4 ms·

I'm coming at this from the perspective of Ontario, Canada. eHealth, as cumbersome and obtuse as it is, is unquestionably secure. It's not perfect, but it's go

I'm coming at this from the perspective of Ontario, Canada. eHealth, as cumbersome and obtuse as it is, is unquestionably secure. It's not perfect, but it's good enough. We have the IPC (https://www.ipc.on.ca/ https://www.ipc.on.ca/) and several other checks and balances that must be satisfied before a system can hold health data. Not to mention the federal requirements such as PHIPA. These safety requirements are completely out the door when some guy runs a vaccine app. This leak wasn't a mishandled CVE or a zero-day - it was just lazy and sloppy design. Personally, I'm neutral on the technological aspect of 'passports'. I would prefer a hard-copy if possible to keep tech out of the question entirely, but there are absolutely ways to do it well, or at least good enough. This isn't it - this was an opportunist seizing the disorganization of the Alberta government from what I gather.

motohagiography 5y ago
Slight nitpicks, PHIPA is provincial legislation for health information privacy, and you're likely thinking of FIPPA and MFIPPA as federal. A passport is going to be a debacle, and there will be leaks like this one and likely worse. If you happened to look at the clerks screen on their tablet when you got your last shot, the vaccination rollout was done using a salesforce app, and it's very likely it didn't go through the same checks and balances (like a privacy impact assessment) as internal govt apps. IMO, it's got a huge legal problem where it doesn't collect consent in any meaningful way (an anonymous clerk ticks boxes on a screen you can't see, with no way of verifying they have obtained your consent). At least when you sign a physical consent form, you can write-in that you are getting the shot under duress from your employer, but the rollout doesn't track that, and that's by design. The same can be said for public sector employers collecting vaccine certificate information as a condition of employment (have fun with the unions on that one), as they are also subject to PHIPA, and most of them do not have the facilities for PHIPA compliance in the handling of employee health information (PHI). There are so many technical issues with passports that it's going to be a complete discredit to government, but my impression is they don't actually care. This is a putsch to elevate a class of apparatchiks who do not assert their freedoms or rights, and where they are headed, they don't need legitimacy or credibility. There is a generation of people in government and other institutions now who are basically terrible people whose plan is to squeeze the toothpaste out of the tube in terms of data, "temporary measures," and passing laws that won't withstand court challenges, and they imagine themselves as being muscular about policy. I'd predict it ends very badly for them, and if not for them, then definitely for the rest of us. One wonders why they think it will work this time.
- Scoundreller 5y ago
  > The same can be said for public sector employers collecting vaccine certificate information as a condition of employment Oh, it’s a lot more than the public sector that will be finding themselves to now be health information custodians by collecting this data.
  - motohagiography 5y ago
    Indeed, being a HIC has a lot of liability. Unfortunately, I think the regulatory institutions and the media are compromised, and I do not forsee any principled resistance based on PHIPA getting traction. The only way to get traction will be to find a way for it to be used to scapegoat conservative party politicians, otherwise, it's not going to go anywhere. Basically, unless you can pin it all on Doug Ford, the press is going to ignore it.
- 908B64B197 5y ago
  > and it's very likely it didn't go through the same checks and balances (like a privacy impact assessment) as internal govt apps. > There is a generation of people in government and other institutions now who are basically terrible people whose plan is to squeeze the toothpaste out of the tube in terms of data, "temporary measures," and passing laws that won't withstand court challenges, and they imagine themselves as being muscular about policy. "Why are you opposing these temporary emergency measures? Are you a conspiracy theorist with something to hide? Flag this one in the system Gladys..."

motohagiography 5y ago

Slight nitpicks, PHIPA is provincial legislation for health information privacy, and you're likely thinking of FIPPA and MFIPPA as federal. A passport is going to be a debacle, and there will be leaks like this one and likely worse. If you happened to look at the clerks screen on their tablet when you got your last shot, the vaccination rollout was done using a salesforce app, and it's very likely it didn't go through the same checks and balances (like a privacy impact assessment) as internal govt apps. IMO, it's got a huge legal problem where it doesn't collect consent in any meaningful way (an anonymous clerk ticks boxes on a screen you can't see, with no way of verifying they have obtained your consent). At least when you sign a physical consent form, you can write-in that you are getting the shot under duress from your employer, but the rollout doesn't track that, and that's by design. The same can be said for public sector employers collecting vaccine certificate information as a condition of employment (have fun with the unions on that one), as they are also subject to PHIPA, and most of them do not have the facilities for PHIPA compliance in the handling of employee health information (PHI). There are so many technical issues with passports that it's going to be a complete discredit to government, but my impression is they don't actually care. This is a putsch to elevate a class of apparatchiks who do not assert their freedoms or rights, and where they are headed, they don't need legitimacy or credibility. There is a generation of people in government and other institutions now who are basically terrible people whose plan is to squeeze the toothpaste out of the tube in terms of data, "temporary measures," and passing laws that won't withstand court challenges, and they imagine themselves as being muscular about policy. I'd predict it ends very badly for them, and if not for them, then definitely for the rest of us. One wonders why they think it will work this time.

Scoundreller 5y ago
> The same can be said for public sector employers collecting vaccine certificate information as a condition of employment Oh, it’s a lot more than the public sector that will be finding themselves to now be health information custodians by collecting this data.
- motohagiography 5y ago
  Indeed, being a HIC has a lot of liability. Unfortunately, I think the regulatory institutions and the media are compromised, and I do not forsee any principled resistance based on PHIPA getting traction. The only way to get traction will be to find a way for it to be used to scapegoat conservative party politicians, otherwise, it's not going to go anywhere. Basically, unless you can pin it all on Doug Ford, the press is going to ignore it.
908B64B197 5y ago
> and it's very likely it didn't go through the same checks and balances (like a privacy impact assessment) as internal govt apps. > There is a generation of people in government and other institutions now who are basically terrible people whose plan is to squeeze the toothpaste out of the tube in terms of data, "temporary measures," and passing laws that won't withstand court challenges, and they imagine themselves as being muscular about policy. "Why are you opposing these temporary emergency measures? Are you a conspiracy theorist with something to hide? Flag this one in the system Gladys..."