4 ms·

The government has put in all kinds of laws, but really others find ways around. IT should be written into law that the spirit is such, that if you fuck up, you

The government has put in all kinds of laws, but really others find ways around. IT should be written into law that the spirit is such, that if you fuck up, you pay. Orgs need to keep data safe like life or death depended on it. In the end, it does. Data encrypted in flight, at rest and only kept around as long as needed.

JumpCrisscross 4y ago
> Orgs need to keep data safe like life or death depended on it. In the end, it does. Then the parties injured can bring claims with the actual damages in hand. If the courts get clogged with such cases, we’ll have the evidence with which to legislate. Jumping the shark by assuming hypothetical harms are real is how we supercharge needless bureaucracy.
- ClumsyPilot 4y ago
  'Then the parties injured can bring claims with the actual damages in hand.' This is basically impossible. First you must prove the leak came from the party you are suing, most Westerners had their data leaked by over 10 organisations at this point - equifax, high profile hacks, etc. Secondly you need to prove damages. That is extremely difficult because no-one will ever admit in court to using leaked data against you. So the solution you are proposimg is unworcable. We know, becauae we tested it - equifax leaked data for hundred million people, and so far noone was able to prove the damage.
  - JumpCrisscross 4y ago
    > equifax leaked data for hundred million people, and so far noone was able to prove the damage Which leads me to believe there hasn’t been any damage worth pursuing. It’s a simpler hypothesis than there being rampant, apparently undetectable fraud.
    - hansvm 4y ago
      Roughly $40B/yr is stolen from retirement accounts in the USA. Some of that is due to data leaks, and it's not unreasonable to assume other thefts are due to data leaks. The issue is tying any specific instance back to the Equifax clusterfuck.
    - ClumsyPilot 4y ago
      > It’s a simpler hypothesis than there being rampant, apparently undetectable fraud. Undetectable? I know 7 people that were targeted and defrauded, and unless you live under a rock, you probably know someone too. I get 2 scam robocalls a week, 5 scam emails a week, where do you think all of them are getting my nyumber, name and address? Now, how do I prove where these fraudsters get their data so that I cna file a lawsuit?
Ferrotin 4y ago
This is evil shit you’re saying (I’m being a bit dramatic, sure). Healthcare is made more expensive by all these rules about IT. Life or death depends on keeping costs down and making it seamless for doctors to share information with one another. It isn’t some catastrophe if a breach happens. They’ve happened before, yet people have not been getting their private health information published in the local newspaper.
- daniel-cussen 4y ago
  Shouldn't be seamless, on the contrary. Full of seams. Go back to pencil and paper, better. That was a better system on all counts. Like actually getting my private health information published in the local newspaper--in particular regarding my psychiatrization and torture--is much, much better than creepy standardized test cheaters knowing all my secrets and nobody else knowing anything. That's what I'm doing these days. In fact I would say the system works far too well, it's very easy for doctors to gossip in their seamless channels and far too hard to stop my psych record--like it was a prison record or a warrant or some actual judgment by a worthy authority--getting around behind my back. I still can't see it myself. I'm expected to believe I have a doctor who advises people paying for my treatment and I've never met this asshole. Hundreds, even thousands of pages and I can't see any of it, it's like a Kick Me on my back, but a biography, a Kick Me epic. Jorge Barros Beck has a few hundred pages, Ximena Rojas Núnez has some, Stanford CAPS has some, that asshole I told you about, then "Clínica" Rayencura produced a couple hundred (they have a former trained journalist called Gonzalo, former junkie too, working to fill out accusative, slanderous dossiers on people, he doesn't say shit he just writes shit, only shit, lots of shit). Can't wait for that leak!
- Silhouette 4y ago
  Healthcare is made more expensive by all these rules about IT. Healthcare is made more expensive by a lot of things. Sometimes the cost of treating one specific condition affecting one specific individual right now isn't the only thing that matters. It isn’t some catastrophe if a breach happens. Given that we're potentially talking about sensitive personal data, that is a wildly unsafe assumption. Sadly our society has and probably always will have both widespread cultural prejudices and individual personal prejudices against people who have or have had certain conditions, who are receiving or have received certain treatments or procedures, and so on. If a computer wasn't fully encrypted but no identifiable data ever actually leaked then sure, that's a technicality but no real harm was done on that occasion. If a computer with a list of everyone who say had an abortion or received treatment for their mental health in the last decade was held insecurely and that data was leaked to the wrong people after a breach then that could profoundly affect or in the worst case even endanger the lives of the people involved.
karaterobot 4y ago
At the same time, I wouldn't want anyone to be able to enforce certain parts of that. For example, to make sure that data was only kept around as long as needed, you'd need to be able to monitor the contents of all the computers that contained that data. This creates problems of its own, much larger than the original one. To a certain extent, we just have to trust researchers with sensitive data, and severely punish gross violations of that trust. To be honest, I've heard of many more examples of organizations who put too strict of controls on their data. This is due to researchers trying to walk a line between a requirement that they share their data, and their (understandable) desire to keep their work to themselves as long as possible, so other competing researchers can't publish on it first. A bad data governance committee fails much more often in allowing data contributors to be too strict with their data, even though I agree that a data breach is a worse outcome, and avoiding it should be the highest priority.
- Retric 4y ago
  Shared data between researchers defeats the purpose of replication. Suppose two people conduct the same experiment on the same medical data using the same code. If the sample was biased then what’s the point?
  - karaterobot 4y ago
    Reusability of data is an important part of research. It helps collaboration between researchers, and enables secondary research to take place. Using the same data is important for reproducibility in many cases, because the research isn't about creating the dataset, it's about doing analysis on the data. A lot of original research relies on existing datasets. Having "good" data is obviously crucial, but it's a separate matter.
    - Retric 4y ago
      It’s not a question of “good” data. Slice and dice perfectly random data and sometimes you get spurious correlations. The only way to separate them from real results is to have completely new data. It’s not even a question of p hacking or bad design. Preform enough experiments and you always get false positives.
shadowgovt 4y ago
The tricky bit is the interplay between security and criticality of need. If I'm dying of an unknown condition in the ER, I really want minimal fences between my doctor and my data. So a careful balance has to be struck because sometimes patient need is served by breaking privacy. Bulletproof technical solutions could impede patient care.

JumpCrisscross 4y ago

> Orgs need to keep data safe like life or death depended on it. In the end, it does. Then the parties injured can bring claims with the actual damages in hand. If the courts get clogged with such cases, we’ll have the evidence with which to legislate. Jumping the shark by assuming hypothetical harms are real is how we supercharge needless bureaucracy.

ClumsyPilot 4y ago
'Then the parties injured can bring claims with the actual damages in hand.' This is basically impossible. First you must prove the leak came from the party you are suing, most Westerners had their data leaked by over 10 organisations at this point - equifax, high profile hacks, etc. Secondly you need to prove damages. That is extremely difficult because no-one will ever admit in court to using leaked data against you. So the solution you are proposimg is unworcable. We know, becauae we tested it - equifax leaked data for hundred million people, and so far noone was able to prove the damage.
- JumpCrisscross 4y ago
  > equifax leaked data for hundred million people, and so far noone was able to prove the damage Which leads me to believe there hasn’t been any damage worth pursuing. It’s a simpler hypothesis than there being rampant, apparently undetectable fraud.
  - hansvm 4y ago
    Roughly $40B/yr is stolen from retirement accounts in the USA. Some of that is due to data leaks, and it's not unreasonable to assume other thefts are due to data leaks. The issue is tying any specific instance back to the Equifax clusterfuck.
  - ClumsyPilot 4y ago
    > It’s a simpler hypothesis than there being rampant, apparently undetectable fraud. Undetectable? I know 7 people that were targeted and defrauded, and unless you live under a rock, you probably know someone too. I get 2 scam robocalls a week, 5 scam emails a week, where do you think all of them are getting my nyumber, name and address? Now, how do I prove where these fraudsters get their data so that I cna file a lawsuit?

Ferrotin 4y ago

This is evil shit you’re saying (I’m being a bit dramatic, sure). Healthcare is made more expensive by all these rules about IT. Life or death depends on keeping costs down and making it seamless for doctors to share information with one another. It isn’t some catastrophe if a breach happens. They’ve happened before, yet people have not been getting their private health information published in the local newspaper.

daniel-cussen 4y ago
Shouldn't be seamless, on the contrary. Full of seams. Go back to pencil and paper, better. That was a better system on all counts. Like actually getting my private health information published in the local newspaper--in particular regarding my psychiatrization and torture--is much, much better than creepy standardized test cheaters knowing all my secrets and nobody else knowing anything. That's what I'm doing these days. In fact I would say the system works far too well, it's very easy for doctors to gossip in their seamless channels and far too hard to stop my psych record--like it was a prison record or a warrant or some actual judgment by a worthy authority--getting around behind my back. I still can't see it myself. I'm expected to believe I have a doctor who advises people paying for my treatment and I've never met this asshole. Hundreds, even thousands of pages and I can't see any of it, it's like a Kick Me on my back, but a biography, a Kick Me epic. Jorge Barros Beck has a few hundred pages, Ximena Rojas Núnez has some, Stanford CAPS has some, that asshole I told you about, then "Clínica" Rayencura produced a couple hundred (they have a former trained journalist called Gonzalo, former junkie too, working to fill out accusative, slanderous dossiers on people, he doesn't say shit he just writes shit, only shit, lots of shit). Can't wait for that leak!
Silhouette 4y ago
Healthcare is made more expensive by all these rules about IT. Healthcare is made more expensive by a lot of things. Sometimes the cost of treating one specific condition affecting one specific individual right now isn't the only thing that matters. It isn’t some catastrophe if a breach happens. Given that we're potentially talking about sensitive personal data, that is a wildly unsafe assumption. Sadly our society has and probably always will have both widespread cultural prejudices and individual personal prejudices against people who have or have had certain conditions, who are receiving or have received certain treatments or procedures, and so on. If a computer wasn't fully encrypted but no identifiable data ever actually leaked then sure, that's a technicality but no real harm was done on that occasion. If a computer with a list of everyone who say had an abortion or received treatment for their mental health in the last decade was held insecurely and that data was leaked to the wrong people after a breach then that could profoundly affect or in the worst case even endanger the lives of the people involved.

karaterobot 4y ago

At the same time, I wouldn't want anyone to be able to enforce certain parts of that. For example, to make sure that data was only kept around as long as needed, you'd need to be able to monitor the contents of all the computers that contained that data. This creates problems of its own, much larger than the original one. To a certain extent, we just have to trust researchers with sensitive data, and severely punish gross violations of that trust. To be honest, I've heard of many more examples of organizations who put too strict of controls on their data. This is due to researchers trying to walk a line between a requirement that they share their data, and their (understandable) desire to keep their work to themselves as long as possible, so other competing researchers can't publish on it first. A bad data governance committee fails much more often in allowing data contributors to be too strict with their data, even though I agree that a data breach is a worse outcome, and avoiding it should be the highest priority.

Retric 4y ago
Shared data between researchers defeats the purpose of replication. Suppose two people conduct the same experiment on the same medical data using the same code. If the sample was biased then what’s the point?
- karaterobot 4y ago
  Reusability of data is an important part of research. It helps collaboration between researchers, and enables secondary research to take place. Using the same data is important for reproducibility in many cases, because the research isn't about creating the dataset, it's about doing analysis on the data. A lot of original research relies on existing datasets. Having "good" data is obviously crucial, but it's a separate matter.
  - Retric 4y ago
    It’s not a question of “good” data. Slice and dice perfectly random data and sometimes you get spurious correlations. The only way to separate them from real results is to have completely new data. It’s not even a question of p hacking or bad design. Preform enough experiments and you always get false positives.

shadowgovt 4y ago

The tricky bit is the interplay between security and criticality of need. If I'm dying of an unknown condition in the ER, I really want minimal fences between my doctor and my data. So a careful balance has to be struck because sometimes patient need is served by breaking privacy. Bulletproof technical solutions could impede patient care.