9 ms·

I don't understand why the data being on "Google servers" is generating such outrage. Google almost certainly has superior security to this "PA Consulting" or e

I don't understand why the data being on "Google servers" is generating such outrage. Google almost certainly has superior security to this "PA Consulting" or even the government itself.

anon1385 13y ago
The same government that had completely penetrated Google's network for years without them realising?
- sangnoir 13y ago
  I'm pretty sure "the government" in GP's context referred to the UK government, not the US.
  - anon1385 13y ago
    It was the UK Government (GCHQ) that was breaking into Google's networks.
    - dhoulb 13y ago
      GCHQ has done some appalling stuff, but the Google network penetration was done by the NSA.
      - Shooti 13y ago
        You're both right, its a collaboration between the two: >For the MUSCULAR project, the GCHQ directs all intake into a “buffer” that can hold three to five days of traffic before recycling storage space. From the buffer, custom-built NSA tools unpack and decode the special data formats that the two companies use inside their clouds. Then the data are sent through a series of filters to “select” information the NSA wants and “defeat” what it does not. http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html http://www.washingtonpost.com/world/national-security/nsa-in...
dangerlibrary 13y ago
I've worked with anonymized patient data in a litigation consulting context (in the U.S.). I worked at a small consulting firm nobody's ever heard of. We worked exclusively on air-gapped servers behind several layers of physical security. Even encrypted data was never, ever sent over the public wire. You don't connect sensitive data to the internet if a single breach is catastrophic. We talk about things like the Target hack as catastrophic breaches, but they aren't. You can change your password or cancel your credit card. You can't change your medical history - once public, it is always public.
hobbes300 13y ago
Because it's illegal to put MY data on a server in the US.
Silhouette 13y ago
I don't understand why the data being on "Google servers" is generating such outrage. Because Google's systems demonstrably aren't secure (see numerous recent discussions about NSA etc.) and therefore aren't an appropriate choice to transmit or store sensitive personal data under UK data protection rules.
- raldi 13y ago
  Is your concern that the NSA itself is targeting British health records? If so, what makes you think anyone else is better prepared for this adversary? Or, if you're talking about someone other than the NSA (which you allude to with your use of "etc"), then who is it? What are they going to do, and why do you feel it's demonstrably more likely to happen with the data on Google's servers? Where would you put the data instead, and how would this help reduce the likelihood of the scenario? "On a powered-down hard drive in a vault" doesn't count; presumably, PA was given the contract because the potential benefits of the research were believed to outweigh the privacy risks.
  - Silhouette 13y ago
    The NSA specifically isn't the point, though I do believe their blanket surveillance of the Internet (and the similar surveillance by other government spy agencies such as our own GCHQ) should be considered a hostile act and incur a proportionate response. I simply don't accept that there is any ethical legitimacy to such dragnet programmes or that they bring more benefit than the risk they obviously pose to free, peaceful, democratically governed civilisation. In any case, Google aren't a part of any government. They are a private, profit-making corporation, and they are in the business of collecting as much data on people as possible for their own benefit, and they evidently cannot comply with the restrictions on handing personal data required by UK law even if they want to. Providing this kind of treasure trove to them should be unthinkable.
    - raldi 13y ago
      You didn't answer any of my questions.
DanBC 13y ago
Data must only leave HSCIC under carefully controlled circumstances. It's pseudo-anon within HSCIC and anon outside HSCIC, but still with careful controls on who has access and what they can do with it. I can't tell from the article what data PA Consulting had; nor why they had it; nor why they felt the need to upload it to Google. Even though it's been anonymised it should still be treated as sensitive confidential data. There's a possibility that someone at PA Consulting has committed a criminal offence even though they "got permission" to upload it to Google. The otrage about Google is around keepin data within the EU And this protected by EU data protection laws.
easyfrag 13y ago
I don't think Americans get how distrustful other nations are of American-based cloud providers. It is not a matter of Google's or any other providers' behaviour but of the US Government (warrant-less searches and the like). This lack of trust predates the current NSA-Snowden affair and goes back to the Patriot Act (IMHO). Of course I can't speak for all nations or industries (or even companies) but in my part of the Canadian Health care sector it is simply unthinkable to use a US-based cloud provider for anything to do with patient data.
- fixermark 13y ago
  As an American, I'll be a little surprised if that mistrust runs deeply in Britain, given how closely the Snowden disclosures revealed GCHQ and the NSA to be working. If the NSA had a vested interest in getting health records on a British citizen, I doubt it'd be difficult to get the British government to send them over. You know, to fight terrorism. Of course, people aren't strictly rational actors, so I suppose one could hold the cognitive dissonance that one's private data is safer from the NSA physically stored in Europe than it is in the US.
  - Silhouette 13y ago
    As an American, I'll be a little surprised if that mistrust runs deeply in Britain Why? I don't approve of the NSA behaviour, and I don't approve of the GCHQ behaviour in conducting mass surveillance either. The fact that the latter is theoretically done by my government for my country's benefit doesn't make me think any better of the spy agencies or those in government whose laws and tax money allow it. I would rather take my chances with the terrorists than put up with all the nonsense done in the name of fighting them today. Not only do I think that as a practical matter the nonsense is far more likely to harm me or those I care about, and not only do I strongly disapprove of all the time, money, media attention and other resources I consider wasted on most so-called anti-terror measures when much more deserving causes could have used those resources better, I also think the current culture of rampant paranoia and fear-mongering is helping the terrorists to win anyway.
  - TazeTSchnitzel 13y ago
dhoulb 13y ago
I agree. I personally trust Google far more than the US or my own (UK) government. It's the whole monopoly on force thing. I have no fear that Google will grab me out of my bed in the middle of the night. With the UK government — even though I trust them to be pretty rational and fair, and to my knowledge I've done nothing that would warrant that treatment — there's always the worry that they have the ability to significantly reduce my quality of life (if they ever chose to) and I might not even deserve it. It's always surprising to me the fear regular people have of companies doesn't extend to governments, who have far more power over their lives.

I don't understand why the data being on "Google servers" is generating such outrage. Google almost certainly has superior security to this "PA Consulting" or even the government itself.

anon1385 13y ago

The same government that had completely penetrated Google's network for years without them realising?

sangnoir 13y ago
I'm pretty sure "the government" in GP's context referred to the UK government, not the US.
- anon1385 13y ago
  It was the UK Government (GCHQ) that was breaking into Google's networks.
  - dhoulb 13y ago
    GCHQ has done some appalling stuff, but the Google network penetration was done by the NSA.
    - Shooti 13y ago
      You're both right, its a collaboration between the two: >For the MUSCULAR project, the GCHQ directs all intake into a “buffer” that can hold three to five days of traffic before recycling storage space. From the buffer, custom-built NSA tools unpack and decode the special data formats that the two companies use inside their clouds. Then the data are sent through a series of filters to “select” information the NSA wants and “defeat” what it does not. http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html http://www.washingtonpost.com/world/national-security/nsa-in...

dangerlibrary 13y ago

I've worked with anonymized patient data in a litigation consulting context (in the U.S.). I worked at a small consulting firm nobody's ever heard of. We worked exclusively on air-gapped servers behind several layers of physical security. Even encrypted data was never, ever sent over the public wire. You don't connect sensitive data to the internet if a single breach is catastrophic. We talk about things like the Target hack as catastrophic breaches, but they aren't. You can change your password or cancel your credit card. You can't change your medical history - once public, it is always public.

hobbes300 13y ago

Because it's illegal to put MY data on a server in the US.

Silhouette 13y ago

I don't understand why the data being on "Google servers" is generating such outrage. Because Google's systems demonstrably aren't secure (see numerous recent discussions about NSA etc.) and therefore aren't an appropriate choice to transmit or store sensitive personal data under UK data protection rules.

raldi 13y ago
Is your concern that the NSA itself is targeting British health records? If so, what makes you think anyone else is better prepared for this adversary? Or, if you're talking about someone other than the NSA (which you allude to with your use of "etc"), then who is it? What are they going to do, and why do you feel it's demonstrably more likely to happen with the data on Google's servers? Where would you put the data instead, and how would this help reduce the likelihood of the scenario? "On a powered-down hard drive in a vault" doesn't count; presumably, PA was given the contract because the potential benefits of the research were believed to outweigh the privacy risks.
- Silhouette 13y ago
  The NSA specifically isn't the point, though I do believe their blanket surveillance of the Internet (and the similar surveillance by other government spy agencies such as our own GCHQ) should be considered a hostile act and incur a proportionate response. I simply don't accept that there is any ethical legitimacy to such dragnet programmes or that they bring more benefit than the risk they obviously pose to free, peaceful, democratically governed civilisation. In any case, Google aren't a part of any government. They are a private, profit-making corporation, and they are in the business of collecting as much data on people as possible for their own benefit, and they evidently cannot comply with the restrictions on handing personal data required by UK law even if they want to. Providing this kind of treasure trove to them should be unthinkable.
  - raldi 13y ago
    You didn't answer any of my questions.

DanBC 13y ago

Data must only leave HSCIC under carefully controlled circumstances. It's pseudo-anon within HSCIC and anon outside HSCIC, but still with careful controls on who has access and what they can do with it. I can't tell from the article what data PA Consulting had; nor why they had it; nor why they felt the need to upload it to Google. Even though it's been anonymised it should still be treated as sensitive confidential data. There's a possibility that someone at PA Consulting has committed a criminal offence even though they "got permission" to upload it to Google. The otrage about Google is around keepin data within the EU And this protected by EU data protection laws.

easyfrag 13y ago

I don't think Americans get how distrustful other nations are of American-based cloud providers. It is not a matter of Google's or any other providers' behaviour but of the US Government (warrant-less searches and the like). This lack of trust predates the current NSA-Snowden affair and goes back to the Patriot Act (IMHO). Of course I can't speak for all nations or industries (or even companies) but in my part of the Canadian Health care sector it is simply unthinkable to use a US-based cloud provider for anything to do with patient data.

fixermark 13y ago
As an American, I'll be a little surprised if that mistrust runs deeply in Britain, given how closely the Snowden disclosures revealed GCHQ and the NSA to be working. If the NSA had a vested interest in getting health records on a British citizen, I doubt it'd be difficult to get the British government to send them over. You know, to fight terrorism. Of course, people aren't strictly rational actors, so I suppose one could hold the cognitive dissonance that one's private data is safer from the NSA physically stored in Europe than it is in the US.
- Silhouette 13y ago
  As an American, I'll be a little surprised if that mistrust runs deeply in Britain Why? I don't approve of the NSA behaviour, and I don't approve of the GCHQ behaviour in conducting mass surveillance either. The fact that the latter is theoretically done by my government for my country's benefit doesn't make me think any better of the spy agencies or those in government whose laws and tax money allow it. I would rather take my chances with the terrorists than put up with all the nonsense done in the name of fighting them today. Not only do I think that as a practical matter the nonsense is far more likely to harm me or those I care about, and not only do I strongly disapprove of all the time, money, media attention and other resources I consider wasted on most so-called anti-terror measures when much more deserving causes could have used those resources better, I also think the current culture of rampant paranoia and fear-mongering is helping the terrorists to win anyway.
- TazeTSchnitzel 13y ago

dhoulb 13y ago

I agree. I personally trust Google far more than the US or my own (UK) government. It's the whole monopoly on force thing. I have no fear that Google will grab me out of my bed in the middle of the night. With the UK government — even though I trust them to be pretty rational and fair, and to my knowledge I've done nothing that would warrant that treatment — there's always the worry that they have the ability to significantly reduce my quality of life (if they ever chose to) and I might not even deserve it. It's always surprising to me the fear regular people have of companies doesn't extend to governments, who have far more power over their lives.