Spyware Prank Exposes Hospital Medical Records 319
cheerytt writes "Let this be a lesson to all the broken-hearted geeks out there. A 38-year-old Ohio man is set to plead guilty to federal charges after spyware he meant to install on the computer of a woman he'd had a relationship with ended up infecting computers at a children's hospital. Spyware was sent to the woman's Yahoo e-mail address in the hope it would be used to monitor what his former girlfriend was doing on her PC. But instead, she opened the spyware on a computer in the hospital's pediatric cardiac surgery department. The spyware sent more than 1,000 screen captures via e-mail, including details of medical procedures, diagnostic notes and other confidential information relating to 62 patients. The man will pay $33,000 to the hospital for damages and faces a maximum sentence of five years in prison."
The Woman (Score:5, Insightful)
So what's happening to the woman who stupidly ran an exe she recieved in an email?
HIPAA - SHMIPAA (Score:5, Insightful)
This incident could very well be the least of their problems for all they know.
The fact that it was able to install and send screenshots willy-nilly to Graham and who-knows-where-else is a HIPAA nightmare.
Just for grins I went looking through their employment opportunities to see if any IT jobs opened up recently and stumbled upon this:
(Not relevant to this thread but interesting, nonetheless
Nicotine-free hiring policy
Because itâ(TM)s important for healthcare providers to promote a healthy environment and lifestyle, Akron Childrenâ(TM)s Hospital has a nicotine-free hiring policy.
Newly hired employees are tested for nicotine as part of a pre-employment panel of medical tests.
Akron Childrenâ(TM)s will not hire applicants who test positive for nicotine use.
If you test positive for nicotine, the offer of employment made to you will be rescinded.
If after 90 days you successfully quit using nicotine, you may reapply for employment.
Stereotype much? (Score:5, Insightful)
Uhh, we're not all psycho-privacy-invaders with no ability to let go and move on, you insensitive clod.
Who is really at fault? (Score:5, Insightful)
b) The woman for opening it and infecting the computer?
c) Yahoo for not blocking it?
d) The hospital for not only allowing internet access from a computer with personally identifiable information, but for also allowing the spyware to get installed.
e) Some combination of the above?
Re:Who is really at fault? (Score:5, Insightful)
d) The hospital for not only allowing internet access from a computer with personally identifiable information, but for also allowing the spyware to get installed.
Bingo. They failed to take steps a reasonably prudent person would have taken to protect patient confidentiality under Federal law. Spyware installation via email is not exactly news.
Re:The Woman (Score:5, Insightful)
Most all of them can be configured to reject anything they can't verify as "safe". Whitelist, don't blacklist, it's the first rule of security.
Re:Who is really at fault? (Score:5, Insightful)
a) The man for emailing the spyware?
Yes, for causing spyware to be installed. Electronic trespassing. Theft of HIPPA-regulated information. Stalking.
b) The woman for opening it and infecting the computer?
Yes, for abject stupidity.
c) Yahoo for not blocking it?
Probably not.
d) The hospital for not only allowing internet access from a computer with personally identifiable information, but for also allowing the spyware to get installed.
Yes, for IT incompetence. But they are also liable for some serious charges for violation of HIPPA regulations. It's entirely possible they will lose all Federal support. Breaching HIPPA is a big deal.
Re:The Woman (Score:2, Insightful)
Except when you're mandated to provide general internet access.
Re:Wrong type of tracking (Score:5, Insightful)
Really, you think he had a search warrant?
Re:Don't get it... (Score:3, Insightful)
Almost a good analogy, except that mail bombs are not sent as frequently as malicious emails. If a significant portion of packages contained explosives, then yes, we probably would hold recipients accountable for not taking appropriate precautions when opening their mail.
odd (Score:5, Insightful)
does anyone else find it odd that the real damage was done to the patients and yet the hospital is being compensated for damages and not the patients? wouldn't the hospital also be liable for the damages considering that theri IT department failed to put up reasonable protection?
Re:Don't get it... (Score:3, Insightful)
No.
If you mailed me a package with a cover letter saying "attach the fuse so and so, and you can see FUNNY KITTENS", and I did, THAT would be just as much my fault.
And since she ran the attachment, she's at fault too. In theory, his email account could have been taken over by bad bad men, who spammed evil viruseses to all his contacts. In that case, it would have been purely her fault (not his).
Re:Who is really at fault? (Score:3, Insightful)
Im so sick of the "guilty of stupidity" argument so common here on slashdot.
For most people, computers are still a small, convenient part of life, so they don't educate themselves about it's threats.
But even if they are actually stupid, as in low IQ or poor planning abilities, that does NOT make them guilty in any sense if they're victims of some sad, controlling stalker.
Reminds me a little of some people who say that people who get caught smoking pot 3 times deserve the 25 years in prison they get in some stone-age places i heard of because they were "so stupid".
Stupid people suffer, too, and are mostly not at fault for their stupidity.
Re:Not a Prank (Score:1, Insightful)
The man may be liable to pay the hospital damages because he actually caused damage to the hospital (albeit unintentionally - which should lessen the punishment for the act). He surely should get punishment, how much that's a matter of what is written in the law, and the opinion of the judge in the grade of seriousness of the crime (assuming it's a crime, not an offense - this is also written in the law).
On the other hand the hospital may be liable to pay damages to their patients whose details were exposed.
This is justice at work properly imho - the court case is about this man intentionally sending spyware to spy on someone, and managing to get it installed. It is not about the hospital breaching regulations.
I think we can all agree that the hospital was most certainly at fault AS WELL here for allowing such personal information to get out - but that should become a second court case; presumably initiated by either the government for breaching a government mandated regulation, or by a patient whose data got exposed. And in this case I'd call the hospital even very much at fault for allowing so open Internet access from a computer with such sensitive data on it.
Re:Couldn't happen here... (Score:5, Insightful)
I'm sure there exists spyware for Linux as well.
It is a lot harder to get an executable sent over e-mail to run on the system, but it is still possible. Running Linux does NOT make one immune against this kinds of attacks.
I'm quite sure Linux is easier to secure than Windows, the core error this hospital made was not as much running Windows, as not closing off all access to the Internet. It just doesn't go together with sensitive patient data. Those Linux computers your Belgium hospitals are working with also should be shielded thoroughly from the open Internet.
Re:Couldn't happen here... (Score:3, Insightful)
Except that there are plenty of keyloggers, trojans, rootkits etc for linux as well, open source and commercial. Remember that when kiddies scan for weak php code, they will land on a linux box at least 90% of time time.
Re:Not a Prank (Score:5, Insightful)
why is this that fellow that is responsible for getting the records - this was obviously not his goal and if he is charged for it then it is just laughable.
What the hell is this supposed to mean? Since when has committing a crime unintentionally ever been a defense?
"Oh officer! I wasn't INTENDING to kill all the cancer stricken orphans when I driving drunk, speeding, and firing my gun wildly! I just intending to disturb the peace!"
"Oh! Well, that's a horse of a different color! I'll let you go with a warning then. Just try and keep it down next time. People are trying sleep around here."
"Will do!"
but why is the hospital getting the money - they are guilty of criminal negligence in handling patients' data so they should be paying not getting paid.
1. It's criminal trespassing to access a computer without permission. Which he did by sending the spyware to someone with the intent to observe them.
2. The hospital didn't hand out the data. It was stolen. It's still theft even if I leave the door wide open. It wasn't his. He has it, as a result of his actions.
to me it looks like one more example of justice system malfunctioning. It is not a great malfunction but shows that punishment and the crime are matched not by the facts but by the random acts of gov. officials. Was it not something that american constitution tried to prevent?
The opinion of someone who is woefully ignorant of the law, the intent of the law, common law, and basic morality, but yet somehow is an expert on constitutional law.
It must be tough being so smart and surrounded by so many people that are blind to your brilliance.
Go home and cry in your Ayn Rand novel.
Re:Who is really at fault? (Score:2, Insightful)
Is it? Have things changed since 2006?
http://www.washingtonpost.com/wp-dyn/content/article/2006/06/04/AR2006060400672.html [washingtonpost.com]
"In the three years since Americans gained federal protection for their private medical information, the Bush administration has received thousands of complaints alleging violations but has not imposed a single civil fine and has prosecuted just two criminal cases."
Lots of legislation gets passed to placate voters, but is deliberately de-fanged by not providing funding or a directive for enforcement. The trick is probably as old as politics.
Re:Who is really at fault? (Score:3, Insightful)
b) The woman for opening it and infecting the computer?
Yes, for abject stupidity.
Why? It's a computer where apparently public internet access is accepted, being tricked into installing spyware is stupidity but hardly criminally negligent stupidity. To me it sounds like a major WTF in security design (one pc for both) and permissions (how did she manage to execute the spyware), but her actions are just simple gullability that millions of users fall for.
Re:odd (Score:4, Insightful)
The hospital will be compensated for material damages. They are bound by law to inform the patients that their data has been released. Those patients will take up law suits against the hospital, which will be investigated, and they will recieve large amounts of compensation.
Odds on, if you look at the structure, you'll see the IT dept is over worked and under funded, so the real responsibility lies with the Directorate of the hospital, penny pinching on a department they don't see as shiny enough to be well funded.
Re:$33.000 in damages? (Score:5, Insightful)
Forensics, identifying exactly what the spyware was, conducting a thorough scan of all the network to see if it had spread, identifying what data was transferred, the infection vector, the administrative overheads of stopping the normal work to call an 'emergency situation' in which the sysadmins will concentrate on this exclusively, possibly not doing other maintenance work, or systems commissioning thus holding up medical projects (with the cost to them too).
Administrative time throughout the hospital, as a fair part of the management chain will have this as a high profile to concentrate on, police liaison (and having time to have them on site to investigate in situ, and having technical staff support them), communications time to liaise with press, people to field the phone calls that come in, extra load on the patient support lines to cope with frantic patients who aren't in the best state of mind anyway after suffering cardiac problems, who are now worrying about what of their information is in the wild.. That's the tip of the iceberg by the way.
Begin to see how that racks up to the big numbers? The machines aren't the expense, they're practically disposable. Unfortunately, data isn't tangible, so the non-IT staff don't see this shiny big item, and thus (out of sight, out of mind) don't consider it worth spending money over. All they see is that clicking a button makes data appear. Magic. Doesn't take effort, so why do they need an IT team to make it work? They decide they don't, cut IT funding (or never put it there), and eventually something like this happens because there isn't resource to make a secure network. And when it does, who gets the blame? Even from supposed 'geeks' who are supposed to understand what it's like being in an intensive overstressed IT role?
Re:Not a Prank (Score:4, Insightful)
Sometimes, but more importantly it is pretty much always a mitigating factor. Your hypothetical person would be charged with reckless homicide, not capital murder (DUI = felony, murder = felony, having a gun during commission of a felony = felony). It sounds like he killed enough people in the anecdote for the differences to be semantic, but it's not nonexistent.
Intent does matter. In this case, you can be pretty sure that's the reason the charge is only intercepting or conspiring to intercept electronic communications. They could easily have tacked on any number of unauthorized access/"hacking" charges.
Yeah, and? You said it yourself: criminal trespass. It's a government charge. The "victim" doesn't get the money. If they want to recover whatever it cost them to clean the systems and do whatever else it is they've done as a result of this, they can recover that via a civil action. And in any event, he wasn't charged with illegally accessing a computer system, he was charged with illegally intercepting electronic communication.
To the degree that the government is handing over the money, the question remains. I don't know if it's an unrelated out-of-court agreement with the hospital to avoid litigation, however. The wording in the article wasn't clear.
True. The question is what exactly the software did and how it works. A hospital employee shouldn't be able to install software on a department's computers at all. So what happened? Is it just really good spyware, able to avoid all the protections they had in place? Or is it that they didn't have any protections in place at all? Did the employee specifically download and run the attachment, regardless of what she thought it was? Or was it something that simply installed itself?
The answers to those questions don't matter in terms of what the man did, but they do matter. There are extremely strict laws on the books about protecting patient data. If this is a symptom of their failure to do so, they could easily end up on the wrong side of legal action by either the government or the patients whose data was disseminated. I've no doubt that's what the OP was referring to when he said they should be paying, not getting paid. We don't have all the facts by any means, but it sounds like their security on systems capable of accessing patient records was spotty at best. That shouldn't be any more acceptable than what the man did.
Basic morality? Really? What he did was undoubtedly wrong, and he should be punished. But do you really think it's a felony? Should he really be locked up for five years because of it, in addition to a $33,000 fine? For the average American, $33,000 is essentially a year's worth of labor for free. That's a pretty hefty punishment all by itself. Five years? That's the sort of sentence we hand out for burglary or aggravated assault. This is not a man who is a danger to society. At this point we're left simply to hope that the judge is reasonable and there is sufficient leeway in the federal sentencing guidelines that this doesn't turn into a total miscarriage of justice. Surely justice counts among the intent of the law and basically morality, doesn't it?
Maybe I'm one of these left-wing softy types, but what this guy needs more
Re:Who is really at fault? (Score:5, Insightful)
You make a compelling argument for not firing the IT guy for what happens which, let's face it, is probably what will happen after they scapegoat him if anything bad happens to the hospital.
However, "they" in the GP's post referred to "the hospital." In that sense it doesn't really matter if it's an incompetent IT staffer, a cranky doctor or poor executive management. Something that needed to be done under the law wasn't done, and the result was the leaking of confidential medical information. The hospital still deserves both blame and punishment for that.
Re:The Woman (Score:5, Insightful)
Except when you're mandated to provide general internet access.
If for whatever silly reason you need to provide general, unprotected internet access, you do that with seperate machines, isolated from the hospital medical record stuff.
Whichever way you spin this, it's a horrible, gaping hole in the security of the hospital's computer system. The people who set it up and authorised it need to be fired and replaced by people who know something about (the need for) security.
Re:HIPAA - SHMIPAA (Score:3, Insightful)
Re:Couldn't happen here... (Score:3, Insightful)
It is trivial to angrily write a trojan that infects a girlfriend's Linux machine and sends screen caps via email. You don't need to be root to run something to the effect of xwd | sendmail. All you need to do is to be dumb enough to execute an attachment. That's not a problem unique to Windows, that's a feature of dumb users.
Re:The Woman (Score:1, Insightful)
She was congratulated for her achievement of being a woman, and was given a promotion in order to appease the politically-correct quota gods.
Re:The Woman (Score:3, Insightful)
Probably nothing, at least not from the law. She's protected by the fact that judges are stupid enough to do the same and don't want to go to jail themselves.
Re:Who is really at fault? (Score:4, Insightful)
You ARE aware that the victims in this case are the patients of the hospital, not the woman who foolishly installed the spyware, yes?
Re:The Woman (Score:4, Insightful)
Yeah, but it doesn't do a damn thing in this case, or most places at work, where users can access their personal mail accounts via webmail.
Re:Not a Prank (Score:2, Insightful)
Um, always? Most crimes require intent. Some require merely negligence. If you're charged with a crime that requires intent, and intent cannot be proven, then you cannot be sentenced for it.
But there is intent - he clearly intended to commit the crime of installing spyware.
Now, should someone's punishment take into account the effects, including things he didn't intended? In general, my understand is that this does happen. In fact, in some cases you can be charged for more serious crimes, even if you didn't intended that, on the grounds that you intended to commit a less serious crime. The obvious example is murder, where if you intended to harm someone, and they die as a result, that's still murder even if you didn't intend them to die.
This makes sense if you think about it, otherwise someone could just claim they when they shot someone in the stomach, they didn't intended them to die. The point is that if you intended to commit a crime, you take responsibility for the consequences.
In this case, it's not unreasonable to realise that installing something like spyware might have knock on unintentional effects.
Re:The Woman (Score:5, Insightful)
You obviously don't work at a hospital. It would be very unpractical to provide 2 machines to every person, 1 for web access and 1 for hospital records. The issue is that this person ran spyware that she received. Virus scanners won't help, the only thing that could help is that she shouldn't have admin privileges (which is kinda impossible with some hospital software on Windows) or she shouldn't be running on the Windows platform (Mac or Linux can be more granular when running programs as an Administrator).