(Attempted) Computer Murder

There has for years been speculation about whether a computer could be used to commit murder, i.e., to intentionally kill a human being.

I was researching that issue for something I’m writing, and managed to track down what seems to be the original version of a story I’ve heard for a long time. I thought it might have been an urban legend -- a purely apocryphal tale about attempted . . . something, maybe murder, maybe manslaughter. (Basically, murder is intentionally causing the death of another human being, while manslaughter is recklessly causing such a death.)

According to a story published in 1994, Dominic Rymer, then a 21-year-old male nurse in the United Kingdom, had hacked into the computer system at Arrowe Park Hospital, Wirral and modified the prescriptions for two patients. Nurse- hacker Alters Hospital Prescriptions, Computer Audit Update (February 1, 1994), 1994 WLNR 3804526. Here’s how the story described what Rymer did:

A nine-year-old boy, suffering from meningitis was only saved from serious harm by a sharp-eyed ward sister. She spotted that the youngster's prescription had been altered the previous day to include drugs used to treat heart disease and high blood pressure and an investigation was immediately launched.

It was then discovered that . . . Rymer had also secretly used the computer system at Arrowe Park Hospital . . . to prescribe anti -biotics to 70-year-old Kathleen Wilson, a patient on a geriatric ward. She had been given the drug, but had suffered no adverse reaction.

Rymer, described as obsessed with computers and high-tech equipment, had also accessed other records. He had scheduled a patient to have an unnecessary X -ray and recommended that another patient be discharged.

Nurse-hacker Alters Hospital Prescriptions, supra.

Rymer was not charged with attempted murder but with unauthorized access to a computer that resulted in damage to data in the system. At trial, the prosecutor told the court that

Rymer used a doctor's pin number to access the computer at the hospital. He had memorized the number five months earlier, after observing a locum doctor having trouble accessing the system. Rymer altered the prescription for the nine-year-old boy suffering from suspected meningitis, and prescribed a potentially toxic drug cocktail of Atenol, Temazepim, Bendroflumethiazide and Coproxomal.

Nurse-hacker Alters Hospital Prescriptions, supra. According to the story, Rymer was “unable to explain why he had altered the treatment records, but denied having any malicious intent. He had developed a fascination for computers . . . and had developed a lack of sensitivity to the consequences of his actions.” Nurse-hacker Alters Hospital Prescriptions, supra.

The judge found Rymer guilty and sentenced him to a year in jail. And the hospital’s executive nurse said “tighter computer security” was implemented to ensure this did not happen again. Nurse-hacker Alters Hospital Prescriptions, supra.

I assume Rymer wasn’t charged with murder because there was no evidence that his purpose was to kill people; he may simply have been experimenting. I’m not sure why he wasn’t charged with manslaughter or whatever the analogous crime is under UK law. It seems to me if someone hacks into a hospital’s prescription database and changes people’s prescriptions, that person could be held liable for recklessly causing their death if the altered prescriptions had a lethal effect. Recklessly means that the defendant was aware there was some risk death could result from what he was doing but ignored it, and proceeded to alter the prescriptions.

This case seems to be an artifact. I can’t find any cases since that involve conduct that could arguably be characterized as computer-facilitated homicide of whatever type . . . murder, manslaughter, negligent homicide. Perhaps that’s because hospitals have secured their systems so well that this can’t happen . . . except, of course, Rymer was an insider, a nurse who had worked at this hospital until a year or so before he altered the prescriptions. And as we all know, it’s very difficult to secure systems from insiders.

Maybe there haven’t been any incidents (reported incidents, I should say) of computer homicide because those who commit homicide prefer real-world methods. Maybe those who are inclined toward homicide tend to assume real-world methods are more reliable . . . which might be a reasonable assumption given what happened in the Rymer case.

I’ve always assumed (or maybe I’ve always just hoped) that if someone were to try something like this, the hospital staff would figure out that there’s something wrong with the prescription that’s suddenly shown up for a particular patient. I tend to assume the same problem would arise here as would have arisen with a computer homicide scenario that cropped up ten or so years ago, when I was just getting into cybercrime.

I can’t find any accounts of that scenario, so I’ll describe it as best I can. The theory was that a hacker (a truly malicious hacker) would access the databases of a company that makes children’s cereal. He would alter the recipe for a popular kind of cereal so that it would include a very high level of some mineral or chemical that is not toxic to people in small doses but that becomes toxic if consumed in large doses, especially if one were to consume large doses every day or so. According to the scenario, this would be a clever way to commit a particularly heinous kind of mass murder; children would die, the cereal company would be blamed for its negligence in goofing up the recipe, and the hacker would have gotten away with murder scot free. The problem, of course, was that the cereal company would probably have noticed the alteration in its formula . . . especially since, as many pointed out, it would suddenly be buying tremendous quantities (truckloads) of that chemical.

I’m really not going anywhere with this post. It’s just a rumination on the notion of computer as an implement of homicide which, of course, it can and probably will be. If and when someone actually does use computer technology to commit murder, they will simply be charged with murder (or manslaughter or negligent homicide, as the case may be) because the tool used to commit the crime is irrelevant. However you cause another to die, that’s murder.