Business Continuity Management / Disaster Recovery,
Governance & Risk Management,
Litigation
Georgia Court Advances Delta’s Claims against CrowdStrike Over Software Update Issues
A Georgia judge has permitted Delta Airlines to pursue the majority of its lawsuit against CrowdStrike, centered on a problematic software update that temporarily paralyzed the airline’s operations. This situation underscores ongoing concerns regarding software security and contract obligations in the tech sector.
According to Delta, the disputed update was deployed by CrowdStrike without their explicit permission, circumventing necessary compliance checks with Microsoft’s validation processes. The airline contends that this resulted in a severe failure of its operational systems. Conversely, CrowdStrike maintains that they acted within the contractual rights to apply the update and swiftly reverted the changes upon realizing the issue.
Judge Kelly Lee Ellerbe from Fulton County Superior Court noted that Delta’s legal arguments, if viewed in the most favorable light for the airline, suggested a confidential relationship could invoke independent duties, allowing certain claims of gross negligence to advance in court. While claims of fraud related to pre-June 2022 representations were dismissed, the judge allowed other claims to move forward, revealing an acknowledgment of the gravity of Delta’s situation.
In their defense, CrowdStrike expressed optimism concerning the partial rejection of Delta’s claims, anticipating that remaining allegations will be resolved with financial limits consistent with past contractual expectations. Delta argues that the ramifications of the faulty update extend beyond mere product failure to fundamental lapses in software development practices, notably the absence of pre-deployment testing and robust rollback protocols.
The court recognized that pushing kernel-level code without necessary authorization raises serious legal implications that extend well beyond a typical service failure. Judge Ellerbe’s ruling allowed Delta to build on claims of technical trespassing and unauthorized access, crucial points in advancing their case.
As the legal proceedings unfold, CrowdStrike has maintained that such update mistakes can occur even within established software environments but faces serious allegations of bypassing standard validation procedures. The challenges here highlight significant areas of concern for the software industry, particularly regarding contractual compliance and substantive software testing.
This case not only exemplifies the challenges faced by organizations in managing cybersecurity risks but also raises critical questions about accountability in software deployment practices. Delta’s claims implicate various tactics outlined in the MITRE ATT&CK framework, specifically in areas such as initial access, where unauthorized updates could facilitate system intrusions, and persistence, as unauthorized code may remain embedded in critical infrastructure.
The outcome of this case could influence how companies view cybersecurity risks embedded within contractual agreements and guide future software management practices. As both parties prepare for trial, the implications of this ruling could reverberate throughout the technology sphere, shaping the landscape of software liability and corporate accountability.
