4 ms·

I think the bigger issue (which another article I read on this last week described, but I sadly can't find it right now) is that low punishment for when it's ca

by jc4p 11y ago

I think the bigger issue (which another article I read on this last week described, but I sadly can't find it right now) is that low punishment for when it's caught means its more likely to happen and not be caught. There were 3 cases reported in 2015, how many went unreported? If the culture is "oh it's fine, just don't be egregious about it" I expect it's happened a lot more than 3 times in the last year. Do they not maintain proper audit logs? I work for Stack Overflow and I can't look at a user's PII without it being logged in multiple systems, do we have higher internal security than the police department?

jacquesm 11y ago
> I work for Stack Overflow and I can't look at a user's PII without it being logged in multiple systems, do we have higher internal security than the police department? Most likely: yes.
sixothree 11y ago
Imaging how these low-lifes would be treated if these were HIPAA violations.
- handedness 11y ago
  One could argue that they aren't necessarily low-lifes: I'd wager many, many people would abuse such power if they could. Which is why it's more important to place constraints on positions of power, than to hope that we only staff those positions with wholly noble people (who are incredibly few in number, in reality). The other consideration is that if they were doing so under the threat of HIPAA violations, they may not have abused the information quite so casually. Jealous husband fears a slap on the wrist, he abuses the database. Jealous husband fears jail time, he possibly [hires P.I. / follows his wife / etc.]. I'm not defending them–law enforcement enjoys some protections that are arguably unconstitutional, and as such should be held to a much higher standard–but it's unproductive to examine what would have happened if the penalties were different, while simultaneously assuming that the actors would have made identical decisions based on different criteria. And the reason that's important brings me back to my first point–built-in constraints are the only way to solve this sort of thing, which is the same reasoning the founders used to try to place constraints on American politicians.
  - jacquesm 11y ago
    > One could argue that they aren't necessarily low-lifes: I'd wager many, many people would abuse such power if they could. The fact that there may be more of them does not change that they are low-lifes.
    - handedness 11y ago
      Sure, but then we wind up having to broadly categorize most people as low-lifes. Which may be true, but that's all the more reason to construct a system that can survive them, not a system that falls apart when representative human beings are part of it.
  - sixothree 11y ago
    Lack of fear of penalties is likely why this happened in the first place. Regardless I should not have used the term low-lifes. I'm fairly sure it's not the appropriate kind of discourse for this place.
- LogicX 11y ago
  There are very few examples of punishment or loss of licensure related to HIPPA violations (at least the last time I looked into it, to calm my RN wife that she didn't violate HIPPA and even if she did, her life isn't over.)
tajen 11y ago
I'm interested to know how your system ensures that anyone accessing PII goes through the system. Don't sysadmins have full access to the db? When you are granted access, can you see the full table or just the row about this user?
- Retric 11y ago
  It's not that hard to keep all PII encrypted in the DB. Ideally, PII should only be decrypted inside your application. Though at a minimum https://en.wikipedia.org/wiki/Transparent_Data_Encryption https://en.wikipedia.org/wiki/Transparent_Data_Encryption should be used.
revelation 11y ago
Of course you do. They still don't know what Snowden has.

by jc4p 11y ago

jacquesm 11y ago

> I work for Stack Overflow and I can't look at a user's PII without it being logged in multiple systems, do we have higher internal security than the police department? Most likely: yes.

sixothree 11y ago

Imaging how these low-lifes would be treated if these were HIPAA violations.

handedness 11y ago
One could argue that they aren't necessarily low-lifes: I'd wager many, many people would abuse such power if they could. Which is why it's more important to place constraints on positions of power, than to hope that we only staff those positions with wholly noble people (who are incredibly few in number, in reality). The other consideration is that if they were doing so under the threat of HIPAA violations, they may not have abused the information quite so casually. Jealous husband fears a slap on the wrist, he abuses the database. Jealous husband fears jail time, he possibly [hires P.I. / follows his wife / etc.]. I'm not defending them–law enforcement enjoys some protections that are arguably unconstitutional, and as such should be held to a much higher standard–but it's unproductive to examine what would have happened if the penalties were different, while simultaneously assuming that the actors would have made identical decisions based on different criteria. And the reason that's important brings me back to my first point–built-in constraints are the only way to solve this sort of thing, which is the same reasoning the founders used to try to place constraints on American politicians.
- jacquesm 11y ago
  > One could argue that they aren't necessarily low-lifes: I'd wager many, many people would abuse such power if they could. The fact that there may be more of them does not change that they are low-lifes.
  - handedness 11y ago
    Sure, but then we wind up having to broadly categorize most people as low-lifes. Which may be true, but that's all the more reason to construct a system that can survive them, not a system that falls apart when representative human beings are part of it.
- sixothree 11y ago
  Lack of fear of penalties is likely why this happened in the first place. Regardless I should not have used the term low-lifes. I'm fairly sure it's not the appropriate kind of discourse for this place.
LogicX 11y ago
There are very few examples of punishment or loss of licensure related to HIPPA violations (at least the last time I looked into it, to calm my RN wife that she didn't violate HIPPA and even if she did, her life isn't over.)

tajen 11y ago

I'm interested to know how your system ensures that anyone accessing PII goes through the system. Don't sysadmins have full access to the db? When you are granted access, can you see the full table or just the row about this user?

Retric 11y ago
It's not that hard to keep all PII encrypted in the DB. Ideally, PII should only be decrypted inside your application. Though at a minimum https://en.wikipedia.org/wiki/Transparent_Data_Encryption https://en.wikipedia.org/wiki/Transparent_Data_Encryption should be used.

revelation 11y ago

Of course you do. They still don't know what Snowden has.