back to article Google mistakes the entire NHS for massive cyber-attacking botnet

Google is blocking access to the entire NHS network, mistaking the amount of traffic it is currently receiving as a cyber attack. An email from an NHS trust's IT department seen by The Register confirmed that the US search giant has mistaken the current traffic levels for a botnet. The email headed "Google Access" stated: " …

Page:

  1. Hans Neeson-Bumpsadese Silver badge

    confirmed that Google is was the "go-to resource" for a lot of clinicians.

    I now have rather disturbing visions of patients lying on operating tables, surgeons poised over them with scalpel in hand, and laptop to one side while he Googles "how to perform open heart surgery"

    1. MrWibble

      Maybe that's their USP with Google Assistant - hands free access to surgery how-to guides.

    2. Andy The Hat Silver badge

      beat me to it. One wonders why a service sector industry such as the NHS would generate 'abnormal' quantities of traffic ... Unless it's the patients using google translate to understand the foreign staff?

      Sorry, bit harsh perhaps, but when I know good kids who are unable to get training as the number of places are so limited they can't get on courses and it's suggested they increase their chances by *paying* to volunteer if does hurt.

      1. Nick Ryan Silver badge

        beat me to it. One wonders why a service sector industry such as the NHS would generate 'abnormal' quantities of traffic ...

        Probably because most Internet traffic goes through the N3 network, therefore compressing the number of public IPs that are accessing Google's services down to a somewhat lower number than if each site had (relatively) direct access to the Internet.

        The N3 network diagram may help: http://n3.nhs.uk/technicalinformation/n3networkoverview.cfm. To summarise in their words: The Internet Gateway is the biggest and most important gateway. (...) It's the single aggregation and access point for all Internet-bound traffic from N3 users. (...)

        1. Anonymous Coward
          Anonymous Coward

          One wonders why a service sector industry such as the NHS would generate 'abnormal' quantities of traffic ...

          Probably because most Internet traffic goes through the N3 network, therefore compressing the number of public IPs that are accessing Google's services

          Sure, but that's been the case a long time. Something must have changed for it to suddenly start being a problem now.

          My guess is that Google have activated some new algorithm for detecting and auto-blocking an attack, and it's having an unintended consequence.

          So... kinda like a Trump executive order, then. ;-)

          1. Sir Sham Cad

            Re: Something must have changed

            Nope. It's been going on for years. It's only been reported on now, probably because it's taken this long for someone to decide it's worth moaning about.

          2. Anonymous Coward
            Anonymous Coward

            This isn't new news, it's been happening for the last couple of years, usually just after lunch time when I really need to get on with finding the solution to a coding problem that I was putting off before lunch.

            Of course I could probably just search on StackOverflow but I can't remember their URL so just Google that...

            Although I don't think it's happened since we moved from N3 to SWAN.

        2. Anonymous Coward
          Anonymous Coward

          Nailed it Nick, also people seem to forget the NHS is not just clinicians. There's also the Scottish Wide Area network which includes local authorities - they all come out of a handful of exit points and reduce the number of IPs google sees as a source.

          No doubt some will continue to see this as a time to bash the NHS, heaven forbid people try to find out where houses are on a map for home visits etc.

      2. Anonymous Coward
        Anonymous Coward

        re: Unless it's the patients using google translate to understand the foreign staff?

        I've been under the doctor for both a hiatus hernia and a hole between my sinuses and mouth. I've been to Southmead Hospital and the Bristol Dental Hospital. I've not heard a single employee who didn't speak English with an English accent. Where have you been where you can't understand the staff?

        1. Rob Daglish

          Re: re: Unless it's the patients using google translate to understand the foreign staff?

          Try West Cumbria, AC. We've a great mix of nationalities, skin tones, accents and languages, all with varying levels of English speaking skills. We had a situation last week where my wife took the little one for a checkup as she has a cough, and due to a language mix up, thought the (German) Doctor was giving her antibiotics to placate her, so never bothered filling the prescription. This week, the little one is still unwell, so she went back and saw a different (also foreign, but from Oz) Doctor explained that my 3 month old daughter has a chest infection and needs antibiotics ASAP...

          In fact, in my own GP practice, we've got 1 x Australian, 1 x German, 1 x South African, a lovely locum from the Ukraine (who most people will quite happily wait for!) and a blooming Scot!

          Personally, I think if they want to come here and look after us, so much the better for us, but given some strong regional accents, it can get confusing at times - I have known people who've had to translate between Glaswegian and Cockney before now!

          1. Doctor Syntax Silver badge

            Re: re: Unless it's the patients using google translate to understand the foreign staff?

            "I have known people who've had to translate between Glaswegian and Cockney"

            Where did you find such a polyglot?

            1. TRT Silver badge

              Re: re: Unless it's the patients using google translate to understand the foreign staff?

              Do I really have to post a link to this video again?

              1. Wilseus

                Re: re: Unless it's the patients using google translate to understand the foreign staff?

                Or this one.

            2. Anonymous Coward
              Anonymous Coward

              Re: re: Unless it's the patients using google translate to understand the foreign staff?

              "I have known people who've had to translate between Glaswegian and Cockney"

              Where did you find such a polyglot?

              Was it Google Translate?

          2. Jan 0 Silver badge

            Re: re: Unless it's the patients using google translate to understand the foreign staff?

            Rob in W Cumbria wrote:

            > I have known people who've had to translate between Glaswegian and Cockney before now!

            Ah, mystery solved? After living in the East End of London for nearly four decades, I've often wondered where all the Cockneys went. I haven't heard any Cockney, or Yiddish for that matter, in the last 20 years. Round here it's all either Estuary, Public School, Nth language or completely not English. I thought some Cockneys might have migrated to Spain, but West Cumbria is interesting. Do Cockneys, like the Dutch, long to see mountains?

          3. Anonymous Coward
            Anonymous Coward

            Re: re: Unless it's the patients using google translate to understand the foreign staff?

            thought the (German) Doctor was giving her antibiotics to placate her...

            So, you went to the doctor, were prescribed antibiotics (which they won't do unless absolutely necessary) and decided to ignore their advice... ?

            1. Ben Tasker

              Re: re: Unless it's the patients using google translate to understand the foreign staff?

              thought the (German) Doctor was giving her antibiotics to placate her...

              So, you went to the doctor, were prescribed antibiotics (which they won't do unless absolutely necessary) and decided to ignore their advice... ?

              Exactly my thinking. That's not an issue of the Doctor being foreign, that's an issue of the Doctor's advice being ignored. Could just as easily have happened with a born-and-bred English doctor speaking the Queen's.

              It's possible there was a communication problem, in that the Doctor didn't make it clear why the anti-biotics were being prescribed, but again, that can just as easily happen with a british doctor.

              1. Anonymous Coward
                Anonymous Coward

                Re: re: Unless it's the patients using google translate to understand the foreign staff?

                In short, a stupid attitude to a foreign doctor by a stupid woman, I would advice the husband to take his kid to the doctor himself next time, then again.

                I am aware and I have felt uncertainty with foreign doctors at home and abroad, but with a sic kid like that is beyond me

          4. Cashpot

            Re: re: Unless it's the patients using google translate to understand the foreign staff?

            Sorry to ask, but why not go to your GP instead of using an ACCIDENT and EMERGENCY service? Don't say no appointments all doctors will see a sick child same day.

        2. Andy The Hat Silver badge

          Re: re: Unless it's the patients using google translate to understand the foreign staff?

          ... try Norfolk. Pick a hospital, any hospital.

          I'm not being critical of their work (they're generally really good) but both patients and staff must be able to clearly understand each other where mistakes and potential death is involved.

        3. Anonymous Coward
          Anonymous Coward

          Re: re: Unless it's the patients using google translate to understand the foreign staff?

          Try London.

          Ealing in my case.

          Most staff are foreign and I struggle with their accents.

          That's where I've been because that's where I live.

          But despite the difficulty with accents I'm happy because without immigrants filling the posts we would have no NHS.

      3. Anonymous Coward
        Anonymous Coward

        @andy the asshat

        Maybe the good kids you know just aren't that bright?

        Access to training is based on merit, not nationality.

        1. MOV r0,r0

          Simplistic bordering on naive. For years professional bodies such as the BMA, the Royal College of GPs have restricted the numbers entering training citing 'standards' with the happy by-product that scarcity maintains high remuneration. NHS managers respond by recruiting from overseas where ironically some medical qualifications are of low standard.

          None of this benefits patients but the phrase 'Our NHS' was never truer than when issued from the mouths of staff and it doesn't surprise me that Google's traffic algorithms can't quite believe how overstaffed the NHS is.

          1. Anonymous Coward
            Anonymous Coward

            That is quite simply untrue. Neither the BMA or the RCGP have any control over training numbers. These are set by the government. Both organisations have called for an increase in training places. In the case of GP training there is the additional problem that we cannot even fill the current places.

        2. Andy The Hat Silver badge

          Please don't call me a donkey.

          When did you last look into UK medical training? Perhaps you should.

          1. Anonymous Coward
            Anonymous Coward

            "Please don't call me a donkey." - I assure you, I wasn't.

            "When did you last look into UK medical training? Perhaps you should"

            Personally I have never looked into it, but the last three generations of our family has at least one trained nurse... we have friends who are Nurses (Not aux - properly trained nurses), GPs and a few Radiographers for good measure.

            I'm willing to accept that there may be more competition for the training now - but that goes back to my original statement - maybe the people you know just aren't quite as good as the other people applying (This is not a slight against them, if a significant number of people apply and the bar is sufficiently high even good, intelligent people will not be good enough)

      4. Sir Sham Cad

        Re: "generate 'abnormal' quantities of traffic"

        This has been going on for years, I have users contact our service desk about this on a regular basis. The traffic isn't abnormal in itself it's being deemed "abnormal" for the number of IP addresses the traffic is coming from.

        This is because the entire NHS directs traffic to the Internet via the private N3 network which has a few Internet Gateways that translate N3 routed traffic to Internet routed traffic therefore there's a funnel effect whereby shitloads of private N3 IP address users accessing Google and the Internet as a whole, and the shitloads of traffic which is generated by the moderate traffic from each, hit the N3-facing side of the handful of gateways which send a shitload of traffic to Google and therefore get mistaken for bots.

        The impact on the user is, essentially, fill in a CAPTCHA to prove you're actually human. Then Google leaves you in peace to get on with it.

        1. BristolBachelor Gold badge

          Re: "generate 'abnormal' quantities of traffic"

          "The impact on the user is, essentially, fill in a CAPTCHA to prove you're actually human. Then Google leaves you in peace to get on with it."

          No, it does the search and then when you change it slightly, or horror want to see page 2 throws another captcha at you. Sems to happen continually if you use any of the search parameters (filetype, inurl, etc.)

    3. Anonymous Coward
      Anonymous Coward

      From "bloodoverflow.com"

      Step 1: .....

    4. 0laf

      Knowing some of them that might be a good ting

    5. Simon Harris

      'while he Googles "how to perform open heart surgery"'

      More probably using Google Scholar to keep up with current research and review published case descriptions.

    6. MR J

      Probably more like users using a search string with lots of variables.

      You can google "Cat Yawning" all day long and never trigger anything.

      Search a specific site or database for five or six specific strings and Google will soon flag you.

      As for them asking how to do OHS, I wouldn't put it past some of the doctors.

      I know a doctor who used 5 clips on 2 aneurisms, he has no idea why the extras were used, he has a video of it and cant figure it out. After he had a few more mysterious brain surgeries he decided to become a spinal surgeon. After seeing some issues with that he now writes prescriptions for pain meds instead - and so far all of his clients, err patients are happy.

    7. Joseph Haig

      ... while he Googles "how to perform open heart surgery"

      It could be worse. It might be that he is being talked through it by a 12-year-old on Slack.

    8. Anonymous Coward
      Anonymous Coward

      Hasbro/M&B's Game of Operation

      Even I forget the board layout of the game Operation, every so often. For reference purposes, of course.

    9. hatti

      Is that the same surgeon who hit reply all to that email.

      1. Anonymous Coward
        Anonymous Coward

        @hatti

        It wasn't surgeons who hit "reply all". Many of those who did were managers and administrators.

    10. Sam Haine

      "how to perform open heart surgery"

      Carefully.

      1. allthecoolshortnamesweretaken

        Re: "how to perform open heart surgery"

        Well, there's practically nothing you can't do as long as you've got a Swiss army knife, a roll of duct tape, a handfull of cable ties and a can of WD-40.

        1. Simon Harris

          Re: "how to perform open heart surgery"

          Don't forget the superglue

          1. tr1ck5t3r

            Re: "how to perform open heart surgery"

            Surprised the NHS are helping to train Google Health.

            https://googleblog.blogspot.co.uk/2015/02/health-info-knowledge-graph.html

            Now I know how Google knows when the UK suffers pandemics, or local out breaks of something, whilst helping to train Google's Health AI's which will be a future venture based on their current partners.

            Do taxpayers mind the NHS helping to train Google's AI's and getting awarded contracts for eye scans?

            Its getting to the stage Google is taking with the left hand using searchs from the NHS as well as the right with Deep Mind contracts.

    11. David 132 Silver badge
      Happy

      I now have rather disturbing visions of patients lying on operating tables, surgeons poised over them with scalpel in hand, and laptop to one side while he Googles "how to perform open heart surgery"

      And obstetricians googling "how is babby formed"?

  2. Anonymous Coward
    Anonymous Coward

    Well as an NHS employee (non-clinical) I access Google regularly for finding information rather than having to leaf through reams of printed information to find specific stuff.

    Also huge numbers of enquiries at set times of day as staff access Google at lunchtime etc. for personal use.

  3. James12345

    Google Captcha

    We get this from time to time, despite being a Google Apps customer and we are much smaller that the NHS. I would be surprised if this doesn't happen to lots of organisations all the time, especially those who send lots of traffic to Google.

    1. Alan J. Wylie

      Re: Google Captcha

      I was prompted by an "I am not a robot" page this morning. I haven't seen one of those at work for ages. Perhaps Google has tweaked some of their detection settings?

      1. Ben Tasker

        Re: Google Captcha

        > Perhaps Google has tweaked some of their detection settings?

        No idea if it's related, but in the last few weeks they seem to have truly fucked up their false detection rate on Gmails/Apps for Domains spam filters. I've had no end of hassles from email going missing, in both directions, and have had a few that they wouldn't even let me send in the first place.

    2. Daggerchild Silver badge

      Re: Google Captcha

      Yup, I've had them too. Last time I investigated, it was someone who had installed a browser extension that had lost its marbles and was loop-bombing google search through a common proxy.

      But that was in the days before HTTPS-only, so you could actually see repetitive insanity in the proxy logs. Those days are pretty much gone now.

      1. Anonymous Coward
        Anonymous Coward

        Re: Google Captcha

        Maybe it's punishment for someone behind the IP running Ad Nauseam.

    3. allthecoolshortnamesweretaken
  4. Anonymous Coward
    Anonymous Coward

    I would not be surprised is there is some issue inside the NHS network...

    .... once a disgruntled employee of ours started to spam through gmail accounts from the office PC (knowing the situation I tried to lock down his PC - being a developer he had broad privileges -, but I was overridden by an upper manager for fear of HR issues...) , and then our egress IPs were blacklisted by Google...

    1. Steve Davies 3 Silver badge

      Re: I would not be surprised is there is some issue inside the NHS network...

      I offer in evidence this here Linksys WiFi router. Perhaps there are more than a few unpatched ones on the NHS network and they have been made part of a botnet?

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like