Delta lobs another volley at CrowdStrike, outlines cost of meltdown

In the letter to a lawyer for CrowdStrike, Boies Schiller Flexner attorney David Boies wrote that the outage disrupted travel plans for more than 1.3 million Delta customers and shutdown more than 37,000 of the airline’s computers.

The outage, fallout and Delta’s response has trigged a U.S. Department of Transportation investigation, a class-action lawsuit against Delta and pointed letters from attorneys for Microsoft and CrowdStrike.

“If CrowdStrike genuinely seeks to avoid a lawsuit by Delta, then it must accept real responsibility for its actions and compensate Delta for the severe damage it caused to Delta’s business, reputation, and goodwill,” Boies wrote in the letter to Quinn Emanuel attorney Michael Carlinsky, who represents CrowdStrike.

A CrowdStrike spokesperson said in a statement Thursday that “Delta continues to push a misleading narrative,” adding that CrowdStrike and Delta teams “worked closely together within hours of the incident, with CrowdStrike providing technical support beyond what was available on the website.”

According to Delta’s filing with the SEC, the lost revenue is primarily due to refunds to customers for canceled flights and compensation to customers with cash and SkyMiles.

It said it expects $170 million in expense from the outage and operational recovery, mostly due to reimbursements for customers’ expenses and costs for crews. It expects fuel expense to be about $50 million lower, since the airline used less fuel as a result of the 7,000 flight cancellations.

Carlinsky sent a letter to Boies on Sunday saying the airline’s public threat of litigation “has contributed to a misleading narrative that CrowdStrike is responsible for Delta’s IT decisions and response to the outage.” He wrote that CrowdStrike reiterates its apology, while adding that the software firm “strongly rejects any allegation that it was grossly negligent or committed willful misconduct.”

In his Thursday letter back to Carlinsky, Boies wrote that CrowdStrike’s apology to Delta is “vastly inadequate.”

“There is no basis — none — to suggest that Delta was in any way responsible for the faulty software that crashed systems around the world, including Delta’s,” Boies wrote. He contested Carlinsky’s earlier contention that CrowdStrike’s liability is contractually capped at an amount in the “single digit millions.”

Boies also wrote that a CrowdStrike post-incident review includes information that CrowdStrike “did not properly validate or test the Faulty Update” and “there was no staged rollout to mitigate risk and CrowdStrike did not provide roll-back capabilities.”

“The contract does not cap liability or damages for gross negligence or willful misconduct. Your position disregards the massive impact that CrowdStrike’s conduct has inflicted on Delta, its customers, and its people,” Boies wrote. He also wrote that CrowdStrike’s remediation website initially instructed Delta to manually reboot every affected machine.

“Delta has long regarded CrowdStrike and Microsoft as reliable technology providers,” Boies wrote. “Delta’s reliance on CrowdStrike and Microsoft actually exacerbated its experience in the CrowdStrike-caused disaster.”

The outage caused a massive backlog in the airline’s crew tracking system, with incomplete and inconsistent data that required several days to resolve and required “significant human intervention by skilled crew specialists to get Delta people and aircraft to right locations to resume normal, safe operation,” according to Boies’ letter.