19 ms·

HealthCare.gov deferred final security check, could leak personal data

118 points by Cbasedlifeform 13y ago

generj 13y ago
Passing this sort of data in analytics requests is mind-boggingly-stupid. Most analytics providers explicitly tell you not to pass along Personally Identifiable Information (PII). Their Terms of Contract usually state doing so is a terminable offense. It's part of the training process to be certified by most providers. Basically, this only highlights how terrible the programmers at healthcare.gov are.
- briandear 13y ago
  We can blame the programmers, but who is ultimately responsible. The Whitehouse is the executive branch; they are paid to execute and ultimately this is entirely their responsibility. They are the project managers of this entire mess. Now imagine those same people deciding your medical treatment. It's just sheer incompetence disguised as politics. Of course a more subversive view would suggest that this was engineered in order to pave the way for single payer. The Soviets built better cars than the US government builds websites.
  - llamataboot 13y ago
    Last I checked, the Affordable Care Act really didn't involve anyone at the Executive Branch deciding on what medical treatment I could get. Downvoted for fearmongering and paranoid speculation. (purposely botched implementation of a large software project to make single payer easier? Because the Tea Party shutting down the US government to try to block this healthcare bill makes it likely we will see single payer pass?)
    - Shivetya 13y ago
      Actually if the Independent Payment Advisory Board fails to develop a proposal should costs exceed certain thresholds then the Secretary of Health and Human services must submit a proposal themselves which they must implement. Since all appointees to this committee must be agreed upon by the Executive Branch as well as both minority and majority leaders from each party (hence 12 from Congress with the Presidents approval/recommendation) and 3 from the President, yes the Executive branch could very well determine what health options are available too you. The real issues before us now are. 1) why can the Secretary of Health and Human Services even refuse to divulge enrollment numbers? 2) why is the same not keeping the President fully aware or made aware of the problems the site faced before launch and after (conspiracy advocated claim the President knew) 3) By regulating what must be covered and not covered they are deciding what you can have and have not. Remember, there are a lot of gray areas in the law which the Secretary has shown more than enough interest in creating actual rules.
      - generj 13y ago
        Of course, the nice part is that since they do have analytics (as terribly implemented as it appears to have been), we can force enrollment number disclosure by filing a FOIA request for the web analytics data. Which, incidentally, I did today before this story broke.
      - cma 13y ago
        You can still by supplemental insurance, so they aren't regulating what you can have, they are regulating the minimum floor.
        drivingmissm 13y ago
        Obamacare is not a "minimum floor" it is a full suite of mandated coverage for every politically connected medical sector.
        dragonwriter 13y ago
        Yes, its a minimum floor. And there are many plans that offer more than the ACA minimum. You may not like where the minimum is set, but that doesn't make it anything but a minimum floor.
        RickHull 13y ago
        > they aren't regulating what you can have, they are regulating the minimum floor. This is utter nonsense on its face. If I have (or want) something under the minimum floor, they have regulated that away from me. They have regulated what I can have.
        VladRussian2 13y ago
        They also regulated away spoiled beef in stores, non smoke detectors equipped bedrooms and poisoned tap water. You can't have it. Minimum floor.
        13y ago
    - briandear 13y ago
      Actually, have you read the entire bill? If Government is controlling the insurance, they are controlling the care. And yes, if the Affordable Care Act forces insurers to leave markets, then the only thing left would be a call for single payer. Harry Reid even said that Obamacare is "absolutely" a step towards single payer. And, by the way, the calls for Single Payer because of the Obamacare "mess" are starting, Paul Krugman seems to be leading the charge along with others. So could making the Obamacare rollout rougher than necessary prime the pump for a single payer push? I don't know, could closing the WWII memorial and Mt. Rushmore scenic roadside stops make the government shutdown worse than it needed to be to make a political point? The White House would never do that would they? That's just paranoid conspiracy stuff right? Strangely enough the Andrews Air Force Base golf course stayed open during the shutdown but the privately run Mt. Vernon (who happens to lease land from the Park Service) was forced to close. The even closed the Normandy beach in France! Yet, I had no problems getting a routine consular appointment during the shutdown in Marseille. It's not paranoia if it's really happening. http://www.healthcare-now.org/sen-reid-obamacare-absolutely-a-step-toward-a-single-payer-system http://www.healthcare-now.org/sen-reid-obamacare-absolutely-... http://www.forbes.com/sites/paulroderickgregory/2013/10/28/obama-care-a-mess-liberals-say-go-single-payer/ http://www.forbes.com/sites/paulroderickgregory/2013/10/28/o...
  - crusso 13y ago
    Actually, what I think about is the recent government shutdown where the administration went out of its way to close monuments even when those monuments required no federal funds to keep running... even those monuments that had remained open during previous shutdowns. Obviously we witnessed an administration that wanted to really put the screws to the voting public to score political points. Now imagine when they want to do something similar with your healthcare.
    - mkramlich 13y ago
      If I were forced to choose between the following 3 entities/groups as to who the factual evidence suggests was trying to "put the screws to the voting public": 1. Presidency 2. Repubs in Congress 3. Dems in Congress I'd have to pick #2. Overwhelming disposition of evidence pointing in that direction. In the spirit of your point: now imagine what those folks would be willing to do to your healthcare. Actually, we don't have to imagine. Look at their actions.
      - roboneal 13y ago
        Since these is not typically a political discussion forum, at least outline your "overwhelming" factual evidence.
    - GVIrish 13y ago
      What evidence do you have that the administration had anything to do with shutting down monuments? Something like that is at the discretion of the director of a given federal agency. Now maybe the director of the National Park Service decided that he was going to shut monuments down as a matter of politics, but you have to recognize that there are good reasons to do so. In DC in the last year we had a vandal deface the Lincoln Memorial and the National Cathedral. If during the shutdown the National Park Service just left all of the monuments unguarded and someone took a hammer to the nose of a statue of Jefferson, that'd be a humongous price to pay. In a national park, without park rangers to rescue people, if someone got themselves into trouble and died, that would be worse than ruining some people's vacations. It is possible that the White House ordered parks and monuments closed for political reasons, but that's all speculation at this point. No different than speculating that George W. Bush allowed 9/11 to happen to justify invading Iraq.
  - generj 13y ago
    According to the article, Marilyn Tavenner is responsible for authorizing the security checks to be skipped, along with several other administrators at HHS. Now, I would argue that Sibelius is ultimately responsible for setting unrealistic timelines, and general culture at HHS, but without a smoking gun I'm not going to blame the President. Yet. Although I think he entrusted his only signature act in the hands of a very incompetent woman, and gave her carte blanche for 3 years. The programmer responsible (and his QA) should still be relegated to typewriters for the rest of their careers.
    - briandear 13y ago
      The fault lies with Sebelius, however the same logic would absolve Bush of Rumsfeld's errors.
      - GVIrish 13y ago
        To me the question is, once the president learns of the incompetence of a subordinate, what action does he take? Does the president hold the subordinate accountable, and fire them? Or does the president just let them keep on bungling. Rumsfeld eventually resigned, but Bush didn't push him out, meaning Bush owns Rumsfeld's failures. In my opinion, if Obama doesn't hold Sebelius and Clapper accountable, he owns their incompetence and misconduct.
  - bdcravens 13y ago
    The US Government is accountable, yes. I'll even buy that the executive branch is the accountable party, given the role of implementing laws and programs. However, calling them the project manager of the site and then extending that to directly making medical treatment decisions is pretty crazy. If Amazon screws up my toilet paper order, does that mean they're automatically incompetent at auto-scaling my EC2 instances? For what it's worth, there's some crazy delegation of tasks in the ACA. For over a year now, I've been on the interim Preexisting Condition Insurance Program. (expires 12/31, so I'm in a bit of freakout mode, but that's another story for another time ....) It's administered by the Department of Agriculture. Ummm.... moo?
  - Aloisius 13y ago
    The Whitehouse is the executive branch; they are paid to execute and ultimately this is entirely their responsibility. They are the project managers of this entire mess. Now imagine those same people deciding your medical treatment. It's just sheer incompetence disguised as politics. The executive branch has 2.1 million employees and is structured as set of a dozen subsidiary companies each with dozens of subsidiary companies. It is impossible for the Whitehouse, any Whitehouse, to manage except in a completely delegatory way. The idea that someone at the Whitehouse is going to be doing checkins with the contractors brought in to build a website is, frankly, laughable considering the number of things competing for attention. I mean, would you call Warren Buffet incompetent if GEICO rolled out a faulty website because he ultimately controls it?
    - briandear 13y ago
      Ok, so who the hell is in charge then? After all, The Affordable Car Act is the President's "Signature Legislative Achievement." So You going to simply say that the President isn't responsible because he has too many employes and can't possibly manage. That's a scary thought because the President is also in charge of another large organization -- the military. So your logic would suggest that the President isn't responsible for the acts of the military, yet in the same breath folks have no problem blaming Bush for Abu Ghraib. As Harry Truman said, the buck stops here. By the way, Warren Buffet isn't the CEO of GEICO. Tom Nicely is and yes, I would certainly call Mr. Nicely incompetent is a website they had over 2 years of lead time to build faild, especially if it were part of Mr. Nicely's "Signature" achievement and grand promise to revolutionize auto insurance for the company's customers. Should Steve Balmer be blamed for Windows Vista? Balmer had almost 100K employees, so obviously Vista couldn't have been his fault. Guys, it's a damned website! It's essentially just a guided questionnaire. The "tough" part is that it probably has to talk to insurance company APIs. Other than that, it was purely a greenfield project. I'm sure we could assemble a team of 10 guys (or girls) from right here in Hacker News and could build a better product in 25% of the time at 1/100th of the cost. Actually, I would go so far as to say that the basic functionality could be built with a team of 6 with a budget of $500K. Remember, this site ISN'T administering insurance. It's Kayak for insurance -- that's pretty much it. There is NO excuse for this level of incompetence. If I built healthcare.gov for a private client I wouldn't have been paid. I probably would have been sued. Yet according to the person to whom I am replying, The White House bears no responsibility because the government is just too damned big for the President to be responsible. I didn't elect the President to suck, but that's what's happening.
- KevinEldon 13y ago
  It also highlights that the privacy and security were not as important to management as launching the app on a fixed deadline.
  - generj 13y ago
    Yes, in that the security checks were forced through. But that's not atypical - the security requirements for federal sites are amazingly complex to navigate, and even if the site was a) functional and b) secure in time for testing, it's likely they would have punted that down the road a bit, or even indefinitely. The mind still boggles. If I was even asked by a client to put a password reset in analytics, I would report it to my manager immediately, then refuse the client's request. If the client didn't give up on tracking this, we'd have to stop working for them. That's how serious raw PII is in analytics. You'd have to be seriously incompetent to even consider tracking a password request.
    - pionar 13y ago
      "Never attribute to malice that which is adequately explained by stupidity." I think that situation was probably just sloppy coding of some sort, not an intentional act.
      - generj 13y ago
        Reflecting on the blogger sourced by Arstechnica, you are correct. The data is present in the URL (queryString) for the page, so there is nothing malicious about the analytics code, which is merely going about it's default of reporting the URL of the page. Returning that sort of data in a queryString is still far outside the realm of common sense.
  - Spooky23 13y ago
    Of course. They already had to do a password reset for everyone -- it's probably been breached already.
- kmfrk 13y ago
  It's like they were running up against a deadline and just crunched the best they could. There is so much insanity in this project, and I say that as someone who more than anything wants this to succeed.
  - generj 13y ago
    Crunching against tight deadlines is not abnormal in big IT projects. Which is of course why big IT projects are such horrible things. The risks (some would say inevitable results) are well researched at this point. There is a reason the world has switched to Agile or Agile-like processes. There is no reason a project with a 3 year timeline didn't have a build and testing starting at year 1 and continuing periodically. There shouldn't have been any development by the start of September 2013. None, except fixing bugs found by testers.
    - GVIrish 13y ago
      The problem is that if you have a terrible customer holding the purse strings, no development methodology would save you. Maybe if CGI used an Agile process to develop this, they could've at least gotten a good start even though the requirements were horribly late and were changing all the way up to launch. But we don't even know if they received enough requirements to start development before this year. We also don't know if the customer would've authorized them to start development before this year. Bad decisions and failings from the customer can doom projects like these very early in the process. And even if CGI had used Agile and gotten as much done as they could, if you didn't get all of the requirements in time to implement them, you still probably couldn't launch. Politically HHS probably would not agree to launch without certain functionality completed. In a sane project if you're getting big requirements changes late in the game you'd either push them to another release or you'd push back the release date. Neither happened and predictably, disaster ensued. Then there's the whole idiocy of allocating one week for full integration testing. Of course that test failed but again, no one sounded the alarm (at least not publicly).
gesman 13y ago
I think we had enough punch bagging on this.
- InclinedPlane 13y ago
  Until it's fixed, until it's worthy of the hard earned money spent on it (which is a considerable sum), no, we haven't had enough. This is government accountability 101.
  - ajross 13y ago
    Agreed, as long as the "worthy" bit of your sentence remains the goal. This being an inherently political issue, probably 90% of the people grousing about how badly this works never wanted it to work at all (and probably 95% never would have used it anyway, being employed with existing health care options). But to the extent that there are real people who want to purchase health plans through the federal exchange and can't: yes, this is a disaster and has to be fixed.
  - toomuchtodo 13y ago
    Wait wait wait. 2 failed wars costing over a trillion dollars, near-economic collapse due to the rollback of financial regulations, and NOW we're holding the government accountable?? Over healthcare.gov? Where the hell was everyone for the last 13 years?
    - InclinedPlane 13y ago
      Pretty sure the public voted a different party into the WH and senate due to some of those issues. Regardless, it's not as though bigger problems make it so that smaller but still very large problems should be ignored. Similarly, one does not need to decide between foreign policy mistakes, nsa wiretaps, and bailouts to be angry about, you can be angry about all of them, and hold government officials responsible for all of them. Besides which, healthcare.gov is a cornerstone of the affordable care act, which is a multi-trillion dollar endeavor.
      - 13y ago
programminggeek 13y ago
I think the only good news about HealhCare.gov is going to come from The Onion at this point.
spoiledtechie 13y ago
I blogged about this very problem the other day. http://spoiledtechie.com/post/2013/10/23/What-Scares-Me-about-the-Tech-Behind-Healthcaregov.aspx http://spoiledtechie.com/post/2013/10/23/What-Scares-Me-abou... If you think the UI is designed badly, just imagine how bad the backend is...
- semerda 13y ago
  "If you think the UI is designed badly, just imagine how bad the backend is..." - exactly! A glimpse into the mess that lies behind the curtains.
siphor 13y ago
Heh, i also wouldn't be surprised for this site to be a high profile target... Any successful attack to it would completely embarrass the u.s. Which id imagine is up there on some peoples lists right now
- generj 13y ago
  Are there really any new revelations that could make us be more embarrassed about healthcare.gov? Then again, I keep thinking that nothing the NSA does will surprise me anymore on a weekly basis, until another story like today happens.
- Turing_Machine 13y ago
  Leaving the embarrassment aside, this thing has to be the Holy Grail for identity thieves.
outside1234 13y ago
everyone is probably using "health" for their password anyway, amiright?
prawn 13y ago
Physical address of the organisation managing the site is amusingly "7500 Security Boulevard, Baltimore, MD 21244".
danso 13y ago
Not to diminish the researcher's work here, but even as bad as these security holes are, as reported, I'm mildly non-surprised...just because they've got to be much worse...the most visible parts of this system were cracking...it would be hard to believe that the unseen and often skipped-over parts of engineering would be more solid than what we've experienced, given the laughably short testing period. This is going to set back electronic medical records for quite a long time. Don't forget the Obama admin put aside $20 billion dollars to fund that, and contractors have been eating up that money for a few years now.
kaeawc 13y ago
Maybe HealthCare.gov is just a honey pot by design, except poorly cloaked?
aabalkan 13y ago
Seriously I'm thinking that whoever developed HealthCare.gov did not know anything about web development. I knew that one doesn't simply add usernames passwords to URLs when I was f*cking 12 years old. I am even more surprised that no one ever audited their security and US citizens are not asking government what the heck the money is gone to. That's a reason that many government officials should immediately resign from their positions.
joezydeco 13y ago
Somewhere in America, Harper Reed is breathing a massive sigh of relief.
garthdog 13y ago
Move fast and break things!
ck2 13y ago
So if all 50 states created their own exchanges, healthcare.gov would have just been an info splash page? I mean even DC created their own exchange, what was the excuse of the other 30+ states?
- peterstjohn 13y ago
  It was part of an organised plan to try and sabotage Obamacare, having lost the legislative battle and the Presidential election.
  - hga 13y ago
    These Blue or Purple states are not doing one: New Hampshire, New Mexico for the moment for individuals, Utah permanently for individuals, Arkansas, Iowa, Michigan, Illinois. Plus my Purple home state of Missouri isn't doing one based on a citizen initiative in 2012, where 62% of us voted to outlaw the creation of a state exchange unless authorized by the people or the legislature (http://ballotpedia.org/wiki/index.php/Missouri_Health_Care_Exchange_Question,_Proposition_E_(2012) http://ballotpedia.org/wiki/index.php/Missouri_Health_Care_E... ). I also find it highly questionable to score elections like you have. Not only are you ignoring Scott Brown and 2010, but the one in 2012 was between Mr. Obamacare and Mr. Romneycare, the eGOP handed voters the single worst possible candidate to have a referendum on Obamacare about. More generally, you should acknowledge this is the first ever major entitlement program that didn't pass on a widely popular bipartisan basis, from FDR's Social Security to Bush's Medicare Part D prescription one. It would be remarkable if that didn't have consequences we've never seen before. Or more specifically, how did not building an exchange "sabotage" Healthcare.gov? Sounds like you're trying to magic a perceived by you sin of omission into a sin of commission. Can't be a volume problem, seeing as how the site failed in integration testing a week before launch before achieving 200 simultaneous logins, and so much has to go through it for every exchange (remember when Verizon's goof shut them all down) and perhaps one day if they get around to it insurer (it's the only allowed source of subsidy calculations, which does make some sense).
  - crusso 13y ago
    Right, because the States are just vassals of the Federal government. They must meekly go along with poorly written and executed laws of the Feds.
vincie 13y ago
I am going to make a stand for all the developers working furiously on this, although I don't know any of them. I blame it all on management, and they have the worst kind - politicians. I write this as I am certain it is very similar to what happened here in Brisbane Australia with the Queensland Health payroll system fiasco. Under severe pressure from politicians, they pushed out a system without thoroughly testing it first. Edit: The Queensland health Payroll system was quoted at $6.19 million, latest revised cost is $1.2 billion.
- briandear 13y ago
  I don't blame the devs either. I know they crap with which they must deal. It must be like the movie Office Space mixed with endless meetings, thousands of pages of specification docs with the agility of an 12th century stone wall.
- stef25 13y ago
  I'm a dev up shitcreek with no paddle and also blame management ("here take a couple more projects. And support a couple more", while trying to rewrite a piece of sh*t that's already months behind). It's almost always the go-to excuse though, I just don't know if it's the truth anymore. Of course we'd blame management. Depressing.
  - vincie 13y ago
    Darn you sound like you work with me. And I swear to almighty god it is never my fault. A bunch of idiots get together and promise that I will deliver this piece of software at this date, without inviting me along to the meeting. Then, they write the specs (shouldn't it be the other way round at this point?). In most cases, the specs are incomplete and they want me to start while they are still finalizing stuff. I go tell them about a roadblock, and that they should revise the deadline and they tell me I should go ask someone else how to do it as if I am incompetent. And they always think bringing in more developers would make things go faster. Damn I am beginning to lose my cool just writing this.
    - 13y ago
disposition2 13y ago
Maybe they should've ran the site through the 'meaningful use' certification process first...
- hga 13y ago
  Very funny. I have a friend in this general field. Last time I checked, he told me those two words in the "Stimulus" bill expands in ~ 700 pages of regulations and it has made a bunch of consultants on it quite wealthy. Per Michelle Malkin, who lost her Primary Care Physician to this insanity, talking about another (http://michellemalkin.com/2013/10/23/dont-forget-obamacares-electronic-medical-records-wreck/ http://michellemalkin.com/2013/10/23/dont-forget-obamacares-...): "Dr. Michael Laidlaw of Rocklin, Calif., told EHR Practice Consultants that he abandoned the Obamacare EMR “incentive” program “when I realized that I spent the first two to five minutes of each visit endlessly clicking a bunch of garbage to make all the green lights show up on the (meaningful use) meter. I said to myself: ‘I’m not wasting precious seconds of my life and my patients’ time to ensure some database gets filled with data. I didn’t go into medicine for this. It is not benefiting my patients or me. I hate it.’ I actually refused to take the $10K-plus this year. I have even accepted that I would rather be penalized in the future. What is worth the most to me is AUTONOMY." The later refers to the concept that this is firmly inserting the visible foot of government into the physician patient relationship.
mcone 13y ago
Former federal IT security contractor here. There's nothing unusual about this event, except perhaps the fact that it's receiving national attention. When I worked for the federal agency responsible for providing health care services to tribal entities, we would routinely accept and issue waivers for high-level risks discovered in RPMS (called VistA at the VA), the 30-year-old EHR application we used to store PHI and PII. Honestly, I don't know why we even bothered performing C&As and penetration tests -- everybody knew we weren't going to mitigate the vulnerabilities, even before we started testing for them. It was an incredibly frustrating environment to work in. Federal law required us to test for vulnerabilities, but the director and CIO didn't give a shit about infosec and the CISO just kept issuing waivers for everything.
- generj 13y ago
  > the federal agency responsible for providing health care services to tribal entities Wouldn't that be the IHS, which is underneath HHS? Suggesting a general disdain for security within the HHS? Healthcare.gov is underneath CMS, not IHS, but I don't think it's unreasonable to conclude that the overarching body, HHS, has poor security practices.

118 points by Cbasedlifeform 13y ago

Passing this sort of data in analytics requests is mind-boggingly-stupid. Most analytics providers explicitly tell you not to pass along Personally Identifiable Information (PII). Their Terms of Contract usually state doing so is a terminable offense. It's part of the training process to be certified by most providers. Basically, this only highlights how terrible the programmers at healthcare.gov are.

briandear 13y ago
We can blame the programmers, but who is ultimately responsible. The Whitehouse is the executive branch; they are paid to execute and ultimately this is entirely their responsibility. They are the project managers of this entire mess. Now imagine those same people deciding your medical treatment. It's just sheer incompetence disguised as politics. Of course a more subversive view would suggest that this was engineered in order to pave the way for single payer. The Soviets built better cars than the US government builds websites.
- llamataboot 13y ago
  Last I checked, the Affordable Care Act really didn't involve anyone at the Executive Branch deciding on what medical treatment I could get. Downvoted for fearmongering and paranoid speculation. (purposely botched implementation of a large software project to make single payer easier? Because the Tea Party shutting down the US government to try to block this healthcare bill makes it likely we will see single payer pass?)
  - Shivetya 13y ago
    Actually if the Independent Payment Advisory Board fails to develop a proposal should costs exceed certain thresholds then the Secretary of Health and Human services must submit a proposal themselves which they must implement. Since all appointees to this committee must be agreed upon by the Executive Branch as well as both minority and majority leaders from each party (hence 12 from Congress with the Presidents approval/recommendation) and 3 from the President, yes the Executive branch could very well determine what health options are available too you. The real issues before us now are. 1) why can the Secretary of Health and Human Services even refuse to divulge enrollment numbers? 2) why is the same not keeping the President fully aware or made aware of the problems the site faced before launch and after (conspiracy advocated claim the President knew) 3) By regulating what must be covered and not covered they are deciding what you can have and have not. Remember, there are a lot of gray areas in the law which the Secretary has shown more than enough interest in creating actual rules.
    - generj 13y ago
      Of course, the nice part is that since they do have analytics (as terribly implemented as it appears to have been), we can force enrollment number disclosure by filing a FOIA request for the web analytics data. Which, incidentally, I did today before this story broke.
    - cma 13y ago
      You can still by supplemental insurance, so they aren't regulating what you can have, they are regulating the minimum floor.
      - drivingmissm 13y ago
        Obamacare is not a "minimum floor" it is a full suite of mandated coverage for every politically connected medical sector.
        dragonwriter 13y ago
        Yes, its a minimum floor. And there are many plans that offer more than the ACA minimum. You may not like where the minimum is set, but that doesn't make it anything but a minimum floor.
      - RickHull 13y ago
        > they aren't regulating what you can have, they are regulating the minimum floor. This is utter nonsense on its face. If I have (or want) something under the minimum floor, they have regulated that away from me. They have regulated what I can have.
        VladRussian2 13y ago
        They also regulated away spoiled beef in stores, non smoke detectors equipped bedrooms and poisoned tap water. You can't have it. Minimum floor.
        13y ago
  - briandear 13y ago
    Actually, have you read the entire bill? If Government is controlling the insurance, they are controlling the care. And yes, if the Affordable Care Act forces insurers to leave markets, then the only thing left would be a call for single payer. Harry Reid even said that Obamacare is "absolutely" a step towards single payer. And, by the way, the calls for Single Payer because of the Obamacare "mess" are starting, Paul Krugman seems to be leading the charge along with others. So could making the Obamacare rollout rougher than necessary prime the pump for a single payer push? I don't know, could closing the WWII memorial and Mt. Rushmore scenic roadside stops make the government shutdown worse than it needed to be to make a political point? The White House would never do that would they? That's just paranoid conspiracy stuff right? Strangely enough the Andrews Air Force Base golf course stayed open during the shutdown but the privately run Mt. Vernon (who happens to lease land from the Park Service) was forced to close. The even closed the Normandy beach in France! Yet, I had no problems getting a routine consular appointment during the shutdown in Marseille. It's not paranoia if it's really happening. http://www.healthcare-now.org/sen-reid-obamacare-absolutely-a-step-toward-a-single-payer-system http://www.healthcare-now.org/sen-reid-obamacare-absolutely-... http://www.forbes.com/sites/paulroderickgregory/2013/10/28/obama-care-a-mess-liberals-say-go-single-payer/ http://www.forbes.com/sites/paulroderickgregory/2013/10/28/o...
- crusso 13y ago
  Actually, what I think about is the recent government shutdown where the administration went out of its way to close monuments even when those monuments required no federal funds to keep running... even those monuments that had remained open during previous shutdowns. Obviously we witnessed an administration that wanted to really put the screws to the voting public to score political points. Now imagine when they want to do something similar with your healthcare.
  - mkramlich 13y ago
    If I were forced to choose between the following 3 entities/groups as to who the factual evidence suggests was trying to "put the screws to the voting public": 1. Presidency 2. Repubs in Congress 3. Dems in Congress I'd have to pick #2. Overwhelming disposition of evidence pointing in that direction. In the spirit of your point: now imagine what those folks would be willing to do to your healthcare. Actually, we don't have to imagine. Look at their actions.
    - roboneal 13y ago
      Since these is not typically a political discussion forum, at least outline your "overwhelming" factual evidence.
  - GVIrish 13y ago
    What evidence do you have that the administration had anything to do with shutting down monuments? Something like that is at the discretion of the director of a given federal agency. Now maybe the director of the National Park Service decided that he was going to shut monuments down as a matter of politics, but you have to recognize that there are good reasons to do so. In DC in the last year we had a vandal deface the Lincoln Memorial and the National Cathedral. If during the shutdown the National Park Service just left all of the monuments unguarded and someone took a hammer to the nose of a statue of Jefferson, that'd be a humongous price to pay. In a national park, without park rangers to rescue people, if someone got themselves into trouble and died, that would be worse than ruining some people's vacations. It is possible that the White House ordered parks and monuments closed for political reasons, but that's all speculation at this point. No different than speculating that George W. Bush allowed 9/11 to happen to justify invading Iraq.
- generj 13y ago
  According to the article, Marilyn Tavenner is responsible for authorizing the security checks to be skipped, along with several other administrators at HHS. Now, I would argue that Sibelius is ultimately responsible for setting unrealistic timelines, and general culture at HHS, but without a smoking gun I'm not going to blame the President. Yet. Although I think he entrusted his only signature act in the hands of a very incompetent woman, and gave her carte blanche for 3 years. The programmer responsible (and his QA) should still be relegated to typewriters for the rest of their careers.
  - briandear 13y ago
    The fault lies with Sebelius, however the same logic would absolve Bush of Rumsfeld's errors.
    - GVIrish 13y ago
      To me the question is, once the president learns of the incompetence of a subordinate, what action does he take? Does the president hold the subordinate accountable, and fire them? Or does the president just let them keep on bungling. Rumsfeld eventually resigned, but Bush didn't push him out, meaning Bush owns Rumsfeld's failures. In my opinion, if Obama doesn't hold Sebelius and Clapper accountable, he owns their incompetence and misconduct.
- bdcravens 13y ago
  The US Government is accountable, yes. I'll even buy that the executive branch is the accountable party, given the role of implementing laws and programs. However, calling them the project manager of the site and then extending that to directly making medical treatment decisions is pretty crazy. If Amazon screws up my toilet paper order, does that mean they're automatically incompetent at auto-scaling my EC2 instances? For what it's worth, there's some crazy delegation of tasks in the ACA. For over a year now, I've been on the interim Preexisting Condition Insurance Program. (expires 12/31, so I'm in a bit of freakout mode, but that's another story for another time ....) It's administered by the Department of Agriculture. Ummm.... moo?
- Aloisius 13y ago
  The Whitehouse is the executive branch; they are paid to execute and ultimately this is entirely their responsibility. They are the project managers of this entire mess. Now imagine those same people deciding your medical treatment. It's just sheer incompetence disguised as politics. The executive branch has 2.1 million employees and is structured as set of a dozen subsidiary companies each with dozens of subsidiary companies. It is impossible for the Whitehouse, any Whitehouse, to manage except in a completely delegatory way. The idea that someone at the Whitehouse is going to be doing checkins with the contractors brought in to build a website is, frankly, laughable considering the number of things competing for attention. I mean, would you call Warren Buffet incompetent if GEICO rolled out a faulty website because he ultimately controls it?
  - briandear 13y ago
    Ok, so who the hell is in charge then? After all, The Affordable Car Act is the President's "Signature Legislative Achievement." So You going to simply say that the President isn't responsible because he has too many employes and can't possibly manage. That's a scary thought because the President is also in charge of another large organization -- the military. So your logic would suggest that the President isn't responsible for the acts of the military, yet in the same breath folks have no problem blaming Bush for Abu Ghraib. As Harry Truman said, the buck stops here. By the way, Warren Buffet isn't the CEO of GEICO. Tom Nicely is and yes, I would certainly call Mr. Nicely incompetent is a website they had over 2 years of lead time to build faild, especially if it were part of Mr. Nicely's "Signature" achievement and grand promise to revolutionize auto insurance for the company's customers. Should Steve Balmer be blamed for Windows Vista? Balmer had almost 100K employees, so obviously Vista couldn't have been his fault. Guys, it's a damned website! It's essentially just a guided questionnaire. The "tough" part is that it probably has to talk to insurance company APIs. Other than that, it was purely a greenfield project. I'm sure we could assemble a team of 10 guys (or girls) from right here in Hacker News and could build a better product in 25% of the time at 1/100th of the cost. Actually, I would go so far as to say that the basic functionality could be built with a team of 6 with a budget of $500K. Remember, this site ISN'T administering insurance. It's Kayak for insurance -- that's pretty much it. There is NO excuse for this level of incompetence. If I built healthcare.gov for a private client I wouldn't have been paid. I probably would have been sued. Yet according to the person to whom I am replying, The White House bears no responsibility because the government is just too damned big for the President to be responsible. I didn't elect the President to suck, but that's what's happening.
KevinEldon 13y ago
It also highlights that the privacy and security were not as important to management as launching the app on a fixed deadline.
- generj 13y ago
  Yes, in that the security checks were forced through. But that's not atypical - the security requirements for federal sites are amazingly complex to navigate, and even if the site was a) functional and b) secure in time for testing, it's likely they would have punted that down the road a bit, or even indefinitely. The mind still boggles. If I was even asked by a client to put a password reset in analytics, I would report it to my manager immediately, then refuse the client's request. If the client didn't give up on tracking this, we'd have to stop working for them. That's how serious raw PII is in analytics. You'd have to be seriously incompetent to even consider tracking a password request.
  - pionar 13y ago
    "Never attribute to malice that which is adequately explained by stupidity." I think that situation was probably just sloppy coding of some sort, not an intentional act.
    - generj 13y ago
      Reflecting on the blogger sourced by Arstechnica, you are correct. The data is present in the URL (queryString) for the page, so there is nothing malicious about the analytics code, which is merely going about it's default of reporting the URL of the page. Returning that sort of data in a queryString is still far outside the realm of common sense.
- Spooky23 13y ago
  Of course. They already had to do a password reset for everyone -- it's probably been breached already.
kmfrk 13y ago
It's like they were running up against a deadline and just crunched the best they could. There is so much insanity in this project, and I say that as someone who more than anything wants this to succeed.
- generj 13y ago
  Crunching against tight deadlines is not abnormal in big IT projects. Which is of course why big IT projects are such horrible things. The risks (some would say inevitable results) are well researched at this point. There is a reason the world has switched to Agile or Agile-like processes. There is no reason a project with a 3 year timeline didn't have a build and testing starting at year 1 and continuing periodically. There shouldn't have been any development by the start of September 2013. None, except fixing bugs found by testers.
  - GVIrish 13y ago
    The problem is that if you have a terrible customer holding the purse strings, no development methodology would save you. Maybe if CGI used an Agile process to develop this, they could've at least gotten a good start even though the requirements were horribly late and were changing all the way up to launch. But we don't even know if they received enough requirements to start development before this year. We also don't know if the customer would've authorized them to start development before this year. Bad decisions and failings from the customer can doom projects like these very early in the process. And even if CGI had used Agile and gotten as much done as they could, if you didn't get all of the requirements in time to implement them, you still probably couldn't launch. Politically HHS probably would not agree to launch without certain functionality completed. In a sane project if you're getting big requirements changes late in the game you'd either push them to another release or you'd push back the release date. Neither happened and predictably, disaster ensued. Then there's the whole idiocy of allocating one week for full integration testing. Of course that test failed but again, no one sounded the alarm (at least not publicly).

gesman 13y ago

I think we had enough punch bagging on this.

InclinedPlane 13y ago
Until it's fixed, until it's worthy of the hard earned money spent on it (which is a considerable sum), no, we haven't had enough. This is government accountability 101.
- ajross 13y ago
  Agreed, as long as the "worthy" bit of your sentence remains the goal. This being an inherently political issue, probably 90% of the people grousing about how badly this works never wanted it to work at all (and probably 95% never would have used it anyway, being employed with existing health care options). But to the extent that there are real people who want to purchase health plans through the federal exchange and can't: yes, this is a disaster and has to be fixed.
- toomuchtodo 13y ago
  Wait wait wait. 2 failed wars costing over a trillion dollars, near-economic collapse due to the rollback of financial regulations, and NOW we're holding the government accountable?? Over healthcare.gov? Where the hell was everyone for the last 13 years?
  - InclinedPlane 13y ago
    Pretty sure the public voted a different party into the WH and senate due to some of those issues. Regardless, it's not as though bigger problems make it so that smaller but still very large problems should be ignored. Similarly, one does not need to decide between foreign policy mistakes, nsa wiretaps, and bailouts to be angry about, you can be angry about all of them, and hold government officials responsible for all of them. Besides which, healthcare.gov is a cornerstone of the affordable care act, which is a multi-trillion dollar endeavor.
    - 13y ago

programminggeek 13y ago

I think the only good news about HealhCare.gov is going to come from The Onion at this point.

spoiledtechie 13y ago

I blogged about this very problem the other day. http://spoiledtechie.com/post/2013/10/23/What-Scares-Me-about-the-Tech-Behind-Healthcaregov.aspx http://spoiledtechie.com/post/2013/10/23/What-Scares-Me-abou... If you think the UI is designed badly, just imagine how bad the backend is...

semerda 13y ago
"If you think the UI is designed badly, just imagine how bad the backend is..." - exactly! A glimpse into the mess that lies behind the curtains.

siphor 13y ago

Heh, i also wouldn't be surprised for this site to be a high profile target... Any successful attack to it would completely embarrass the u.s. Which id imagine is up there on some peoples lists right now

generj 13y ago
Are there really any new revelations that could make us be more embarrassed about healthcare.gov? Then again, I keep thinking that nothing the NSA does will surprise me anymore on a weekly basis, until another story like today happens.
Turing_Machine 13y ago
Leaving the embarrassment aside, this thing has to be the Holy Grail for identity thieves.

outside1234 13y ago

everyone is probably using "health" for their password anyway, amiright?

prawn 13y ago

Physical address of the organisation managing the site is amusingly "7500 Security Boulevard, Baltimore, MD 21244".

danso 13y ago

Not to diminish the researcher's work here, but even as bad as these security holes are, as reported, I'm mildly non-surprised...just because they've got to be much worse...the most visible parts of this system were cracking...it would be hard to believe that the unseen and often skipped-over parts of engineering would be more solid than what we've experienced, given the laughably short testing period. This is going to set back electronic medical records for quite a long time. Don't forget the Obama admin put aside $20 billion dollars to fund that, and contractors have been eating up that money for a few years now.

kaeawc 13y ago

Maybe HealthCare.gov is just a honey pot by design, except poorly cloaked?

aabalkan 13y ago

Seriously I'm thinking that whoever developed HealthCare.gov did not know anything about web development. I knew that one doesn't simply add usernames passwords to URLs when I was f*cking 12 years old. I am even more surprised that no one ever audited their security and US citizens are not asking government what the heck the money is gone to. That's a reason that many government officials should immediately resign from their positions.

joezydeco 13y ago

Somewhere in America, Harper Reed is breathing a massive sigh of relief.

garthdog 13y ago

Move fast and break things!

ck2 13y ago

So if all 50 states created their own exchanges, healthcare.gov would have just been an info splash page? I mean even DC created their own exchange, what was the excuse of the other 30+ states?

peterstjohn 13y ago
It was part of an organised plan to try and sabotage Obamacare, having lost the legislative battle and the Presidential election.
- hga 13y ago
  These Blue or Purple states are not doing one: New Hampshire, New Mexico for the moment for individuals, Utah permanently for individuals, Arkansas, Iowa, Michigan, Illinois. Plus my Purple home state of Missouri isn't doing one based on a citizen initiative in 2012, where 62% of us voted to outlaw the creation of a state exchange unless authorized by the people or the legislature (http://ballotpedia.org/wiki/index.php/Missouri_Health_Care_Exchange_Question,_Proposition_E_(2012) http://ballotpedia.org/wiki/index.php/Missouri_Health_Care_E... ). I also find it highly questionable to score elections like you have. Not only are you ignoring Scott Brown and 2010, but the one in 2012 was between Mr. Obamacare and Mr. Romneycare, the eGOP handed voters the single worst possible candidate to have a referendum on Obamacare about. More generally, you should acknowledge this is the first ever major entitlement program that didn't pass on a widely popular bipartisan basis, from FDR's Social Security to Bush's Medicare Part D prescription one. It would be remarkable if that didn't have consequences we've never seen before. Or more specifically, how did not building an exchange "sabotage" Healthcare.gov? Sounds like you're trying to magic a perceived by you sin of omission into a sin of commission. Can't be a volume problem, seeing as how the site failed in integration testing a week before launch before achieving 200 simultaneous logins, and so much has to go through it for every exchange (remember when Verizon's goof shut them all down) and perhaps one day if they get around to it insurer (it's the only allowed source of subsidy calculations, which does make some sense).
- crusso 13y ago
  Right, because the States are just vassals of the Federal government. They must meekly go along with poorly written and executed laws of the Feds.

vincie 13y ago

I am going to make a stand for all the developers working furiously on this, although I don't know any of them. I blame it all on management, and they have the worst kind - politicians. I write this as I am certain it is very similar to what happened here in Brisbane Australia with the Queensland Health payroll system fiasco. Under severe pressure from politicians, they pushed out a system without thoroughly testing it first. Edit: The Queensland health Payroll system was quoted at $6.19 million, latest revised cost is $1.2 billion.

briandear 13y ago
I don't blame the devs either. I know they crap with which they must deal. It must be like the movie Office Space mixed with endless meetings, thousands of pages of specification docs with the agility of an 12th century stone wall.
stef25 13y ago
I'm a dev up shitcreek with no paddle and also blame management ("here take a couple more projects. And support a couple more", while trying to rewrite a piece of sh*t that's already months behind). It's almost always the go-to excuse though, I just don't know if it's the truth anymore. Of course we'd blame management. Depressing.
- vincie 13y ago
  Darn you sound like you work with me. And I swear to almighty god it is never my fault. A bunch of idiots get together and promise that I will deliver this piece of software at this date, without inviting me along to the meeting. Then, they write the specs (shouldn't it be the other way round at this point?). In most cases, the specs are incomplete and they want me to start while they are still finalizing stuff. I go tell them about a roadblock, and that they should revise the deadline and they tell me I should go ask someone else how to do it as if I am incompetent. And they always think bringing in more developers would make things go faster. Damn I am beginning to lose my cool just writing this.
  - 13y ago

disposition2 13y ago

Maybe they should've ran the site through the 'meaningful use' certification process first...

hga 13y ago
Very funny. I have a friend in this general field. Last time I checked, he told me those two words in the "Stimulus" bill expands in ~ 700 pages of regulations and it has made a bunch of consultants on it quite wealthy. Per Michelle Malkin, who lost her Primary Care Physician to this insanity, talking about another (http://michellemalkin.com/2013/10/23/dont-forget-obamacares-electronic-medical-records-wreck/ http://michellemalkin.com/2013/10/23/dont-forget-obamacares-...): "Dr. Michael Laidlaw of Rocklin, Calif., told EHR Practice Consultants that he abandoned the Obamacare EMR “incentive” program “when I realized that I spent the first two to five minutes of each visit endlessly clicking a bunch of garbage to make all the green lights show up on the (meaningful use) meter. I said to myself: ‘I’m not wasting precious seconds of my life and my patients’ time to ensure some database gets filled with data. I didn’t go into medicine for this. It is not benefiting my patients or me. I hate it.’ I actually refused to take the $10K-plus this year. I have even accepted that I would rather be penalized in the future. What is worth the most to me is AUTONOMY." The later refers to the concept that this is firmly inserting the visible foot of government into the physician patient relationship.

mcone 13y ago

Former federal IT security contractor here. There's nothing unusual about this event, except perhaps the fact that it's receiving national attention. When I worked for the federal agency responsible for providing health care services to tribal entities, we would routinely accept and issue waivers for high-level risks discovered in RPMS (called VistA at the VA), the 30-year-old EHR application we used to store PHI and PII. Honestly, I don't know why we even bothered performing C&As and penetration tests -- everybody knew we weren't going to mitigate the vulnerabilities, even before we started testing for them. It was an incredibly frustrating environment to work in. Federal law required us to test for vulnerabilities, but the director and CIO didn't give a shit about infosec and the CISO just kept issuing waivers for everything.

generj 13y ago
> the federal agency responsible for providing health care services to tribal entities Wouldn't that be the IHS, which is underneath HHS? Suggesting a general disdain for security within the HHS? Healthcare.gov is underneath CMS, not IHS, but I don't think it's unreasonable to conclude that the overarching body, HHS, has poor security practices.