Therapy patients blackmailed for cash after clinic data breach

https://www.bbc.com/news/technology-54692120

by velmu • 6 years ago

246 196 6 years ago

titzer2• 6 years ago

Yet another instance of "if you're not doing anything wrong, you've got nothing to hide" being a very poor argument against robust privacy protections.

himinlomax2• 6 years ago

Excellent point!

mostlove• 6 years ago

"I'm scared that I'll end up like the first 300 people who had all of their info dumped on [anonymity network] Tor, with people going through them, reading everything about their lives and abusing their info for identity thefts."

Also another good reason for people not to seek mental help, on top of being able to own a gun.

And with the recent rush to transition online, I hope this 2018 hack doesn't give the bad guys any ideas.

williamtwild3• 6 years ago

mostlove said:

"Also another good reason for people not to seek mental help,"

Are you actually advocating that people ignore health issues and not seek help because the way you worded you statement it certainly seems so.

heavenlyblue2• 6 years ago

How does owing a gun would help here?

friendlybus3• 6 years ago

Another good reason to not go to Catholic confession or store your cash in the Panama paper's islands or go to a scientology session or store your credit information with equifax. Secrets have to exist somewhere.

Socially ostracizing people for leaked mental help information is like laughing at fat people who had their gym treadmill data leaked. That's where you go to solve your problems, data leak or not.

jermaustin13• 6 years ago

Also another good reason for people not to seek mental help, on top of being able to own a gun.

Your feeling is well-founded, as much as you are being downvoted. This is actually a huge topic in the ongoing evolution of digitizing client records in psychotherapy.

My wife (a marriage and family therapist) was taught in school that about 20 years ago insurance started requiring a diagnosis to reimburse for treatment, and ongoing treatment plans to be uploaded to their portal to continue reimbursing more than the standard 3-6 sessions most insurers felt was adequate.

This cause a HUGE backlash among psychotherapist, because depression would be considered a pre-existing condition, and also if it is on your records, life insurance was nearly impossible to secure, future non-workplace health insurance was hard to get, etc.

So everyone started using various "adjustment disorders", or acute grief (I think that's the term they use for loss of a loved one) as an ethical way around marring an otherwise healthy persons permanent record. There are times when it is more ethical to put a real diagnosis, usually so that you can have them referred to a more specialized clinician.

mehrdadn12• 6 years ago

More like yet another example of Bitcoin inflicting massive damage with techies being completely blind to its gigantic role.

Edit: Judging from the responses, "blind to" may have been overly charitable.

calmworm• 6 years ago

Why not both?

mmm_grayons6• 6 years ago

It definitely played a role, but so what? The ability to transfer money outside the control of the state is a good thing, and the fact that some people abuse that doesn't make it bad. Same as gun ownership.

imgabe7• 6 years ago

Ah yes, the notorious bitcoin that stole this data and extorted people. Curse this troublesome software that has gained sentience wreaks havoc on the world.

specialist5• 6 years ago

I'm still unclear how bitcoin (et al) can be used to exfiltrate assets anonymously.

Doesn't the ledger (blockchain) keep track?

ashleyn• 6 years ago

Banning bitcoin won't fix anything, they'll just go back to Panamanian mailboxes and moneypak.

unishark2• 6 years ago

You're complaining about criminals having anonymity in a discussion about privacy. The technology enabling bitcoin is cryptography itself. There's no putting it back in the bottle, and we'd still want it anyway.

We simply need data to be as well protected as the criminals can protect their financial transactions.

badjeans4• 6 years ago

Overall, the benefits from more transparency are huge, and far outweigh the drawbacks.

lr4444lr• 6 years ago

To the collective maybe. Not to the individual.

dredmorbius3• 6 years ago

It's interesting to read back over past discussion of this question. Among the more interesting academics is Herbert Simon, and his 1977 essay "What Computers Mean for Man and Society" makes a strong case for the positive impacts of increased utilisation of computer technology. It also specifically discusses the privacy concerns, in one paragraph.

That, unfortunately for Simon's case, contains an egregious factual error, though one which may not have been known to Simon at the time:

The Nazis operated with horrifying effectiveness and thoroughness without the benefits of any kind of mechanized data processing.

Screenshot:

https://mastodon.cloud/@dredmorbius/103059230160200494

Source:

https://pdfs.semanticscholar.org/a9e7/33e25ee8f67d5e670b3b7d...

Unfortunately, we're now very well aware that this was not the case. Not only did Nazi German prosecute the Holocaust with the extensive aid of mechanised data processing technologies, but they did so using American technology, provided and supported, with full knowledge, by IBM:

Edwin Black has documented this in his horrific book, IBM and the Holocaust (2012)

https://ibmandtheholocaust.com

https://www.worldcat.org/title/ibm-and-the-holocaust-the-str...

To paraphrase Lord Acton, it appears that data corrupts, and absolute data corrupts absolutely.

mynameishere• 6 years ago

I don't think I've ever heard anyone actually argue that. Much like "trickle-down economics" it seems to exist almost entirely for straw man purposes.

underdeserver• 6 years ago

Eric Schmidt, former CEO of Google.

  When asked during an interview for CNBC's recent "Inside the Mind of Google" special about whether users should be sharing information with Google as if it were a "trusted friend," Schmidt responded, "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place."

https://www.eff.org/deeplinks/2009/12/google-ceo-eric-schmid...

notRobot• 6 years ago

Previous discussion, 2 days ago: https://news.ycombinator.com/item?id=24886039

adriand• 6 years ago

This is so insane and so tragic. The anguish these people are going through right now is unconscionable. And the people doing this are truly the scum of the earth.

It also raises the question whether certain records just ought not to be digitized, ever. I saw a therapist a few years ago. I asked her at the start, while reviewing her Ts&Cs, about the service she used to store her client data. It was a very secure online service, she assured me. Yeah right, I thought. I asked her to keep my records on paper in her locked filing cabinet instead, and she agreed. I would really recommend the same course of action to anyone.

amelius2• 6 years ago

Perhaps they should simply store patients as numbers.

biot• 6 years ago

That tends to not work very well: https://www.nytimes.com/2006/08/09/technology/09aol.html

mjevans• 6 years ago

That would help, but metadata is a powerful thing. The relations, tendencies, and activities of someone, particularly the kind of notes (I imagine) are kept for therapy subjects, would be a treasure trove even with some subject indirection.

jedimastert• 6 years ago

Unfortunately you need surprisingly little data to uniquely identify someone. For example, sex, date of birth, and zip code can uniquely identify a large swath of the general public.

http://latanyasweeney.org/work/identifiability.html

vesinisa• 6 years ago

My spouse works as psychotherapist. She has ever only used pen & paper for patient notes for exactly this reason. No digital service is unhackable, and the cases where you would actually need to access patient notes in electronic form are quite rare.

Shivetya• 6 years ago

Sadly this is no guarantee as the news is replete with stories of people finding medical records in trash or abandoned in close facilities.

However since no system is perfect laws have to exist to prevent the information from being used by others except as how authorized by the law; examples would be preventing prospective employers from using it to filter candidates, housing agencies would be similar restricted. The same law would put in place a means to force it to be removed from any site hosting the information.

The key take away is we cannot guarantee full protection but we minimize the damage caused

zajio1am• 6 years ago

IMHO using separate computer not connected to any network, locked in cabinet, should be safe enough.

james305• 6 years ago

Agree on this point. Some computers just should not be internet connected. Security is the wild west right now and isn't going to be fixed any time soon.

easytiger• 6 years ago

Maybe some things should just be kept on paper, at the end of the day.

wun0ne• 6 years ago

Absolutely horrific. I hope those responsible are identified and apprehended as soon as possible.

mlang23• 6 years ago

Identifying the incompetend IT security department responsible for this is likely pretty easy. It is much harder to make the message heard that those in charge of taking care of sensible data are those putting people at risk. How the stuff gets stolen isnt very relevant if it has been stolen. Healthcare data should simply not be allowed to be stored in a way where it can get lost. Period. If the people in charge can not guarantee that, then digital storage needs to be stopped immediately.

bencollier49• 6 years ago

Agree. Hackers in this case ought to be treated as a force of nature and those responsible for security treated as though they had failed to put adequate "weather protection" in place.

null_object2• 6 years ago

In the interest of accuracy, the title of this post should replace ‘cash’ with ‘Bitcoin’.

williamtwild3• 6 years ago

Venmo = digital currency

Apple Cash = digital currency

ACH = digital currency

Direct Deposit = digital currency

Bitcoin = Digital currency

Credit/Debit Card = digital currency

Cash = an annoyance

I guess you are trying to make a point but if you don't have your head in the sand cash and bitcoin mean the same.

ceejayoz4• 6 years ago

if you don't have your head in the sand cash and bitcoin mean the same

Not when it comes to blackmailing someone safely from another country.

There's a reason ransomware asks for Bitcoin and not cash, credit, Venmo, etc. It's the only non-reversible payment method on your list.

amanaplanacanal• 6 years ago

If cash and Bitcoin are the same why would anyone ever use Bitcoin?

null_object2• 6 years ago

My comment was somewhat flippant and I genuinely don't want to distract from this terrible situation for all the victims, but seriously, this type of criminal activity has been enabled by cryptocurrency, and the journalist who uses 'cash' and 'bitcoin' interchangeably the way that the BBC has done in this article should be ashamed of themselves.

Cash may well be 'irreversible' in the same way as bitcoin, but how exactly would these criminals physically receive cash from all of the victims? How else would they be able to demand and receive these vast payments anonymously?

edit: I'd prefer to get counter-arguments for genuine questions instead of downvotes.

AnssiH• 6 years ago

The police have received over 13500 crime reports already, so this may well become the largest Finnish criminal case in history in terms of number of victims (Finnish source: https://www.hs.fi/kotimaa/art-2000006702261.html).

Though I don't think it is yet known how many of those crime reports concern blackmail, unauthorized data release, or other crimes related to the data breach.

A couple of English links:

https://yle.fi/uutiset/osasto/news/court_freezes_assets_as_v... -- https://yle.fi/uutiset/osasto/news/vastaamo_board_fires_ceo_... -- https://yle.fi/uutiset/osasto/news/president_niinisto_this_a... (Yle News)

https://www.poliisi.fi/about_the_police/press_releases/1/0/n... (Police)

https://tietosuoja.fi/en/-/advice-for-the-victims-of-the-dat... (Data Protection Ombudsman)

iflp• 6 years ago

From the first two links:

Vastaamo board fires CEO, says he kept [a previous] data breach secret for year and a half
[The CEO's family] owned the company until it was bought by Helsinki-based private equity firm Intera Partners in May 2019, not long after a second breach of the psychotherapy provider’s data security systems.

jeltz• 6 years ago

So a quite serious GDPR violation then?

gonzo412• 6 years ago

Ahh private equity, is there anything it won't wreck.

jonplackett• 6 years ago

It has set up a helpline and is offering all victims one free therapy session, the details of which will not be recorded.

Wow, bet they'll have a lot of takers for that. Maybe they should have thought of this concept earlier.

dbspin• 6 years ago

I trained as a therapist a decade ago, and even then it was written into my organisational code of ethics that patient notes be stored encrypted with identifying codes rather than names, and the list of name / numbers stored and encrypted separately. While our code of practice didn't specify scheme or location, it's pretty awful that this company didn't seem to have anything in place. But I guess that's to be expected from what sounds like a corporate firm rather than a set of practitioners. At this scale, clients are just numbers on a balance sheet.

ptaipale6• 6 years ago

That makes sense, but Finland is a welfare state where government pays for a large part of health care costs, and this data breach was at a start-up that has a couple hundred therapists that mostly contract for the public health care system.

And government regulations require tracking of sessions, costs and compensations, identifiable by person ID.

One extra piece of anguish people have here is that not only may their mental records be revealed, but simply that their address and person ID is used by identify thiefs who take loans or mail-order things in their name.

The government has now responded by starting to find out if the person IDs of the victims could be changed quickly to avoid this risk, but I think that is an answer to wrong question. The right question is why it is permitted to apply for loans with a specific person ID without providing reliable authentication (either electronic signing or physical photo ID).

willvarfar3• 6 years ago

Decades ago one of my first jobs was as an IT bod for a regional health service.

One of their facilities was an family psychiatry centre. The staff there refused to let their records be held centrally, and instead had everything on clunky PCs bolted into lockable safes in the corner of each doctor's office. When the safe opened the keyboard slid out.

The doctor in charge had also built their own database that they used. Early adopters, before the rest of the health service was modernizing with newfangled computer thingies. Clever people, those doctors.

heavenlyblue2• 6 years ago

Another option is to go live in a forest and not use any of the digital tech at all. But that isn’t a smart solution if you’re doing all of this only not to get hacked.

PS: let’s say a patient in that clinic wanted to move their history to another clinic. Are they now supposed to pro-rata their surgeon just to get the information from that custom-built database? That is incredibly expensive; and no matter how smart that surgeon is that database is almost certainly not that much more secure than off-the-shelf solution.

ChrisMarshallNY2• 6 years ago

In the US, that's actually the way it works. HIPAA laws are very strict.

When I change doctors, I have to go around to all my prior physicians, and get hand-signed releases delivered (if I'm lucky, they will accept a fax). Sometimes, the records are physical papers.

I still have all my old MRI and CAT pics (long story).

jermaustin13• 6 years ago

As the husband of a Marriage and Family Therapist operating in NYC and upstate, I can tell you that most client notes are still done on paper, and locked away. My wife's notes are either locked in a "safe" at her office (heavy time-locked door to a room, with locking file cabinets) in the city, or in a small locking fire-proof file safe at home.

Really the only things that get computerized are the things required by insurance (diagnosis and treatment plans).

But notes are highly personal to the therapist, and can include any number of on-topic or off-topic , and it is rare even under subpoena to release your personal notes. Her office has a lawyer on retainer who's only job is to quash subpoenas. She's never had one served to her, and I dont know if any of the other clinicians have.

But back on topic - though, I'm 90% sure the clinicians at the psychotherapy clinic in GP's comment probably had the same thing. They would take paper notes, and only digitized what they needed to digitize, and most of those digitized records are non-transferable anyway, because they would be diagnosis and treatments for that patient/client provided by that clinic, and if a clinician left, and was allowed to take clients/patients to their new practice (sometimes allowed, but often times not), the clinician would take their personal notes with them.

Bukhmanizer2• 6 years ago

IMO this is terrible advice. What happens after a decade when some or all of the desktops are way out of date? Are the doctors diligent about patching them? All of the doctors?

Likely the situation they’ll end up in is a bunch of old computers running outdated software that all ends up being a massive security threat. Let’s say in 2005 one of the doctors wanted to video chat with their kid, and the kid tells them to download teamviewer. Chances are, 15 years later in 2020, that 2005 version of teamviewer is still going to be on that computer. I know this because I work in a psychiatric research institute (though not in IT) and this kind of stuff happens all the time. It’s not everyone, but in this case the weakest link breaks the chain.

mschuster91• 6 years ago

Are the doctors diligent about patching them?

Why should they be, if the system is airgapped?

metalliqaz3• 6 years ago

sounds like the PCs were air gapped

willvarfar3• 6 years ago

I wasn’t recommending something, I was describing it!

This was before the internet.

The very real threat were people trying to locate young victims taken into care etc.

The center, on their own initiate, mitigated this by physically locking the computers into safes.

They also used classic usernames and passwords, but I don’t think encrypted storage was a thing then.

appleflaxen• 6 years ago

this sounds about a thousand times more secure than a state of the art cloud solution, because the physical isolation (even with outdated software) is so robust.

I think whether it's a local optimum vs. a global optimum can be debated, but to call it "terrible advice" is way off the mark.

raxxorrax• 6 years ago

And yet a compromisation is still far more unlikely than hosting it on the next shitty cloud application. Any cloud application and a threat analysis on data will reveal exactly that. And it won't even be close.

salex893• 6 years ago

A funny piece of advice, I have an actually very good friend (we still are, but at a point in history our relations became a bit dark) who knew that I was going into therapy. I didn't actually accept the fact that I had to go well, and I felt ashamed and weak when we talked about it. Little did he knew, in the meantime I got much better, accepted the fact and started freely speaking about it with other people here and there. Not when not asked, but when the topic of mental health came along, I wasn't shy to expose the fact and encourage people to seek their own. And in one relatively big dispute (minor from this distance), he kind of tried exposing it against me in front of some mutual friends who actually already knew (I told them in the meantime). Well, he looked like massive jackass.

In conclusion, don't be ashamed for seeking therapy. Yes, it may feel shameful now, which is completely unwarranted, but a part of the process of healing is also dealing with the existence of the issue itself and taking a different stance at mental health issues.

As for the blackmailers... just rot in hell.

fakedang2• 6 years ago

So... Guess you're friend must enjoy the prospect of rotting in hell.

0xdeadb00f• 6 years ago

They said they're on good terms now, LOL.

salex893• 6 years ago

Haha, I send him there a couple of times every week for the last 20 years.

It was much more benign and the people we were with are fairly close to both of us. We wouldn't quarrel in such a way in front of them if they weren't. But it was heated at that point, and a learning opportunity for both of us.

fredleblanc• 6 years ago

My therapist addressed the stigma of therapy in session one: when your arm is broken, you go to a doctor. So why wouldn’t you go to one when your mind is broken? Makes sense to me.

Therapy was the best $20 co-pay I paid every week for quite a while. I only stopped because I moved to a state where mental health wasn’t covered well by insurance and couldn’t justify the hourly rate in cash. But it really helped me find perspective in the minutia that is my life.

I’d highly recommend it to anyone that can access it. Find a good therapist and give it a go.

Also, I second your call for blackmailers to rot. :)

metalliqaz3• 6 years ago

At least in the US where I am, there is a strong stigma attached, and if people know you have mental issues you are assumed to be dangerous. Not surprising, I suppose, in a society that guarantees access to weapons of mass murder. But people won't let you near their kids, and you probably would have trouble finding a job.

jnsie• 6 years ago

I've never gone to therapy but have always thought that in an ideal world everyone would go, from time to time. People go to the gym to keep their bodies fit and healthy, why not go to a therapist to keep your mind fit and healthy?

b0rsuk2• 6 years ago

There is a Philip K. Dick short story where practically everyone does. I don't remember its name. The topic of therapy commonly came up in his short stories and novels.

cultus• 6 years ago

You must have the forgiveness of a saint to still be friends after something like that. I hope your friend has genuinely changed.

jrochkind12• 6 years ago

I am not ashamed of seeking therapy, and am pretty open about it with anyone, although I respect anyone that wants to keep it private.

I still would definitely not choose to share the NOTES FROM MY THERAPIST of private things I said to them -- if I'd ever choose to share that with anyone (maybe not), it would certainly not be with the public at large, with anyone who cares to look it up at any time.

It's not just an indication that someone went to therapy that the blackmailers are revealing and threatening to reveal. It's a very different thing. I would expect most people who are public about having gone to therapy (like the people interviewed in OP) are not in fact fine with sharing the complete notes of everything they said in therapy with any interested acquaintance or member of the public.

reagent_finder• 6 years ago

Apparent timeline:

2018 Nov: Company breached, seems most likely database of 40,000 mental health records including PII (duh), contact information and treatment history and notes was stolen at this time.

2019 Mar: Another breach. This causes Vastaamo to increase security and close the holes the hackers used.

2019 Apr/May: Independent security company (not named) performs audit since the company was to be sold. Some improvements were suggested, no major security flaws were found.

2020 Aug/Sep: Vastaamo receives threat from hacker if they will not pay 40BTC the hacker will release the database. Until they do the hacker will release 100 records per day.

2020 Sep/Oct: Infosec company Nixu researches Vastaamo systems, reporting that the breach that stole the database was probably made in November 2018, possibly single records in subsequent breaches.

2020 Oct: Individuals whose information was not in the already-leaked records have been contacted and extorted individually.

After that, in no particular order:

* 300 records have been leaked. The hacker seems to have stopped, though.

* Single records not included in the 400 have surfaced on TOR web

* A site on TOR was up for a while with several similarly-named files, one a 10GB tar that is rumored to be database. Partial downloads have been reported. Edit: Also program snippets etc included, with possible 'digital fingerprint' according to Mikko Hyppönen, a well-known Finnish security expert.

* An IP address related to the hack has been traced to Inkoo, Finland.

CEO claims the 2020 Nixu report was the first time he heard of the breaches and that's why the new CEO or board were not informed -- which seems awfully sus, considering several breaches were made and a reactionary battering down the hatches as well as an external audit were made.

Further, people who work or used to work at Vastaamo have come out claiming toxic work environment, threats of lawsuits if they speak out against the company, bad working conditions and a large number of ethical violations (like using as advertisement names and reputation of people who don't work for them). It also appears they've been sending social security numbers in plaintext over email. Claims have also been made that the database and system were outdated and only had default passwords and no real attempt at securing the data or even servers have been made, but of course nothing is public yet. Possibly never will be.

All in all, looks like the previous owner is a bona fide scumbag with all the bells and whistles that entail. And, of course as is fashionable, when asked about these things his responses have been "I have no knowledge of that" and "I do not recall." And, of course, affected people have found out about this from the news and not Vastaamo themselves.

My heart goes out to the people affected, it takes courage and effort to start working out mental health problems and this has probably been a devastating blow to many.

FDSGSG• 6 years ago

A Finnish court just ordered a seizure of almost 10 million euros worth of assets from the ex-CEO and his family.

Investors believe that he knew about the breach but covered it up, so now they're trying to claw back their money.

https://www.mtvuutiset.fi/artikkeli/jattimainen-takavarikko-...

miohtama• 6 years ago

This is good developments. Would love to see swift action in the case of data breaches elsewhere.

apples_oranges• 6 years ago

Is there a catchy expression for the fact that in the future all data that we believe private will probably be public? Give it a few more security breaches..

mcbits• 6 years ago

I would nominate "data apocalypse" based on the literal meaning of apocalypse (disclosure), but it seems others have already coined the phrase for various other events.

swebs3• 6 years ago

https://en.wikipedia.org/wiki/Information_wants_to_be_free

BMSmnqXAE4yfe1• 6 years ago

Even in absence of any security breaches, all currently used encryption is practically assured to be broken with the advances of technology. That LastPass app is so convenient, it stores your passwords in the cloud "securely encrypted". But all your secrets are going to spill in ~50 years.

srtjstjsj4• 6 years ago

"privacy is dead" is Mark Zuckerberg's slogan

brador• 6 years ago

Therapy notes should require both therapist and patient to enter a secret passcode to unlock. 2 person consent.

metalliqaz3• 6 years ago

I would sue the clinic into oblivion. The clinic is finished anyway, who would go there now?

ptaipale6• 6 years ago

Sueing companies doesn't work quite the same way in Finland as it does in the US, but I am fairly certain that this chain of clinics (which was a 10-year-old start-up with about 250 employees, sold to private equity investor a couple of years ago) is out of business within months.

I expect the pieces ("assets") will be picked up by some of the larger private health care providers where the same therapists will continue to contract for the public health care system (it's not the fault of therapists, after all).

greatgib• 6 years ago

A very good example to show to people that are still in the stupid mindset: "i have nothing to hide because I'm not a criminal"

privacylawthrow• 6 years ago

There have been previous discussions on HN about why it should be illegal to pay a ransom to hackers. Here is a very good reason why it should not be illegal.

thatguy0900• 6 years ago

Well if it had been made illegal and people stopped paying long ago maybe these hackers wouldn't have bothered since they wouldn't expect a payout. It's only going to get worse as people continue to pay.

rebuilder• 6 years ago

Here I was thinking this is a very good example why paying ransoms should indeed be outlawed. It's a classic case of the individual's short-term interests conflicting with the long-term interests of both society at large and the individual being blackmailed. My main reservation is, I'm not sure how effective a ban on ransom payments would be, in reality.

gonzo412• 6 years ago

So I don't speak Finnish, but to commit extortion in Finland you probably need to right?

Would this mean that the hackers are probably Finnish?

And if that's the case, seeing how massive this is for the country. Wouldn't this type of action just be crazy risky for them?

Good luck to the cops, I hope they get the bad guys and there's consequences.

hackerman_fi2• 6 years ago

The initial post and data dump was on a Finnish TOR-based imageboard but it was written in English. It is still being discussed if the hacker actually is from Finland but uses English to not reveal that.

Most Finnish people are fluent in English so it wasn't an issue. The leak was in Finnish mainstream media before the Finnish extortion mails were even sent. When the mails were sent, all hell went loose.

Tuna-Fish• 6 years ago

So I don't speak Finnish, but to commit extortion in Finland you probably need to right?

Reportedly, the extortionists bought translation services from a TOR chan.

ptaipale6• 6 years ago

Sorry, what does "reportedly" mean here? That word is used often in a weasel-like way to make various claims, but is there an actual source for this?

xorcist• 6 years ago

At least some of the threats were reportedly in poor Finnish. Some thinks that is indicative that the extortionists aren't native. You could just as easily make the argument that they're trying to obscure that they are.

b0rsuk2• 6 years ago

Off-topic, but there's one funny thing about psychiatric clinics. Waiting rooms are completely silent. Everywhere else, patients (especially elderly) won't shut up about their pains and treatments.

watwut• 6 years ago

Everywhere else, patients (especially elderly) won't shut up about their pains and treatments.

That is not my experience with clinics at all. People waiting for doctor usually wait silently.

specialist5• 6 years ago

Data at rest must be encrypted.

Field level encryption. Just like password files. Salt and hash any potentially identifying information.

Translucent Databases shows how. https://www.amazon.com/gp/product/1441421343

Source: Created some of the first medical records digital exchanges (NYCLIX, BHIX, etc) in the mid 2000s. Worked very hard to figure out how to protect patient privacy. This breach and subsequent blackmailing was one of our nightmare scenarios. FWIW, nothing (nothing) has improved since.

yowlingcat• 6 years ago

I'm kinda curious about what some of the recent advances in differential privacy in ML could imply in the field here. Taking a look at FB's Opacus, they basically use added noise to ensure that the data "in transit" is not really the data "at rest" and I've toyed with the idea of storing working data and data at rest differently for sensitive information, with the latter being encrypted by a user's OTP so an operator breach cannot effectively do much.

The problem with this approach is the question "how much noise?" Too little and an adversarial attacker can do some kind of a regression based attack. Too much and the "anonymized" data fails to be a useful "substitute" for previous analysis/business logic previously operating on the raw data. There's also the whole field of homomorphic encryption to get into as well. It looks like there have been some interesting breakthroughs there from the crypto nut side, specifically with zk-snarks. I can't say I understand the underlying tech well enough to comment, though. Fascinating subject.

[1] https://ai.facebook.com/blog/introducing-opacus-a-high-speed...

specialist5• 6 years ago

Thanks. Learning zero knowledge is on my to do list.

I'm skeptical of differential privacy for patient medical records. I assume big data style deanon wins once you can correlate with other data.

Differential privacy is probably fine for "data dumps", like when study data is extracted from many patients. Since those dumps are not used for ongoing care, they can be more aggressively scrubbed.

Total aside:

Even encrypting data at rest is insufficient. Because even preserving chronological order (no timestamps) is sufficient for deanon. But last week I had a new notion for hiding time and order. I am a total crypto noob, so I'm still trying to figure out if this is a new idea.

As a defender of patient and voter privacy, and so therefore a very vocal critic of electronic voting, I will be deeply chagrinned if I figure out how to make it work.

fritzo2• 6 years ago

Call to action for neural artists: We need deep fakes to generate vast amounts of plausible noise and thereby conceal our sensitive private signal. I feel like the only way our species will regain a sense of privacy is when we're concealed in a forest of artificial signal.

marcinzm• 6 years ago

Wasn't that a plot point in Rainbow's End where in the future the internet is filled with fake personal information to the point of googling someone is pointless.

fritzo2• 6 years ago

Thanks, I hadn't heard of Rainbow's End!

amelius2• 6 years ago

Another crime partially made possible by Bitcoin. This doesn't necessarily make Bitcoin or other cryptocurrencies "bad", but we should keep a score of the advantages and disadvantages of a technology.

EGreg• 6 years ago

Yes agreed. Every technology has downsides.

This isn’t just limited to Bitcoin. It applies to encryption and privacy in general. Should people be allowed to permissionlessly create accounts on networks, and have private communications in which they can organize large activities or effect large value transfers, or should we as a society go after every such network to shut it down?

Therapy patients blackmailed for cash after clinic data breach

Related Stories