Here is what the USPTO announced a few minutes ago about the massive system crash that started yesterday evening:
On Wednesday, December 15, 2021, at approximately 8:30 p.m. ET, the United States Patent and Trademark Office (USPTO) proactively and deliberately shut down all external access to systems in light of a serious and time-sensitive concern related to Log4j vulnerabilities. Although this preventative measure impacted those seeking to file documents, the USPTO needed to shut down the systems to perform necessary maintenance to safeguard not only our infrastructure, but also the security of our filers’ data. The USPTO created a path for filers to continue to submit applications via email during the outage. Around 8:30 a.m. ET on Thursday, December 16, maintenance was completed and all external systems were restored.
Several things can be said about this.
First, the USPTO announcement is not accurate about the start time of the crash. USPTO customers started seeing login problems at about 7PM Eastern Time.
Second, I will note that alert blog reader Chris called it! Chris posted a comment very early this morning that you can see here (scroll down a bit) correctly guessing that this would turn out to be USPTO’s explanation for the outage.
Third, yes we have all been reading about Log4j vulnerabilities and yes of course it is prudent to take whatever steps one needs to take to protect against those vulnerabilities. But this particular vulnerability was publicly disclosed on Thursday, December 9. Nowhere in the USPTO announcement is there any explanation as to why the corrective action was taken only six days later. Nor is there any explanation why the starting time selected for this work was during working hours (for USPTO customers) rather than at the normal time for such corrective actions which is shortly past midnight on whatever day the work is to be done.