4 ms·

I hope this includes the HIPAA NSA backdoor.

by piqufoh 13y ago

jessaustin 13y ago
I've probably shoveled more fuel on HN's NSA fire than most, but how do you think health records are related to anyone's NSA threat model? Are there health conditions that will prompt a visit from the black-bag squad?
- notacoward 13y ago
  I'm pretty sure I've read a story about a psychiatrist who found out that some government agency (not sure if it was NSA) was illicitly browsing his patients' records and particularly their prescription histories without any kind of consent (as would be the case for a security-clearance audit). Their excuse was that some conditions might affect people's ability to perform in security-sensitive roles. It's also not unlikely that they might use the threat of disclosing someone's medical/psychological status to coerce keys out of them. So yeah, NSA might well want that information enough to "suggest" adding a back door.
  - jlgaddis 13y ago
    The SF86[0] (the form you'll be filling out if applying for any type of clearance) is extremely "intrusive" with regard to your medical history. Excluding information isn't an option, either. [0]: http://www.opm.gov/forms/pdf_fill/SF86.pdf http://www.opm.gov/forms/pdf_fill/SF86.pdf
- sssbc 13y ago
  http://en.wikipedia.org/wiki/Infection_control#Surveillance_for_infections http://en.wikipedia.org/wiki/Infection_control#Surveillance_... and http://en.wikipedia.org/wiki/Infection_control#Isolation http://en.wikipedia.org/wiki/Infection_control#Isolation especially if "terrorists" are anywhere within the many small-networks lurking in all that data (http://en.wikipedia.org/wiki/Small-world_networks http://en.wikipedia.org/wiki/Small-world_networks)
- shoeless 13y ago
  Some medications or treatments are indicative of life's events. NSA may be interested in why this person of interest (because, it would definitely be a person of interest and not some random individual - snark) is suddenly taking anti-anxiety meds or having some plastic surgery.
- jjoonathan 13y ago
  They aren't any more related to their threat model than anything else they're vacuuming up but that doesn't mean they don't want them. All it takes is one known terrorist with a known illness / rare treatment and "wouldn't it be nice to have this access" becomes "we need this access NOW" becomes "we will take the access, now and forever into the future, and there's nothing you can do about it." Also, perhaps terrorist networks target people with terminal illnesses and nothing to lose? Or perhaps the FBI is worried that someone who has been denied treatment in the US will turn terrorist all on their own. We have a large population that has been wronged by the system and has nothing to lose, I think the FBI wants to keep an eye on them. I know, FBI!=NSA, but the whole "parallel construction" deal shows exactly what they think about separation of powers: at least a few of them see it as an obstacle to overcome, not as a safeguard against abuse. And a few people is enough to do all the damage in the world. Also, let's not forget there's a heavy financial incentive for individuals with access to such a database to sell the info to insurance companies. It follows that such individuals then have a motive to push for the establishment of such a database. They could launder the info into some "proprietary liability metric" which they would be able to sell for loads of money. I don't know what internal checks they put in place after Snowden but they can't be perfect. Any shadow copy of your health records increases your exposure and provides an opportunity to the unscrupulous if the records can be accessed in aggregate.
  - jessaustin 13y ago
    I have to admit that these are plausible scenarios. However, most regular citizens (I know, lots of horrible arguments start out with that phrase) would be harmed more by the spooks turning communications about legal gray areas over to prosecutors than to anyone in the government knowing about their gout or depression or whatever. (Sure some people are worried about "Obama's Death Panels" but if such ever appear I'm pretty sure they'll have access to your health records anyway.) In your last scenario, the "bad" agents only win if they can sell the service, but keep secret the inputs to that service. I'm sure they can do that in the short term, but it's quite likely that eventually a salesweasel will speak a bit too freely in a semi-public forum and the whole scheme will unravel. After all, other government agents would be pissed off, if only out of jealousy.

I hope this includes the HIPAA NSA backdoor.

by piqufoh 13y ago

I hope this includes the HIPAA NSA backdoor.

I've probably shoveled more fuel on HN's NSA fire than most, but how do you think health records are related to anyone's NSA threat model? Are there health conditions that will prompt a visit from the black-bag squad?

notacoward 13y ago
I'm pretty sure I've read a story about a psychiatrist who found out that some government agency (not sure if it was NSA) was illicitly browsing his patients' records and particularly their prescription histories without any kind of consent (as would be the case for a security-clearance audit). Their excuse was that some conditions might affect people's ability to perform in security-sensitive roles. It's also not unlikely that they might use the threat of disclosing someone's medical/psychological status to coerce keys out of them. So yeah, NSA might well want that information enough to "suggest" adding a back door.
- jlgaddis 13y ago
  The SF86[0] (the form you'll be filling out if applying for any type of clearance) is extremely "intrusive" with regard to your medical history. Excluding information isn't an option, either. [0]: http://www.opm.gov/forms/pdf_fill/SF86.pdf http://www.opm.gov/forms/pdf_fill/SF86.pdf
sssbc 13y ago
http://en.wikipedia.org/wiki/Infection_control#Surveillance_for_infections http://en.wikipedia.org/wiki/Infection_control#Surveillance_... and http://en.wikipedia.org/wiki/Infection_control#Isolation http://en.wikipedia.org/wiki/Infection_control#Isolation especially if "terrorists" are anywhere within the many small-networks lurking in all that data (http://en.wikipedia.org/wiki/Small-world_networks http://en.wikipedia.org/wiki/Small-world_networks)
shoeless 13y ago
Some medications or treatments are indicative of life's events. NSA may be interested in why this person of interest (because, it would definitely be a person of interest and not some random individual - snark) is suddenly taking anti-anxiety meds or having some plastic surgery.
jjoonathan 13y ago
They aren't any more related to their threat model than anything else they're vacuuming up but that doesn't mean they don't want them. All it takes is one known terrorist with a known illness / rare treatment and "wouldn't it be nice to have this access" becomes "we need this access NOW" becomes "we will take the access, now and forever into the future, and there's nothing you can do about it." Also, perhaps terrorist networks target people with terminal illnesses and nothing to lose? Or perhaps the FBI is worried that someone who has been denied treatment in the US will turn terrorist all on their own. We have a large population that has been wronged by the system and has nothing to lose, I think the FBI wants to keep an eye on them. I know, FBI!=NSA, but the whole "parallel construction" deal shows exactly what they think about separation of powers: at least a few of them see it as an obstacle to overcome, not as a safeguard against abuse. And a few people is enough to do all the damage in the world. Also, let's not forget there's a heavy financial incentive for individuals with access to such a database to sell the info to insurance companies. It follows that such individuals then have a motive to push for the establishment of such a database. They could launder the info into some "proprietary liability metric" which they would be able to sell for loads of money. I don't know what internal checks they put in place after Snowden but they can't be perfect. Any shadow copy of your health records increases your exposure and provides an opportunity to the unscrupulous if the records can be accessed in aggregate.
- jessaustin 13y ago
  I have to admit that these are plausible scenarios. However, most regular citizens (I know, lots of horrible arguments start out with that phrase) would be harmed more by the spooks turning communications about legal gray areas over to prosecutors than to anyone in the government knowing about their gout or depression or whatever. (Sure some people are worried about "Obama's Death Panels" but if such ever appear I'm pretty sure they'll have access to your health records anyway.) In your last scenario, the "bad" agents only win if they can sell the service, but keep secret the inputs to that service. I'm sure they can do that in the short term, but it's quite likely that eventually a salesweasel will speak a bit too freely in a semi-public forum and the whole scheme will unravel. After all, other government agents would be pissed off, if only out of jealousy.