Hacker News Reader

Comment by blendergeek | Hacker News Reader

> Throughout 2020, APT29 has targeted various organisations involved in COVID-19 vaccine development in Canada, the United States and the United Kingdom, highly likely with the intention of stealing information and intellectual property relating to the development and testing of COVID-19 vaccines.

Vaccine makers are trying to hide their work behind the veil of "intellectual property". The makers of this malware want the information. For what purpose do the 'malware' authors want the information?

1. To make a vaccine that works. Making a vaccine is an objective good.

2. To discover flaws with the vaccine that the company developing the vaccine would rather keep secret. Alerting the public to dangerous vaccines is an objective good.

I believe the real story here is that governments allow vaccine development companies to hide their work behind a shield of intellectual property, while the world needs a vaccine as quickly as possible.

View on HN

I think it's fair to say that:

3. This information is worth an enormous amount of money.

That would explain why the current companies are attempting to hide information that could be used to save lives. Is that a moral justification for the government granting the vaccine companies a monopoly on the information, even though free sharing of the information could save even more lives?

I’ve read stories indicating that some of these companies are ramping up production prior to approval in order to have batches of doses to distribute soon after approval happens. Having a government that will protect said company’s intellectual property helps reduce financial risk to the company, making that preproduction a bit less risky overall. It’s also arguable that protecting that IP is a moral justification for the same reason — saving lives. There might not be as many companies developing vaccines and committing to large production runs before they’re even approved without it.

Keep in mind, I’m not outright saying you’re wrong. I do think you’re way oversimplifying things.

Yep, sharing information may be important, but generating the information to begin with is even more important. Whatever we do, the incentives must align so we have as many people working on the problem as possible. It is critical that there is a guaranteed revenue stream as reward for developing a vaccine; the world does not have enough scientists that can/will volunteer their time. IP is the established way of doing this. Maybe there are other solutions, but if they haven't been implemented at this point, it's already too late.

If it is APT29, their motive and directive, and what they are paid for, is to ensure Russia's national interest. Which is probably access to capability, although denial of capability is also possible. That all the other stuff dovetails is just happy coincident.

> 2. To discover flaws with the vaccine that the company developing the vaccine would rather keep secret. Alerting the public to dangerous vaccines is an objective good.

You seem to think that this is a net positive, but they could could also keep it secret, which is a net negative. So #3 would be to keep the flaws secret with the intention to potentially exploit the flaws in the future

There is the possibility this APT group is trying to disrupt vaccine development because they want to watch the world burn, or they have a competing vaccine.

I doubt that is the case, but you can bet that's going to be the side the media will take...

How does what they are doing disrupt vaccine development?

For now they've only infiltrated and stole data.

But theoretically, they could also seriously disrupt IT operations virtually overnight: wipe servers, brick (expensive) lab machines, mess with door locks, cleanroom HVAC tech, corrupt sensors to render data worthless...

Vaccine researchers have had their systems infected with malware. At the minimum, they've lost time while IT has taken systems offline to research and resolve the issue. Potentially, the integrity of the data itself could be called into question. Regardless of the malware developers intentions, they have done harm just by the nature of their actions.

Reply on news.ycombinator.com