13 ms·

Unencrypted patient medical information is being broadcast across Vancouver

265 points by gregmac 7y ago

Spastche 7y ago
this is pretty much every hospital in america too
- 13of40 7y ago
  Do you know that, or are you speculating? Edit: Huh, I guess you might be right. https://www.beckershospitalreview.com/cybersecurity/man-s-antenna-picks-up-phi-from-pagers-at-5-hospitals.html https://www.beckershospitalreview.com/cybersecurity/man-s-an... (2018)
  - dlgeek 7y ago
    I have absolutely seen this sort of thing in a major US city.
- JunkDNA 7y ago
  I believe many (most?) US hospitals have switched to secure paging services delivered via smartphone. HIPAA pretty much requires it.
  - hxjfbjxbbc 7y ago
    nope. bust out multimon-ng with an rtl-sdr and listen on 929.625 give or take a few 12.5khz channels, and you will see a ton of PHI.
    - Herodotus38 7y ago
      What kind of PHI are you getting? Is it from first responders or hospital sources?
      - kitteh 7y ago
        Hospital staff. Patient names, hospital record numbers, medication names, dosage amounts, detailed descriptions of their issues (which can be graphic).
        Herodotus38 7y ago
        Interesting. Are you getting this information using the same method as the parent user I asked?
    - xxpor 7y ago
      In the seattle area, there's still a ton of hospital POCSAG traffic, but no PHI as far as I can tell. Its usually stuff like "go to room 314" or "call 206-blah-blah"
      - kitteh 7y ago
        As of a few minutes ago there is still PHI going out in the air. And this is in Seattle.
        xxpor 7y ago
        Which frequency were you listening to? I know there's a few different ones.
- deleted 7y ago
  [deleted]
dredmorbius 7y ago
Sarah Jamie Lewis's Twitter thread (unrolled): https://threadreaderapp.com/thread/1171148964264992768.html https://threadreaderapp.com/thread/1171148964264992768.html
throw0101a 7y ago
Going over the timeline, I find these things very odd: > 2018-11-12: Sarah Jamie Lewis reaches out to Vancouver Coastal Health Privacy Office (VCH-P) with information about the breach. > 2019-03-04: Sarah Jamie Lewis meets with two journalists and demonstrates the pager breach. This meeting was not recorded and this meeting is never followed up on. > 2019-07-23: During an interview with journalist Francesca Fionda, on Open Privacy’s research into Swiss election systems, Sarah Jamie Lewis discusses the pager breach. [...] > 2019-08-15: Sarah Jamie Lewis reaches out to the Office of the Information and Privacy Commissioner for B.C. (OIPC), offering to help aid any investigation they wish to undertake in regards to this data breach. They waited nine months before contacting the provincial Privacy Commissioner? They contacted journalists before the OIPC? * https://www.oipc.bc.ca https://www.oipc.bc.ca
- Deimorz 7y ago
  From Twitter (https://twitter.com/SarahJamieLewis/status/1171202699888492544 https://twitter.com/SarahJamieLewis/status/11712026998884925...): > I've been asked why there are some big gaps in the timeline early this year, and that was mostly because I was working on the research around the cryptographic flaws in the Swiss evoting system. We get a lot done at @OpenPriv but we are limited!
- sarahjamielewis 7y ago
  There is no official way for 3rd parties to make breach reports to OIPC-BC (nor is there a legal requirement for VCH to report to them) - it was only after Francesca raised the issue during a meeting with the commissioner(regarding breaches in general) we were informed they would be interested in this, and were given an avenue to contact them in a way that an investigation might be authorized.
bigiain 7y ago
I saw Balint Seeber give a fascinating talk about discovering the use of unencrypted pagers in hospitals, with messages full of personal information available too anyone with an SDR (and his particular brand of persistence to work out how to discover the modulation/encoding to get the text out.) It's mentioned in passing in this talk description from 2011: https://2011.ruxcon.org.au/2011-talks/all-your-rfz-belong-to-me-hacking-the-wireless-world-with-gnu-radio/ https://2011.ruxcon.org.au/2011-talks/all-your-rfz-belong-to... " ... and security-through-obscurity in hospital pager systems." I'm 99% certain I saw him give that talk at Dorkbot in Sydney, which make it maybe 5 or more years earlier than that...
- myself248 7y ago
  "discovering" is an odd word to use there. I'd say "noticing". PDW has been going since 2003 and I only mention it because I can't remember the name of the DOS software that preceded it... https://www.discriminator.nl/pdw/index-en.html https://www.discriminator.nl/pdw/index-en.html
  - bigiain 7y ago
    I only worded it like that because of the way he described his long and often unfruitful efforts over several years before he finally hit upon the right keywords and documentation to describe what he was seeing over the air...
    - myself248 7y ago
      That's a confusion born of not spending enough time hanging out with sneaky folks doing shady shit. I remember that in the 90s, the local PD had learned that some folks would listen to scanner traffic to figure out when their rowdy parties were going to be broken up, so everyone could hide and make the scene look calm by the time officers arrived. So they stopped using voice radios for this sort of call, and instead switched to their Mobile Data Terminals. Which was even better, because MDTMON had an alert feature where it'd sound the PC speaker when your keywords (say, your street name) showed up in the decoded traffic. That freed up one partygoer from scanner duty! POCSAG/FLEX were even more of a treasure trove, but that's a story for another day.
hxjfbjxbbc 7y ago
rtlsdr + gqrx + multimon-ng pole around 929.600mhz and you'll eventually find a shitload of phi in most metro areas. you'll probably also find a ton of industrial traffic, and the occasional weather and sports scores. it's also not far fetched to think it's used as a means to broadcast to/from field operatives. most pager lines offer an smtp gateway, so a bit of "spam" could have a intended recipient anywhere in the region, or possibly country based on network.
- phonethrowaway 7y ago
  https://en.m.wikipedia.org/wiki/POCSAG https://en.m.wikipedia.org/wiki/POCSAG
- DrAwdeOccarim 7y ago
  I was just about to buy an SDR rig to play around with, so the timing of your comment is wonderful. I have been looking off and on for a year now and there are just too many choices. I have my tech license, but then I had two kids and haven't been able to go for general yet. I've been bored not getting on HF, which is where I hear all the "action" is. So what SDR would you recommend I get if I also wanted the ability to transmit HF one day?
  - jrockway 7y ago
    I don't think it's economic to buy an SDR rig with the intention of maybe transmitting on HF one day. Most HF digital modes are audio-jack based, meaning that you connect any radio, particularly a used one that you can get cheaply on eBay, to your computer via a line-in/line-out connection. You do not need any fancy SDR stuff going on; popular digital modes like FT8 put the entire band in the space of one normal voice conversation. So no special equipment whatsoever is necessary to use digital modes. One time I had my audio misconfigured to use my microphone instead of the line-in, and I had my radio disconnected from the computer to tune the antenna. As I was listening through the radio's built-in speaker, my computer properly decoded a number of FT8 transmissions... through the microphone. You really don't need anything expensive or interesting to do SDR stuff on the HF bands. People that buy the "real" ham SDRs are doing things like contesting, where they really need to see entire bands, or even multiple bands, at once. And they're paying over $10,000 for that. The cheap "hacker" SDRs are largely inadequate for ham work. They are OK, but not great. They don't have proper frontends, so transmit a lot of out-of-band garbage. They don't have niceties like an antenna matching network, or even a power amplifier. I have a KX3 which has a maximum transmit power of 12W. But these hobbyist boards will max out in the mW range. It is adequate for some digital modes, but even then, it's pretty low. I typically run FT8 at 1-3W. So generally, would not recommend these for someone new to the hobby. Buy an RTL-SDR stick for $20. Listen to some stuff. When you get bored, find a proper HF radio in the $300 range and use that. If you then decide you want to spend $10,000 on the hobby, then you can start looking into the SDRs ;)
motohagiography 7y ago
Key management between emergency services remains a hard problem. Paramedics often don't have hands free to type information into a terminal, so they use radio, which means keying their handsets, and then classifying the keys for different security levels. e.g if you need to talk to SWAT and other teams, you are going to need a separate channel and key. Police have an interesting case with that as well, where techs that use or distract their hands during stops are a safety issue. Military communications for a given mission are mainly all in the same security domain so key management is relatively easy. Co-ordinating key management for daily use between police forces, ambulance services, hospitals, fire stations, and other responders is non-trivial. I do suspect the best possible privacy solution would be a regulation that made personal and health information acquired without explicit consent inadmissible in a civil court case, regulatory tribunal, or other government process, and heavy fines for using it for insurance and credit and licensing other decisions by regulated/protected businesses. Not so much GDPR regs, but just removing legal leverage from the data. We still need technical security and privacy controls, but creating legal liability for the people who hold and exploit it is the real solution. Agencies can't hide behind, "machine learning," and "random checks," for targeting people. There will be some hard cases, but if you use PII/PHI without explicit informed consent and collection, use and disclosure for specific purposes, you should be handicapped legally, imo.
- tonyarkles 7y ago
  I upvoted you, but want you to consider how there can be dramatically worse bad actors than the government or legitimate companies (the insurance/credit/licensing stuff you mention): people end up in the hospital sometimes because someone else wants to hurt them. Simple example: spousal/partner abuse. More extreme but easily plausible in Vancouver: gang violence. If I failed at a hit, and I can watch the POCSAG traffic and see the that the guy I tried to take out is in a coma (and not dead), and is in room 404 at Vancouver General Hospital, that's very valuable information.
  - Scoundreller 7y ago
    I've found with most hospitals that finding out a patient's location is as simple as asking. Maybe some people get identified as "VIPs" and it's not so easy. Dunno if every random gun-shot victim makes that, but if your "hit" was more an "accidental" car wreck, you can probably ask and find out where they are.
smudgymcscmudge 7y ago
> VCH was unaware of the radio broadcasting component of the pager system(s) in question until several weeks ago I’d like to know how they think pagers operate.
- timeimp 7y ago
  Like this: https://media.giphy.com/media/12NUbkX6p4xOO4/giphy.gif https://media.giphy.com/media/12NUbkX6p4xOO4/giphy.gif
- dmix 7y ago
  Hopefully the privacy commissioner is aware of this stuff works as well
th0ma5 7y ago
I had read, and maybe I'm misguided, that the law in the US was that you could listen to this stuff as an experiment with your amateur radio license and mess around with all the decoding you wanted... It was just illegal to disclose to anyone anything you heard or read. Actually I don't think the amateur license may have had much to do with it at all, but anyway... I played with it for a minute and mostly saw automated messages about housekeeping needs, but I did occasionally see names, some kind of ID number but I don't think it was a SSN, and sometimes little "love you" notes and quite a lot of "please call me back". I got pretty bored with it pretty quickly that day.
- JshWright 7y ago
  > you could listen to this stuff as an experiment with your amateur radio license A license is only required to transmit. There is no license required to receive (how would that work, anyway?).
  - msla 7y ago
    > There is no license required to receive (how would that work, anyway?). By prosecuting anyone who receives without a license. Laws are often passed without regard for how enforceable they are.
  - lsaferite 7y ago
    > how would that work, anyway? https://en.wikipedia.org/wiki/Television_licence https://en.wikipedia.org/wiki/Television_licence Ask all of those countries.
  - lostlogin 7y ago
    When I was young an inspector came to the door to see if we had a tv, as we had no licence. A parent said to the inspector that yes, we did, but it’s unused and boxed in a spare room. They came in and inspected it and put a bag over the power cable and taped it on. Solved. This was 1980s New Zealand.
- jlgaddis 7y ago
  The only thing I can think of that sounds even remotely close to what you're describing is when Congress made it illegal [0] to listen in on cellular phone calls a few decades ago but, notable, pager traffic was specifically excluded from the law. Until listening to cellular calls was made illegal, it had always been legal (AFAIK) to receive any transmissions on any frequency (the reasoning was that the signal was being broadcasted into, e.g., your home). [0]: https://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act https://en.wikipedia.org/wiki/Electronic_Communications_Priv...
Herodotus38 7y ago
I'm a hospitalist (internal medicine employed by a hospital). I'm fairly certain that what they are intercepting are pages from the ER to admitting or consulting physicians. In the US, this would be a HIPAA violation but I'm not sure of the Canadian law. We still use pages at my hospital, but no PHI, only room numbers in the ER for admissions are paged and then you log into the EMR. We use HIPAA compliant texting apps to communicate PHI.
- marcolussetti 7y ago
  Under BC Law, it would strike me as a FIPPA violation, but it's a bit more complicated.
- jhart99 7y ago
  What about communications between the ambulance and the receiving ER? Those are unencrypted digital voice here in San Diego. I've heard names, DOBs, medical histories etc being blasted out over their repeater.
  - _r2h 7y ago
    HIPAA allows us (I'm a medic) to broadcast patient information for treatment related purposes. It's useful for us and hospitals because they can pre-register time sensitive patients and pull up history/previous test that can be extremely important for STEMIs/strokes/etc.
    - 420codebro 7y ago
      I understand your point but I would prefer an end to end crypto system to protect said data.
- blaisio 7y ago
  HIPAA is such an awesome law. I have to work with it daily as an engineer, and I'm continually amazed that the US government requires so much security. Normally the US is extremely hands off when it comes to privacy and security. Congress almost never passes laws that have such far reaching scope. And HIPAA actually has teeth, with significant penalties for companies who don't comply (and of course people can sue as well over the violation). I think aspects of it could definitely be improved. I see HIPAA violations at doctor's offices all the time - but they are usually still fairly minor, and doctors and nurses grow concerned quickly as soon as you mention a possible violation.
Scoundreller 7y ago
Pagers are great. They're a lot more resilient than the cell phone network, especially if there's a mass disaster. They tend to work better in basements or deep in buildings. They don't get annoying amber alerts (important in Canada where they're all sent as Presidential/ICBM), constant "IRS" or "Dell" call spam from your area+exchange code (ie: lookalike numbers that seem internal to your hospital) or SMS spam. These are excellent features if you're on-call, but must respond to anything.
- t34543 7y ago
  One way pagers are also privacy friendly - base stations are not aware of your location.
endymi0n 7y ago
While the findings are solid and the denial is despicable corpspeak, I fear the data is still way safer this way than letting the same kind of contractors build a "secure" app and then finding all that data neatly ordered in an open S3 bucket or MongoDB a year later. Nobody‘s gonna put up an antenna over years collecting all this noisy stuff. On top, my condolences for the hospital IT staff having to exchange thousands of real pagers with real doctors, and train them again over the course of several months, all for a pretty synthetic finding that took them a couple of hours. Builders vs. breakers all again... Well, you got your attention, guys.
- Uhrheber 7y ago
  > Nobody‘s gonna put up an antenna over years collecting all this noisy stuff What do you think all the antennas on embassy buildings are for?
- jimktrains2 7y ago
  > Nobody‘s gonna put up an antenna over years collecting all this noisy stuff. I think you misjudged how interested in radio some people can be. People do this to ADS-B (airplane location) all the time.
noodlesUK 7y ago
In my part of the US, I can overhear loads of PII by just tuning my VHF transceiver to various public safety frequencies. I hear drivers license numbers, medical info, all sorts. I hesitate to think that there’s a better alternative though. I’m terrified that the UK is moving to LTE rather than the current trunked radio. The amount of damage caused by comms failing in a major emergency (or even just dead zones) massively outweighs the risk of a little data loss at present. If there are more reliable communication methods that preserve privacy, then we should be using them, but I’m not sure they exist at the moment. edit: to be fair, it should be possible to encrypt some of the traffic, but things should fail open, not closed, or people will die.
- tinus_hn 7y ago
  Meanwhile the rest of the world has moved on to digital, encrypted communication. Mobile phones continue to work during a disaster as long as the base station batteries hold out and that’s with cheap base stations serving very large amounts of idiot users using the cheapest of the cheap handsets limited by regulations. Why wouldn’t you be able to make this work indefinitely with a limited amount of trained users using selected, powerful expensive handsets. In other words, a bunch of poor excuses made by coincidentally those same people who love to profess that privacy doesn’t matter as long as it’s someone else’s privacy.
  - chooseaname 7y ago
    > Mobile phones continue to work during a disaster ... Except when you go over your Verizon bandwidth limit.
    - MichaelApproved 7y ago
      That's for data. This conversation is about voice communication.
      - zaroth 7y ago
        This is in reference to a specific incident last year where fire fighters operations were impacted because their service plan inadvertently was setup with a monthly limit. https://arstechnica.com/tech-policy/2018/08/verizon-throttled-fire-departments-unlimited-data-during-calif-wildfire/ https://arstechnica.com/tech-policy/2018/08/verizon-throttle...
Uhrheber 7y ago
"didn’t seem to rely on any radio connection" What did they think it relies on? Fairy dust?
trishmapow2 7y ago
Happens in Australia too, probably the easiest signals to find (i.e. strongest) using my $10 RTL-SDR besides broadcast FM. Plenty of names, emails, addresses, phone numbers, medical conditions, security alarms being triggered etc. Other interesting finds are SCADA messages, some from Pizza Hut etc. Regulations here allow reception as long as you don't take any action based on what you receive so that's nice.
Jonahgay 7y ago
bruh, that sucks
anfilt 7y ago
I am not too surprised. A lot of emergency services use analog radio. Pretty much works with all radios, and no setup before hand unlike with encrypted radio. No need to negotiate things with other agencies either.
raxxorrax 7y ago
I wonder how much security issues relate to the data formats that are often used to exchange medical information. I believe northern American nations mostly use HL7, while European countries tend to prefer Dicom. HL7 was around since 1987, while Dicom is older than TCP/IP I believe. I think requirements for data exchange fundamentally changed in the last 30 years and at least Dicom is just horrible to handle. True, you could upgrade it with putting everything in a crypt container, but that is just a quick fix. This is a case where I fully support software engineers that say that we need to fully reimplement these formats. It is good to have standards here, but many manufacturers of medical devices have their own proprietary adaptations anyway. It shouldn't mean to throw everything learned from these formats away. Just maybe it should all be reevaluated.
- criley2 7y ago
  HL7 is just text, if you're not sending it over SSL then it's arguably easier to decipher than a simple webpage when looking through the packets! The current thing is called FHIR though and instead of sending text HL7v2 messages directly to a port over SSL now we can use a web service, HTTPS, and exchange JSON messages.
  - raxxorrax 7y ago
    Oh really? I always thought it would mainly be an image container like Dicom, which is in practice abused to exchange text just as well. Haven't had the pleasure to work with HL7, I was just tormented by Dicom and have always been told that HL7 is just the American version of it.
    - criley2 7y ago
      All of my legacy interfaces for an EHR vendor are HL7v2 based. It's pretty simple to work with but our lack of external libraries leaves me tinkering with opening ports and reading data manually too much. The beginning of a HL7 (2.4) message with the header and patient ID node might look like this (this example looks like an ORU^R01 inbound lab result) MSH|^~\&|GHH LAB|ELAB-3|GHH OE|BLDG4|200202150930||ORU^R01|CNTRL-3456|P|2.4 PID|||555-44-4444||EVERYWOMAN^EVE^E^^^^L|JONES|19620320|F|||153 FERNWOOD DR.^^STATESVILLE^OH^35292||(206)3345232|(206)752-121||||AC555444444||67-A4335^OH^20030520 Just a list of offsets using |^~\& seperators sent directly over a port. The JSON/FHIR versions are nicer even if they are more verbose.
pgkyc 7y ago
A few notes: * In Canada, we have jurisdictional privacy law. In this case BC FIPPA. This is different than in the US where the few privacy laws that exist are mostly sectoral, such as health (HIPPA). https://www.oipc.bc.ca/guidance-documents/1466 https://www.oipc.bc.ca/guidance-documents/1466 * In Canada, only only one party has to agree to agree to record a telephone conversation. * In Canada, it is not illegal to have a scanner and listen to phone calls even, hence the need to encrypt them faster up here. POGSAC decoding was done in the middle of the 90s with my local #2600 group. It even easier now with RTL-SDR. https://twitter.com/cqwww/status/1171113297011019781 https://twitter.com/cqwww/status/1171113297011019781 * I've been in two states of emergency in my life. Cell phone switches go down in minutes. You want to have your amateur radio licence, an amateur radio, and battery, on standby for when this happens. Practice setting up a data connection to is, as the internet goes away quickly as well. Get your ham radio licence, it's free, and you have your call sign for life. It's a nerdy thing to have except in an emergency, where you quickly turn to hero if you're the only person in your area capable of communicating with emergency services.
beaugunderson 7y ago
Happening in the majority of the hospitals in Seattle as well.

265 points by gregmac 7y ago

Spastche 7y ago

this is pretty much every hospital in america too

13of40 7y ago
Do you know that, or are you speculating? Edit: Huh, I guess you might be right. https://www.beckershospitalreview.com/cybersecurity/man-s-antenna-picks-up-phi-from-pagers-at-5-hospitals.html https://www.beckershospitalreview.com/cybersecurity/man-s-an... (2018)
- dlgeek 7y ago
  I have absolutely seen this sort of thing in a major US city.
JunkDNA 7y ago
I believe many (most?) US hospitals have switched to secure paging services delivered via smartphone. HIPAA pretty much requires it.
- hxjfbjxbbc 7y ago
  nope. bust out multimon-ng with an rtl-sdr and listen on 929.625 give or take a few 12.5khz channels, and you will see a ton of PHI.
  - Herodotus38 7y ago
    What kind of PHI are you getting? Is it from first responders or hospital sources?
    - kitteh 7y ago
      Hospital staff. Patient names, hospital record numbers, medication names, dosage amounts, detailed descriptions of their issues (which can be graphic).
      - Herodotus38 7y ago
        Interesting. Are you getting this information using the same method as the parent user I asked?
  - xxpor 7y ago
    In the seattle area, there's still a ton of hospital POCSAG traffic, but no PHI as far as I can tell. Its usually stuff like "go to room 314" or "call 206-blah-blah"
    - kitteh 7y ago
      As of a few minutes ago there is still PHI going out in the air. And this is in Seattle.
      - xxpor 7y ago
        Which frequency were you listening to? I know there's a few different ones.
deleted 7y ago
[deleted]

dredmorbius 7y ago

Sarah Jamie Lewis's Twitter thread (unrolled): https://threadreaderapp.com/thread/1171148964264992768.html https://threadreaderapp.com/thread/1171148964264992768.html

throw0101a 7y ago

Going over the timeline, I find these things very odd: > 2018-11-12: Sarah Jamie Lewis reaches out to Vancouver Coastal Health Privacy Office (VCH-P) with information about the breach. > 2019-03-04: Sarah Jamie Lewis meets with two journalists and demonstrates the pager breach. This meeting was not recorded and this meeting is never followed up on. > 2019-07-23: During an interview with journalist Francesca Fionda, on Open Privacy’s research into Swiss election systems, Sarah Jamie Lewis discusses the pager breach. [...] > 2019-08-15: Sarah Jamie Lewis reaches out to the Office of the Information and Privacy Commissioner for B.C. (OIPC), offering to help aid any investigation they wish to undertake in regards to this data breach. They waited nine months before contacting the provincial Privacy Commissioner? They contacted journalists before the OIPC? * https://www.oipc.bc.ca https://www.oipc.bc.ca

Deimorz 7y ago
From Twitter (https://twitter.com/SarahJamieLewis/status/1171202699888492544 https://twitter.com/SarahJamieLewis/status/11712026998884925...): > I've been asked why there are some big gaps in the timeline early this year, and that was mostly because I was working on the research around the cryptographic flaws in the Swiss evoting system. We get a lot done at @OpenPriv but we are limited!
sarahjamielewis 7y ago
There is no official way for 3rd parties to make breach reports to OIPC-BC (nor is there a legal requirement for VCH to report to them) - it was only after Francesca raised the issue during a meeting with the commissioner(regarding breaches in general) we were informed they would be interested in this, and were given an avenue to contact them in a way that an investigation might be authorized.

bigiain 7y ago

I saw Balint Seeber give a fascinating talk about discovering the use of unencrypted pagers in hospitals, with messages full of personal information available too anyone with an SDR (and his particular brand of persistence to work out how to discover the modulation/encoding to get the text out.) It's mentioned in passing in this talk description from 2011: https://2011.ruxcon.org.au/2011-talks/all-your-rfz-belong-to-me-hacking-the-wireless-world-with-gnu-radio/ https://2011.ruxcon.org.au/2011-talks/all-your-rfz-belong-to... " ... and security-through-obscurity in hospital pager systems." I'm 99% certain I saw him give that talk at Dorkbot in Sydney, which make it maybe 5 or more years earlier than that...

myself248 7y ago
"discovering" is an odd word to use there. I'd say "noticing". PDW has been going since 2003 and I only mention it because I can't remember the name of the DOS software that preceded it... https://www.discriminator.nl/pdw/index-en.html https://www.discriminator.nl/pdw/index-en.html
- bigiain 7y ago
  I only worded it like that because of the way he described his long and often unfruitful efforts over several years before he finally hit upon the right keywords and documentation to describe what he was seeing over the air...
  - myself248 7y ago
    That's a confusion born of not spending enough time hanging out with sneaky folks doing shady shit. I remember that in the 90s, the local PD had learned that some folks would listen to scanner traffic to figure out when their rowdy parties were going to be broken up, so everyone could hide and make the scene look calm by the time officers arrived. So they stopped using voice radios for this sort of call, and instead switched to their Mobile Data Terminals. Which was even better, because MDTMON had an alert feature where it'd sound the PC speaker when your keywords (say, your street name) showed up in the decoded traffic. That freed up one partygoer from scanner duty! POCSAG/FLEX were even more of a treasure trove, but that's a story for another day.

hxjfbjxbbc 7y ago

rtlsdr + gqrx + multimon-ng pole around 929.600mhz and you'll eventually find a shitload of phi in most metro areas. you'll probably also find a ton of industrial traffic, and the occasional weather and sports scores. it's also not far fetched to think it's used as a means to broadcast to/from field operatives. most pager lines offer an smtp gateway, so a bit of "spam" could have a intended recipient anywhere in the region, or possibly country based on network.

phonethrowaway 7y ago
https://en.m.wikipedia.org/wiki/POCSAG https://en.m.wikipedia.org/wiki/POCSAG
DrAwdeOccarim 7y ago
I was just about to buy an SDR rig to play around with, so the timing of your comment is wonderful. I have been looking off and on for a year now and there are just too many choices. I have my tech license, but then I had two kids and haven't been able to go for general yet. I've been bored not getting on HF, which is where I hear all the "action" is. So what SDR would you recommend I get if I also wanted the ability to transmit HF one day?
- jrockway 7y ago
  I don't think it's economic to buy an SDR rig with the intention of maybe transmitting on HF one day. Most HF digital modes are audio-jack based, meaning that you connect any radio, particularly a used one that you can get cheaply on eBay, to your computer via a line-in/line-out connection. You do not need any fancy SDR stuff going on; popular digital modes like FT8 put the entire band in the space of one normal voice conversation. So no special equipment whatsoever is necessary to use digital modes. One time I had my audio misconfigured to use my microphone instead of the line-in, and I had my radio disconnected from the computer to tune the antenna. As I was listening through the radio's built-in speaker, my computer properly decoded a number of FT8 transmissions... through the microphone. You really don't need anything expensive or interesting to do SDR stuff on the HF bands. People that buy the "real" ham SDRs are doing things like contesting, where they really need to see entire bands, or even multiple bands, at once. And they're paying over $10,000 for that. The cheap "hacker" SDRs are largely inadequate for ham work. They are OK, but not great. They don't have proper frontends, so transmit a lot of out-of-band garbage. They don't have niceties like an antenna matching network, or even a power amplifier. I have a KX3 which has a maximum transmit power of 12W. But these hobbyist boards will max out in the mW range. It is adequate for some digital modes, but even then, it's pretty low. I typically run FT8 at 1-3W. So generally, would not recommend these for someone new to the hobby. Buy an RTL-SDR stick for $20. Listen to some stuff. When you get bored, find a proper HF radio in the $300 range and use that. If you then decide you want to spend $10,000 on the hobby, then you can start looking into the SDRs ;)

motohagiography 7y ago

Key management between emergency services remains a hard problem. Paramedics often don't have hands free to type information into a terminal, so they use radio, which means keying their handsets, and then classifying the keys for different security levels. e.g if you need to talk to SWAT and other teams, you are going to need a separate channel and key. Police have an interesting case with that as well, where techs that use or distract their hands during stops are a safety issue. Military communications for a given mission are mainly all in the same security domain so key management is relatively easy. Co-ordinating key management for daily use between police forces, ambulance services, hospitals, fire stations, and other responders is non-trivial. I do suspect the best possible privacy solution would be a regulation that made personal and health information acquired without explicit consent inadmissible in a civil court case, regulatory tribunal, or other government process, and heavy fines for using it for insurance and credit and licensing other decisions by regulated/protected businesses. Not so much GDPR regs, but just removing legal leverage from the data. We still need technical security and privacy controls, but creating legal liability for the people who hold and exploit it is the real solution. Agencies can't hide behind, "machine learning," and "random checks," for targeting people. There will be some hard cases, but if you use PII/PHI without explicit informed consent and collection, use and disclosure for specific purposes, you should be handicapped legally, imo.

tonyarkles 7y ago
I upvoted you, but want you to consider how there can be dramatically worse bad actors than the government or legitimate companies (the insurance/credit/licensing stuff you mention): people end up in the hospital sometimes because someone else wants to hurt them. Simple example: spousal/partner abuse. More extreme but easily plausible in Vancouver: gang violence. If I failed at a hit, and I can watch the POCSAG traffic and see the that the guy I tried to take out is in a coma (and not dead), and is in room 404 at Vancouver General Hospital, that's very valuable information.
- Scoundreller 7y ago
  I've found with most hospitals that finding out a patient's location is as simple as asking. Maybe some people get identified as "VIPs" and it's not so easy. Dunno if every random gun-shot victim makes that, but if your "hit" was more an "accidental" car wreck, you can probably ask and find out where they are.

smudgymcscmudge 7y ago

> VCH was unaware of the radio broadcasting component of the pager system(s) in question until several weeks ago I’d like to know how they think pagers operate.

timeimp 7y ago
Like this: https://media.giphy.com/media/12NUbkX6p4xOO4/giphy.gif https://media.giphy.com/media/12NUbkX6p4xOO4/giphy.gif
dmix 7y ago
Hopefully the privacy commissioner is aware of this stuff works as well

th0ma5 7y ago

I had read, and maybe I'm misguided, that the law in the US was that you could listen to this stuff as an experiment with your amateur radio license and mess around with all the decoding you wanted... It was just illegal to disclose to anyone anything you heard or read. Actually I don't think the amateur license may have had much to do with it at all, but anyway... I played with it for a minute and mostly saw automated messages about housekeeping needs, but I did occasionally see names, some kind of ID number but I don't think it was a SSN, and sometimes little "love you" notes and quite a lot of "please call me back". I got pretty bored with it pretty quickly that day.

JshWright 7y ago
> you could listen to this stuff as an experiment with your amateur radio license A license is only required to transmit. There is no license required to receive (how would that work, anyway?).
- msla 7y ago
  > There is no license required to receive (how would that work, anyway?). By prosecuting anyone who receives without a license. Laws are often passed without regard for how enforceable they are.
- lsaferite 7y ago
  > how would that work, anyway? https://en.wikipedia.org/wiki/Television_licence https://en.wikipedia.org/wiki/Television_licence Ask all of those countries.
- lostlogin 7y ago
  When I was young an inspector came to the door to see if we had a tv, as we had no licence. A parent said to the inspector that yes, we did, but it’s unused and boxed in a spare room. They came in and inspected it and put a bag over the power cable and taped it on. Solved. This was 1980s New Zealand.
jlgaddis 7y ago
The only thing I can think of that sounds even remotely close to what you're describing is when Congress made it illegal [0] to listen in on cellular phone calls a few decades ago but, notable, pager traffic was specifically excluded from the law. Until listening to cellular calls was made illegal, it had always been legal (AFAIK) to receive any transmissions on any frequency (the reasoning was that the signal was being broadcasted into, e.g., your home). [0]: https://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act https://en.wikipedia.org/wiki/Electronic_Communications_Priv...

Herodotus38 7y ago

I'm a hospitalist (internal medicine employed by a hospital). I'm fairly certain that what they are intercepting are pages from the ER to admitting or consulting physicians. In the US, this would be a HIPAA violation but I'm not sure of the Canadian law. We still use pages at my hospital, but no PHI, only room numbers in the ER for admissions are paged and then you log into the EMR. We use HIPAA compliant texting apps to communicate PHI.

marcolussetti 7y ago
Under BC Law, it would strike me as a FIPPA violation, but it's a bit more complicated.
jhart99 7y ago
What about communications between the ambulance and the receiving ER? Those are unencrypted digital voice here in San Diego. I've heard names, DOBs, medical histories etc being blasted out over their repeater.
- _r2h 7y ago
  HIPAA allows us (I'm a medic) to broadcast patient information for treatment related purposes. It's useful for us and hospitals because they can pre-register time sensitive patients and pull up history/previous test that can be extremely important for STEMIs/strokes/etc.
  - 420codebro 7y ago
    I understand your point but I would prefer an end to end crypto system to protect said data.
blaisio 7y ago
HIPAA is such an awesome law. I have to work with it daily as an engineer, and I'm continually amazed that the US government requires so much security. Normally the US is extremely hands off when it comes to privacy and security. Congress almost never passes laws that have such far reaching scope. And HIPAA actually has teeth, with significant penalties for companies who don't comply (and of course people can sue as well over the violation). I think aspects of it could definitely be improved. I see HIPAA violations at doctor's offices all the time - but they are usually still fairly minor, and doctors and nurses grow concerned quickly as soon as you mention a possible violation.

Scoundreller 7y ago

Pagers are great. They're a lot more resilient than the cell phone network, especially if there's a mass disaster. They tend to work better in basements or deep in buildings. They don't get annoying amber alerts (important in Canada where they're all sent as Presidential/ICBM), constant "IRS" or "Dell" call spam from your area+exchange code (ie: lookalike numbers that seem internal to your hospital) or SMS spam. These are excellent features if you're on-call, but must respond to anything.

t34543 7y ago
One way pagers are also privacy friendly - base stations are not aware of your location.

endymi0n 7y ago

While the findings are solid and the denial is despicable corpspeak, I fear the data is still way safer this way than letting the same kind of contractors build a "secure" app and then finding all that data neatly ordered in an open S3 bucket or MongoDB a year later. Nobody‘s gonna put up an antenna over years collecting all this noisy stuff. On top, my condolences for the hospital IT staff having to exchange thousands of real pagers with real doctors, and train them again over the course of several months, all for a pretty synthetic finding that took them a couple of hours. Builders vs. breakers all again... Well, you got your attention, guys.

Uhrheber 7y ago
> Nobody‘s gonna put up an antenna over years collecting all this noisy stuff What do you think all the antennas on embassy buildings are for?
jimktrains2 7y ago
> Nobody‘s gonna put up an antenna over years collecting all this noisy stuff. I think you misjudged how interested in radio some people can be. People do this to ADS-B (airplane location) all the time.

noodlesUK 7y ago

In my part of the US, I can overhear loads of PII by just tuning my VHF transceiver to various public safety frequencies. I hear drivers license numbers, medical info, all sorts. I hesitate to think that there’s a better alternative though. I’m terrified that the UK is moving to LTE rather than the current trunked radio. The amount of damage caused by comms failing in a major emergency (or even just dead zones) massively outweighs the risk of a little data loss at present. If there are more reliable communication methods that preserve privacy, then we should be using them, but I’m not sure they exist at the moment. edit: to be fair, it should be possible to encrypt some of the traffic, but things should fail open, not closed, or people will die.

tinus_hn 7y ago
Meanwhile the rest of the world has moved on to digital, encrypted communication. Mobile phones continue to work during a disaster as long as the base station batteries hold out and that’s with cheap base stations serving very large amounts of idiot users using the cheapest of the cheap handsets limited by regulations. Why wouldn’t you be able to make this work indefinitely with a limited amount of trained users using selected, powerful expensive handsets. In other words, a bunch of poor excuses made by coincidentally those same people who love to profess that privacy doesn’t matter as long as it’s someone else’s privacy.
- chooseaname 7y ago
  > Mobile phones continue to work during a disaster ... Except when you go over your Verizon bandwidth limit.
  - MichaelApproved 7y ago
    That's for data. This conversation is about voice communication.
    - zaroth 7y ago
      This is in reference to a specific incident last year where fire fighters operations were impacted because their service plan inadvertently was setup with a monthly limit. https://arstechnica.com/tech-policy/2018/08/verizon-throttled-fire-departments-unlimited-data-during-calif-wildfire/ https://arstechnica.com/tech-policy/2018/08/verizon-throttle...

Uhrheber 7y ago

"didn’t seem to rely on any radio connection" What did they think it relies on? Fairy dust?

trishmapow2 7y ago

Happens in Australia too, probably the easiest signals to find (i.e. strongest) using my $10 RTL-SDR besides broadcast FM. Plenty of names, emails, addresses, phone numbers, medical conditions, security alarms being triggered etc. Other interesting finds are SCADA messages, some from Pizza Hut etc. Regulations here allow reception as long as you don't take any action based on what you receive so that's nice.

Jonahgay 7y ago

bruh, that sucks

anfilt 7y ago

I am not too surprised. A lot of emergency services use analog radio. Pretty much works with all radios, and no setup before hand unlike with encrypted radio. No need to negotiate things with other agencies either.

raxxorrax 7y ago

I wonder how much security issues relate to the data formats that are often used to exchange medical information. I believe northern American nations mostly use HL7, while European countries tend to prefer Dicom. HL7 was around since 1987, while Dicom is older than TCP/IP I believe. I think requirements for data exchange fundamentally changed in the last 30 years and at least Dicom is just horrible to handle. True, you could upgrade it with putting everything in a crypt container, but that is just a quick fix. This is a case where I fully support software engineers that say that we need to fully reimplement these formats. It is good to have standards here, but many manufacturers of medical devices have their own proprietary adaptations anyway. It shouldn't mean to throw everything learned from these formats away. Just maybe it should all be reevaluated.

criley2 7y ago
HL7 is just text, if you're not sending it over SSL then it's arguably easier to decipher than a simple webpage when looking through the packets! The current thing is called FHIR though and instead of sending text HL7v2 messages directly to a port over SSL now we can use a web service, HTTPS, and exchange JSON messages.
- raxxorrax 7y ago
  Oh really? I always thought it would mainly be an image container like Dicom, which is in practice abused to exchange text just as well. Haven't had the pleasure to work with HL7, I was just tormented by Dicom and have always been told that HL7 is just the American version of it.
  - criley2 7y ago
    All of my legacy interfaces for an EHR vendor are HL7v2 based. It's pretty simple to work with but our lack of external libraries leaves me tinkering with opening ports and reading data manually too much. The beginning of a HL7 (2.4) message with the header and patient ID node might look like this (this example looks like an ORU^R01 inbound lab result) MSH|^~\&|GHH LAB|ELAB-3|GHH OE|BLDG4|200202150930||ORU^R01|CNTRL-3456|P|2.4 PID|||555-44-4444||EVERYWOMAN^EVE^E^^^^L|JONES|19620320|F|||153 FERNWOOD DR.^^STATESVILLE^OH^35292||(206)3345232|(206)752-121||||AC555444444||67-A4335^OH^20030520 Just a list of offsets using |^~\& seperators sent directly over a port. The JSON/FHIR versions are nicer even if they are more verbose.

pgkyc 7y ago

A few notes: * In Canada, we have jurisdictional privacy law. In this case BC FIPPA. This is different than in the US where the few privacy laws that exist are mostly sectoral, such as health (HIPPA). https://www.oipc.bc.ca/guidance-documents/1466 https://www.oipc.bc.ca/guidance-documents/1466 * In Canada, only only one party has to agree to agree to record a telephone conversation. * In Canada, it is not illegal to have a scanner and listen to phone calls even, hence the need to encrypt them faster up here. POGSAC decoding was done in the middle of the 90s with my local #2600 group. It even easier now with RTL-SDR. https://twitter.com/cqwww/status/1171113297011019781 https://twitter.com/cqwww/status/1171113297011019781 * I've been in two states of emergency in my life. Cell phone switches go down in minutes. You want to have your amateur radio licence, an amateur radio, and battery, on standby for when this happens. Practice setting up a data connection to is, as the internet goes away quickly as well. Get your ham radio licence, it's free, and you have your call sign for life. It's a nerdy thing to have except in an emergency, where you quickly turn to hero if you're the only person in your area capable of communicating with emergency services.

beaugunderson 7y ago

Happening in the majority of the hospitals in Seattle as well.