5 ms·

Seconded. I was playing with mine last week and had it set up to read pager messages. Turns out that hospitals still use pagers heavily, and pager data is compl

Seconded. I was playing with mine last week and had it set up to read pager messages. Turns out that hospitals still use pagers heavily, and pager data is completely unencrypted.

larrywright 7y ago
Adding, just in case anyone wants to do this on their own: IANAL, but my understanding is that in the US it is not against the law to capture and decode these plain-text messages, but it is probably against the law to publish that information elsewhere or act on it in some way (an example from the link below was intercepting taxi service text messages in order to gain a business advantage for your own taxi business). Source: https://www.fcc.gov/consumers/guides/interception-and-divulgence-radio-communications https://www.fcc.gov/consumers/guides/interception-and-divulg... via https://www.reddit.com/r/RTLSDR/comments/4nhg7h/legalities_of_intercepting_pager_signals/ https://www.reddit.com/r/RTLSDR/comments/4nhg7h/legalities_o... The text messages that float about in the ether these days aren’t messages between individuals, they’re monitoring alerts (refrigeration systems, computers), and medical (doctors being paged, order to clean hospital rooms, calls for medical transport). That’s the case at least here in my medium-sized town in the US Midwest. It could be very different elsewhere.
amatecha 7y ago
Oh yeah, this has actually been a bit of a controversy in Vancouver recently[0][1], including speculation that the problem may be national. Local hospitals have now removed diagnosis data from the transmissions, but apparently still broadcast everything else, including "patient name, age, gender marker, their attending doctor and room number" (as of Sept 2019)[2]. Vancouver Coastal Health claims they "have no information to suggest private patient information has been used in any malicious way", which is a very disingenuous statement to make, because there's no conceivable way for them to know who has received radio transmissions or made use of such data maliciously. To be frank, I find this pretty mind-blowing and it's disappointing that even in the face of press/public attention, it's not being remedied. [0] https://openprivacy.ca/blog/2019/09/09/open-privacy-discovers-vancouver-patient-medical-data-breach/ https://openprivacy.ca/blog/2019/09/09/open-privacy-discover... [1] https://www.ctvnews.ca/health/pager-systems-used-in-healthcare-could-be-exposing-patient-data-across-canada-1.4727129 https://www.ctvnews.ca/health/pager-systems-used-in-healthca... [2] https://openprivacy.ca/blog/2019/09/26/pager-breach-update/ https://openprivacy.ca/blog/2019/09/26/pager-breach-update/
- WrtCdEvrydy 7y ago
  Sit outside that place with a 4G connected phone and just send it up to a website called VancouverCostalData.com and I bet you someone will care.
  - guiambros 7y ago
    ... and go to jail for stealing patient data and break HIPAA laws. Nice thought experiment, though.
    - sildur 7y ago
      They are broadcasting patient data. It’s not more stealing than me publishing in a web site CB conversations.
    - wizzwizz4 7y ago
      Then set up a mock-up site at https://10.3.42.8/ https://10.3.42.8/, and just show a journalist on your laptop. Ask to remain anonymous, then switch off your web server and let them know that "it has since been taken down, but anybody else could make a new one". That's their story. They can then go on to describe the actual issues, namely the plain-text broadcast that made your proof of concept possible, and state in all honesty that it'd be ten minutes work for a bad actor to set up another, similar, site – and less to just gather (and later sell) the private medical data. Plus, it's not wildly unethical! (Might still be illegal, though.) This is drawing attention to an issue that they're well aware of, and are doing nothing about, in a way that minimises public access to these medical records – one could argue it's positively ethical. … Though, actually, it'd probably be better to do to somebody in charge first, since perhaps only with such a mock-up would they truly understand. They might genuinely not be aware, thinking it's just some obscure issue.
    - blodorn 7y ago
      HIPAA doesn't apply to individuals, it only applies to health institutions and their employees and business associates[0]. [0] https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials...

Seconded. I was playing with mine last week and had it set up to read pager messages. Turns out that hospitals still use pagers heavily, and pager data is completely unencrypted.

larrywright 7y ago

Adding, just in case anyone wants to do this on their own: IANAL, but my understanding is that in the US it is not against the law to capture and decode these plain-text messages, but it is probably against the law to publish that information elsewhere or act on it in some way (an example from the link below was intercepting taxi service text messages in order to gain a business advantage for your own taxi business). Source: https://www.fcc.gov/consumers/guides/interception-and-divulgence-radio-communications https://www.fcc.gov/consumers/guides/interception-and-divulg... via https://www.reddit.com/r/RTLSDR/comments/4nhg7h/legalities_of_intercepting_pager_signals/ https://www.reddit.com/r/RTLSDR/comments/4nhg7h/legalities_o... The text messages that float about in the ether these days aren’t messages between individuals, they’re monitoring alerts (refrigeration systems, computers), and medical (doctors being paged, order to clean hospital rooms, calls for medical transport). That’s the case at least here in my medium-sized town in the US Midwest. It could be very different elsewhere.

amatecha 7y ago

Oh yeah, this has actually been a bit of a controversy in Vancouver recently[0][1], including speculation that the problem may be national. Local hospitals have now removed diagnosis data from the transmissions, but apparently still broadcast everything else, including "patient name, age, gender marker, their attending doctor and room number" (as of Sept 2019)[2]. Vancouver Coastal Health claims they "have no information to suggest private patient information has been used in any malicious way", which is a very disingenuous statement to make, because there's no conceivable way for them to know who has received radio transmissions or made use of such data maliciously. To be frank, I find this pretty mind-blowing and it's disappointing that even in the face of press/public attention, it's not being remedied. [0] https://openprivacy.ca/blog/2019/09/09/open-privacy-discovers-vancouver-patient-medical-data-breach/ https://openprivacy.ca/blog/2019/09/09/open-privacy-discover... [1] https://www.ctvnews.ca/health/pager-systems-used-in-healthcare-could-be-exposing-patient-data-across-canada-1.4727129 https://www.ctvnews.ca/health/pager-systems-used-in-healthca... [2] https://openprivacy.ca/blog/2019/09/26/pager-breach-update/ https://openprivacy.ca/blog/2019/09/26/pager-breach-update/

WrtCdEvrydy 7y ago
Sit outside that place with a 4G connected phone and just send it up to a website called VancouverCostalData.com and I bet you someone will care.
- guiambros 7y ago
  ... and go to jail for stealing patient data and break HIPAA laws. Nice thought experiment, though.
  - sildur 7y ago
    They are broadcasting patient data. It’s not more stealing than me publishing in a web site CB conversations.
  - wizzwizz4 7y ago
    Then set up a mock-up site at https://10.3.42.8/ https://10.3.42.8/, and just show a journalist on your laptop. Ask to remain anonymous, then switch off your web server and let them know that "it has since been taken down, but anybody else could make a new one". That's their story. They can then go on to describe the actual issues, namely the plain-text broadcast that made your proof of concept possible, and state in all honesty that it'd be ten minutes work for a bad actor to set up another, similar, site – and less to just gather (and later sell) the private medical data. Plus, it's not wildly unethical! (Might still be illegal, though.) This is drawing attention to an issue that they're well aware of, and are doing nothing about, in a way that minimises public access to these medical records – one could argue it's positively ethical. … Though, actually, it'd probably be better to do to somebody in charge first, since perhaps only with such a mock-up would they truly understand. They might genuinely not be aware, thinking it's just some obscure issue.
  - blodorn 7y ago
    HIPAA doesn't apply to individuals, it only applies to health institutions and their employees and business associates[0]. [0] https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials...