5 ms·

Engineer reports data leak to nonprofit, hears from the police

61 points by brainwipe 6y ago

brainwipe 6y ago
UK Computer Misuse Act is woefully out of date. I do wish the engineer all the best.
hedora 6y ago
So, the Apperta Foundation is trying to centralize healthcare databases from multiple organizations in the cloud. They claim they can be much cheaper than their competition, and (from the article) clearly don’t care about / intend to secure their infrastructure. What could go wrong? https://apperta.org/openOutcomes/ https://apperta.org/openOutcomes/
- brainwipe 6y ago
  I think you've pretty much hit the nail squarely on the head.
dghlsakjg 6y ago
If a neighbour comes by to let me know that I left the garage open, I close the door and thank them profusely. Why does someone at this organization think that filing a police report is the appropriate action. It fairly well guarantees that no one else will let them know the door is open in the future, and it highlights to adversaries that there is a good chance this is an easy company to find a weakness in. As an aside I see this as a side effect of increasing layers of abstractions between law/society and technology. A tech manager goes to legal to let them know that a former employee has just let them know that there was a security breach. Without understanding git, github, responsible disclosure or programming, all the lawyer hears is that a former employee has written to tell us that he has found copies of sensitive information and has encrypted them on his hard-drive. If you are the legal representative for a technology company, at what point do you have a responsibility to understand the technology?
- Nextgrid 6y ago
  > Why does someone at this organization think that filing a police report is the appropriate action Ass-covering. You can spin your own incompetence into a hack instead and legal action increases your credibility in front of your (equally stupid) peers.
- Rule35 6y ago
  When this sort of thing happens, the customers of a company need to sue it for whatever you sue a bad engineering firm for, plus what you sue a crooked accountant for. I mean, they were told about a flaw and didn't pass that notice to the product team but sued the reporter of the problem. That's proof that they understood the flaw. Nobody sues over a mistaken bug report, or if they don't understand the impact. The entire legal team should be disbarred for knowingly conspiring to hide evidence of customer impacting flaws. Every lawyer of theirs who saw the proceeding should never lawyer again in the free world. And then you should go after the management and board who are always equally guilty in these cases. Directly after the people - all the joys of modern cancellation, with charges of dereliction of duty, fraud, conspiracy, etc. Leave them with a smear even if the case doesn't proceed, like their malicious lawsuit could have ruined the bug reporter. Get them to say stupid things to cover "CEO: I had no idea" and use those against them. "CEO incapable of managing company, in his own words". Guilty or incompetent. Pick one. There's no way to accidentally sue someone so this whole episode is malicious. Nobody in management or above from this company should ever have a paying job again without someone swooping in to garnish their wages.
  - dghlsakjg 6y ago
    On the other hand, I can see why the legal team was a little shaken by the fact that he kept a copy of the database. It's a little like saying you left the garage door open, but I also took a full inventory of your stuff, and unlocked a window. I'll tell you about it once you close the door. If you aren't familiar with info sec standard practice it seems a little odd.... All the more reason for technology lawyers to have an understanding of technology.
    - 6y ago
goatinaboat 6y ago
I wonder if the best course of action in this situation would be to simply report the company directly to the ICO as GDPR violators and not bother to contact them at all.
- 908B64B197 6y ago
  I think so too. Let the bureaucrats handle it.
- triceratops 6y ago
  Is the UK still subject to GDPR?
  - goatinaboat 6y ago
    Yes, it was grandfathered in
- brainwipe 6y ago
  The police will report too as part of their procedures.
  - goatinaboat 6y ago
    The police will report too as part of their procedures The British police don't understand any of this, and they will simply arrest whoever's easiest. You are better off going around them.

61 points by brainwipe 6y ago

UK Computer Misuse Act is woefully out of date. I do wish the engineer all the best.

So, the Apperta Foundation is trying to centralize healthcare databases from multiple organizations in the cloud. They claim they can be much cheaper than their competition, and (from the article) clearly don’t care about / intend to secure their infrastructure. What could go wrong? https://apperta.org/openOutcomes/ https://apperta.org/openOutcomes/

brainwipe 6y ago
I think you've pretty much hit the nail squarely on the head.

dghlsakjg 6y ago

If a neighbour comes by to let me know that I left the garage open, I close the door and thank them profusely. Why does someone at this organization think that filing a police report is the appropriate action. It fairly well guarantees that no one else will let them know the door is open in the future, and it highlights to adversaries that there is a good chance this is an easy company to find a weakness in. As an aside I see this as a side effect of increasing layers of abstractions between law/society and technology. A tech manager goes to legal to let them know that a former employee has just let them know that there was a security breach. Without understanding git, github, responsible disclosure or programming, all the lawyer hears is that a former employee has written to tell us that he has found copies of sensitive information and has encrypted them on his hard-drive. If you are the legal representative for a technology company, at what point do you have a responsibility to understand the technology?

Nextgrid 6y ago
> Why does someone at this organization think that filing a police report is the appropriate action Ass-covering. You can spin your own incompetence into a hack instead and legal action increases your credibility in front of your (equally stupid) peers.
Rule35 6y ago
When this sort of thing happens, the customers of a company need to sue it for whatever you sue a bad engineering firm for, plus what you sue a crooked accountant for. I mean, they were told about a flaw and didn't pass that notice to the product team but sued the reporter of the problem. That's proof that they understood the flaw. Nobody sues over a mistaken bug report, or if they don't understand the impact. The entire legal team should be disbarred for knowingly conspiring to hide evidence of customer impacting flaws. Every lawyer of theirs who saw the proceeding should never lawyer again in the free world. And then you should go after the management and board who are always equally guilty in these cases. Directly after the people - all the joys of modern cancellation, with charges of dereliction of duty, fraud, conspiracy, etc. Leave them with a smear even if the case doesn't proceed, like their malicious lawsuit could have ruined the bug reporter. Get them to say stupid things to cover "CEO: I had no idea" and use those against them. "CEO incapable of managing company, in his own words". Guilty or incompetent. Pick one. There's no way to accidentally sue someone so this whole episode is malicious. Nobody in management or above from this company should ever have a paying job again without someone swooping in to garnish their wages.
- dghlsakjg 6y ago
  On the other hand, I can see why the legal team was a little shaken by the fact that he kept a copy of the database. It's a little like saying you left the garage door open, but I also took a full inventory of your stuff, and unlocked a window. I'll tell you about it once you close the door. If you aren't familiar with info sec standard practice it seems a little odd.... All the more reason for technology lawyers to have an understanding of technology.
  - 6y ago

goatinaboat 6y ago

I wonder if the best course of action in this situation would be to simply report the company directly to the ICO as GDPR violators and not bother to contact them at all.

908B64B197 6y ago
I think so too. Let the bureaucrats handle it.
triceratops 6y ago
Is the UK still subject to GDPR?
- goatinaboat 6y ago
  Yes, it was grandfathered in
brainwipe 6y ago
The police will report too as part of their procedures.
- goatinaboat 6y ago
  The police will report too as part of their procedures The British police don't understand any of this, and they will simply arrest whoever's easiest. You are better off going around them.