7 ms·

Passing this sort of data in analytics requests is mind-boggingly-stupid. Most analytics providers explicitly tell you not to pass along Personally Identifiabl

by generj 13y ago

Passing this sort of data in analytics requests is mind-boggingly-stupid. Most analytics providers explicitly tell you not to pass along Personally Identifiable Information (PII). Their Terms of Contract usually state doing so is a terminable offense. It's part of the training process to be certified by most providers. Basically, this only highlights how terrible the programmers at healthcare.gov are.

briandear 13y ago
We can blame the programmers, but who is ultimately responsible. The Whitehouse is the executive branch; they are paid to execute and ultimately this is entirely their responsibility. They are the project managers of this entire mess. Now imagine those same people deciding your medical treatment. It's just sheer incompetence disguised as politics. Of course a more subversive view would suggest that this was engineered in order to pave the way for single payer. The Soviets built better cars than the US government builds websites.
- llamataboot 13y ago
  Last I checked, the Affordable Care Act really didn't involve anyone at the Executive Branch deciding on what medical treatment I could get. Downvoted for fearmongering and paranoid speculation. (purposely botched implementation of a large software project to make single payer easier? Because the Tea Party shutting down the US government to try to block this healthcare bill makes it likely we will see single payer pass?)
  - Shivetya 13y ago
    Actually if the Independent Payment Advisory Board fails to develop a proposal should costs exceed certain thresholds then the Secretary of Health and Human services must submit a proposal themselves which they must implement. Since all appointees to this committee must be agreed upon by the Executive Branch as well as both minority and majority leaders from each party (hence 12 from Congress with the Presidents approval/recommendation) and 3 from the President, yes the Executive branch could very well determine what health options are available too you. The real issues before us now are. 1) why can the Secretary of Health and Human Services even refuse to divulge enrollment numbers? 2) why is the same not keeping the President fully aware or made aware of the problems the site faced before launch and after (conspiracy advocated claim the President knew) 3) By regulating what must be covered and not covered they are deciding what you can have and have not. Remember, there are a lot of gray areas in the law which the Secretary has shown more than enough interest in creating actual rules.
    - generj 13y ago
      Of course, the nice part is that since they do have analytics (as terribly implemented as it appears to have been), we can force enrollment number disclosure by filing a FOIA request for the web analytics data. Which, incidentally, I did today before this story broke.
    - cma 13y ago
      You can still by supplemental insurance, so they aren't regulating what you can have, they are regulating the minimum floor.
      - drivingmissm 13y ago
        Obamacare is not a "minimum floor" it is a full suite of mandated coverage for every politically connected medical sector.
        dragonwriter 13y ago
        Yes, its a minimum floor. And there are many plans that offer more than the ACA minimum. You may not like where the minimum is set, but that doesn't make it anything but a minimum floor.
      - RickHull 13y ago
        > they aren't regulating what you can have, they are regulating the minimum floor. This is utter nonsense on its face. If I have (or want) something under the minimum floor, they have regulated that away from me. They have regulated what I can have.
        VladRussian2 13y ago
        They also regulated away spoiled beef in stores, non smoke detectors equipped bedrooms and poisoned tap water. You can't have it. Minimum floor.
        13y ago
  - briandear 13y ago
    Actually, have you read the entire bill? If Government is controlling the insurance, they are controlling the care. And yes, if the Affordable Care Act forces insurers to leave markets, then the only thing left would be a call for single payer. Harry Reid even said that Obamacare is "absolutely" a step towards single payer. And, by the way, the calls for Single Payer because of the Obamacare "mess" are starting, Paul Krugman seems to be leading the charge along with others. So could making the Obamacare rollout rougher than necessary prime the pump for a single payer push? I don't know, could closing the WWII memorial and Mt. Rushmore scenic roadside stops make the government shutdown worse than it needed to be to make a political point? The White House would never do that would they? That's just paranoid conspiracy stuff right? Strangely enough the Andrews Air Force Base golf course stayed open during the shutdown but the privately run Mt. Vernon (who happens to lease land from the Park Service) was forced to close. The even closed the Normandy beach in France! Yet, I had no problems getting a routine consular appointment during the shutdown in Marseille. It's not paranoia if it's really happening. http://www.healthcare-now.org/sen-reid-obamacare-absolutely-a-step-toward-a-single-payer-system http://www.healthcare-now.org/sen-reid-obamacare-absolutely-... http://www.forbes.com/sites/paulroderickgregory/2013/10/28/obama-care-a-mess-liberals-say-go-single-payer/ http://www.forbes.com/sites/paulroderickgregory/2013/10/28/o...
- crusso 13y ago
  Actually, what I think about is the recent government shutdown where the administration went out of its way to close monuments even when those monuments required no federal funds to keep running... even those monuments that had remained open during previous shutdowns. Obviously we witnessed an administration that wanted to really put the screws to the voting public to score political points. Now imagine when they want to do something similar with your healthcare.
  - mkramlich 13y ago
    If I were forced to choose between the following 3 entities/groups as to who the factual evidence suggests was trying to "put the screws to the voting public": 1. Presidency 2. Repubs in Congress 3. Dems in Congress I'd have to pick #2. Overwhelming disposition of evidence pointing in that direction. In the spirit of your point: now imagine what those folks would be willing to do to your healthcare. Actually, we don't have to imagine. Look at their actions.
    - roboneal 13y ago
      Since these is not typically a political discussion forum, at least outline your "overwhelming" factual evidence.
  - GVIrish 13y ago
    What evidence do you have that the administration had anything to do with shutting down monuments? Something like that is at the discretion of the director of a given federal agency. Now maybe the director of the National Park Service decided that he was going to shut monuments down as a matter of politics, but you have to recognize that there are good reasons to do so. In DC in the last year we had a vandal deface the Lincoln Memorial and the National Cathedral. If during the shutdown the National Park Service just left all of the monuments unguarded and someone took a hammer to the nose of a statue of Jefferson, that'd be a humongous price to pay. In a national park, without park rangers to rescue people, if someone got themselves into trouble and died, that would be worse than ruining some people's vacations. It is possible that the White House ordered parks and monuments closed for political reasons, but that's all speculation at this point. No different than speculating that George W. Bush allowed 9/11 to happen to justify invading Iraq.
- generj 13y ago
  According to the article, Marilyn Tavenner is responsible for authorizing the security checks to be skipped, along with several other administrators at HHS. Now, I would argue that Sibelius is ultimately responsible for setting unrealistic timelines, and general culture at HHS, but without a smoking gun I'm not going to blame the President. Yet. Although I think he entrusted his only signature act in the hands of a very incompetent woman, and gave her carte blanche for 3 years. The programmer responsible (and his QA) should still be relegated to typewriters for the rest of their careers.
  - briandear 13y ago
    The fault lies with Sebelius, however the same logic would absolve Bush of Rumsfeld's errors.
    - GVIrish 13y ago
      To me the question is, once the president learns of the incompetence of a subordinate, what action does he take? Does the president hold the subordinate accountable, and fire them? Or does the president just let them keep on bungling. Rumsfeld eventually resigned, but Bush didn't push him out, meaning Bush owns Rumsfeld's failures. In my opinion, if Obama doesn't hold Sebelius and Clapper accountable, he owns their incompetence and misconduct.
- bdcravens 13y ago
  The US Government is accountable, yes. I'll even buy that the executive branch is the accountable party, given the role of implementing laws and programs. However, calling them the project manager of the site and then extending that to directly making medical treatment decisions is pretty crazy. If Amazon screws up my toilet paper order, does that mean they're automatically incompetent at auto-scaling my EC2 instances? For what it's worth, there's some crazy delegation of tasks in the ACA. For over a year now, I've been on the interim Preexisting Condition Insurance Program. (expires 12/31, so I'm in a bit of freakout mode, but that's another story for another time ....) It's administered by the Department of Agriculture. Ummm.... moo?
- Aloisius 13y ago
  The Whitehouse is the executive branch; they are paid to execute and ultimately this is entirely their responsibility. They are the project managers of this entire mess. Now imagine those same people deciding your medical treatment. It's just sheer incompetence disguised as politics. The executive branch has 2.1 million employees and is structured as set of a dozen subsidiary companies each with dozens of subsidiary companies. It is impossible for the Whitehouse, any Whitehouse, to manage except in a completely delegatory way. The idea that someone at the Whitehouse is going to be doing checkins with the contractors brought in to build a website is, frankly, laughable considering the number of things competing for attention. I mean, would you call Warren Buffet incompetent if GEICO rolled out a faulty website because he ultimately controls it?
  - briandear 13y ago
    Ok, so who the hell is in charge then? After all, The Affordable Car Act is the President's "Signature Legislative Achievement." So You going to simply say that the President isn't responsible because he has too many employes and can't possibly manage. That's a scary thought because the President is also in charge of another large organization -- the military. So your logic would suggest that the President isn't responsible for the acts of the military, yet in the same breath folks have no problem blaming Bush for Abu Ghraib. As Harry Truman said, the buck stops here. By the way, Warren Buffet isn't the CEO of GEICO. Tom Nicely is and yes, I would certainly call Mr. Nicely incompetent is a website they had over 2 years of lead time to build faild, especially if it were part of Mr. Nicely's "Signature" achievement and grand promise to revolutionize auto insurance for the company's customers. Should Steve Balmer be blamed for Windows Vista? Balmer had almost 100K employees, so obviously Vista couldn't have been his fault. Guys, it's a damned website! It's essentially just a guided questionnaire. The "tough" part is that it probably has to talk to insurance company APIs. Other than that, it was purely a greenfield project. I'm sure we could assemble a team of 10 guys (or girls) from right here in Hacker News and could build a better product in 25% of the time at 1/100th of the cost. Actually, I would go so far as to say that the basic functionality could be built with a team of 6 with a budget of $500K. Remember, this site ISN'T administering insurance. It's Kayak for insurance -- that's pretty much it. There is NO excuse for this level of incompetence. If I built healthcare.gov for a private client I wouldn't have been paid. I probably would have been sued. Yet according to the person to whom I am replying, The White House bears no responsibility because the government is just too damned big for the President to be responsible. I didn't elect the President to suck, but that's what's happening.
KevinEldon 13y ago
It also highlights that the privacy and security were not as important to management as launching the app on a fixed deadline.
- generj 13y ago
  Yes, in that the security checks were forced through. But that's not atypical - the security requirements for federal sites are amazingly complex to navigate, and even if the site was a) functional and b) secure in time for testing, it's likely they would have punted that down the road a bit, or even indefinitely. The mind still boggles. If I was even asked by a client to put a password reset in analytics, I would report it to my manager immediately, then refuse the client's request. If the client didn't give up on tracking this, we'd have to stop working for them. That's how serious raw PII is in analytics. You'd have to be seriously incompetent to even consider tracking a password request.
  - pionar 13y ago
    "Never attribute to malice that which is adequately explained by stupidity." I think that situation was probably just sloppy coding of some sort, not an intentional act.
    - generj 13y ago
      Reflecting on the blogger sourced by Arstechnica, you are correct. The data is present in the URL (queryString) for the page, so there is nothing malicious about the analytics code, which is merely going about it's default of reporting the URL of the page. Returning that sort of data in a queryString is still far outside the realm of common sense.
- Spooky23 13y ago
  Of course. They already had to do a password reset for everyone -- it's probably been breached already.
kmfrk 13y ago
It's like they were running up against a deadline and just crunched the best they could. There is so much insanity in this project, and I say that as someone who more than anything wants this to succeed.
- generj 13y ago
  Crunching against tight deadlines is not abnormal in big IT projects. Which is of course why big IT projects are such horrible things. The risks (some would say inevitable results) are well researched at this point. There is a reason the world has switched to Agile or Agile-like processes. There is no reason a project with a 3 year timeline didn't have a build and testing starting at year 1 and continuing periodically. There shouldn't have been any development by the start of September 2013. None, except fixing bugs found by testers.
  - GVIrish 13y ago
    The problem is that if you have a terrible customer holding the purse strings, no development methodology would save you. Maybe if CGI used an Agile process to develop this, they could've at least gotten a good start even though the requirements were horribly late and were changing all the way up to launch. But we don't even know if they received enough requirements to start development before this year. We also don't know if the customer would've authorized them to start development before this year. Bad decisions and failings from the customer can doom projects like these very early in the process. And even if CGI had used Agile and gotten as much done as they could, if you didn't get all of the requirements in time to implement them, you still probably couldn't launch. Politically HHS probably would not agree to launch without certain functionality completed. In a sane project if you're getting big requirements changes late in the game you'd either push them to another release or you'd push back the release date. Neither happened and predictably, disaster ensued. Then there's the whole idiocy of allocating one week for full integration testing. Of course that test failed but again, no one sounded the alarm (at least not publicly).

by generj 13y ago

briandear 13y ago

We can blame the programmers, but who is ultimately responsible. The Whitehouse is the executive branch; they are paid to execute and ultimately this is entirely their responsibility. They are the project managers of this entire mess. Now imagine those same people deciding your medical treatment. It's just sheer incompetence disguised as politics. Of course a more subversive view would suggest that this was engineered in order to pave the way for single payer. The Soviets built better cars than the US government builds websites.

llamataboot 13y ago
Last I checked, the Affordable Care Act really didn't involve anyone at the Executive Branch deciding on what medical treatment I could get. Downvoted for fearmongering and paranoid speculation. (purposely botched implementation of a large software project to make single payer easier? Because the Tea Party shutting down the US government to try to block this healthcare bill makes it likely we will see single payer pass?)
- Shivetya 13y ago
  Actually if the Independent Payment Advisory Board fails to develop a proposal should costs exceed certain thresholds then the Secretary of Health and Human services must submit a proposal themselves which they must implement. Since all appointees to this committee must be agreed upon by the Executive Branch as well as both minority and majority leaders from each party (hence 12 from Congress with the Presidents approval/recommendation) and 3 from the President, yes the Executive branch could very well determine what health options are available too you. The real issues before us now are. 1) why can the Secretary of Health and Human Services even refuse to divulge enrollment numbers? 2) why is the same not keeping the President fully aware or made aware of the problems the site faced before launch and after (conspiracy advocated claim the President knew) 3) By regulating what must be covered and not covered they are deciding what you can have and have not. Remember, there are a lot of gray areas in the law which the Secretary has shown more than enough interest in creating actual rules.
  - generj 13y ago
    Of course, the nice part is that since they do have analytics (as terribly implemented as it appears to have been), we can force enrollment number disclosure by filing a FOIA request for the web analytics data. Which, incidentally, I did today before this story broke.
  - cma 13y ago
    You can still by supplemental insurance, so they aren't regulating what you can have, they are regulating the minimum floor.
    - drivingmissm 13y ago
      Obamacare is not a "minimum floor" it is a full suite of mandated coverage for every politically connected medical sector.
      - dragonwriter 13y ago
        Yes, its a minimum floor. And there are many plans that offer more than the ACA minimum. You may not like where the minimum is set, but that doesn't make it anything but a minimum floor.
    - RickHull 13y ago
      > they aren't regulating what you can have, they are regulating the minimum floor. This is utter nonsense on its face. If I have (or want) something under the minimum floor, they have regulated that away from me. They have regulated what I can have.
      - VladRussian2 13y ago
        They also regulated away spoiled beef in stores, non smoke detectors equipped bedrooms and poisoned tap water. You can't have it. Minimum floor.
        13y ago
- briandear 13y ago
  Actually, have you read the entire bill? If Government is controlling the insurance, they are controlling the care. And yes, if the Affordable Care Act forces insurers to leave markets, then the only thing left would be a call for single payer. Harry Reid even said that Obamacare is "absolutely" a step towards single payer. And, by the way, the calls for Single Payer because of the Obamacare "mess" are starting, Paul Krugman seems to be leading the charge along with others. So could making the Obamacare rollout rougher than necessary prime the pump for a single payer push? I don't know, could closing the WWII memorial and Mt. Rushmore scenic roadside stops make the government shutdown worse than it needed to be to make a political point? The White House would never do that would they? That's just paranoid conspiracy stuff right? Strangely enough the Andrews Air Force Base golf course stayed open during the shutdown but the privately run Mt. Vernon (who happens to lease land from the Park Service) was forced to close. The even closed the Normandy beach in France! Yet, I had no problems getting a routine consular appointment during the shutdown in Marseille. It's not paranoia if it's really happening. http://www.healthcare-now.org/sen-reid-obamacare-absolutely-a-step-toward-a-single-payer-system http://www.healthcare-now.org/sen-reid-obamacare-absolutely-... http://www.forbes.com/sites/paulroderickgregory/2013/10/28/obama-care-a-mess-liberals-say-go-single-payer/ http://www.forbes.com/sites/paulroderickgregory/2013/10/28/o...
crusso 13y ago
Actually, what I think about is the recent government shutdown where the administration went out of its way to close monuments even when those monuments required no federal funds to keep running... even those monuments that had remained open during previous shutdowns. Obviously we witnessed an administration that wanted to really put the screws to the voting public to score political points. Now imagine when they want to do something similar with your healthcare.
- mkramlich 13y ago
  If I were forced to choose between the following 3 entities/groups as to who the factual evidence suggests was trying to "put the screws to the voting public": 1. Presidency 2. Repubs in Congress 3. Dems in Congress I'd have to pick #2. Overwhelming disposition of evidence pointing in that direction. In the spirit of your point: now imagine what those folks would be willing to do to your healthcare. Actually, we don't have to imagine. Look at their actions.
  - roboneal 13y ago
    Since these is not typically a political discussion forum, at least outline your "overwhelming" factual evidence.
- GVIrish 13y ago
  What evidence do you have that the administration had anything to do with shutting down monuments? Something like that is at the discretion of the director of a given federal agency. Now maybe the director of the National Park Service decided that he was going to shut monuments down as a matter of politics, but you have to recognize that there are good reasons to do so. In DC in the last year we had a vandal deface the Lincoln Memorial and the National Cathedral. If during the shutdown the National Park Service just left all of the monuments unguarded and someone took a hammer to the nose of a statue of Jefferson, that'd be a humongous price to pay. In a national park, without park rangers to rescue people, if someone got themselves into trouble and died, that would be worse than ruining some people's vacations. It is possible that the White House ordered parks and monuments closed for political reasons, but that's all speculation at this point. No different than speculating that George W. Bush allowed 9/11 to happen to justify invading Iraq.
generj 13y ago
According to the article, Marilyn Tavenner is responsible for authorizing the security checks to be skipped, along with several other administrators at HHS. Now, I would argue that Sibelius is ultimately responsible for setting unrealistic timelines, and general culture at HHS, but without a smoking gun I'm not going to blame the President. Yet. Although I think he entrusted his only signature act in the hands of a very incompetent woman, and gave her carte blanche for 3 years. The programmer responsible (and his QA) should still be relegated to typewriters for the rest of their careers.
- briandear 13y ago
  The fault lies with Sebelius, however the same logic would absolve Bush of Rumsfeld's errors.
  - GVIrish 13y ago
    To me the question is, once the president learns of the incompetence of a subordinate, what action does he take? Does the president hold the subordinate accountable, and fire them? Or does the president just let them keep on bungling. Rumsfeld eventually resigned, but Bush didn't push him out, meaning Bush owns Rumsfeld's failures. In my opinion, if Obama doesn't hold Sebelius and Clapper accountable, he owns their incompetence and misconduct.
bdcravens 13y ago
The US Government is accountable, yes. I'll even buy that the executive branch is the accountable party, given the role of implementing laws and programs. However, calling them the project manager of the site and then extending that to directly making medical treatment decisions is pretty crazy. If Amazon screws up my toilet paper order, does that mean they're automatically incompetent at auto-scaling my EC2 instances? For what it's worth, there's some crazy delegation of tasks in the ACA. For over a year now, I've been on the interim Preexisting Condition Insurance Program. (expires 12/31, so I'm in a bit of freakout mode, but that's another story for another time ....) It's administered by the Department of Agriculture. Ummm.... moo?
Aloisius 13y ago
The Whitehouse is the executive branch; they are paid to execute and ultimately this is entirely their responsibility. They are the project managers of this entire mess. Now imagine those same people deciding your medical treatment. It's just sheer incompetence disguised as politics. The executive branch has 2.1 million employees and is structured as set of a dozen subsidiary companies each with dozens of subsidiary companies. It is impossible for the Whitehouse, any Whitehouse, to manage except in a completely delegatory way. The idea that someone at the Whitehouse is going to be doing checkins with the contractors brought in to build a website is, frankly, laughable considering the number of things competing for attention. I mean, would you call Warren Buffet incompetent if GEICO rolled out a faulty website because he ultimately controls it?
- briandear 13y ago
  Ok, so who the hell is in charge then? After all, The Affordable Car Act is the President's "Signature Legislative Achievement." So You going to simply say that the President isn't responsible because he has too many employes and can't possibly manage. That's a scary thought because the President is also in charge of another large organization -- the military. So your logic would suggest that the President isn't responsible for the acts of the military, yet in the same breath folks have no problem blaming Bush for Abu Ghraib. As Harry Truman said, the buck stops here. By the way, Warren Buffet isn't the CEO of GEICO. Tom Nicely is and yes, I would certainly call Mr. Nicely incompetent is a website they had over 2 years of lead time to build faild, especially if it were part of Mr. Nicely's "Signature" achievement and grand promise to revolutionize auto insurance for the company's customers. Should Steve Balmer be blamed for Windows Vista? Balmer had almost 100K employees, so obviously Vista couldn't have been his fault. Guys, it's a damned website! It's essentially just a guided questionnaire. The "tough" part is that it probably has to talk to insurance company APIs. Other than that, it was purely a greenfield project. I'm sure we could assemble a team of 10 guys (or girls) from right here in Hacker News and could build a better product in 25% of the time at 1/100th of the cost. Actually, I would go so far as to say that the basic functionality could be built with a team of 6 with a budget of $500K. Remember, this site ISN'T administering insurance. It's Kayak for insurance -- that's pretty much it. There is NO excuse for this level of incompetence. If I built healthcare.gov for a private client I wouldn't have been paid. I probably would have been sued. Yet according to the person to whom I am replying, The White House bears no responsibility because the government is just too damned big for the President to be responsible. I didn't elect the President to suck, but that's what's happening.

KevinEldon 13y ago

It also highlights that the privacy and security were not as important to management as launching the app on a fixed deadline.

generj 13y ago
Yes, in that the security checks were forced through. But that's not atypical - the security requirements for federal sites are amazingly complex to navigate, and even if the site was a) functional and b) secure in time for testing, it's likely they would have punted that down the road a bit, or even indefinitely. The mind still boggles. If I was even asked by a client to put a password reset in analytics, I would report it to my manager immediately, then refuse the client's request. If the client didn't give up on tracking this, we'd have to stop working for them. That's how serious raw PII is in analytics. You'd have to be seriously incompetent to even consider tracking a password request.
- pionar 13y ago
  "Never attribute to malice that which is adequately explained by stupidity." I think that situation was probably just sloppy coding of some sort, not an intentional act.
  - generj 13y ago
    Reflecting on the blogger sourced by Arstechnica, you are correct. The data is present in the URL (queryString) for the page, so there is nothing malicious about the analytics code, which is merely going about it's default of reporting the URL of the page. Returning that sort of data in a queryString is still far outside the realm of common sense.
Spooky23 13y ago
Of course. They already had to do a password reset for everyone -- it's probably been breached already.

kmfrk 13y ago

It's like they were running up against a deadline and just crunched the best they could. There is so much insanity in this project, and I say that as someone who more than anything wants this to succeed.

generj 13y ago
Crunching against tight deadlines is not abnormal in big IT projects. Which is of course why big IT projects are such horrible things. The risks (some would say inevitable results) are well researched at this point. There is a reason the world has switched to Agile or Agile-like processes. There is no reason a project with a 3 year timeline didn't have a build and testing starting at year 1 and continuing periodically. There shouldn't have been any development by the start of September 2013. None, except fixing bugs found by testers.
- GVIrish 13y ago
  The problem is that if you have a terrible customer holding the purse strings, no development methodology would save you. Maybe if CGI used an Agile process to develop this, they could've at least gotten a good start even though the requirements were horribly late and were changing all the way up to launch. But we don't even know if they received enough requirements to start development before this year. We also don't know if the customer would've authorized them to start development before this year. Bad decisions and failings from the customer can doom projects like these very early in the process. And even if CGI had used Agile and gotten as much done as they could, if you didn't get all of the requirements in time to implement them, you still probably couldn't launch. Politically HHS probably would not agree to launch without certain functionality completed. In a sane project if you're getting big requirements changes late in the game you'd either push them to another release or you'd push back the release date. Neither happened and predictably, disaster ensued. Then there's the whole idiocy of allocating one week for full integration testing. Of course that test failed but again, no one sounded the alarm (at least not publicly).