11 ms·
Correction: SSI sent a letter containing two unencrypted CDs containing CPR-numbers and health records for 5.28 residents in Danish municipals between 2010 and
by Svip 10y ago
Correction: SSI sent a letter containing two unencrypted CDs containing CPR-numbers and health records for 5.28 residents in Danish municipals between 2010 and 2012 to the Danish statistics agency (Statistics Denmark).
Post Danmark (postal service) accidentally delivered the letter to Chinese Visa Application Centre instead. When the employee responsible for receiving the letter noticed the mistake upon opening, the employee turned the letter with the two CDs to Statistics Denmark.
According to the employee's story, this was done immediately. And the investigation team says they have no reason to doubt the validity of her story.
To sum up: The investigation team believe that the Chinese Visa Application Centre never actually saw the contents on the CDs. SSI sent the data unencrypted, and the postal service delivered the letter to the wrong recipient.
Edit: Changed wording from blaming the postal service.
- throwanem 10y agoHow long does a modern machine need to copy off the contents of a couple of CDs? Were the discs in tamper-evident packages?
- Svip 10y agoNo long, I'd imagine. But again there is little to no way to figure out for sure whether the Chinese government has this information. The story really highlights the careless handling of data, because the chances of the Chinese government (or any other third part) getting access to these data is way too high.
- pilif 10y ago> But again there is little to no way to figure out for sure whether the Chinese government has this information assume they have it.
- seszett 10y agoLet's assume they have it. What kind of interest would you say the Chinese government has in the health records of a few million Danish residents? I don't know, maybe it's really important, but then maybe it's not that critical after all.
- throwanem 10y agoProbably none, but you don't stay a power in the modern world by turning up your nose at any kind of information that comes your way.
- deleted 10y ago[deleted]
- adrianratnapala 10y agoThey use it can track the movements of Chinese residents abroad, to blackmail Danes who are assisting Chinese disidents, run scams at doctors offices or insurers in order to get documentation for spies. I am sure there is more, I am no expert in this sort of thing.
- pilif 10y agoPlus identity theft to help spies assume a false identity when gathering information. And of course: Selling the health records to insurers in order to allow them to set prices for prospective customers. I'm sure insurance companies would pay nicely for this.
- vkou 10y agoI'm not Danish, but... 1. Denmark does not have a private health insurance market. 2. Any company even considering about doing this would be in a huge pot of boiling water, if the public, or the police got wind of it. Any above-board business would not want to touch lost/stolen health data with a ten-foot pole. In addition to the legalities of this, this opens a huge liability hole, in terms of keeping it secure.
- peteretep 10y ago
- Jach 10y agoAssume they had it already.
- mseebach 10y agoThat's the problem with blame culture. It needs to be someones (emphasis ONE) fault, and then anyone else can breathe a sigh of relief and move on. It's blatantly irresponsible that SSI even has the infrastructure to burn CDs with this information on it (it needs to live in heavily secured, jealously guarded and scrupulously audited (ideally airgapped) computer system). If they absolutely need this capability, it's blatantly irresponsible to let such a CD out of the care of trusted employees -- and if they absolutely need to post it, they need to heavily encrypt it. It's not meaningfully "the post service's fault".
- Svip 10y agoI apologise, that summary was inaccurate. But parent's wording seemed to indicate that the SSI had sent the letter to the wrong recipient when that was not the case. I wanted to clear that up. The problem is that SSI sent the data unencrypted.
- kwhitefoot 10y agoThe problem was that they sent it at all.
- digi_owl 10y agoLikely the capability exits for when someone moves to another part of the country, and the local doctor wants to check the new patient's medical history. Note also that the data was meant for what i assume is the national statistics office. Likely for investigating changes in danish public health over recent years. Unless by airgapped you mean to build a separate, free standing, network just for delivering medical records to doctor's offices around the nation.
- peteretep 10y agohttps://en.m.wikipedia.org/wiki/N3_(NHS) https://en.m.wikipedia.org/wiki/N3_(NHS)
- mseebach 10y agoFirst, this is not about doctors exchanging patients' medical histories, it's about two central government offices exchanging everybody's medical histories. Second, the fact that security is (really!) hard is not a valid argument against doing it. Third, there's a huge difference between the appropriate levels of security around individual patients' medical histories, a single doctors office worth of patients' data, and then the collective medical histories for every single patient in the nation.
- rasz_pl 10y agoWas postman of Chinese descent?
- zht 10y agowhy does it matter?
- busterarm 10y agoVirtually all spy agencies recruit foreign nationals to do their dirty work. Also your question has a 1 in 5 chance of the answer being "Yes".
- OJFord 10y ago> Also your question has a 1 in 5 chance of the answer being "Yes". Assuming a uniform distribution of postman nationality. If we go by the CS literature, postmen seem always to be Chinese. :)