infrastructure — jolek78's blog

Be ready. Or maybe not?

Sun, 08 Nov 2026 17:08:55 +0000

In the space of a fortnight Europe got hacked freezers in hundreds of supermarkets, thirty-odd hoax bomb threats on airliners, and a British government telling families to keep three days of food and water at home. It all looked like one story. I spent days trying to work out whether it is – and the answer is: partly, and not in the way it looks.

In Sjöbo, in southern Sweden, on the morning of 2 November the staff of the local ICA Kvantum open the shop and find the frozen food thawed. No door forced, no alarm tripped, no power cut. Somebody, somewhere in the world, in the middle of the night, told the freezers to go to 50 degrees, and the freezers obeyed. The manager writes it on Facebook with the resignation of a man who has just thrown away a stockroom: we've been hacked, they set the temperature to 50.

In the same hours, in Brussels, Stephan Moelans, managing director of Sabcobel, the company that runs the refrigeration for Delhaize supermarkets, is waking up his technicians. At one in the morning. He sends them out across Belgium and Luxembourg to do something that in 2026 sounds almost medieval: physically unplug the fridges from the network, shop by shop, before the rest of the stock melts. As he told the Belga news agency afterwards:

We began mobilizing technicians at 1 a.m. to get the situation under control

Three days later an Aer Lingus Airbus from Dublin to Rome lands at a French military base at Évreux, under fighter escort, while bomb disposal teams search it. They find nothing. On the same day some twenty other flights across Europe receive the same threat, and meanwhile the British tabloids are explaining to their readers which fourteen items to buy in order to survive an emergency nobody has declared.

Within a week you get the feeling of being inside a dystopian novel that somebody is writing too fast. I spent days collecting the pieces. This article is an attempt to put them in a row, separating what we know from what we think we understand. Because the two, as we'll see, don't coincide.

The week

Let's rewind the tape. In mid-October, in France, the fridges of a few hundred supermarkets (between 250 and 350 stores according to the technical reconstructions, up to 700 according to others, across the Intermarché, Coopérative U, Carrefour Market and Leclerc chains) are driven overnight up to 50 degrees. Stock to throw away, and in a few shops the beginnings of a fire, because a fridge that heats is an appliance doing something it was never designed to do. The attack gets told as a French story, but the analysis by Sekoia picked up by Reuters finds units hit in Spain, Portugal, Poland, Germany and Belgium too: the continent was already in it, nobody had counted it yet.

On the night between 2 and 3 November it happens again, this time on a continental scale: at least nine countries. Ireland, Belgium, Luxembourg, Sweden, the Netherlands, Finland, Estonia. Among the brands hit, Ikea, Delhaize, Carrefour, SuperValu (thirteen shops in Ireland). In Estonia the technicians step in within minutes and contain the damage; in Sweden ICA talks of “a limited number” of stores, which is the formula you use when you'd rather not say the number. In Athens a butcher tells the TV that his display fridge was set to 150 degrees, and that it took the technician two hours to get it back under control. And it isn't only frozen food: the same night Coolworld is attacked, the refrigeration supplier of the Établissement français du sang, the French blood transfusion service. Blood bags are not something anyone resells on the black market.

Then the emails. On Monday 2 November Hungary scrambles a Gripen to escort a Wizz Air flight from Luton to Budapest, threatened while already airborne. By Tuesday 3 the threats are already around thirty, twenty-seven according to the AP, plus a cruise ship; a Warsaw airport closes for a few hours. On Thursday 5 at least twenty-six are reported across Europe, on flights departing from sixteen countries. On Friday 6 another seventeen by noon, nine in Prague alone. Hungary scrambles its Gripens three times within an hour to escort a Brussels-Sofia and two flights out of Prague bound for Cyprus and Romania. In Dublin the headquarters of RTÉ, the Irish public broadcaster, is evacuated, and two other broadcasters receive threats the same day. Not a single device is found. Anywhere.

And finally London. On 22 October the Cabinet Office launches “Be Ready”, a three-year campaign asking families to keep enough at home for three days of self-sufficiency: water, food, a torch, a wind-up radio, cash, copies of documents. The same day the Defence Secretary, Wes Streeting, backs it with a line about “increasingly sophisticated cyber attacks”, and the next day the Prime Minister, Andy Burnham, defends it in person at a wildfire summit (and tells the Guardian about his own stash: beans, soup and Twiglets). From 27 October the papers start turning the same page of the government website over and over: the Independent headlines on the “attacks”, the Express on the “14 items to stockpile”, one news site on the “4 foods to have at home” (declared source: a Reddit thread...), another on the “13 things” to buy. Barclays publishes a survey: one Briton in four is stockpiling.

Four facts in fifteen days. Three of them are true. One is half true. And the question worth asking is whether they have anything to do with one another.

The radiator

To understand what happened in the supermarkets you need to know something supermarkets would rather not tell you: the fridge in a modern shop doesn't have a thermostat, it has a computer. It's called a controller, and in this case it's almost always a Danfoss of the AK-SM 800A series, a Danish box whose job is to let the maintenance technician check the temperatures of fifty shops from his sofa instead of driving round in a van. Convenient, and sensible too: if a display cabinet fails at three in the morning, somebody sees it straight away.

The problem is that this computer has a web page, and that web page, in hundreds of shops, was reachable by anyone on the internet. It's as if the thermostat in your house had a door onto the landing, with the key left in the lock. And as if the key were also printed in the instruction manual: many of the logins used factory passwords, the ones written in the manual you download from the manufacturer's website. After the French attack, researchers put fake controllers online to see who came knocking, and whoever came knocking tried exactly those passwords.

There was no stroke of genius. The main flaw, catalogued as CVE-2025-41450, lets you skip the controller's login screen. It was found by researchers at a security firm, Claroty, along with two others. Danfoss disclosed them in March 2025, published the fix in August 2025, and the American CISA issued an advisory the same year; Claroty's detailed technical report came out in August 2026, complete with a count of the controllers reachable from the internet: thousands. It wasn't even the first time: back in 2023 Dutch researchers had found three vulnerabilities in the same family of devices. Danfoss itself admitted that most of the systems hit were old products no longer receiving updates, and another manufacturer, Copeland, found a flaw in its own end-of-life controllers. A researcher interviewed by the Associated Press put it better than I could:

Nobody broke into these refrigeration systems with a zero-day

And the NCSC, the British cybersecurity agency, in its statement to the AP:

The cyberattack on French supermarkets was a result of exploitation of known vulnerabilities

Translated for those who don't do this for a living: the door had been open for a year and a half, everyone who needed to know knew, and in the end somebody walked in. Surprising, isn't it?

Once inside, the attacker didn't even have to write a malicious program. They pressed “defrost”, the de-icing function every industrial fridge has as standard, and held it down all night. A security expert interviewed by Gizmodo, Lamplmair, put it like this:

A freezer should never accept an instruction to heat to 50°C

Who did it, nobody knows. Two pro-Russian groups, NoName057(16) and Z-Pentest Alliance, claimed it on Telegram, posting what they say are 2,500 lines of data stolen from Danfoss, and then deleted the posts. It's worth what it's worth: NoName habitually claims anything that happens in Europe, and no security agency has confirmed. What the agencies have confirmed is that this isn't a bored teenager: researchers at Lupovis saw days of reconnaissance before the night of 2 November, with login attempts coming from “bulletproof” hosting, the kind that doesn't answer police requests. Somebody did their homework, and chose targets that don't earn a penny. The Pentagon, meanwhile, is still investigating the freezers of more than half a dozen American military commissaries that went haywire in late August, and is coordinating with the French. The FBI and four other federal agencies have published an advisory to cold-chain operators. And the head of British cybersecurity confirmed that in the UK too there has been “a small number” of incidents of the same kind.

The emails

The mechanism behind the threats against aircraft, as far as the police have said, is disarmingly banal: anonymous emails, sent in bulk to several airports with the list of “mined” flights. The Czech police said the email that reached Prague was addressed to the airport and that similar emails had reached other European hubs. The Danish police, on Friday, in a statement picked up by Reuters:

We are once again at Copenhagen Airport today in connection with threats directed at air traffic

And the office of the French Prime Minister:

An investigation is underway to determine the source of these alerts

In Spain the Guardia Civil received three in twenty minutes, on Air Europa departures from Madrid and Iberia arrivals from Rome and Milan. In Rome, on the other hand, one threat came by telephone to the control tower at Fiumicino. The protocol, at that point, leaves no room: the aircraft lands where it can, fighters escort it if needed, bomb disposal searches it, passengers wait on the apron. It costs tens of thousands of euros per flight and it's done anyway, because the alternative isn't on the table. In the Aer Lingus case, by the way, things went less smoothly than the press told it: according to Prime Minister Lecornu's office the fighters were sent after the pilot had failed to cooperate as expected, and pilot and co-pilot were questioned by the Évreux prosecutor before being allowed to leave. Aer Lingus says they acted impeccably. That too is part of the cost.

The number that puts things back in proportion came from Eurocontrol, the European air traffic body: the 14 flights affected on Thursday were 0.05% of the 26,300 flights on the European network that day. “Minimal” disruption, says Eurocontrol. The “flights in chaos” of the headlines never existed: the thousands of delays circulating in the same days were the normal delays of Heathrow, Charles de Gaulle and Schiphol, which produce them by the hundred every day with or without threats. The real effect of the emails isn't on air traffic. It's on people's heads, and on the coffers of the states.

Who did it, here too, nobody knows. The British government called them “malicious hoax threats”. The European transport commissioner said it's “too early” to say who is behind them, and even whether the episodes are linked to one another. Moscow denied, and there is no evidence of Russian or Iranian involvement, or of groups tied to them. There is actually one jarring note, reported by a single source and which I couldn't verify elsewhere: the threats against flights bound for Rome supposedly came from a group calling itself anti-feminist, which would suggest either several different hands jumping on the bandwagon, or a signature planted there to mislead. A private security analyst, Borie, told the AP that the European focus “could have a Russian angle”, adding straight away:

Iranian hybrid warfare is just as active in certain pockets of Europe

Experts from the various countries will meet in Brussels next week. Allow me to be sceptical: either the data exists, and then it should be made public, or it doesn't, and then there are only suspicions. And filling the headlines with a Russian threat on the basis of suspicions, I don't know whether that's more irresponsible or more reckless.

That said, the precedent everyone has in mind, without saying it too loudly, is 2024: waves of bomb threats against schools and courts in Czechia and Slovakia, about which the head of the Czech intelligence service Michal Koudelka spoke publicly like this:

There is clearly a visible Russian trace

And before that the incendiary parcels in DHL depots in Germany, Poland and the UK, where the European investigation identified 22 suspects recruited in Russia, the Baltics and Ukraine, often people in financial trouble paid for an odd job. That is evidence. This, for now, is an analogy. The difference between the two is the only thing that matters, and it's worth holding on to.

The leaflet

And then there is the United Kingdom, where for two weeks you get the impression that the government is talking to its citizens non-stop. It isn't. The “Be Ready” campaign wasn't born this week. It had been planned at the start of the year by the Starmer government, announced in September, and was published on 22 October. And it's the British version of something the Nordic countries have done for decades: Sweden sends every household a leaflet titled “If crisis or war comes”, and has done so since 1943. A report by former Finnish president Sauli Niinistö to the European Commission, two years ago, recommended exactly those 72 hours of household self-sufficiency to all member states, and Brussels adopted it. The context is declared: last year's British national security strategy explicitly names Russian aggression, hostile cyber activity and sabotage. It's no secret, it's a public document.

On 23 October the Prime Minister defended the advice saying that “unexpected events” are becoming more common, and the Defence Secretary had his say. From there on, though, it's no longer the government talking. It's the press parroting (if only it were stochastic...) whatever sells copies. A site that checks these things, Prepared Britain, looked at the GOV.UK page on 3, 4, 5 and 6 November: no new guidance, no emergency instruction, no department telling anyone to prepare for a war. The “attacks” in the Independent's headline were a word lifted from the campaign's original text, which talks about bad weather, blackouts, water and phone outages. The Express's “14 items” were the list of 22 October. The “4 foods” came from Reddit. And in the middle of all this, the Met Office's ordinary weather bulletins ended up in the same notification stream, indistinguishable from the rest.

The only truly new thing on the British front is the speech by the head of the NCSC, the cybersecurity agency, who in the same week as the fridges talked about empty shelves and lights going out:

When food isn't on shelves, lights aren't on, businesses have gone under

He said that one day we might have to explain why we had seen the signs and not chosen well, and confirmed the British incidents tied to the controllers. That one is an explicit link between the fridges and the wind-up radio. Made by someone who has the data to make it.

Three actors, but no director?

Having got this far, the temptation is strong, and I admit I was the first to feel it: all of this looks orchestrated. Fridges, planes, leaflets, all in the same fortnight, all pushing in the same direction: get used to it, get ready, something is about to happen that we know about and you don't. It's a legitimate hypothesis, and I put it on the table as such.

Let's call it hypothesis A: the alarms are manufactured, or inflated, to prepare the population for a crisis someone has already decided on or already sees coming. In its favour: the timing, the convergence of interests, the fact that Europe's military chiefs openly talk about a possible confrontation with Russia within a few years. The German chief of defence Carsten Breuer, in May:

Various indicators all point to one possible date of a Russian attack on NATO: 2029

and he adds “or even earlier”. His minister Boris Pistorius:

By 2029 or 2030, Putin could strengthen his army to the point where Russia would be capable of striking NATO

The French chief, Burkhard, says 2030. And the Czech general Karel Řehka:

Most of us, defense chiefs, share a similar view

Against it, though, weigh the fridges. There you have stock destroyed by the million, private companies losing real money, a supplier sending technicians out at one in the morning, blood bags at risk, American bases hit since August. It's a physical event, with real economic victims and a technical vector that anyone with a search engine for connected devices and the Danfoss manual can verify for themselves. No European government has any interest in burning its own supermarkets to educate public opinion, and it would be a strangely expensive and traceable way of doing it. The same goes for the emails: every diversion with Gripens in the air costs the state money and embarrassment, and the day one of those emails were traced back to a friendly service the political damage would be devastating. The cost-benefit ratio of “doing it to yourself” is terrible.

Then there's a number that weighs against the very premise of a “fortnight of stage direction”. Forescout counted more than twenty claimed attacks on refrigeration systems between January and October 2026, and the most active groups were precisely Z-Pentest and NoName057(16). This isn't a sudden escalation: it's the visible tail of a campaign that has been running for a year, and that only became news when it hit enough supermarkets on the same night. The feeling of orchestration comes from the media's attention threshold, not from the real density of events.

Hypothesis B: an adversary, or more than one, does real things that cost next to nothing. One email to twenty airports costs zero and moves the fighters of three countries. One manual password on a 2015 controller empties a hundred supermarkets in a night. Governments, which have long expected this phase and have written it into their documents, use the incidents to push a preparedness they already had on the agenda. It's called communicative opportunism, and it needs no director. And the media, which live on repetition, multiply the same web page into ten headlines. Three different trades, three different interests, nobody coordinating with anybody. It looks orchestrated because the interests converge, not because somebody aligned them.

And there's a third box the two-way scheme doesn't allow for. Call it hypothesis A': there is a single director, but it's the adversary. Fridges and emails are one package of low-cost hybrid warfare, calibrated to produce in democracies exactly the effect “the government is preparing us for something”. In that case the timing would be deliberate, and hypothesis B would be true for the governments and false for the attackers. It's cheaper than hypothesis A, because it doesn't require anyone to burn their own supermarkets, and more unsettling than hypothesis B, because the target isn't the stock but the trust.

The problem with hypothesis A is that it can't be refuted: any alarm confirms it, and the absence of alarms doesn't weaken it. That old genius Popper would say that a hypothesis which cannot be refuted is not a scientific hypothesis; I'd say, more simply, that it's a feeling. To keep it alive honestly you have to turn it into predictions that can fail.

What to watch carefully, from here to six months out

If hypothesis A is true, we should see: threats that are never attributed to anyone, or attributed vaguely and without names; claims like NoName's taken at face value without verification; preparedness campaigns that accelerate regardless of whether the incidents continue or stop. Careful, though: the first two would happen even if B were true and the investigations were simply slow or classified. The only prediction that truly tells A from B is the third: if the incidents fall off and Be Ready accelerates anyway, changes tone or finds new emergencies to cite, column A fills up for real. If hypothesis B is true, we should see: arrests with first and last names, like the 22 of the incendiary parcels; a public technical report on the controllers, with the addresses and infrastructure of whoever got in; and a drop in the British alarms once the media window closes and the GOV.UK page goes back to being a GOV.UK page.

Keep count. I will too, and if in six months the column that has filled up is the wrong one, I'll try to write it here.

Discuss...

References and further reading

· 📝 Content shared under CC BY-SA 4.0 · · 🦣 Mastodon · 📸 Pixelfed · 📬 Email · · ☕ Support this work on Liberapay

Legacy systems: problem or resource?

Wed, 28 Jan 2026 16:30:00 +0000

Tuesday morning, 9 AM. After a routine patching session, a long-standing ZFS storage system running Solaris 11 suddenly stops talking to its Windows 10 clients. The culprit is the usual, maddening SMB dialect dance: Windows pushes for SMB 3 on security grounds, while Solaris's native service struggles through the negotiation. Two days of banging my head against the wall – hard – and then the discovery: OpenCSW. A community that maintains updated packages for Solaris where the vendor long since threw in the towel. Updated libraries, sorted dependencies, problem solved. There are volunteers out there patching critical systems better than the official vendor ever did. Worth knowing.

Same film, next scene.

Friday afternoon – because critical migrations always happen out of hours. I'm migrating a system from Red Hat 7 to Red Hat 9. Why? To support the new version of Charon-SSP, the Stromasys emulator that lets SPARC hardware run on x86. All of this to keep alive a virtual machine running Solaris 9, an operating system from 2002 that went end-of-life in 2014. It's a layered structure, each level propping up the one below. One of those classic houses of cards you can't quite understand how it stays balanced.

Welcome to the world of legacy systems. A world where “modernising” often means finding increasingly creative ways to change nothing at all, and where communities and old-school sysadmins are the ones guarding infrastructure that corporations abandoned long ago. Try asking Oracle for Solaris support: they'll laugh in your face.

The numbers

In January 2025, the UK government published a report that should have rattled a few chairs at Westminster. Twenty-eight percent of central government IT systems are classified as legacy – up from 26% in 2023. Estimated productivity losses? Forty-five billion pounds. In 2024, the NHS recorded 123 critical IT system crashes. One hundred and twenty-three.

But wait, because the numbers get even more interesting when you look at the banking sector. COBOL – a programming language dating back to 1959 – still processes 95% of global ATM transactions, 43% of the world's banking systems, and around 3 trillion dollars of commerce every day. Every day. It's estimated there are still 220 billion lines of COBOL code in production.

And Windows XP? The one Microsoft stopped supporting in 2014? Today, 1-2% of internet-connected devices still run it. Sounds small until you realise we're talking about millions of machines. And not your grandad's PC: we're talking about MRI scanners in hospitals, industrial control systems, bank ATMs. Critical devices that can't be updated because the software controlling them only runs on XP, and re-certifying the entire system would cost more than building a new one.

Remember WannaCry in 2017? The ransomware that paralysed 75,000 computers in 99 countries? The NHS was devastated. And do you know how many Windows XP machines the NHS had in 2019 – two years after the attack, five years after end-of-support? 2,300.

At this point in the story one might say “right, the problem is clear: legacy systems are dangerous and need replacing.” And that would be the easy narrative – the one that consultants selling “digital transformation” love, and vendors wanting to sell licences love. What if I told you that a Solaris 11 system, properly isolated in a VLAN, is significantly more stable and secure than a shiny new Ubuntu 24.04 LTS?

Reality, as always, is more complicated.

Problems upon problems

Here's the fundamental issue: we use the word “legacy” as if it meant one thing, when it actually covers at least three completely different situations.

Type 1: Unavoidable legacy Solaris 9 on SPARC hardware controlling industrial machinery. Windows XP on MRI scanners. Systems where hardware and software are inseparable, where an upgrade would require replacing equipment worth millions, where re-certification for medical or industrial use would take years and fortunes. These systems are legacy out of necessity, not negligence. There's no fault here. There's only the reality of a technological ecosystem where certain devices have 20-30 year lifespans and the software controlling them can't be changed without changing everything else.

Type 2: Avoidable legacy CentOS 7, for instance. End of support: 30 June 2024. Available alternatives: AlmaLinux, Rocky Linux, migration to RHEL. Cost of migration? Economically: it depends. In time, resources, learning: enormous. How many CentOS 7 systems are still in production today? Too many. Why? Because nobody wants to pay RHEL licences, because “we'll do it next quarter,” because “there are other important things to deal with,” because “if it ain't broke, don't fix it.” This is legacy by choice – or rather, by inertia. It's an organisational decision, not a technical one.

Type 3: Non-legacy perceived as legacy Take COBOL on modern IBM mainframes. Today's mainframes aren't the ones from the 1970s – they're immensely powerful machines, with dedicated processors, hardware security, 99.999% uptime. The COBOL running on them is the same as ever, but the underlying infrastructure is current. Is the code legacy, or the platform? And if the platform is modern, can we still call it legacy? The distinction is fundamental because it determines the strategy. A Type 1 system needs to be isolated and protected. A Type 2 system needs to be migrated. A Type 3 system needs to be left alone. Try explaining that to a CTO who just finished reading a Gartner report on “legacy modernisation.”

From a thread on TheLayoff:

“FWIW, there's a very good chance that your electronic footprint on any given day has passed through a piece of SPARC equipment running Solaris, and that will continue to happen for a good portion of your lifetime.”

Would you believe me if I told you I've seen original BSD systems with eleven years of uptime?

The real problem isn't the machines

Here we get to the heart of the matter. And the answer will surprise you: the real problem with legacy systems isn't technological. It's human.

Let's talk about the “COBOL Cowboys” – retired programmers called back on consulting contracts when something breaks. They're the last generation that knows how those systems actually work. When they leave, they take decades of undocumented knowledge with them. According to Deloitte, companies have seen a 23% decline in mainframe workforce over the last five years, with 63% of those positions left unfilled. It's not that there's no money to hire – it's that there's nobody to hire. Young developers don't want to learn COBOL. It's “unsexy.” It's “archaic.” It's “boomer stuff.”

From ComputerWeekly:

“The retirement of the generation of experts who possess in-depth knowledge of Cobol systems is leading to a severe knowledge shortage. They have knowledge not only of the Cobol programming language, but also of the specific systems they have worked on and built over the years” – Tijs van der Storm, CWI/University of Groningen

And so we find ourselves in a paradoxical situation: systems processing trillions of dollars a day, managed by people who might die of old age before anyone learns to replace them. Knowledge transfer never happened. Documentation – where it exists – is outdated, incomplete, written in a language nobody understands anymore. And every year that passes, the gap widens.

This is the real legacy problem. Not the systems. The people.

When modernisation fails (spoiler: often)

There's a story that people in the UK know well, but that strangely never comes up when “digital transformation” is being discussed. It's called the National Programme for IT, or NPfIT.

Launched in 2002, it was the largest public sector IT project in British history. The goal? Modernise the entire NHS IT infrastructure. Initial budget: 6 billion pounds. Planned completion: 2010.

In 2011, after nine years of delays, exploding costs, vendors abandoning the project, and a system that simply didn't work, the UK government announced the dismantling of NPfIT. Final estimated cost: over 10 billion pounds. For a system that was never completed.

What went wrong? Practically everything. Top-down decisions made by politicians who didn't understand technology. Rigid contracts with vendors who didn't understand the NHS. Resistance from medical staff who hadn't been consulted. Continuously shifting requirements. Impossible integrations with existing systems.

From TechMonitor:

“A lack of digital and procurement capability within government has led to wasted expenditure and lack of progress on major digital transformation programmes.”

The lesson? “Modernising” is not automatically better than “maintaining.” Sometimes, the legacy system that works is preferable to the modern system that never will. But this lesson, apparently, we haven't learned. Because the dominant narrative remains the same: legacy = bad, modern = good. And consultants keep selling the shiny new thing.

Strategies that actually work

TL;DR: There is no single solution. There's a matrix of options ranging from virtualisation to isolation, from refactoring to API wrapping. The choice depends on the type of legacy, the budget, and the acceptable level of risk.

The Gartner 7Rs (yes, they have a name for everything):

Retire – Switch it off. Only works if nobody's actually using it.
Retain – Keep it as is. Sometimes the best choice.
Relocate – Move it to new infrastructure without changes.
Rehost – “Lift and shift” to cloud. Changes the hardware, not the software.
Replatform – Minimal changes to run on a modern platform.
Refactor – Rewrite parts of the code while maintaining functionality.
Rearchitect – Completely redesign. The riskiest and most expensive.

Virtualisation and emulation For systems on proprietary architectures (SPARC, VAX, Alpha, PA-RISC), solutions like Stromasys Charon emulate the original hardware on x86-64 platforms. The operating system and software don't change – only the iron underneath does. For legacy x86 systems (Windows XP, Server 2003, old Linux), standard virtualisation (Proxmox, VMware, KVM) allows you to “freeze” the environment and keep it running indefinitely. I've seen Proxmox setups running Windows 3.11. I'm not joking.

Network isolation If a system can't be patched, it can at least be isolated. Dedicated VLANs, restrictive firewalls, air-gap where possible. It doesn't fix the problem, but it limits the impact in case of compromise.

API wrapping Put a modern REST layer in front of a legacy system. The mainframe keeps doing what it knows how to do; the outside world talks to the API. This is the strategy many banks use to expose COBOL functionality to mobile applications.

The public sector: a special case

Those who work in the public sector know that the dynamics differ from the private sector in ways that make the legacy problem even more complex.

Multi-year budgets. You can't decide in January to modernise a system and have the money by March. Funding cycles are long, rigid, subject to political priorities that change with every election.

Procurement. Buying software in the public sector is a bureaucratic nightmare. Tenders, compliance requirements, impact assessments, GDPR, accessibility. A purchase that takes a week in the private sector takes months here.

Compliance. Systems handling health, education, or tax data are subject to stringent regulatory requirements. You can't simply “migrate to the cloud” – you have to demonstrate that the cloud complies with an endless list of standards.

Service continuity (which in my view is the core problem). If a private company's system goes down for a day, they lose money. If a system managing national exams, or medical prescriptions, or pension payments goes down, the consequences fall on real people with no alternatives. The risk of downtime during a migration is often simply unacceptable.

And then there's the political dimension. Every government wants to announce its own “digital revolution.” Nobody wants to inherit the previous government's problems. And so projects get started, abandoned, restarted, re-abandoned, in an endless cycle of waste.

NPfIT wasn't an exception. It was the rule.

The uncomfortable question

At this point, the question nobody wants to ask is this: what if some legacy systems were simply… better? Not better in an absolute sense, but better for their specific purpose?

Let me tell you something. I worked for years in environments dealing with large-scale Oracle infrastructure – the company that sells “cloud transformation” and “modern infrastructure” to half the world. And among other things, you know what got managed day to day? Old ZFS storage. Stuff that, on paper, should have been “modernised” years ago. Those machines had been running since before Docker existed, before Kubernetes, before “cloud native” became a term. And they worked. Quietly. Without drama. Nobody was in any hurry to replace them. Why would they be? In pursuit of what advantage, exactly?

The COBOL processing bank transactions has been optimised for sixty years. Every bug has been found and fixed. Every edge case has been handled. Every possible scenario has been tested in production billions of times. It's code that has achieved a kind of perfection through Darwinian evolution. Rewriting it in Python would mean starting from scratch. New bugs. New untested scenarios. Years of instability before reaching the same level of reliability.

And in the meantime? In the meantime, the legacy system keeps working. There's a reason banks aren't in a rush to abandon mainframes. It's not ignorance. It's not laziness. It's that they've done the maths and understood that the risk of the new outweighs the cost of the old. And the old administrators have retired. But this is an uncomfortable truth. It doesn't sell well in PowerPoint presentations. It doesn't generate consulting contracts. It doesn't make tech headlines.

And so we keep talking about “modernisation” as if it were automatically a good thing. As if “new” meant “better.” As if technology had a moral direction.

So what?

Legacy doesn't mean old – it means abandoned. The problem is never technical – it's always organisational. And “modernising” is not automatically better than “maintaining.”

If there's one lesson, it's this: be suspicious of anyone with simple answers to complex problems.

Every time I hear some manager say “we need to automate everything with AI,” I think about the software pachyderms holding up half of critical infrastructure. I think about the time it would take to train a model on COBOL written in 1987 with no documentation. I think about how long it would take to migrate a Java 1.7 system running on Solaris 9. I think about the hours spent reverse-engineering platforms still running Lotus Notes. I think about the costs. I think about the risks. And then I think that those same managers don't have the budget to hire juniors willing – and why should they be, when the IT world is moving in a completely different direction – to learn systems that have been decommissioned for at least thirty years. And I laugh. Bitterly, but I laugh. Then I take a few drops of CBD to calm myself down.

Before talking about artificial intelligence – and those who know me know I'm not against AI at all – perhaps we should make sure that human intelligence doesn't retire, taking years of undocumented knowledge with it. But that, evidently, is a less sexy priority to put on the slides.

Sources and further reading

UK government reports – NAO: “The sustainability of government IT” (January 2025) https://www.nao.org.uk/reports/local-government-financial-sustainability-2025/ – NHS Digital: Infrastructure assessment reports https://www.bma.org.uk/advice-and-support/nhs-delivery-and-workforce/the-future/building-the-future-healthcare-infras

COBOL and mainframes – Reuters: “Banks scramble to fix old systems” (Commonwealth Bank Australia cost analysis) https://www.reuters.com/article/technology/banks-scramble-to-fix-old-systems-as-it-cowboys-ride-into-sunset-idUSKBN17C0CN/ – IBM: “COBOL Modernization” https://www.ibm.com/think/topics/cobol-modernization

Legacy virtualisation – Stromasys: “What are legacy systems” https://www.stromasys.com/resources/what-are-legacy-systems-challenges-benefits/ – Proxmox Forums: discussions on legacy system virtualisation https://forum.proxmox.com/tags/legacy/

Sector analysis – Gartner: 7Rs of Application Modernization https://www.techtarget.com/searchCloudComputing/tip/Use-the-7-Rs-to-develop-an-app-modernization-strategy – Deloitte: Mainframe workforce decline study https://www.deloitte.com/us/en/insights/topics/technology-management/tech-trends/2023/future-mainframe-technology-latest-trends.html – WSJ: How AI Can Rev Up Mainframe Modernization https://deloitte.wsj.com/cio/how-ai-can-rev-up-mainframe-modernization-2e3c1c4a

Case studies: failures – Computer Weekly: “What went wrong with the National Programme for IT” https://www.computerweekly.com/opinion/Six-reasons-why-the-NHS-National-Programme-for-IT-failed – NAO: Post-implementation review NPfIT https://www.nao.org.uk/reports/review-of-the-final-benefits-statement-for-programmes-previously-managed-under-the-national-programme-for-it-in-the-nhs/

Security – WannaCry incident reports https://any.run/malware-trends/wannacry/ – NHS Windows XP audit findings (2019) https://www.verdict.co.uk/windows-xp-nhs/