4 ms·
"the patient records database was accessible via the internet; there was no firewall and, perhaps most egregiously, it was secured with a blank password, so any
by bigiain 9mo ago
"the patient records database was accessible via the internet; there was no firewall and, perhaps most egregiously, it was secured with a blank password, so anyone could just press enter and open it"
There _should_ be a bunch of people in jail for that. Including, but not limited to the CEO. It should also include all the people on the org chart between whoever set that database up and the CEO.
- jruohonen 9mo agoIndeed, the CEO was held criminally liable, but the charges were dropped in a higher court just recently. From the article: "In April 2023, Tapio was found guilty of criminal negligence in his handling of patient data. His conviction was overturned on appeal in December 2025. (He declined my requests to interview him.)" More specifically, he was charged of a data protection crime (i.e., note that in Finland these GDPR-like things are also in the criminal law). However, based on local news, I suppose there was not enough evidence that it was specifically a responsibility of a CEO or that CEO-level gross negligence occurred.
- raverbashing 9mo agoFunny whenever people complain about the GDPR here they're thinking they would be slapped with a €20Mi fine and that EU team 6 is going to parachute in their office and arrest everyone So they're saying this is not the case?
- jruohonen 9mo ago> So they're saying this is not the case? Yes it was. The company was fined 20M EUR on standard GDPR-basis and went bankrupt (but unlikely due to the fine alone). Please re-read the above discussion.
- alibarber 9mo agoWell, not for public bodies at least: “ Administrative fines cannot be imposed on public organisations, such as the government or state-owned companies, municipalities and parishes” [1] But luckily this sort of thing never happens in the public sector. Except for when it does: https://yle.fi/a/74-20094950 https://yle.fi/a/74-20094950 [1] https://tietosuoja.fi/en/corrective-powers https://tietosuoja.fi/en/corrective-powers
- raverbashing 9mo agoThat's interesting, because if you go here https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ there are a lot of public institutions being hit with fines (if they are enforced it's another issue) - search for Municipality for example However I don't see any municipality in Finland getting fines
- alibarber 9mo agoIndeed, but 'the EU' isn't the one enforcing it or leveraging fines - it's up to national bodies/governments and law enforcement. From that link we can see that the UK fined its own Ministry of Defence 400,000 EUR. However it appears that Finish public bodies are deemed above reproach by their government.
- jimmaswell 9mo agoThe law is written such that they could do all that to a small family business that forgot to delete their Apache logs, which isn't good and leaves room for abuse even if they pinkie swear it's only meant for big violations.
- interactivecode 9mo agoOnly after informing you, giving you the opportunity to fix things and many many other steps. The harshness is directly related to the size of the company and the companies willingness to fix any issues. They want companies to comply.
- raverbashing 9mo agoReading the words and interpreting the law in its wider legal context are two different things
- justincormack 9mo agoAccording to this report [1] the appeal was about specific requirements like encryption, and he claimed he had delegated it. So it is clear that it is hard to actually hold people responsible. > The appellate court rejected the prosecution's argument and dismissed all charges. In its unanimous decision, the court stated that neither the GDPR nor the applicable Finnish healthcare legislation required encryption or pseudonymisation of patient data at the time in question. > Prosecutors alleged that Tapio knew about the March 2019 breach and failed to act. They claimed he neglected legal obligations to report and document the incident and did not take sufficient steps to protect the database. Tapio denied the claims, saying he was unaware of the breach until autumn 2020 and had delegated technical oversight to external IT professionals. > The court found there was no clear legal requirement at the time obliging Tapio, as CEO, to take the specific security measures cited by the prosecution. These included firewall management, password policies, access controls, VPN implementation, and security updates. > According to the ruling, the failure to adopt such measures did not, in the court’s view, constitute criminal negligence under Finnish law. > Tapio’s conduct during and after the 2019 breach did not meet the threshold for criminal liability, the court concluded. [1] https://www.helsinkitimes.fi/finland/finland-news/domestic/28328-court-clears-former-vastaamo-ceo-ville-tapio-of-data-protection-charges.html?tmpl=component&layout=default https://www.helsinkitimes.fi/finland/finland-news/domestic/2...
- aitchnyu 9mo agoYup, I heard of an ERP full of microservices and many endpoints dont check authorization at all and the auth mechanism doesnt check valid user credentials. Seems like they are very common.
- reactordev 9mo agoExactly, was it a burglary when your front door is open, lights on, spotlights on your wall safe, with the keys still inserted? The CEO should be in prison.
- bryanrasmussen 9mo ago>Exactly, was it a burglary when your front door is open Legally speaking, yes in every place I've ever lived if all those things are the case it's still a burglary, although the cops may call the victim an idiot.
- quietbritishjim 9mo agoIn the UK, there is no crime "burglary". "Breaking and entering" it's a criminal offence, and walking through an unlocked front door back door doesn't count. If you are on someone's land but didn't have to break in then that's trespass, which is just a civil offense. Theft is a crime in any case (indeed even if you're not on their land e.g. snatching a phone off the street).
- wulfstan 9mo agoThat is false. Burglary is a crime in the UK. See https://www.legislation.gov.uk/ukpga/1968/60/section/9 https://www.legislation.gov.uk/ukpga/1968/60/section/9 and https://www.cps.gov.uk/prosecution-guidance/theft-act-offences https://www.cps.gov.uk/prosecution-guidance/theft-act-offenc...
- bryanrasmussen 9mo agoOK, I probably should specify closer, but while the other commenter has noted there is "burglary" in the UK, I was using burglary in the vernacular, meaning you entered someone's house without their knowledge and stole some shit. I was perhaps unclear with this and in fact in some places what entering someone's house that is not locked and stealing some shit may be a different crime than when it is locked both variations are still generally described, in common usage, as a burglary and are both illegal according to every legal code of every place I've lived, which I've lived in a lot of Western Civ type places.
- tclancy 9mo agoStill reading the story but just hit that line and came here to snarkily post, “another MongoDB success story”. I should probably talk to my therapist about this desire to be seen as funny.
- tclancy 9mo agoHaving now read it, the CEO did get convicted.