6 ms·

Trove of LA students’ mental health records posted to dark web after cyber hack

71 points by arkadiyt 4y ago

bayesian_horse 4y ago
[flagged]
- nathanaldensr 4y ago
  What?
  - gymbeaux 4y ago
    "Mental healthcare in the US sucks"
    - bayesian_horse 4y ago
      Also the biggest problem with that story is that there was a central database with mental health records of students in the first place...
      - kube-system 4y ago
        It sounds like these are records used to give special consideration to students with special needs. Special education is not unique to the US.
e40 4y ago
There is hopefully a special place in hell for people that do stuff like this. I can sort of see why people fall into computer-based crime, especially in developing nations (e.g., India), but this. It's despicable. Not only can it ruin lives, it can make people hesitate to get help when they need it, which can either lead to more suicides or just plain terrible life outcomes.
- shrimp_emoji 4y ago
  Do the people who neglect to secure their IT systems get a place nearby?
  - hgsgm 4y ago
    That's everyone. The IT department is a conventient scapegoat for failing to do the impractical.
    - dboreham 4y ago
      Someone decided to put sensitive records unencrypted on a computer connected to the internet. In the past they'd be on paper in a filing cabinet, only available to Watergate style attackers.
      - SoftTalker 4y ago
        No it’s unlikely that they decided that. More likely that they didn’t realize that’s what they were doing, or didn’t understand the possible consequences.
        landemva 4y ago
        Are there any civil or criminal consequences for the people who did the atrocious acts of collecting the PII?
        tstrimple 4y ago
        Even though companies routinely neglect security until they are forced to address it through breaches, "Shadow IT" is often a thing and can bypass company security standards. I've worked with multiple corporations where the business side of the house had all but lost trust in the technical side of the house and just started getting what they needed implemented by 3d parties and consultants instead bypassing any existing corporate security standards and review.
  - tomjen3 4y ago
anigbrowl 4y ago
(Off-topic) 'Clever' design shit like this just makes me reach for reader mode. If you want to do video, make a video. When I read an article, I do not want to scroll through the equivalent of a TV intro or game cutscene to get to the information. Normally this is just an aesthetic preference, but when you're reporting on a serious and complex legal situation, emotional theatrics actually undermine the journalistic mission.
- comfypotato 4y ago
  I’m impressed as a software engineer that it worked as well as it did on my random phone screen. Also, now I’m thinking about it more because I was annoyed. I really don’t agree with you. I think it worked. It worked in a way that’s hard to describe; similar to how bad press will sometimes skyrocket a business into success and stardom.
- itqwertz 4y ago
  I agree. It looks like it was done well, but it was probably more fun to create than to read.
- nabilhat 4y ago
  There's some design inexperience going on. #FFF text on #000 background for starters [0]. Images of text used as a background for content text is an unusual choice. The #FF0000 red underlines for links look a lot like spellcheck highlighting. Storing still images as .gif can be a lack of experience thing, as in not knowing what default to select after drawing red squares over sensitive information, or not knowing to avoid image types that support layers. [0] https://ironicsans.com/owmyeyes/ https://ironicsans.com/owmyeyes/
sourcecodeplz 4y ago
Digitalization was/is such a hard push and it's obvious some decision makers were just blinded by it. This also happened last month (the guy was caught). We really need some serious laws/consequences in order to prevent situations like this. The last hack was a MySQL with admin/admin!?
neom 4y ago
"They’re instead covered by the Family Educational Rights and Privacy Act, the federal student privacy law known as FERPA. The law prohibits student records from being released publicly but, unlike HIPAA, does not require schools to disclose when such breaches occur." ... "The federal privacy rules that apply to hospitals and schools “live in separate universes. If it’s maintained by the school, it’s FERPA. If it’s maintained by your doctor, the same information is HIPAA protected.” " Sounds like one thing that should be fixed sooner rather than later is brining FERPA up to HIPAA level. Seems like something folks could realistically rally their lawmakers around?
- alistairSH 4y ago
  Yeah. The question is do we change FERPA (add notification requirements and penalties) OR do we remove the exemption that places education-related medical records under FERPA (and let that info fall under HIPAA, where it should have been all along)? I think the latter makes sense - the school is acting as a medical provider, so HIPAA should apply. No get-out-of-jail card because they’re a school. Of course, the problem with any meaningful penalties is what does that really accomplish? Crippling a school district (by yanking funding) doesn’t help anybody in the long run - it just makes education in that area worse.
b1c1jones 4y ago
That is just plain sick and twisted.
Beaver117 4y ago
Despicable but that's one way to draw attention to cybersecurity for sure

71 points by arkadiyt 4y ago

bayesian_horse 4y ago

[flagged]

nathanaldensr 4y ago
What?
- gymbeaux 4y ago
  "Mental healthcare in the US sucks"
  - bayesian_horse 4y ago
    Also the biggest problem with that story is that there was a central database with mental health records of students in the first place...
    - kube-system 4y ago
      It sounds like these are records used to give special consideration to students with special needs. Special education is not unique to the US.

e40 4y ago

There is hopefully a special place in hell for people that do stuff like this. I can sort of see why people fall into computer-based crime, especially in developing nations (e.g., India), but this. It's despicable. Not only can it ruin lives, it can make people hesitate to get help when they need it, which can either lead to more suicides or just plain terrible life outcomes.

shrimp_emoji 4y ago
Do the people who neglect to secure their IT systems get a place nearby?
- hgsgm 4y ago
  That's everyone. The IT department is a conventient scapegoat for failing to do the impractical.
  - dboreham 4y ago
    Someone decided to put sensitive records unencrypted on a computer connected to the internet. In the past they'd be on paper in a filing cabinet, only available to Watergate style attackers.
    - SoftTalker 4y ago
      No it’s unlikely that they decided that. More likely that they didn’t realize that’s what they were doing, or didn’t understand the possible consequences.
      - landemva 4y ago
        Are there any civil or criminal consequences for the people who did the atrocious acts of collecting the PII?
      - tstrimple 4y ago
        Even though companies routinely neglect security until they are forced to address it through breaches, "Shadow IT" is often a thing and can bypass company security standards. I've worked with multiple corporations where the business side of the house had all but lost trust in the technical side of the house and just started getting what they needed implemented by 3d parties and consultants instead bypassing any existing corporate security standards and review.
- tomjen3 4y ago

anigbrowl 4y ago

(Off-topic) 'Clever' design shit like this just makes me reach for reader mode. If you want to do video, make a video. When I read an article, I do not want to scroll through the equivalent of a TV intro or game cutscene to get to the information. Normally this is just an aesthetic preference, but when you're reporting on a serious and complex legal situation, emotional theatrics actually undermine the journalistic mission.

comfypotato 4y ago
I’m impressed as a software engineer that it worked as well as it did on my random phone screen. Also, now I’m thinking about it more because I was annoyed. I really don’t agree with you. I think it worked. It worked in a way that’s hard to describe; similar to how bad press will sometimes skyrocket a business into success and stardom.
itqwertz 4y ago
I agree. It looks like it was done well, but it was probably more fun to create than to read.
nabilhat 4y ago
There's some design inexperience going on. #FFF text on #000 background for starters [0]. Images of text used as a background for content text is an unusual choice. The #FF0000 red underlines for links look a lot like spellcheck highlighting. Storing still images as .gif can be a lack of experience thing, as in not knowing what default to select after drawing red squares over sensitive information, or not knowing to avoid image types that support layers. [0] https://ironicsans.com/owmyeyes/ https://ironicsans.com/owmyeyes/

sourcecodeplz 4y ago

Digitalization was/is such a hard push and it's obvious some decision makers were just blinded by it. This also happened last month (the guy was caught). We really need some serious laws/consequences in order to prevent situations like this. The last hack was a MySQL with admin/admin!?

neom 4y ago

"They’re instead covered by the Family Educational Rights and Privacy Act, the federal student privacy law known as FERPA. The law prohibits student records from being released publicly but, unlike HIPAA, does not require schools to disclose when such breaches occur." ... "The federal privacy rules that apply to hospitals and schools “live in separate universes. If it’s maintained by the school, it’s FERPA. If it’s maintained by your doctor, the same information is HIPAA protected.” " Sounds like one thing that should be fixed sooner rather than later is brining FERPA up to HIPAA level. Seems like something folks could realistically rally their lawmakers around?

alistairSH 4y ago
Yeah. The question is do we change FERPA (add notification requirements and penalties) OR do we remove the exemption that places education-related medical records under FERPA (and let that info fall under HIPAA, where it should have been all along)? I think the latter makes sense - the school is acting as a medical provider, so HIPAA should apply. No get-out-of-jail card because they’re a school. Of course, the problem with any meaningful penalties is what does that really accomplish? Crippling a school district (by yanking funding) doesn’t help anybody in the long run - it just makes education in that area worse.

b1c1jones 4y ago

That is just plain sick and twisted.

Beaver117 4y ago

Despicable but that's one way to draw attention to cybersecurity for sure