4 ms·

While I agree with the overall thrust of the article, I have to take issue with the author's ostensibly-BigData-access-enabled disaster scenarios. Because let'

While I agree with the overall thrust of the article, I have to take issue with the author's ostensibly-BigData-access-enabled disaster scenarios. Because let's be honest... From which source would the data be more likely to be stolen to enable the author's scenarios? Google's infrastructure (post-hardening against intrusion by---among other entities---GCHQ)? Or the NHS's system (which has been proven to---among other things---hand data on every NHS patient in England and Wales out to contractors on 27 unauditable, non-remotely-deletable DVDs)?

mercurial 13y ago
While I agree with your overall point that Google security is pretty big, I have no reason to think they did anything else than copy the data to Google, and that the original data is not still hosted in their infrastructure.
vidarh 13y ago
See the update to the post - apparently the data was made publicly accessible. It's not about Google per se. It's about what this says about the consultancy's laissez faire attitude to dealing with this data.
- notahacker 13y ago
  The addendum to the post appears to be a totally unrelated NHS security breach, which actually strengthens the point made by the poster-above-but-one. Further down the page still, in the comments section, I saw this: To quote from the report where PA admitted this is what they had done: " ...upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards." So they are claiming that they (a) had permission to do this and (b) steps were taken to secure it. It may also be that PA via partnership with Google have access to a more secure version of BigData. Don't get me wrong, I've sold proprietary data to big-name management consultants before and know they don't always respect licensing restrictions, but at the moment the suggestion that PA have actually done anything wrong here is pure conjecture
qwerta 13y ago
I think Google has direct line to NSA, so yes the Google.
- fixermark 13y ago
  The article wasn't positing scenarios enabled by a nation's intelligence arm having access to the health records; it was positing burglary gangs, religious organizations, and insurance companies having (and abusing) access to the data. I suppose one could posit a scenario where an intelligence agency abuses access to the health records of citizens of another nation, but the scenarios highlighted in the article are not enabled by PA uploading the data to Google's servers. I'd even go so far as to argue that the specific scenarios highlighted in the article are LESS likely if PA uploaded the data to Google's service and then destroyed the originals; "27 DVDs" is a format far more likely to be stolen by a burglary gang. Assuming the author's scenarios are enabled by NSA access assumes a much, much larger global conspiracy against the people of England and Wales than I'd be willing to assume. (This thought process even grants the assumption that the NSA has some kind of clear-text access to the data in Google's services these days, which is also not an assumption I'd make.)
- Oletros 13y ago
  > I think Google has direct line to NSA, Source?

mercurial 13y ago

While I agree with your overall point that Google security is pretty big, I have no reason to think they did anything else than copy the data to Google, and that the original data is not still hosted in their infrastructure.

vidarh 13y ago

See the update to the post - apparently the data was made publicly accessible. It's not about Google per se. It's about what this says about the consultancy's laissez faire attitude to dealing with this data.

notahacker 13y ago
The addendum to the post appears to be a totally unrelated NHS security breach, which actually strengthens the point made by the poster-above-but-one. Further down the page still, in the comments section, I saw this: To quote from the report where PA admitted this is what they had done: " ...upload it to the cloud using tools such as Google Storage and use BigQuery to extract data from it. As PA has an existing relationship with Google, we pursued this route (with appropriate approval). This showed that it is possible to get even sensitive data in the cloud and apply proper safeguards." So they are claiming that they (a) had permission to do this and (b) steps were taken to secure it. It may also be that PA via partnership with Google have access to a more secure version of BigData. Don't get me wrong, I've sold proprietary data to big-name management consultants before and know they don't always respect licensing restrictions, but at the moment the suggestion that PA have actually done anything wrong here is pure conjecture

qwerta 13y ago

I think Google has direct line to NSA, so yes the Google.

fixermark 13y ago
The article wasn't positing scenarios enabled by a nation's intelligence arm having access to the health records; it was positing burglary gangs, religious organizations, and insurance companies having (and abusing) access to the data. I suppose one could posit a scenario where an intelligence agency abuses access to the health records of citizens of another nation, but the scenarios highlighted in the article are not enabled by PA uploading the data to Google's servers. I'd even go so far as to argue that the specific scenarios highlighted in the article are LESS likely if PA uploaded the data to Google's service and then destroyed the originals; "27 DVDs" is a format far more likely to be stolen by a burglary gang. Assuming the author's scenarios are enabled by NSA access assumes a much, much larger global conspiracy against the people of England and Wales than I'd be willing to assume. (This thought process even grants the assumption that the NSA has some kind of clear-text access to the data in Google's services these days, which is also not an assumption I'd make.)
Oletros 13y ago
> I think Google has direct line to NSA, Source?