4 ms·
Nowhere in the original article[1] is the professor accused of hacking and certainly not of having any malicious intent. The headline of the subsequent summary
by skywhopper 12y ago
Nowhere in the original article[1] is the professor accused of hacking and certainly not of having any malicious intent. The headline of the subsequent summary in scmagazine.com[2] is where the word "hacked" came in, and to be fair to the reporters, what the professor did would be considered "hacking" in some legal interpretations of existing laws whether that's right or wrong.
To be clear, we have absolutely zero evidence that the IT staff at the hospital ever accused him of anything or claimed he did anything wrong. Apparently they didn't respond and tell him thanks, but given that they knew who it was, if the hospital thought it was a crime, surely they would have contacted the authorities.
In any case, neither article named the professor until he came forward, so I'm not sure how even the extremely mild misinterpretations of the case could be called libel, exactly.
All in all, this isn't exactly a cut-and-dried case of curious white-hat smeared by the government and media. There are plenty of those to go around. We needn't invent more.
[1] http://www.thenewsstar.com/story/news/local/2014/08/19/conway-server-breach-personal-information-lost/14296833/ http://www.thenewsstar.com/story/news/local/2014/08/19/conwa...
[2] http://www.scmagazine.com/professor-hacks-university-health-conway-in-demonstration-for-class/article/367123/ http://www.scmagazine.com/professor-hacks-university-health-...
- fnordfnordfnord 12y agoThe headline is: "Professor hacks University Health Conway in demonstration for class" http://imgur.com/M3rdooP http://imgur.com/M3rdooP I'd be pretty annoyed to see that written about me after I had emailed the server owners and informed them that they were hosting patients' personal data on an open ftp server. It'd merely be piss-poor coming from some random local newspaper, and we often tend to dismiss it because technology is complicated egghead stuff; but, this is a website that claims its audience is "IT Professionals" which makes it really irresponsible and the reporter ought to know better. caveat: Given that the professor's story is legit.
- spacemanmatt 12y agoWrong on the facts -- the article calls it a "security breach" and names the professor as the responsible party. The article says he did this in front of a class full of students. I'd say he has a pretty good case for libel, and the authors are pretty stupid to ignore his demand for retraction and apology.
- acdha 12y agoCheck out the actual HIPAA retaliation complaint: http://samsclass.info/125/proj11/LSU-HIPAA2.pdf http://samsclass.info/125/proj11/LSU-HIPAA2.pdf I had the same initial question about why he was reacting so strongly but people sending letters to your college administration demanding action is something of an existential threat to someone who teaches ethical hacking.
- kevinpet 12y agoTechnically, he did not file a complaint with the office of civil rights. He should file a formal complaint with health and human services since he discovered a HIPAA breach, and since they decided to be assholes about it. They aren't likely to stumble on an article and take action based on that.
- x0x0 12y agoSo John Poffenbarger -- jpoff@definisec.com -- of definitive data security contacted the admin at ccsf.edu to attempt to get this guy fired.