attacks. This is because the hospitals had to put together new security measures, some of which cost patients precious minutes as nurses and doctors tried to get into the system.
PBS also reported the number of health care entities impacted by electronic breaches rose 20% in 2019.
These incidents have created some discussion about whether cybercrime that causes death could lead to manslaughter charges, or murder charges, for hackers.
Federal law defines manslaughter as “the unlawful killing of a human being without malice.”
The Federal felony murder rule allows a defendant to be charged with first-degree murder if they commit a dangerous felony that results in the death of another person, even if they did not kill that person directly.
In New York, a defendant can be charged with murder in the second degree if a person loses their life because, “Under circumstances evincing a depraved indifference to human life, he recklessly engages in conduct which creates a grave risk of death to another person, and thereby causes the death of another person.”
The New York felony murder law outlines certain felonies which can lead to a murder charge if they result in a person’s death. These are “robbery, burglary, kidnapping, arson, rape in the first degree, criminal sexual act in the first degree, sexual abuse in the first degree, aggravated sexual abuse, escape in the first degree, or escape in the second degree.” Because the statute specifies these crimes and does not specify cyber crime it might be more difficult to prosecute a hacker for second-degree murder under New York law.
Nevertheless, it is possible, even under the current language of the New York law, to convict a hacker for manslaughter.
Under federal law it would be terribly easy to tack a murder charge onto any hacking attempt that resulted in the death of other human beings.
As cybercrime grows more sophisticated, so to will the cases arising from these crimes.