4 ms·

Assuming this is medical data collected as part of UCSF's research (which seems to be implied by the article), doesn't it become worthless once you know malicio

Assuming this is medical data collected as part of UCSF's research (which seems to be implied by the article), doesn't it become worthless once you know malicious actors could have edited it? In other words, the chain of custody was broken, so how can we trust the resulting papers? I realize the perps say they just encrypted it, but if someone has root access to your computer, they can do whatever the hell they please.

galacticaactual 6y ago
One could take this line of thinking arbitrarily far. For example - how are you supposed to trust that authors of any paper, anywhere, always had authenticated, authorized, and controlled access to their integrity-checked data at all times during the entire span of their research?
- spekcular 6y ago
  The people I know who work with medical data do indeed follow protocols like this, involving for example hardware security tokens and encrypted, physically secured private servers. Though, I believe this is more to protect patient privacy than the data itself. More generally, I'm happy to presume (as long as the data is password-protected, say) that scientific data that hasn't obviously been vandalized is trustworthy. However, in this case we have positive evidence of tampering, and therefore a good reason to be skeptical.
  - londons_explore 6y ago
    I clearly know different people... The people I know have all their important data in "Copy of Copy of Copy of Datav2 - FINAL.xlsx" saved in an email from a PhD student.
dmurray 6y ago
Why would it be worthless? No medical trial gives you absolute proof of its results, it just increases your confidence the drug is safe or effective. It's vanishingly unlikely that a ransomware attack was actually targeted to get a new drug approved. Now, it might be good to insist on a rigorous chain of custody or you'll reject the results, in order to better incentivize security. That's an approach that has parallels in criminal justice: in the US it's (in theory) not good enough for a cop to produce incontrovertible evidence you committed a certain crime, he also has to have come by that evidence lawfully. But if it was going to save my life, I'd rather see a new drug approved in a timely manner rather than get held back on a technicality.

galacticaactual 6y ago

One could take this line of thinking arbitrarily far. For example - how are you supposed to trust that authors of any paper, anywhere, always had authenticated, authorized, and controlled access to their integrity-checked data at all times during the entire span of their research?

spekcular 6y ago
The people I know who work with medical data do indeed follow protocols like this, involving for example hardware security tokens and encrypted, physically secured private servers. Though, I believe this is more to protect patient privacy than the data itself. More generally, I'm happy to presume (as long as the data is password-protected, say) that scientific data that hasn't obviously been vandalized is trustworthy. However, in this case we have positive evidence of tampering, and therefore a good reason to be skeptical.
- londons_explore 6y ago
  I clearly know different people... The people I know have all their important data in "Copy of Copy of Copy of Datav2 - FINAL.xlsx" saved in an email from a PhD student.

dmurray 6y ago

Why would it be worthless? No medical trial gives you absolute proof of its results, it just increases your confidence the drug is safe or effective. It's vanishingly unlikely that a ransomware attack was actually targeted to get a new drug approved. Now, it might be good to insist on a rigorous chain of custody or you'll reject the results, in order to better incentivize security. That's an approach that has parallels in criminal justice: in the US it's (in theory) not good enough for a cop to produce incontrovertible evidence you committed a certain crime, he also has to have come by that evidence lawfully. But if it was going to save my life, I'd rather see a new drug approved in a timely manner rather than get held back on a technicality.