Google offers a Safe Browsing feature – a system that finds and records websites that seem to have “drive-by downloads” or MalWare on them – software that downloads automatically, which you don’t ask to receive.

It flags up such sites in its search results with a warning under the result, “This site may harm your computer.” and an interstitial page, if you insist on clicking on the link, explaining how it may harm your computer.

Sadly, today, it seems to have gone mad, flagging every website, including its own, as potentially harmful.

Oops.

Wildly speculating here, there could be two reasons for this: firstly, its list of malicious websites has been corrupted to list everything (which seems hugely unlikely)¹, or the system is set up in such a way that it presumes guilt (which seems much more likely) – it is fail-safe.

I presume that the search results server displaying the list of search results asks the bad website list server whether each website address is on the list of bad websites. The bad website list server could respond with Yes or No – but what if it didn’t respond at all? What should the search results server do then?

A standard way of responding is to fail-safe – that is, to respond in a cautious way, so that the result is a safe situation. In this case, to presume guilt. So it looks like the bad website list server has failed, and so the search results are all being branded as malicious – just in case.

Such fail-safe systems, or fault-tolerant systems are thankfully common, but usually only noticed when they misbehave. That signal failure on the Tube this evening? It probably wasn’t a signal that was actually broken, but dirt and debris causing a similar effect – and the system shuts down anyway, just in case.

So while it is annoying for this to happen, it’s the right way round for the system to fail.

(And if you are interested in such things, comp.risks is a wonderful digest of such stories.)

¹ Update (again): Google says that the cause was… their list of sites accidentally included an instruction for every site to be listed as bad and StopBadware says otherwise… agrees. But it sounds like it was not what I thought at all. Which is interesting as Google says their list of bad sites “is maintained by humans, not algorithms.” Apparently the list is maintained (according to their updated blog post) “through both manual and automated methods.” Google’s Tech report accessible from the link I provided earlier, talks of a clever automated system to analyse whether the sites that they were investigating were malware or not.