Outsourced Confidential Data On Children Posted

Kataire writes "MSNBC exposes a grievous blunder in which an outsourced programmer posts highly confidential data to a public website, concerning the daily whereabouts of hundreds of children in upstate New York. Yes, this person did this not once, or twice, but three times, with two different data sets. Even worse, the data was out there, publicly 'visible' for months. Just because RentACoder finally discovered and yanked it, after a coder 'stuck with a tricky formatting issue' posted the specific database he was working on to their messageboards, doesn't mean the damage is undone. The ramifications reach beyond the painfully obvious privacy issues, touching on outsourcing and peer ethics."

Comments

Queue the outsourcing jokes.....

[Anonymous Coward]

wait for it....

wait for it...

NOW!

Re:Queue the outsourcing jokes.....

[Anonymous Coward]

worst. post. ever.

Who do you trust?

[DarkHelmet]

Who do you trust? And who do you get to solve something like this?

Do you say, "Only certain government approved facilities can deal with this sort of information?" Seriously, should I feel that someone "government sponsored" is better off with my information than an outsourced programmer in India? Who gets to play Big Brother? And what will they do with what they know?

You can take this to the extreme, and be wary of anyone to handle private data about you. But then, if there's that sort of outcry, nobody would be able to handle it, would they?

I suppose it's better than having the Smoking Man from the X-Files having a file about you, and a blood sample. I find most programmers to have a certain level of professionalism to what they do.

I personally have access to roughly 10,000 credit card numbers. I'll never abuse the fact that I have access to them. But on the other hand, I'm not stupid enough to post all of them on the net for everybody to see, either.

I hope anybody who ends up doing something that stupid becomes a victim of identity theft. That'll really open their eyes to respecting other people's privacy.

By the way, I hate how everybody gets up in arms over the fact that this is data from children. This is horrible for ANYBODY to have their information posted on the net like this. And it could have been worse. It could have been a list of women tying them to the current Battered Women's Shelter they were staying at.

Re: Who do you trust?

[Anonymous Coward]

You're right... In general one would have to be totally paranoid even of one's own employees (gov't or otherwise) who are the stewards of the data.

In reality a lot of information is "publicized". Too many corps, persons, etc. have a lot of info on people; e.g., banks, insurance companies, trust companies, credit card companies, mortgage companies, fund managers, lawyers, airlines, car dealerships, etc, etc. and information (or at least gossip) sooner or later does leak; --verbally in conversation OR through the sale of info. The modern world doesn't and hasn't done much to protect against these abuses.

In this case, however, common sense would have dictated to NOT publish such information. Duh!!!

Re:Who do you trust?

[MrAngryForNoReason]

But, anyone can legally find out what shelter your moms staying at currently

I very much doubt that is true as the whole point of women's shelters is normally that they are confidential. Most women staying there have escaped abusive situations and are essentially hiding from their abusive partner. No way would the shelter give out names of their residents as it would defeat the whole point of the shelter.

Re:Who do you trust?

[segment]

Who gets to play Big Brother? That's an easy one ... Choicepoint gets to play Big Brother. They tout 40 billion records... 40 billion records on about 300million Americans?...

And what will they do with what they know? They claim to be able to pinpoint every move you made from college to getting tossed out your duplex etc.,

Re:Who do you trust?

[Skyshadow]

Posting anon for reasons which will become clear:

I work for a large healthcare organization. A while back, we caught some heat because we were transferring a lot of patient data over to India for use in one of our offshore projects and a local newspaper found out about it. Our official response was "Hey, Americans do this work too. It's not necessarily safer there than here."

A month later, one of the outsourced programmers took off with a couple of backup tapes and blackmailed my company.

This exposed the real issue at hand here: Offshore workers aren't in America, which means that we found ourselves unable to bring the weight of American law enforcement to bear on this person. In America, we would have had the FBI kicking in this guy's door within the hour. Instead, this individual simply moved to a different part of India, which is apparently like moving to another planet for the purposes of getting them arrested. The issue was clamped down on by management before the resolution, but the word around the water cooler is that we just paid them off -- really, the amount of money they wanted was insignificant against the massive PR damage we were looking at.

So while it's true that a worker in America can spill private data just as easily as a worker in the third world, *getting away* with it is a completely different matter. Companies which offshore private data deserve the lawsuits they'll face when something like this actually plays out wrong...

Re:Who do you trust?

[Jeremiah Blatz]

The issue with giving sensitive data to outsourcing agencies (who give it to outsourcing agencies (who give it to .... is that after a while, the chain of accountability gets pretty tenuous. When it's your client's sensitive information, it's pretty clear that you should protect it. When it's your boss' client's client's ... client's boss' sensitive information, you're really disconnected from the parties who would be damaged if the information was disclosed.

Re:Who do you trust?

[stratjakt]

No, the shelter wouldnt.

But if I knew who was in any given shelter, legally I dont know of anything preventing me from publishing it.

If I published a list of what kids live in what foster homes, I'd end up in jail.

As an adult you pretty much get only client-attorney, doctor-patient and spousal priveledges. Past that or a specific court order, pretty much anyone can say anything they want about you. Juveniles have much more protection.

Ever notice they dont print the names of juvenile suspects in the newspaper?

Re:Who do you trust?

[Greyfox]

Posting anon for reasons which will become clear:

Dibbs on his 3 digit user ID when his company has him killed!

Re:Who do you trust?

[Anonymous Coward]

C'mon, give it up! Do you work for UCSF, Sausalito Transcription Stat, Sonya Newburn or Tom Spires?

And was it India or Pakistan? And was the "Indian" really a Pakistani woman named Lubna Baloch? And was the problem really because UCSF required such little control over the custody of the medical records that it allowed them to be handed of to a chain of at least four levels of subcontractors before they ended up in Pakistan?

Oh, and was it really Sonya Newburn who paid off Baloch?

It's not so super-secret as you think. And the real issue (in your hospital's case) isn't that you couldn't bring the weight of American law enforcement to bear, it's that your organization completely lost control of the data that was entrusted to it.

Incidentally, UCSF has revised its contracts to require its transcriptions firms to reveal who they subcontract with.

P.S., if you click on the little "Post Anonymously" checkbox, your /. ID won't be revealed. Although I don't think that you'll be in much trouble given that the whole business is splattered all over Google.

Re:Who do you trust?

[Anonymous Coward]

I personally have access to roughly 10,000 credit card numbers.

people are gonna try and crack your machine now!

Re:Who do you trust?

[Uber Banker]

Ever notice they dont print the names of juvenile suspects in the newspaper?

It is illegal to print the names of juvenile suspects in most countries. The newspaper don't like to get their asses sued.

In many countries it is also illegal to print the names of convicted jeuveniles (something to do with being over the legal age of responsibility (~8 years old in some countries) but not totally responsible until they're a bit older (~14 in many countries)).

Re:Who do you trust?

[pwtrash]

Yep, your example would have been worse.

However, the article suggested that these kids are foster kids, which means that at a minimum they were victims of neglect to the extent that the state stepped in and removed them from their birth parents.

It's likely that a number of these kids were victims of sexual abuse. Needless to say, many of them have views on sexual issues that are warped by their experience. A predator would likely know how to take advantage of their experience.

Also, typically, the goal is to re-unite them with their parents. Obviously, some of these parents are not worth anything. But a number of them are genuinely trying to do whatever they can to make their family right. This doesn't help.

My wife works with kids in this situation, and I don't know any names ever. I don't want to know, and she takes her commitment to their confidentiality very seriously.

I hope we get to hear what becomes of Mr. Mark Dennis, the fine bleeding-edge developer who had to ask RentACoder for database formatting help. It would only be fitting if we all got to experience his worst or most vulnerable moment. I'll turn it into HTML for $15.

Re:Who do you trust?

[Anonymous Coward]

Guess you guys saved a lot of money in the long run then. Keep up the good work.

Re:Who do you trust?

[Uber Banker]

the word around the water cooler is that we just paid them off -- really, the amount of money they wanted was insignificant against the massive PR damage we were looking at.

In India it would probably be easier and cheaper to have them killed (hey, that seems easier in the US too!) and would discourage further abuses (given the country is corrupt enough (a local jusisdiction probably is - certainly was in Thailand (one of the most corruption-ridden countries on this planet))).

Re:Who do you trust?

[77Punker]

Choicepoint, eh? Just searched for my name and nothing came up. Then again, maybe I'm going it wrong.

Re:Who do you trust?

[Anonymous Coward]

The problem with this is that coporations DO NOT want to see any precedence set for identity theft. So this guy will probably go free.

Re:Who do you trust?

[Anonymous Coward]

Wouldn't it be possible to obfuscate personal data before outsourcing it? Something just as simple as replacing full names and SS# with a unique identifier, and only the parent company knows the lookup table.

Re:Who do you trust?

[DarkHelmet]

Heh, I knew after posting that, someone would say something like this.

Just because I have access to the numbers doesn't mean it's on my machine. And for that matter, somebody breaking into my machine and waiting for me to connect to the machine that does have the numbers doesn't mean that they'll get access to them either.

I have access to the numbers, but it doesn't mean I have to DO anything with them. And to be quite honest, after coding the system, I haven't seen the need to look at them. I keep the copy of my private key safe on a CD, thank you very much.

One that I've never felt the need to load into my machine. All I really do sometimes is connect to the machine, count rows in the db, look at my CD and go, "I could be sooo naughty if I wanted to be," and then find something else to do.

Hacking me is a waste of time. I have absolutely no doubt that someone could, but there are so many better targets out there. People with usable information actually on their machines. ;)

Re:Who do you trust?

[cait56]

I would prefer to trust someone who has enough sense not to provide confidential data to anyone that has not been properly trained in its handling.

It is all too likely that the person that "released" the data had no real understanding of whether the data was real or what it meant.

This is just plain sloppy procedure. It doesn't matter if the development staff is in-house, local out-sourced, or out-sourced to the other side of the world -- they still don't need the real data in order to develop code.

If this is in response to a specific problem, then the data needs to be exported in a way that strips identities. If they don't know how to do that then they haven't done a proper problem definition, and there are probably other security holes in the system just waiting to be stumbled across.

Re:Who do you trust?

[orthogonal]

Who do you trust? And who do you get to solve something like this?

In this particular case, you needn't trust anyone.

Nothing that Mark Dennis wanted to do -- build the database structure, build the front-end, or get help with his "tricky formatting problem" required that he use supply real data to RentaACoders or other sub contractors

And furthermore, nothing the Livingston County Social Services Commission wanted required that Mark Dennis ever see live data.

This one's simple, folks -- sure, Mark (or someone) needed to do a requirements analysis, sure, somebody had to decide what data entities to capture -- but very little real data was needed.

First, make some dummy data for the developers' use: run through your real data -- if you even need to base the dummy data off the real data --, and replace every name with a random dictionary word. Do the same thing for addresses, and replace Social Security and other id numbers with randomly chosen numbers. In all cases, maintain a constant map of real to dummy, to preserve relations within the data: "Mike Smith" is always translated to "Armchair Landowner" and "1450 Main Street" to "3321 Crumpet Sponge".

Once you've finished your translation, throw away the map.

Now the coder has data that's exactly as diverse as the real data, shows the same frequencies and inter-relations as the real data, is as internally self-consistent as the real data, and yet is (nearly) completely meaningless in terms of the real world, and (nearly) impossible to link to any real persons, places, or identifying information.

(It's possible one could still do traffic analysis on the data, and come up with aggregate data: either more male or more female (but which?) children are in the Social Services system; two zip codes out of six produce 70% of the cases (but which two?). If this is a problem you have to take a weighted slice of the data, and provide the developer with only this weighted slice; that (intentionally) skews your frequencies, but still preserves diverse data and any inter-relations among that data, closely enough to be representative for almost all design and coding needs.)

No trust involved. Just a simple and mechanical translation process that has to take place only once.

(If you really have a situation where the developer must base his requirements and code against gradually accumulating real world data -- and you shouldn't if you've planned at all well -- let one non-out sourced person hold the translation map -- and be held responsible for keeping it secret.)

And a process like I've outlined should be standard for any organization dealing with sensitive data.

Re:Who do you trust?

[segment]

I sincerely hope you were kidding about that. In case you weren't, Choicepoint is in the business of selling data... Yours

source ChoicePoint Acquires National Data Retrieval, Expands Presence in Public Records Field

ALPHARETTA, Ga. - January 2, 2003 - ChoicePoint (NYSE: CPS) today announced the acquisition of National Data Retrieval Inc. (NDR), one of the nation's leading providers of public records information for bankruptcies, civil judgments, and federal and state tax liens. Terms of the acquisition were not disclosed.

National Data Retrieval, which also is based in Alpharetta, has 26 fulltime employees, all of whom will be retained, plus a nationwide network of approximately 400 independent collection contractors. The privately held company was established in 1989.

NDR's products, services and public records databases of nearly 43 million records will complement ChoicePoint's existing Court Research and Retrieval Group (CRRG), which processed approximately 5 million records requests in 2002. NDR's customers will gain access to ChoicePoint's CRRG technology and records collection facilities, supported by ChoicePoint's proprietary database of more than 16 billion public records.

Note I bolded the 16 and the date, there is a page somewhere on that monstrous site which states they have 40 billion. I've seen it a few times unfortunately I can't pinpoint the location right now.

Re:Who do you trust?

[Anonymous Coward]

Yeh, cuz the US is supreme, US is king, damn all OS countries, lets wage war and conquer them all!

Since when was being in another country, hell, being another country, stopped the US from getting anything they wanted?

If you were important enuf, India would be a state of US now.

Re:Who do you trust?

[Bald Wookie]

On the other hand, they know you just searched for your name. Check back in a little while...

Re:Who do you trust?

[kcornia]

I think you're talking about a different incident. Parent poster said someone absconded with backup tapes and then blackmailed. The incident you speak of had to do with transcription and someone threatening to release information if they weren't paid their fee for services rendered.

Re:Who do you trust?

[R2.0]

"By the way, I hate how everybody gets up in arms over the fact that this is data from children. This is horrible for ANYBODY to have their information posted on the net like this. And it could have been worse. It could have been a list of women tying them to the current Battered Women's Shelter they were staying at."

Yes, it would suck if my daily schedule was put up in the internet. Then I'd have to worry about pedophiles or my crazy parent with the restraining order snatching me up.

Oh, wait - I'm an adult male who carries a cell phone, "pocket knife", and just enough martial arts experience to get me out of (okay, into) trouble.

Stories like this about children ARE different. Adults might have the means and methods to deal with the consequences of such a massive blunder. Children DO NOT! Especially lists about kids in day care: children who are pre-selected to be literally unable to take care of themselves.

Oh, and your "even worse" example sucks too. At least women in shelter are somehow connected with help. Think instead of a database of phone calls to an abuse hotline - lots of women who are totally vulnerable.

To borrow from the pigs in "1984": All privacy breeches are equally bad, but some are just way effin' worse than others.

Re:Who do you trust?

[segment]

hehehehehehehe

Re:Who do you trust?

[Anonymous Coward]

Maybe a simple solution to this would be getting a bunch of companies to announce that they are cancelling all their Indian outsourcing due to the actions of this unscrupulous individual. Wait for the Indian media to catch on, leak the individual's name, and wait for the problem to solve itself?

Re:Who do you trust?

[1u3hr]

Who do you trust? And who do you get to solve something like this? Do you say, "Only certain government approved facilities can deal with this sort of information?"

The guy(s) were developing a database front end; what moron gave them real data to work with? He's the one who should be canned.

The real information should never have gone to the coders. How hard would it have been to munge some data to make a test file with all the names, phone numbers, etc in the same format but bogus? Unless you're working at the NSA, you're going to have all kinds of printouts and the like from this test data lying about while you're working on it, thrown in the trash if not posted online as in this case.

Re:Who do you trust?

[jadavis]

I heard, although I don't know how true it is, that one million credit card numbers are going for pennies.

So, you wouldn't be able to do much unless you wanted to do the dirty work yourself, for which you'd probably be quickly caught and prosecuted. It's harder to get away with credit card fraud than you might think, and easier to get credit card numbers than you might think.

Re:Who do you trust?

[MechaStreisand]

Funny... I was about to suggest exactly the same thing.

Re:Who do you trust?

[Anonymous Coward]

Incidentally, UCSF has revised its contracts to require its transcriptions firms to reveal who they subcontract with.

You really think this'll help any? Subcontracting with companies in other countries for this is just stupid. I'm willing to bet that not only will their government look the other way, they'll get official aid if you try to sue them in American courts or ruin their reputation. And you can bet that they'll have some way to sue YOUR ass off. At the very least, you'll go down as an easy mark and other Indian companies will start doing the same thing.

Re:Who do you trust?

[core plexus]

"In America, we would have had the FBI kicking in this guy's door within the hour."

Ha! Highly unlikely. If you really want something done, and done right, you don't call the cops or the lawyers, you call the guy who knows dis guy and he "does this favor for you."

-cp-

President Bush to Liberate Alaska

Re:Who do you trust?

[riffer]

I very much doubt that is true as the whole point of women's shelters is normally that they are confidential.

Indeed. I work for a telco and we had a women's shelter as a customer at one point. Special arrangements were made so that the shelter's number would be unlisted, that the physical address of the shelter not be directly associated with the account, and that the domain registration be done entirely in our company's name.

This is typical, as a woman's shelter (which frequently also shelter's children) is literally trying to save people's lives. There's a lot of twisted fucks who think nothing of beating their own spouses, even their own babies until they are crippled or dead.

This story ignites a great deal of rage in me. Children are the, and I mean THE most critical resource to humanity. Air, water, food, those are just things we need to survive long enough to have children and raise them to adults. Each new generation is what provides continuinty of our species, as well as our culture.

Because of Mark Dennis, hundreds of children already living lives of questionable quality have had those lives put at greater risk. What a pathetic loser.

Re:Who do you trust?

[alphakappa]

Your story sounds too phoney because: 1. This resembles a recent true story too closely, where a programmer had not been paid her dues or something and she blackmailed the company by holding the data (healthcare data) hostage. Looks like you have picked up the story and modified it. 2. "The individual simply moved to a different part of India, which is apparently like moving to another planet".LOL This is not the jungles of the Amazon. To do this you would probably have to disappear to some jungle, or the himalayas and it doesn't appear as if the person would be able to do a programming job from there. Seriously, if you don't know anything about India, please do not make such ridiculous assumptions. 3. If it is 'PR damage' that caused your company to clamp its mouth, the issue could have happened right here in the United States.

Re:Who do you trust?

[GundyRage]

Tell those morons in Accounts-Blackmailable that I'm waiting for my last installment.

Now, where is that "Post Anonymously" check box?

Re:Who do you trust?

[Lurgen]

This is less an issue of who do we give our data to, than one of how do we deal with such a breach of privacy.

Outsourcing is supposed to be the legal equivalent to do it internally, the party being contracted is still bound by the same laws and unless the contract between the parties is inadequate surely this sort of thing is catered for...

Personally, I think this guy deserves a prison sentence as a result of this unbelievable breach of privacy. Having worked with somebody in the childcare industry a lot lately, I can say that there are so many ways this leaked information will be abused and children are the least likely party to be able to protect themselves from that sort of danger.

Re:Who do you trust?

[Lurgen]

Children have neither the social, legal nor physical abilities to protect themselves against the better equiped human (adult) predators out there.

This guy screwed up, and deserves to be punished. That he screwed up and endangered children makes it that much worse.

Re:Who do you trust?

[nandix]

I know you're talking about your experience, but read the article: all of the programmers involved in this were from the NY and NJ areas
The article even mentions the user name (for rentacoder) for the NY programmer that posted the children's database on repeated ocassions, even after getting a friendly warning from another programmer.

So while it's true that a worker in America can spill private data just as easily as a worker in the third world, *getting away* with it is a completely different matter. Companies which offshore private data deserve the lawsuits they'll face when something like this actually plays out wrong...

Re:Who do you trust?

[Esion Modnar]

one of the outsourced programmers

OK, I read that as one of the programmers whose job was outsourced to India, then realized from the context that he was talking about one of the Indian programmers who (allegedly) pulled the blackmail.

Re:Who do you trust?

[afidel]

Thank you, thank you, thank you. That is EXACTLY the kind of thoughts which HIPPA et al are supposed to foster. Real patient data should never be acessible except by people whos jobs it is to use that data. The people whos job it is to track and store the data have no need to see it. Now if only we could get an anti-PATRIOT act passed that forbade the government from accessing an private database for purposes of following its citizenry.

Re:Who do you trust?

[afidel]

Besides 10K records is piddly squat! What was the quote from the recent Slashdot linked article, oh yes

"One way to trace just how bad the situation has gotten: track the price for a million credit card numbers. Just a few years ago, Dave saw prices of $100 or more for a million stolen credit card numbers. Now? Pennies. Stealing credit cards is so easy, and so rampant, that prices have dropped precipitously, in a grotesque parody of capitalist supply and demand. "

So 100X the number of records you have has a value of pennies according to an FBI cyber security expert. Basically anyone working in DB or as an analyst for a telemarketer which has a bank or credit card company as a client has access to many times that many records and crooks who break into ecommerce sites DB's do as well.

Re:Who do you trust?

[Anonymous Coward]

Watch as I double-check the anon box..

I think I work for the same place. They're overall good to their employees, but they do some shitty things. Check out what was in the lobby this morning. Keep in mind this is in Walnut Creek, California, which is about 20 minutes from San Francisco on BART...

Kaiser Foundation Hospitals is seeking approval of a labor condition application for the period of February 26, 2004 to February 26, 2007 to permit employment of one H-1B worker in the classification of Programmer Analyst. The salary for this job is $77,501 per year. The H-1B worker will be employed at our facility located at 501 Lennon Lane, Walnut Creek, California 94598. The labor condition application relating to this employee is available for public inspection at our main office located at One Kaiser Plaza, Oakland, California 94612. Complaints alleging misrepresentation of material facts in the labor condition application and/or failure to comply with the terms of the labor condition application may be filed with any office of the Wage and Hour Division of the United States Department of Labor.

Posted January 26, 2004
(can't read the signature)

Re:Who do you trust?

[d34thm0nk3y]

Ha! Highly unlikely. If you really want something done, and done right, you don't call the cops or the lawyers, you call the guy who knows dis guy and he "does this favor for you."

I don't know where you live, but I live in the US. I would WAY rather have the hitman after me then the corporate lawyers!!!

Re:Who do you trust?

[Draknor]

You missed one key component. All of that requires:

1. Time
2. People who have a clue.

Most companies, organizations, and governments do not have #1. Many of them lack #2, as well. I *fully* agree with what everything you said, particularly the "And a process like I've outlined should be standard for any organization dealing with sensitive data." But the unfortunate fact is, we're a LONG ways from there. When companies think they can save money by outsourcing development, there's not a snowball's chance in hell they're going to waste precious resources protecting private data.

At least, not until it costs less to protect than it does to deal with the consequences. I despise our litigious society as much as the rest of /., but sometimes I think that's the only way to get ideas through thick corporate skulls.

Re:Who do you trust?

[kubrick]

Hey, I thought we all moved up one when someone with a lower ID, erm, goes to that great bit bucket in the sky.

Wait your turn, youngster!

Re:Who do you trust?

[Anonymous Coward]

Hrrrm... Talk about being biased!!!

You seem to not even have bothered going through the article.

Where does India or any other country come into the picture ?

Read again :

programming work for the day-care center had been outsourced to the locally-based Genesee Community College. The manager of the college's program refused to speak to a reporter, but Morris said Dennis was a third party consultant hired by Genesee. Dennis, in turn, used RentACoder to once again subcontract the database work, which ultimately fell to a New Jersey-based programmer.

Looks like they all were just dumb Americans(Not implying that all Americans are dumb).

Re:Who do you trust?

[SiggyRadiation]

I agree with your statements, *but*:
For such a translation to be build a company needs what? Yes: a developer. You could of course use the company Excel-guru but then would it really be a stable and trustworthy translation-process?

This leads to the conclusion that small companies need to rent-a-hidemydata-coder before they rent-a-production-coder. And what are you gonna send the rent-a-hidemydata-coder as example-data?

Siggy

Re:Who do you trust?

[Anonymous Coward]

first ...the article said the programmers were all americans...none of them were Indians.

Secondly, how do we know this guy with the said "experience" (if that is what you are referring to) is telling the truth ?

What kind of an Idiot company outsources senisitive private data ? Ever heard of sample fake data ? Seems to me like they set themselves up for this and ended up learning a valuable lesson. The blackmailer actually did U.S. public a really big favour.

Re:Who do you trust?

[Anonymous Coward]

Well your company obviously deserved it all for employing incompetent morons who are too dumb to understand what kind of data is too sensitive and private to hand out to an unaccountable third-party.

Ever heard of fake sample data?

The "indian" guy deserves an applaud for giving your company the richly-deserved kicking it got. You had it coming.

Re:Who do you trust?

[Anonymous Coward]

Oh, wait - I'm an adult male who carries a cell phone, "pocket knife", and just enough martial arts experience to get me out of (okay, into) trouble.

R2.0-san, I learn from great master. He say, There is no "just enough martial arts experience". You walk on right side of road, ok. You walk on left side of road, ok. You walk in middle of road, squash, just like grape!

Re:Who do you trust?

[lonesome phreak]

I'm surpised someone didn't end up in prison. That is a direct violation of HIPAA Privacy rulings...your supposed to have a chain of trust agreement, specifically a Business Associate Contract. This states that your company is HIPAA compliant in all areas where you deal with PHI (protected health information). If you outsource, your company is supposed to get a BAC from the people you outsource to.

Your company could probably get hit with a violation of 42 U.S.C. 1320D-6(a), which is a federal law. If management knew (or should have known) that the chain of trust was supposed to be followed, your Privacy Officer can be hit with a $50,000 fine and/or one year in the federal pen. If it was done "with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm" someone can be hit with a $500,000 fine and up to 10 years in prison.

Go read this http://www.ehcca.com/presentations/HIPAA3/malone_2 .pdf ASAP. If you deal with PHI, then you are probably a covered entity.

Re:Who do you trust?

[Moraelin]

How about "you do _not_ need a 'hidemydata' _coder_".

I've worked on several enterprise projects so far, and in _none_ of them did I need any actual production data while coding the app. All the test databases we worked on were filled with dummy data. Including login accounts, addresses, products/materials, financial data, etc. You name it, it was fake.

What you do need are a few examples that _look_ like the real data. They don't come from a coder, they're not real data that ran through some encription code. They're just bogus.

Where do they come from? They come from the people who work with the real data. Only those need to see it.

_They_ are allowed to see where little Timmy Victim lives and where does he go to school. So they take some records from that data, read it, then replace the name with Bart Simpson, the address with something bogus, and so on. Then send me the database with a few such examples.

What if I need thousands of records, you say? Well, then I, or another "rent-a-hidemydata-coder", takes those bogus samples, and writes a small script to generate thousands that look like those. Voila, now you have thousands, maybe even hundreds of thousands, of bogus records to run those tests on.

If there's a bug that needs fixing -- e.g., to stick to the article, the formatting code sucks -- I don't need production data to reproduce the bug. I just need an example -- _any_ example -- that clearly demonstrates the bug. If it's a bogus example, all the better.

You may notice how at no point did a coder actually see the confidential data. Not the developper of the application, not the "rent-a-hidemy-data coder", not the coder's PHB, not the company's marketroid (who might go "ka-ching! we have all those people's records, let's try to sell them stuff.") The only ones who saw the confidential data are (surprise!) the people who actually have a right to work with that data.

It wasn't that hard, now was it?

Re:Who do you trust?

[meadowsp]

Amazingly he looks to have quite a good record at the RentACoder site.

Re:Who do you trust?

[Anonymous Coward]

Another issue it exposes is that they aren't American and the loyalties lie differently. We know how Americans generally think and act, but when you are dealing with someone who is in a foreign country, all of that gets thrown out the window because they were raised with a different set of values in a (sometimes) completely alien culture.
Think about it - in China the government owns everything. If you outsource to china, it seems the programmers would almost be duty-bound to turn any code they develop over to either the government or the public domain. Same goes for sensitive information.

Re:Who do you trust?

[Tassach]

You could easily have a 250% increase in record count without adding any new information simply by normalizing or partitioning a couple of tables. Unless you have the schema sitting in front of you, total record count is almost totally meaningless as a way of describing how much real information is in a database.

Re:Who do you trust?

[Tassach]

they still don't need the real data in order to develop code

Mostly, that's true. However, sometimes you absolutely must use production data to debug or reproduce an elusive problem. For example: these 5 people's records are munged and we can't seem to reproduce the problem. Figure out what happened and make sure it doesn't happen again. Or: the system crashes when we run this process on dataset A but not on dataset B. Find out what's making it crash and fix it.

Re:Who do you trust?

[Mysticalfruit]

I've heard of these guys. Those "independant colection contractors" go from court house to court house and pay the 5 bucks and get all the info that was entered into the system from the day before, enter it into forms and then send it off to ChoicePoint to get inserted into their database.

This information gets used for stuff like criminal background checks, etc. Want to guess who's the biggest user of CheckPoints data? The government. When the FBI does a background check on someone, how do you think they do it? First, they check their databases. Then they goto the private data collectors.

The scary thing is, I've heard that getting erroneous data out of these databases is nearly impossible (much like getting erroneous data out of your credit report). So, the next time you go apply for a job and you don't get a call back, it might be because CheckPoint dished up erroneous dirt on you...

Re:Who do you trust?

[Mesaeus]

Do you have any idea how many people I have to off to get to a three figure ID ? I vote we have a lottery for his number.

Re:Who do you trust?

[Anonymous Coward]

It would be nice if the people playing with the data actually cared about privacy. Most programmers in SE Asia are far less concerned about privacy than we are. If they make a mistake, they'll fix it, but they really aren't concerned with the data revealed.

Re:Who do you trust?

[tiger99]

You badly need a UK-style Data Protection Act in the US. Here, even an accidental leak of personal data is a serious criminal offence, and rightly so. It is not even legal to keep data for longer than strictly necessary.

Why do so many millions of people in the US put up with such a rotten system? Surely your politicians need votes to be elected (not excepting Dubya of course, as he was in fact not elected, and does not lawfully govern the country), so they must be susceptible to pressure from the millions who are fed up with the present system. Yet you seem to elect the same kind of vile scumbags, who give you bad laws, every time. Why?

For your own sakes, do something useful with your votes in the forthcoming elections. For a start, get rid of the unelected, mentally retarded, warmongering fascist scumbag that poses as president. An idiot like that would be unemployable anywhere else in the world, yet you almost made him president, a role which he then misappropriated as it was not his. You let him do that. It makes no sense. He should have been removed from office the day the votes were properly counted. Now he is playing with his dangerous toys worldwide, and can be utterly relied upon to do everything possible to create war and destruction. The man is sick, and should be in a secure mental hospital, yet some of you will vote for him again.

You will only get what you deserve if you don't vote, or vote for an imbecile.

Re:Who do you trust?

[cait56]

You can maintain the structure of the real data and still mask identifying data when you export for debugging purposes.

If that fails, you might export the real database. But that should be rare enough that it is worth emphasizing to the receiving staff that this is actual data and to be treated with the utmost care.

This is obviously a case where someone in-house failed to treat the data with proper care and simply counted on a blanket NDA to cover their ass.

Re:Who do you trust?

[mcubed]

To borrow from the pigs in "1984": All privacy breeches are equally bad, but some are just way effin' worse than others.

The pigs are from Animal Farm, not 1984. Right author, wrong book. That aside, good point.

--Michael

What message board?

[The_Rippa]

I'm sure the "it professionals" on alt.pedophiles were more than happy to check out the db issues for him.

Re:What message board?

[ThomK]

Fortunately a lot of those perverts get caught

Re:What message board?

[jabbo]

wow, that's fucking hysterical! nothing like a child being molested, murdered, and tossed in a dumpster to brighten your day. /. is such an insightful bunch!

Re:What message board?

[Anonymous Coward]

All children like it up the ass, they just don't know it yet...

Re:What message board?

[Anonymous Coward]

That's alt.binaries.pictures.erotica.hussy, you insensitive clod!

Today's lesson:

[American AC in Paris]

When you're looking to cut corners, be careful who you give the scissors to...

Re:Today's lesson:

[Anonymous Coward]

Who keeps modding these comments on this story off topic and such? They seem on topic to me...

My question is...

[secondsun]

Why is the government (through sub contractor or not) outsourcing to begin with? Maybe this is the reason Bush came up 249,000 jobs short of his goal of 250,000 new jobs in 2003.

Maybe now someone will pay attention.

[Anonymous Coward]

Talk of identity theft, damaged credit, and so on may not rile up the Soccer Moms of the world, but once something affects the children, watch and admire as their mouths begin to froth!

Re:Maybe now someone will pay attention.

[Schnapple]

Now all we need is for one of those children to be the child of a Congressman. Same way we need just one of the RIAA targets to be some senator's kid off at school...

Re:Maybe now someone will pay attention.

[Elwood P Dowd]

And then all the identity theft and all the RIAA litigation will have been worth it.

Wait, that wasn't your point at all...

Re:Maybe now someone will pay attention.

[gr0ngb0t]

I doubt that any of the kids would be the child of a congressman, as in the article it says that the database "listed the names, addresses and other details of low-income and foster families".

Now I'm not an american, but I assume that your congressmen are all on pretty damn healthy wages, like they are pretty much everywhere, so I don't think that their children would be involved in this child care program.

Re:Maybe now someone will pay attention.

[Schnapple]

What, no Congressman would have foster kids?

Re:Maybe now someone will pay attention.

[Shabazz Rabbinowitz]

Is Newt still a congressman?

Re:Maybe now someone will pay attention.

[gr0ngb0t]

yeah good point... still early here :)

Re:Maybe now someone will pay attention.

[bugnuts]

That'd be about the worst situation I can imagine. Just what we need, more regulation on the Internet. Did you not learn from past legislation that was unconstitutional that you would actually WISH a congresscritter would attempt more laws for the online world?

Remember, Legislative branch just makes up a bunch of laws to justify a job. Executive branch executes those laws whether they are good or bad. If anything, it'd be better for someone in the executive branch to be affected so that they'd try to enforce the laws better, not make up new crap.

Re:Maybe now someone will pay attention.

[Anonymous Coward]

we're not talking about online regulation, we're talking about exploiting the xenophobia of a politician to change a situation we're powerless to do ourselves...

Re:Maybe now someone will pay attention.

[Zebbers]

doesnt matter if the riaa targets a senators daughter/son, the riaa will realize quick and then rescind it...all the while massaging said senator under the table. they arent stupid after all

Re:Maybe now someone will pay attention.

[RyuuzakiTetsuya]

Didn't John McCain raise a foster child?

Re:Maybe now someone will pay attention.

[KarmaMB84]

I'm sorry but I fail to see how someone posing as another person should be more important to *mothers* than protection of children.

I see nothing insightful about stating that *shock* *horror* mothers give children priority over someone's bank account and credit.

Re:Maybe now someone will pay attention.

[afidel]

What about the John Doe suits, would they be able to withdraw the suit once the identity became known without it looking REALLY bad?

Re:Maybe now someone will pay attention.

[nobody69]

It shouldn't be so surprising that people get more concerned about things that affect what they hold most dear. If you don't have children, nieces, nephews, young siblings, young cousins, kids in the neighborhood that you care about I suppose your credit card concerns are reasonable. However, one would hope that people who are parents would be more concerned about the physical safety of their children than about their credit rating. Particularly in the case of foster parents, who's biggest fear is often that the biological parents will somehow get the foster children back through one way or another, and for single parents, since a major cause of child abductions are from the other spouse. Oddly enough, this security fuck-up affects those parents more than the average family. So I think that the frothing mouths are completely appropriate.

I'm not surprised

[samsmithnz]

Myself, I'm always careful about 'stripping' any information when posting code samples or looking for help in Forums. I'm surprised this isn't reported more often...

I wonder if the parent company that hired this 'outsourcer', even knows that their data has been compromised...

Hmmm

[Anonymous Coward]

This really hits the dot on the head and will not curry favor with anyone considering outsourcing.

Re:Hmmm

[MaineCoon]

Very creative, however, if you had read the whole article, you would have realized that the chain of contractors - the university that received the original contract, the programmer they subcontracted, and the programmer that the subcontractor contracted, were all US citizens and/or organizations.

Just because a programmer is located in the US does not make him or her infallible and capable of doing perfect work.

Re:Hmmm

[Anonymous Coward]

This really hits the dot on the head and will not curry favor with anyone considering outsourcing.

My Indian Valet MaHat MaCoat complained bitterly of the subtle joke there.

Re:Hmmm

[Anonymous Coward]

hit the dot on the head? Curry favor? Come on, you can troll better then that..

Re:Hmmm

[Anonymous Coward]

if you had read the whole article

The jokes on you. I didn't read any of the article.

Re:Hmmm

[andy1307]

That's how personal details about hundreds of children ended up on the Internet. A user named Mark Dennis, stuck with a tricky formatting issue, posted his question to RentACoder -- and attached a zipped copy of the database he was working on.

Before the Indian bashing begins, some of us actually read the article.

Little help?

[Anonymous Coward]

I can't seem to find the database in question, could somebody post a mirror? (tab delimited is ok)

Coincidences

[Rosco P. Coltrane]

outsourced programmer posts highly confidential data to a public website, concerning the daily whereabouts of hundreds of children in upstate New York.

In other news: Michael Jackson to move to NY soon.

Re:Coincidences

[Anonymous Coward]

Funny, but the scary truth is that he likely doesn't have to go that far if he is even half as sly (sick?) as this guy:

http://home.wanadoo.nl/hote/wilson/ch_1.htm

Over 2500 boys in one city, and he was never reported to any authorities by any of them. It's a long read but it goes into depth about people like MJ, and from a very different angle. The guy who wrote it is straight/married but looks at the issue more objectively than the mainstream media.

Re:Coincidences

[Anonymous Coward]

Ho HO!

Downside of outsourcing

[johndiii]

When you outsource, you run the risk that the individuals doing the work do not share your company or even cultural values. If you are not willing to take the time to make sure that your outside contractors are what you expect, this is the kind of thing that will happen. Few companies really understand this.

Re:Downside of outsourcing

[Anonymous Coward]

Or the people you hire are complete moron cave-dwellers.

Re:Downside of outsourcing

[allgood2]

I'd have to say, and the article didn't indicate whether or not the originating company had indicated that the data was private and confidential. I've done data cleaning, analysis, report creation, etc. as an outsourced contract for a slew of organizations, nonprofits, government, and corporate--and I can't say the number of times I've been handed confidential data without any type of NDA or even a brief conversation stating this data is confidential. In fact, it happen so much, that we developed our own policy, indicating to all potential clients that all incoming data would be treated as the exclusive, confidential property of the organization, and only those staff members directly working on the project would have access to the provided data, etc.

The truth is, even in places where HIPAA and other types of policies that demand handling of confidential data, thatbesides for the few items that get drilled into the staff-- oh that database requires a password, you can only view those forms in-house, or only that single computer can be used to transmit data to our insurance agency--most of the staff rarely give it a second thought. Its not that they mean to be careless, its just that administrators have typically given them a checklist of guidelines and those are the only issues they worry about.

Outsourcing overseas, is an issue about legal power or the ability to restrain legal. People will take advantage, aand at least if its an American outsourcer you have some recourse.

But the issue of outsourcing has always been convoluted by who considers what valuable and how well you portray that to a third party. And to that regard, I find, you generally have two camps--those that just decide to put a blanket level of valuability on everything they do--you know the firms that have you sign and NDA, confidentiality agreements, and other legal forms, just so you can tweak their tech support database, and their staff sends email like "hey, had a great time last night" followed by a blanket two paragraph long confidentiality statement, that everyone they communicate with on the regular basis has stopped reading because its typically not relevant.

Then their are those who try to make the legalities relevant to the staff and data that is relevant, but find themselves hopeless at conveying the extent and necessity of why confidential needs to mean confidential. These places are typically of the you can only work on that database on that single machine that isn't connected to the internet, and has four levels of passwords. But you can go to the common printer and pick up pages of customer or client profiles that contain data such as social security number, HIV status, etc., etc.

At the one type, the employees and the people the deal with become inured to the message of privacy and confidentiality because its stapled to everything and at least 90% of the items its stapled to is inappropriate. The others fall into the trap of thinking that security, confidentiality, etc is a thing--that's the secure machine, that database contains confidential data, we have our 5 point checklist, and I use it. That they overlook the multitude of everyday things that deserve to be treated with a level or respect and confidentiality.

HA HA

[Anonymous Coward]

serves those corporate fuckheads right!

Thats horrible

[MonkeysKickAss]

Its basically putting a sign saying rape meon each one of the kids on that list. I can see putting a list of people whicht they already do which is called a telephone book, but children come on thats just sick. Whats next a guy in a purple suit is going to be knocking on thier door asking them if they want to join NAMBLA.

Before we bash on outsourcing...

[wan-fu]

... before everyone starts bashing on outsourcing, let's not forget that this problem isn't a result of outsourcing, but an unscrupulous programmer. This could just as well happen on usenet with someone asking for programming advice from any company. It is the programmer who was not careful with data and the fault is on his side (and possibly the company who gave him the data and did not give him specific instructions for care of the data).

Re:Before we bash on outsourcing...

[sporty]

Yes, but when you sue, you can either sue the employee which you have a direct contract with for damages, or the company from which you outsource. With the case of the developer, he has a closer relationship, so is less likely to do wrong since he's not under the protection of a company. With the case of a company, you sue the company and the worse the company may do is fire them. Less vested intereste in what the big boss might say -- depends on who your big boss is.

Re:Before we bash on outsourcing...

[Dimwit]

That's true - this could have happened with any company. However, to play Devil's advocate:

Since this is an outsourced job, there is very little, if any recourse that can be taken against the person in question. Perhaps US companies will see this and think "whoa, if this happens to me, and somebody sues me...who can I sue?"

It's sad that corporations are sending jobs overseas in the name of cheap labour. I frown upon the implications of the term "human resources". However, it's also sad that there are countries in the world poor enough that they can offer labour at those prices. I wish everyone had a standard of living equal to what I enjoy here, and I'm afraid outsourcing may be the way to do it. At this point, all I can hope is that the outsourcing is done in an ethical way - no sweatshops, no gang-ruled factories, no government corruption. Unfortunately, since money is involved, it suffers from all those things and more...

Re:Before we bash on outsourcing...

[laird]

"let's not forget that this problem isn't a result of outsourcing, but an unscrupulous programmer"

I'm not sure it's "unscrupulous" as clueless. Whether he's paid as an employee, a consultant, or a sub-contractor, he's just as responsible to treat sensitive data appropriately. He should have been fired the first time, or at least warned in writing and fired the second time. Allowing this to happen three times exposes both the agency (who's responsible for managing its vendors) and the vendor to tremendous liability because they've obviously not taken this issue seriously.

Re:Before we bash on outsourcing...

[Anonymous Coward]

Right, the only reason this article made it onto slashdot, is because it some how involved outsourcing.

Who ever posted the article was probaly just being a troll, because no where in the article does it say 'outsourced programmer' it only says 'subcontracted programmer'. That could or could not mean that the outsourced programmer was outsourced to India for example..

Re:Before we bash on outsourcing...

[nycsubway]

My guess is that is incorrect. Programmers can certainly make mistakes like this one did. But when you hire programmers and staff to do things so cheaply, you give up the quality control. When you are dealing with personal information, quality control is extremely important. Its also not to say that that kind of thing can't happen in the US. But its unsettling for people to know that they can't even meet the person who is working with their personal information.

If one of the programmers at a children's hospital starts publishing information about it's patients, the hospital will want to start slapping the programmer silly. Its not that easy if the person is overseas.

Quality control with information is much more important than the QA with manufactured products. Cheap products are good for most average people in the US, so outsourcing is ok. But cheap products in airliners and military equipment is not good. Highly personal information should not take the route of cheaply made goods.

Re:Before we bash on outsourcing...

[Jotaigna]

but if you work for some company with a name, as an unscrupulous you are less likely to commit some fault since there is a whole lot of people you have to answer to. If during the outsourcing you can get away with it, chances are no investigation can trace you back on time and youre free. Outsourcing is like asking someone else to pick up your laundry and wash it for you. It may work, it may be a good idea, but some trust bonds must be established for it to work.

Re:Before we bash on outsourcing...

[Kris_J]

You might think it looks like this on the outside, but the environment of outsourcing creates events like this by making it impossible to determine who's competent and who's not. There are so many degrees of separation between the company needing the work and the individual doing it that it's impossible to keep track of what's going on until it's obviously gone wrong or right. Also, outsourcing is so awful that the turnover is very high. This leads to excessive pressure on each new outsourcee as they get employed closer and closer to the deadline -- forcing them to take risks like these in order to do the job "on time". Outsourcing incubates problems like these.

Re:Before we bash on outsourcing...

[selfabuse]

Why is India even coming up? Where the job was outsourced to doesn't really affect this at all. Us folk here in America can screw up too, you know. Also, the article names the person that posted the database as a "Mark Dennis". Though it's possible that there is a "Mark Dennis" in India working on this project, I'd say it's a safe bet to say that this was someone here in the US.

Re:Before we bash on outsourcing...

[inode_buddha]

Without even getting into whether the programmer was unscrupulous, I'd say he was just plain stupid for doing this. You don't need to post your data set to ask a question.

Also, he just opened the whole thing up to a potentially massive class-action suit by the parents; I live in upstate NY and I've seen how those things go here. I'd be surprised if these companies or their projects/contracts are around in a couple of years. They'll be sued to death is my guess.

Re:Before we bash on outsourcing...

[Anonymous Coward]

Yes, and it is not that the posted information constitutes a major risk to this children or the family. Or are there child molesters at every corner in NY and children so rare that they cannot find them without this information?

Re:Before we bash on outsourcing...

[Anonymous Coward]

That wasn't off-shored, MORON... RTFA.

Re:Before we bash on outsourcing...

[Anonymous Coward]

"Before everyone starts bashing on outsourcing, let's not forget that this problem isn't a result of outsourcing, but an unscrupulous programmer."

Actually, if a crime has been committed, the original party to whom the data was entrusted shares the responsibility. If they had the right to share the information with another party, why didn't they have the right to post it on the net themselves?

Someone at the top of this chain was responsibile for security, and failed, and is passing the buck to the obvious party, who isn't in much of a position to pass it back (it appears that it was *intentionally* made public, perhaps even as a protest?)

On the other hand, has a crime been committed? Or is this just one of those things that shouldn't happen because confidential data should not be shared with anyone who can be held accountable for its confidentiality?

I'm not convinced that the "programmer" was "careless" with the data. If someone said "hey, take this .dbf file and make a web form to query it", but doesn't even mention the nature of the data or request that it have even basic http access applied, whose fault is that?

Re:Before we bash on outsourcing...

[Perl-Pusher]

Didn't read the article eh? I'll post the important part.

County attorney David Morris said that programming work for the day-care center had been outsourced to the locally-based Genesee Community College. The manager of the college's program refused to speak to a reporter, but Morris said Dennis was a third party consultant hired by Genesee. Dennis, in turn, used RentACoder to once again subcontract the database work, which ultimately fell to a New Jersey-based programmer. By that time, the programmer actually working on the day-care data was four steps removed from the county's social services program.

So the gist is they outsourced to a CommunityCollege who then outsourced it to a website. The coder who answered the website not only didn't know what he was doing and tried to get someone else to help him, he probably had no idea the significance of the data to begin with. Since nobody who had a clue actually hired him. Outsourcing something that important is exactly what is wrong. I've seen companies outsource jobs that were essential to the well being of the company and nobody in charge (CEO,CIO) will admit that the reason the business failed was due to putting something critical in the hands of others who didn't have the same priorities as them. You should only outsource when the task is not critical and doing it yourself is too expensive. If it's important and you don't have the expertise, hire employees who do. Then when something is needed, you get it when you want it and how you want it. If neither is possible choose another line work.

Re:Before we bash on outsourcing...

[Mr Rohan]

Actually the problem was with the company purchasing the system. They should have had specified the dummy data to use for early acceptance testing & as development validation.

Who uses the *real* data for anything but the very last stage of testing !!

Re:Before we bash on outsourcing...

[Anonymous Coward]

Nope, it was some idiot from canada.

Re:Before we bash on outsourcing...

[Anonymous Coward]

Where the job was outsourced to doesn't really affect this at all.

You're right. If this happened in India on an Indian website we would of never of heard of it.

Re:Before we bash on outsourcing...

[lish2]

I'm curious if, possibly, he didn't know that this was real data, as opposed to a generated database for testing purposes. He was so far removed from the original data source (wasn't this outsourced through like three different people/groups? he's like a sub-sub-subcontractor), that it's possible he honestly didn't know that these were real kids and real records that would be possibly dangerous if he posted them.

I'm guessing he did know, and I'm not excusing it, just thinking about possibilities.

Re:Before we bash on outsourcing...

[Anonymous Coward]

"Since this is an outsourced job, there is very little, if any recourse that can be taken against the person in question. Perhaps US companies will see this and think "whoa, if this happens to me, and somebody sues me...who can I sue?""

Well, since it was outsourced within the US, I'm guessing they can sue the person who posted this stuff just fine.. maybe read the article next time? Not all outsourcing goes overseas, outsourcing just means that the parent company is subcontracting the work to someone else.

Re:Before we bash on outsourcing...

[GigsVT]

I'm a registered employer with RentACoder.

RentACoder allows employers to attach an NDA to the deal, and make the contract dependant on that NDA.

If the employer didn't use an NDA, and turned over data like that, they are stupid, and deserve no recourse. If they used an NDA, they have recourse, even though that recourse might be costly, and yield little from an individual coder with little cash.

Of course, you always have the option of only accepting work from companies rather than individuals, it's all on their RentACoder profile.

RentACoder isn't all offshore labor either, it's a place where anyone can go bid on work. You might be undercut by offshore stuff, but a company might appreciate someone in a nearby time zone, it makes coordinating things much easier.

Re:Before we bash on outsourcing...

[bendelo]

He should have been fired the first time, or at least warned in writing and fired the second time. Allowing this to happen three times exposes both the agency (who's responsible for managing its vendors) and the vendor to tremendous liability because they've obviously not taken this issue seriously.

Once is an accident, twice is a coincidence, three times is a conspiracy.

Re:Before we bash on outsourcing...

[Desert Raven]

So the gist is they outsourced to a CommunityCollege who then outsourced it to a website. The coder who answered the website not only didn't know what he was doing and tried to get someone else to help him, he probably had no idea the significance of the data to begin with. Since nobody who had a clue actually hired him. Outsourcing something that important is exactly what is wrong. I've seen companies outsource jobs that were essential to the well being of the company and nobody in charge (CEO,CIO) will admit that the reason the business failed was due to putting something critical in the hands of others who didn't have the same priorities as them.

Outsourcing it wasn't the screw-up. Truth is, if you don't have the talent in-house to do such a project, you really don't have a choice. The screw-up was in not outsourcing it to a proper development shop.

First, you should be sure anyone you contract to actually has the available talent, and time, to perform the job.

Second, if you're outsourcing, the contract you sign should specifically prohibit sub-contracting without your express knowledge and permission. They're going to be a whole lot less likely to outsource to Apu at the quickee mart if they have to get your permission first, or risk being sued for breach of contract.

Third, as has been mentioned before, unless there's some unbelievably good reason for it, you should never give live "customer" information to an outsource. Even working in-house, I've never used live data in a development system. Part of the initial project plan is creating a test data set.

Oh, and outsourcing anything critical to an educational institution is always a stupid move. At best, you're going to get work done by students, who've never done a real job before. At worst, students tend to have lower ethical standards than employees, if at least for no other reason than they're not getting paid as much as a regular employee. But also, they're not under the same contractual obligations as a regular employee would be (NDA, etc.). Critical jobs should always be handled by professionals.

Re:Before we bash on outsourcing...

[Anonymous Coward]

interesting

Re:Before we bash on outsourcing...

[Anonymous Coward]

If the employer didn't use an NDA, and turned over data like that, they are stupid, and deserve no recourse. If they used an NDA, they have recourse, even though that recourse might be costly, and yield little from an individual coder with little cash.


You're forgetting the part of the story where the RentACoder guy was the 4th link in the chain of outsourcing. County->Company 1->Company 2->Company 3->RentACoder Retard.

Re:Before we bash on outsourcing...

[Kombat]

And people wonder why Americans have such litigious attitudes. What exactly would you sue over? You know, in some countries, you actually have to prove that there were some damages in order to successfully sue someone. In the US, it's just "He made a mistake, I'm suing him even though (thankfully) nothing bad happened. Reward me with millions."

Sure, the guy screwed up. Some data was exposed. Fortunately, nothing bad happened this time. Sure, fire the guy. But sue? Why? Nothing happened! No one lost any money or got hurt.

Re:Before we bash on outsourcing...

[sporty]

Someone doesn't always need to get hurt for osmething to be a crime. It just has to be against the law. The damages probably would be what could happen if the data was used for ill will, the cost of fixing it or some sorta standard.

Re:Before we bash on outsourcing...

[Jonathan Platt]

It's sad that corporations are sending jobs overseas in the name of cheap labour.

This is quite healthy, we are in a capitalist system, and it will only work by people leagally trying to do the best thing for themselves.

Actually by golbalization and companies outsourcing to poorer countries, those countries average wage rises. They get wealth investments and capital investments from wealthier countries, and will eventually lead to equal standards of living accross the world. What is happening is really for the best... in the long run at least.

Sad to say....

[Tangurena]

Folks are too busy cutting back on employees to even think straight. This sort of thing has gone on before and will go on again. Just think of the hospital in Florida that outsourced medical transcription to someone, who outsourced it again, until eventually, some Pakistani woman was upset that that she was not getting paid, and threatened to release all of the info onto the web.

This, and the Florida case will be brought up again and again. And I am sad to say that these are just the beginning of a long decline.

Re:Sad to say....

[SillySlashdotName]

Just think of the hospital in Florida that outsourced medical transcription to someone, who outsourced it again, until eventually, some Pakistani woman was upset that that she was not getting paid, and threatened to release all of the info onto the web.

Even though I agree with what you said, getting the details wrong does little to advance the case with others.

It was the UCSF Medical Center (University of California at San Francisco) not a hospital in Florida - unless someone else did the exact same thing...

Original article at San Francisco Cronicle

Confidential data on slashdot

[Anonymous Coward]

I have seen some people spread data via slashdot comments encoded with base64 and encrypted. (anyone have a link to a specific occurance - at least one time someone decypted it and posted it) Could slashdot be used as a way to anonymously leak information like this, and use slashdot's general policy of "just mod to -1, don't delete" towards comments as an advantage? Unlike other forums, posting anonymously leaves nothing but a MD5SUM of your ip to be used in court. Also, if you "post anonymously" while logged in, slashdot caches your username. You can verify if you have mod points by noticing that even when you post anonymously AND change your ip address, you can't mod up/down the comment.

Re:Confidential data on slashdot

[Anonymous Coward]

Good point. Anybody want to buy the sales data for every taxpayer in the State of California since 1997? I have it all. Find out what they're paying for supplies and what their profit is. Serious offers only and I AM SERIOUS. Be warned this takes up several DVDs so you'd better have a plan as to how to transfer.

Re:Confidential data on slashdot

[Anonymous Coward]

Unlike other forums, posting anonymously leaves nothing but a MD5SUM of your ip to be used in court.

That md5sum may as well be the ip address itself.

2^4 bytes * 2^32 addresses means that only 2^36 bytes would be required to store a copy of the hashes of the entire ip address space. Doing the lookup live and flagging all matches (you would have to search the entire space to make absolutely certain there are no collisions) would not take an unreasonable amount of time.

Really, this is not OT

[MoxCamel]

This is a great example of the risks of outsourcing your IT infrasturcutre, and it's exactly why offshore outsourcing is doomed to failure. One or two high profile cases of millions of records of data being sold to (insert "terrorist" organization of your choice here) by low paid coders, and CIOs won't be able to move their IT infrastructure back in-house fast enough. It will be the IT Enron. Those of us left in IT will rejoice. :)

Re:Really, this is not OT

[MaineCoon]

However, in this case, all the outsourcing was within US borders, as is evident from the contents of the article.

Re:Really, this is not OT

[Anonymous Coward]

This is a great example of the risks of outsourcing your IT infrasturcutre, and it's exactly why offshore outsourcing is doomed to failure.

No, this example shows that it really does not matter if you outsource in usa or offshore.
And not every kind of IT infrastucture has to do with sensible data.

Re:Really, this is not OT

[Rosco P. Coltrane]

[tinfoil_mode]

Actually, I'm surprised nobody here has emitted the opinion that the article is biased, puts the emphasis on the outsourcing issue on purpose, and surely is part of an elaborate PR conspiracy to entice US companies to hire local computer companies and stop the bleeding of high-tech jobs away from the US. Perhaps even that the outsourced programmer was paid to leak the information, so that the article could be written.

What would your answer have been if the guy lived in Nowhere, NM?

[/tinfoil_mode]

Re:Really, this is not OT

[MoxCamel]

However, in this case, all the outsourcing was within US borders, as is evident from the contents of the article.

And had you RTFP, you would have noticed that the comment was about outsourcing in general, and that by extension offshore outsourcing was doomed to failure. Disagree with the point if you must, but please don't intentionally misunderstand the meaning.

Re:Really, this is not OT

[The_K4]

Ok, take off the tinfoil hat and realize that NONE of this took places outside of the US. They DID hire a US contractor (actually a university) with hired a US subcontractor, who hired a US subcontractor. The guys lived in Nowhere, NY and Nowere, NJ!

Re:Really, this is not OT

[be-fan]

Ugh. Your average American code monkey can be bribed just as easily as an Indian code monkey. Terrorist organizations have a lot of cash, and people everywhere are cheaply bought.

Dear god, won't somebody think of the CHILDREN???

[Anonymous Coward]

oh, wait.

Outsourced or not?

[Rosco P. Coltrane]

Officials at the New York State Office of Children and Family Services and in Livingston County, where the incident occured, are investigating. Livingston County's social services office is located in Lima, just a few miles south of Rochester, N.Y.

If it's an outsourced programmer, shouldn't it be Lima, Peru?

Re:Outsourced or not?

[Anonymous Coward]

Insightful? somebody's funny bone is broken here ...

Re:Outsourced or not?

[BiggerIsBetter]

Go back under your bridge, troll. Outsourced means outside your company, not outside your country. I'm sick to death of US based fucktards acting like their countrymen are above any sort of misbehaviour.

Re:Outsourced or not?

[Anonymous Coward]

... Lima, just a few miles south of Rochester, N.Y.

If it's an outsourced programmer, shouldn't it be Lima, Peru?

It is. It's just a few thousand miles south...

Re:Outsourced or not?

[Anonymous Coward]

First of all I think this poster was trying to be funny by making reference to Lima which is the location of entity doing the outsourcing. Unlike Lee-Ma (Peru) it is pronounced Lime-A. Anyways what is perhaps more interesting is that this did not make the local news yet in any fashion... I would know I live near there. On top of that why they need to outsource to New Jersey is beyond me when there are plenty of out of work programmers in Rochester courtesy of Kodak.

"This wouldn't have happened if..."

[Anonymous Coward]

...fill-in-your-dogma. And be wrong. Shit happens to everybody. Don't be so quick to justify some religious issue by pointing out isolated incidents.

Re:"This wouldn't have happened if..."

[chamilto0516]

This has probably happened to each of us but we have yet done the proper google search to yet find out.

Obvious bias in post!

[teetam]

Couldn't a "non-outsourced" developer make the same mistake? What does this have to do with outsourcing at all? Seems to be a very leading post to me, designed to generate the usual angry, anti-outsourcing replies.

Re:Obvious bias in post!

[greywar]

Actually no-a in-source programmer would have been more aware that the data was sensitive. The amazing thing in this one is that the coder after being warned that it was a bad idea to post this stuff-went and did it again the next day! I suspect he's gonna regret that.

Re:Obvious bias in post!

[totatis]

Well, yes and no.

In theory, a non-outsourced developer can do the same mistake. But there is something important called relationship and trust.

If a developer is in-house, if he has talked to clients, project manager, if he had be given a lecture on how the data is sensitive, you can bet that this developer will not mistakenly post that data on the web. Sure he can be corrupted, but that's not what happened here.

On the other hand, if some code-monkey receives some coding to do for an unknown company, in an unknown place, for an unknown application, and he is given a set of data not knowning what it is, then he might publish his data without knowning what he is doing.

The "outsource" stuff is important, not because of some "save jobs" issue, but because it implies the developer should never had received this data in the first place.

If some company/government entity outsources some programming job, it should give said developers only fake datas. And administration jobs with access to the real datas should be done by trusted guys.

Re:Obvious bias in post!

[L-Train8]

Government agencies deal with sensitive data all the time, and have carefully developed practices and policies in place. These have been developed over years and are part of the culture of the workplace.

When you outsource to a company that specializes in IT work, and that gets outsourced to a database contractor, the sensitive data is no longer in an institution used to handling it. Yes, you might have an unscrupulous or incompetent coder in your orginzation, but you are far more likely to have a problem when you hire someone because they are cheap and they can code. The instititional controls and culture that protect the data are not in place after 3 degrees of outsourcing.

Re:Obvious bias in post!

[andy1307]

The morons who gave the september 11 hijackers visa extensions AFTER 9/11 are still working for the government. That wasn't outsourcing. I don't see how a worker for the government agency involved couldn't have made the same mistake.

Re:Obvious bias in post!

[Anonymous Coward]

What part of against outsourcing dont we understand.

I guess the morons on this site want to lose their job..

Oh yeah then they post meaningless messages like the ones before.

Outsourcing has no quality control, and about the government workers that gave these visas away were probabaly arab or useless Indians anyway.

Re:Obvious bias in post!

[Schnapple]

Also, remember that if a non-outsourced programmer (in this context, an American one) did this, they'd be fired. Same reason this outsourced person (hopefully) loses their job.

However, the American gets to have this incident follow him. Every time he lists that job on a resume, one phone call to his former employer can get the details and the company who might hire him next can get more info on it. However, this outsourced offshore programmer will likely either go to work for another outsourcing firm or, more likely, the outsourcing firm will just stick him somewhere else. The hiring company (of the outsourcing firm) doesn't know anything about his background, or how badly he screwed up. Hell, the fact that they don't have to do the interviewing and background checking themselves is seen as a plus.

Yeah, if this is an aberrant incident it'll be ignored in the long run, but if lots of little incidents like these go down - which if the projections that outsourcing is on the rise continue - then perhaps it'll send a signal to the powers that be.

Re:Obvious bias in post!

[Tim C]

if he had be given a lecture on how the data is sensitive, you can bet that this developer will not mistakenly post that data on the web

Well, I've never been told that any data that I have access to is sensitive, and I'd still never post any of it anywhere.

Why not? Because it's obviously sensitive, commercially at least! Credit card details, names and addresses, medical data, business plans - you name it, I've seen it. It's hard to think of a single datum that noone would consider sensitive.

The bottom line is that you never reveal real data. Hell, in some circumstances, even just the type of the data, or names of tables in a db, could be sensitive. Even data that will be public, such as product details, might be sensitive until after the project is completed. (eg as part of a grand launch of a new ecommerce site, or something)

the developer should never had received this data in the first place

No, he shouldn't, but doubly, he shouldn't have posted it.

Re:Obvious bias in post!

[L-Train8]

I don't think the two situations (hijacker's approved visas and db developer posting confidential data to the internet) are analogous. Yes, they are both screw-ups by people working for the government. But I would argue that the visa screw-up was made because the INS was not set up to fight terrorists. Since 9/11, it's mission has changed dramatically to add that responsibility. But it takes a long time to turn a huge organization around, and 6 months isn't long enough. Previously, the INS mission has fluctuated depending on the whims of the administration in the white house, alternately cracking down on illegal immigration or working to streamline legal immigration, depending on the political winds. Before 9/11, President Bush was interested in making it simpler to acquire a green card and was working on an immigration amnesty for Mexican and other illegal immigrants. The latter was put on hold after 9/11, but was finalized recently. While there is glaring irony in the fact that dead terrorists' visas were approved 6 months after their notorious attack, catching them was not until very recently the job of the INS, and it is wrong to fault them for not changing gears so quickly.

State foster care and child protection services, on the other hand, are set up to protect children. From long experience these agencies are aware of the dangers of giving a mother's new address out to her ex-husband with the history of domestic violence and a restraining order. They have policies in place for that that took years of trial and error and experience to develop. An outsourced developer has no experience with these kinds of risks. A good coder is used to posting questions on the internet asking for suggestions. But that doesn't make him a good coder for sensitive family services data. That is the point the article is making about outsourcing. Sometimes it takes more than just being able to write code cheaply to do the job.

Re:Obvious bias in post!

[prockcore]

Couldn't a "non-outsourced" developer make the same mistake?

You can sue the non-outsourced developer.

Re:Obvious bias in post!

[Anonymous Coward]

Couldn't a "non-outsourced" developer make the same mistake?

(*cough*) Microsoft Passport (*cough*)

How does one compensate...

[Unnngh!]

How does the government go about compensating for this type of potential threat? I mean, it was a violation of privacy but there was no immediate damage done to the families, in terms of material loss.

There is, however, a significant threat of emotional stress from knowing that your sensitive data is in strangers' hands, and the very real threat of this data being exploited in some way. I personally think the government should at least reward the families with money enough to relocate if they feel threated. What are y'all's thoughts on this?

Re:How does one compensate...

[fltsimbuff]

What does the government have to do with this?? The individual that posted it and/or the company he worked for should be responsible.

Think about it...

Re:How does one compensate...

[Unnngh!]

I agree, surely the individual and his company needs to take responsibility. But the agency who released this data should have done more to assure that the data was secure. If they can't assure this when the work has been outsourced too many ways to track, they probably shouldn't be outsourcing in the first place...but they still hold, imo, the highest responsibility for the protection of sensitive data.

Look! Outsourcing Bad!! NOT.

[RedHat Rocky]

As much as I feel the outsourcing trend is not a good move, both for my career path and the US industry in general, this 'news' neither adds nor subtracts from the debate.

It would be better titled:

"Idiot makes mistake, exposes private data to Net. Sound thrashing in progress."

Re:Look! Outsourcing Bad!! NOT.

[djeaux]

"Idiot makes mistake, exposes private data to Net. Sound thrashing in progress."

Of course, the thrashing could be inflicted faster & with less preliminary legal wrangling if the culprit had been a regular employee & not an outsourced "consultant."

Regular employees take employers to court after the thrashing. Outsourced consultants have to be taken to court before the thrashing.

Re:Look! Outsourcing Bad!! NOT.

[RedHat Rocky]

Interesting, but neither case affects the main thrust of the sensationalism: "Private Child Data on Net, posted by moron".

In both cases, a person made an error in judgement. The relation of that person to their employer does not have an impact on their judgement, IMO; regular employees and consultants are both equally capable of making bad decisions.

Yes, it was bad that the data was posted. That the individual was outsourced is irrelevant.

Re:Look! Outsourcing Bad!! NOT.

[laird]

"Of course, the thrashing could be inflicted faster & with less preliminary legal wrangling if the culprit had been a regular employee & not an outsourced "consultant.""

Actually, it's far easier in most states to manage a consultant or vendor than an employee, because employees are covered by labor protection laws, while vendors have to live up to their contract. So if the contract is at all reasonable, their should be immediate, significant financial penalties for their violating professional ethics, while for an employee, particularly a state employee, there's a fairly detailed disciplinary process that has to be followed.

Re:Look! Outsourcing Bad!! NOT.

[Abcd1234]

That the individual was outsourced is irrelevant.

Bullshit. The fact is that, when you outsource, you lose all quality control, regarding the employees. As a result, the agency you go with could hire a total moron, who then posts your confidential data on a website. Had you kept the job in-house, you would have been able to do a better job screening employees, thus reducing overall incompetence. Moreover, you can, in-house, communicate and enforce a policy (ie, through careful procedures to gain access to data, etc) which makes it clear what can and cannot be done with various types of data, thus reducing the chances of some incompetent that slipped by misunderstanding or ignoring the rules. If the job is outsourced, you can't be guaranteed that 1) the employee fully understands your policies regarding data or 2) those policies are being followed/enforced. Essentially, you're leaving it up to some firm who may or may not be doing what you expect (hell, they could, themselves, be outsourcing the job to someone else!)

Re:Look! Outsourcing Bad!! NOT.

[gowen]

The fact is that, when you outsource, you lose all quality control, regarding the employees.

Only if your human resource dept are so bone idle that they don't check out to whom they are outsourcing. If you outsource important work to the congenitally clueless, its your own fault if they screw up.

Re:Look! Outsourcing Bad!! NOT.

[RedHat Rocky]

Not to mention if a company can't handle picking an outsourced resource, they probably don't do a good job of screening applicants either.

Re:Look! Outsourcing Bad!! NOT.

[Abcd1234]

So your HR department is going to check out who they're outsourcing to, as well as interviewing all of their hiring managers, their HR department, all individuals working on the project, and any new people brought on? Because if you don't do all of that, you can't be guaranteed that something won't go wrong along the way... after all, a brilliant contract company can still hire boneheads. And if you *do* do all of that, you might as well do the job in-house.

Re:Look! Outsourcing Bad!! NOT.

[gowen]

a brilliant contract company can still hire boneheads.

Contract companies that hire boneheads are not brilliant. Thats kind of an axiom.

Re:Look! Outsourcing Bad!! NOT.

[djeaux]

Only if your human resource dept are so bone idle that they don't check out to whom they are outsourcing.

Isn't that the rule, rather than the exception?

Just wait.....

[Neck_of_the_Woods]

How do you feel about outsourcing the programing done on medical record programs?

Is it really gone?

[AndroidCat]

I wonder if they've checked the wayback machine at archive.org.

Re:Is it really gone?

[EvilLiberalGuy]

From: http://web.archive.org/web/*/www.rentacoder.com:

No pages for year 2004 found. The article said it was posted in Jan 04.

Medical Industry

[jamonterrell]

Those in the medical industry such as myself have a deep understanding of these issues. The government of the United States identified the amount of this kind of sensitivy in the information that we keep, and decided to pose some restrictions on how we handle it. For those who are interested, feel free to google for "HIPAA," and be sure to read over the consequences for disclosing "PHI" to unauthorized sources. Perhaps these kinds of sensitive information handling rules should be global, and not industry-based?

Jamon

Re:Medical Industry

[johnnyb]

NOOOOOOOO!!!!!!

The HIPAA rules are nightmarish. I understand the need for basic privacy, but the requirements of HIPAA are rediculous. I have trouble getting the medical records to my four-year-old son! Plus the overhead involved in any sort of records transfer basically means that there is no point in using computers at all.

Re:Medical Industry

[Anonymous Coward]

Perhaps these kinds of sensitive information handling rules should be global, and not industry-based?

No, perhaps the government should enforce the law and give out some of the large fines called for in the legislation.

You can't outsource your Hippa responsibility. If you outsource, YOU are still responsible.

Re:Medical Industry

[Anonymous Coward]

The first rule of HIPAA is you do not talk about HIPAA...

Re:Medical Industry

[Anonymous Coward]

Absolutely right. The goals of the HIPAA Privacy regulation were noble, but the federal government made a complete bosh of it. It is a case study in how NOT to write regulations. HIPAA was supposed to be about simplifying electronic medical systems. Instead, the Privacy regulation added layers of complexity that will never be sorted out. The tax code = = a children's primer compared to the HIPAA Privacy regulation.

Peer ethics

[Montreal Geek]

Ethics are hardly involved. This is a question of raw stupidity.

That he has even tought of posting his customer's true dataset is inforgivably moronic. Whether it was data on children's whereabouts, credit card information, or even "just" accounting information on some business.

While it is true that not revealing your customer's data is the ethical thing to do, it's also just plain ol' common sense.

Though I should perhaps say vintage common sense. Seems that product has been discontinued for some years now.

-- MG

Re:Peer ethics

[mbge7psh]

I'd be interested to know what restrictions were placed on the data by the owner of it. Surely they must stipulate that the data cannot be sub-outsourced?

And was it really necessary to release such sensitve data in the first place?

Although the subcontractor was obviously stupid, the outsourcer has to take some responsibilty.

Re:Peer ethics

[Pakaran2]

Exactly. Personally, I would have sent an evening creating a database screwed up in a similiar way, and posted it as my example.

And this has nothing to do with whether the guy was hired through outsourcing, on-campus interviewing, monster.com, or was met at Moe's Pub. Idiots occur in every company.

Re:Peer ethics

[YrWrstNtmr]

Exactly. This was not a 'mistake', but pure stupidity.

A few years ago, I headed off a somewhat similar situation.
We got rid of our call center (now done in a subsidiary in Canada). Company B took over all the equipment, the building, servers, etc. And they were goin to hire most of our old phone people. Most, but obviously not 'all'.

They also wanted the personel database.
"Fine. Let me scrub the data, and give them the empty shell."
"We can't do that! Not all these people are going to the new company. I can't release names, addresses, SSAN, etc. to a company they know nothing about."

The bosses pushed, I pushed back.

"OK..I'll do it on one condition.
I need a signed statemt from HR, Legal, the CEO, the operations VP, and the IT VP saying this is OK"

They saw the light, and I sent the now-blank database structure and GUI.

Integrity.

Yet another example of TAPOHS

[Anonymous Coward]

... or, perhaps, the awesome stupidity of human power.

Pretty dubious site

[MyFourthAccount]

I've been looking at that site for a while. There's some dubious stuff going on from time to time. One of the things I noticed recently is this bid request:

I want to know flash bios writing example for my educational purpose. I want to to write "abc..xyz" on flash bios boot block. Program should be compatible with various chipset motherboards like Intel 810,815,845,SIS 530/630,VIA,ALI (and so on...) and also
compatible with Award BIOS/Americal Megatrends having different flash chips or capacity like
Intel,SST,WINBOND,Atmel,EON ....5V/12V etc. I know what I will get after that "A dead motherboard". Don't worry I have three extra motherboard and a flash utility to backup/restore bios boot block. (emph. mine)

I wanted to reply: "you aren't accidently writing a virus, are you?"

Re:Pretty dubious site

[prof_vestanpance]

A bid request? Damn, are they outsourcing virus writing now? Is nothing sacred?

Re:Pretty dubious site

[Pretzalzz]

Additionally, one of the project types is 'Personal Project / Homework Help'(emph. mine). I can't really imagine a situation where solicitating this sort of help on a website wouldn't be considered cheating by most computer science professors/teachers.

Re:Pretty dubious site

[Lehk228]

because teachers/professors don't write assignments that include virus/malicious software, and a MoBo nuker is NOT a school assignment

Re:Pretty dubious site

[weileong]

damn, used up all my mod points already.

you know, for something like that, they really ought to provide proof it's a legitimate request. e.g. post a link to their course syllabus, "4.2 Destroy Motherboard BIOS"

thank god

[midspot]

lucky for all those on the list of the guy sueing the penis enlargement companies that that was not the db released.

Those guys would never find a date if all women knew of their "little problem"!!

You are entirely correct.

[Srividya]

I have tried so far to be patient and tolerant. To be patient and tolerant is to be a good person.

But there is a line.

Every person who is reading this article, every person who wrote this article, is wearing an "outsourced" shirt (maybe even made in India! look at your textile tag!), looking at an "outsourced" watch (usually Taiwan), staring at an "outsourced" computer monitor (again, Taiwan), and ready to drive home from their job which is "threatened by outsourcing" in their "outsourced" Japanese car. This is the way of the world! George Bush, the popularly elected president of America, meets at Free Trade summits, and this is Free Trade! Why should anyone whose entirely life is purchased of "outsourced" products complain of "outsourcing"??

Well my large personal escaping out of the way, it is a tragedy and a flaw what has happened in this article. However I believe it has happened many times before with American firms as well.

http://zdnet.com.com/2100-11-526757.html?legacy= zd nn

No?

So, we are trying not to make these mistakes as well. I can say that at least here the discipline is greater. This person will be beaten for sure.

Re:You are entirely correct.

[Anonymous Coward]

You forget: People in USA favor free trade as long as they profit. Or copyright. Or name it. Free for them does not mean free for you.

Re:You are entirely correct.

[Da VinMan]

And your post is correct as well. However, there is such a thing as "predatory capitalism". You might not believe this yet, but the software companies that have outsourced to India and other countries do not (AFAIK) really care one whit about India or its people. Someday, within the next 10 years probably, the likes of IBM and probably other companies will start setting their sights on even cheaper countries. When that happens, the resulting workforce fallout in India will make the bursting of the .com bubble in the US look like a picnic. An entire strata of India's new middle class will fall into poverty, and they will suffer greatly by it.

As an American software developer, I have my reservations (and yes, even my fears) about outsourcing. Some of that is irrational. Some of it isn't though. You have to ask yourself some hard questions. What will happen when India is no longer "free trade flavor of the decade"? Will the experience have been, on balance, a good one? Or will the newly dispossessed Indian developers also feel bitter? Have you looked into how life has improved for the Japanese and Mexicans? (I've heard that it's a mixed bag at best.) You're right, we've done all this before and we're just doing it again.

Perhaps none of the above will come to pass; that is certainly possible. But I still think that all of us, on a worldwide basis, would do well to ensure that the large companies that would like to do business in our countries actually have an interest in becoming a part of our countries. Every company's fate should be tied, to some degree, to the fortune of their host countries and their relationships with the host countries.

In short, I think the definition of "profit" needs to change over the long run. A company which simply uses their host community and does not contribute to a sustainable economy and environment should pay a steep price for being a poor citizen. After all, if companies get to be treated like people (in the sense of being a legal entity in the US court system), then they ought to have the same obligations.

Re:You are entirely correct.

[Justice8096]

Actually, my outsourced Japanese car was made in America, and ends up supporting more American jobs than my previous "American" cars
I don't think that the problem with "American" software is the cost of American Programmers. It is the incompetence of some American companies. Outsourcing work doesn't make a better product cheaper - it allows the company to make more mistakes, allowing management to survive a little longer, which is the same thing that "outsourcing" labor for making, say, a Ford Escort does. Seen from that light, your job is no safer than mine, in fact it is less safe - once the products start to fail, you will be blamed, because your good will is irrelevant - as long as you have less disposable EU or Dollars than I do, you aren't going to matter economically as much as I do, because they can't make as much profit from you.
Oh, and "protectionism" is what forced Toyota to open American plants. And I don't see that much of an increase in cost from them manufacturing in America - they cost as much as an American car manufactured abroad. The cheapness of your programming hasn't reduced the cost of any of the items I buy. It has reduced my salary - but that would have been reduced once the "Internet" bubble burst anyways.

Re:You are entirely correct.

[Anonymous Coward]

Why should anyone whose entirely life is purchased of "outsourced" products complain of "outsourcing"??

Quite right, sir! Any techie who whinges about outsourcing and did not protest equally strongly when the jobs of Detroit auto workers were "outsourced" to Mexico is a flaming hypocrite.

the dumbasses...

[SHEENmaster]

Who the hell thought to give him REAL information about these children in the first place? A fake datase would've worked just as well for development purposes.

Re:the dumbasses...

[johnnyb]

Actually, I've found that they don't. Fake databases usually are well-organized and thought out. The real deal usually has many, many inconsistencies that have to be dealt with. I always require real data to test any program I develop with, because otherwise it's just a nightmare at go-live time.

Re:the dumbasses...

[SirSlud]

actually

1. It's bad to develop with real data, because you make assumptions about what kinda of data you have to process. You should unit test the code, by *trying* to break it by using known invalid formats or invalid data to ensure that your software handles such input inconsistancies gracefully. As in, the only way to be sure your software won't core, or fork bomb, or enter an infinate loop is to test it on test data, which should be created by the developer.

2. You're right about going live tho. You'd never go live with software before you QA'd it in the final go-around with the real data just to ensure you're not going to spend 2 hours upgrading a platform, and 2 hours backing out.

Neither of these points has any bearing on the fact that, as a developer, you will (most of the time) have/need access to the real data at some point, so it really is up to the developer and the contractor to set out rules for the usage of the data, and even to have the developer sign an NDA of sorts to put the accountability where it should belong.

What stories like this really highlight is the sorts of losses that can occur from outsourcing or contracting that dont often show up on a cost analysis of the project. The less control and supervision you have over your 'employees', the higher the likelihood that those employees may do something with their relationship with you that may damage the company. I've had numerous higher-ups in other companies pass me sensitive data just because they need something fixed as soon as possible, and they can't find the experience/ability in house, and I just think its a completely irresponsible way of conducting business. But if I did something dumb with that data, it wouldn't be my ass on the line, because I was handed that data with no legal documentation concerning how I can use it and what I can do with it. Then again, maybe lawyers might see that differently.

All I know is that when it comes to outsourcing, its usually a gain in labour flexbility and cost effectiveness at the expense of a higher risk for the disclosure of sensitive information, be it data or security rights. It's a cost that employers can willfully ignore if they so choose, but again, I think its just bad business practices. Full employees have a far greater vested interest in the success of their employer and are far less likely to do stoopid things that one-off contractees have been known to do. That is, full time employees are more likely consider the legal and financial implications of how they go about providing solutions for product development. Employers hate that to admit it, tho, because it highlites the downside of a their utopian flexible labour force in which there exists little job security for the people actually doing the gruntwork.

Re:the dumbasses...

[Pakaran2]

The more interesting question is why he felt the need to post the real data. If I had a database formatting error, I would have written a fake database that was corrupted in a similiar wayt and asked about it.

Re:the dumbasses...

[Anonymous Coward]

Sometimes, you can modify real data to replace the original identifiers with fake information. Like, in a DB that contains SSN's, mix them up among the entries, or parts of the numbers. Swap first names among people. Modify addresses/phone numbers slightly.

It's possible to use a "real" dataset that isn't really real.

Re:the dumbasses...

[johnnyb]

"It's bad to develop with real data, because you make assumptions about what kinda of data you have to process. You should unit test the code, by *trying* to break it by using known invalid formats or invalid data to ensure that your software handles such input inconsistancies gracefully."

That's not really what I'm talking about, though. For example, I've worked with databases where the CS department entered in all X's instead of physically deleting an address. Their programmers had simply coded to ignore records with all X's. If an outsourcer had been given a sample data set, it probably would not have indicated this odd fact.

There's lots of other examples. In most cases, it's easy to make something that fails gracefully or does something, but that's different than working correctly. For example, many datasets use "0" or "-1" instead of infinity. If your program treated -1's as invalid data or 0 or raised an error, it would cause real problems when run against real live data.

Also, when computerizing paper forms, there are lots of pieces of information that aren't listed on the form, but are required to be written in the margins anyway.

Re:the dumbasses...

[orthogonal]

The more interesting question is why he felt the need to post the real data. If I had a database formatting error, I would have written a fake database that was corrupted in a similiar (sic) wayt (sic) and asked about it.

I'm guessing it's because he was a lazy dumbass who just didn't give a rip about the confidentiality of low-income kids in foster care.

Given that the article mentions he was informed that he'd posted live data, responded that he'd made a mistake and wouldn't repeat it, and then re-posted the same data the very next day I think supports my assessment.

As to why you would have gone to the trouble to substitute in fake data, well, you've got some equipment he apparently lacks: professional integrity and an ethical compass.

Re:the dumbasses...

[YOU LIKEWISE FAIL IT]

If an outsourcer had been given a sample data set, it probably would not have indicated this odd fact.

This is why the spec is important. If the spec says that X's might be used, the outsourcer should deal with that case. If it doesn't, and the CS department still uses them, then they are out of spec.

I dunno. I can't speak for your situation, but I don't have the time or budget to chase things that aren't in the formal document. My job is to implement what's in there, not to read the minds of the end users. If one side or another later remembers something that should be in there but isn't, have a meeting, revise the document. But just adding ad hoc special case after ad hoc special case is just going to drag you down.

Ignore the data. Follow the specification. The data can always be brought to heel later. :-P

-- YLFI

Re:the dumbasses...

[Anonymous Coward]

Also, when computerizing paper forms, there are lots of pieces of information that aren't listed on the form, but are required to be written in the margins anyway

And how praythee, does this have a bearing on your arguement ?

What do you really have against using your *imagination* to take up few blank forms and scribbling some data about Mr. X(including your "margins") ? If you took the effort to layout your specs properly to begin with, I don't see what problem could be there with the data.

Read up a bit on unit testing by the way. Trust me, you seem to need it

Re:the dumbasses...

[surprise_audit]

as a developer, you will (most of the time) have/need access to the real data at some point

That's not necessarily true. It would take more work, but the pre-prelease versions could be handed off to the QA dept of the originating company. Then, if their real-world data causes a problem, they hand back error reports to the developer, possibly with made-up database records that demonstrate the problem. More work and longer to release, but sensitive data is controlled.

This would not be substantially different to running the whole development cycle in-house.

In other news a poor geeky indonesian programmer..

[jamonterrell]

...has been whipped to a bloody pulp with a wet spaghetti noodle for dishonoring his mother country by making a blunder when asking for help at an online forum. Apparantly the deceased had forgotten to remove sensitive information from a post for help on a public forum. There will be no funeral services, nothing is left to be burried.

Shock, horror

[donnz]

OMFG an "outsourced" programmer makes a mistake. Well if case this doesn't protect your holy US of A jobs then nothing will. Pesky foreigners.

a user named Mark Dennis, stuck with a tricky formatting issue, posted his question to RentACoder.

Chist, they're even stealing our anglo saxon names, is there no end to this perfidious threat?

Re:Shock, horror

[be-fan]

Flamebait? Eh? That's just shitty moderation!

MOD PARENT FUNNY

[Anonymous Coward]

Holy shit, I love slashdot racism.

Multiple Problems

[chamilto0516]

I see several problems:

1) Looks like the IT work was being done on a budget. I mean they are not hiring Anderson to do this stuff right (OK, bad example, I know...)

2) But someone was paying SOME money if it could be subcontracted multiple times and the work was getting done...or was it.

3) It looks like it was contracted DOWN past someone's ability to do the job. It is kind of the opposite of the Peter's principle. Non interesting IT work keeps getting pushed down the chain until it is in the hands of someone that can't do the job. (If I just invented it, please don't call it the chamilto effect as I don't want my handle associated with this behaviour)

4) At the bottom of this there is always some careless sap that didn't know what they were doing wrong should get them slapped upside the head for thinking about it. This person was even worse because the article states that someone pointed out to him his error and then he...DID IT AGAIN!

Incidnet's like this require multiple wrongs and then will require a whole lot of legal work and policies and rules and regulations that will be once again thwarted by the idiots that inhabit this planet.

Re:Multiple Problems

[ahem]

Nope, that's it! Henceforth:

The Chamilto Effect -- IT scutwork is pushed down the developer food chain until it lands with someone incapable of doing the job.

Consider it in the Jargon File.

Not outsourced overseas

[crymeph0]

Rather than mod you down, I'll just let you (and all the other knee-jerks) know that THIS WAS NOT AN INDIAN PROGRAMMER. This was a guy named Mark Dennis. Not a very Indian sounding name. Also, Mark Dennis actually subcontracted the job involving the database out to someone in New Jersey. Maybe IHBT, but the article summary could make you believe this had to do with offshore outsourcing, so that's a misconception we should clear up early.

Re:Not outsourced overseas

[Shut the fuck up!]

This was a guy named Mark Dennis. Not a very Indian sounding name.

True, but if you replace the 'rk' in Mark with 'ndara' and the 'nnis ' in Dennis with 'eptanshu' then you have Mandara Deepthanshu. That, as I am sure you will aggree, sounds Indian to me.

Re:Not outsourced overseas

[crushinghellhammer]

LOL, you xenophobic freak!

And here's some info that you can spout at your next Xenophobes R Us meeting:

Mandara is not an Indian name, Mandira is (added bonus info: that's a woman's name)

I've never heard of Deepthanshu (I'm part Indian, and though I live in the US, know quite a bit about India) and even if it was, it would be a first name, and not a last name.

Re:Not outsourced overseas

[Anonymous Coward]

Hmm, Mark Dennis heh? That sounds more like Marc Denis with me. Blame the french!

P.S: I'm french-canadian. Not dumb enough to burn my karma by not posting anon.

Re:Not outsourced overseas

[SoSueMe]

True, but if you replace the 'rk' in Mark with 'ke' and the 'nnis ' in Dennis with 'epshiticancause thecompanyiamabouttoquit' then you have "Make Deepshiticancausethecompanyiamabouttoquit" sounds like an inside job to me.

Re:Not outsourced overseas

[ReTay]

You know maybe it is just me but I don't see where he said it was an Indian programmer.
He simply said you get what you pay for.

How you got there was your own doing.....
BTW He was right you do get what you pay for.
You want to hire a crack programmer? Be ready to pay him/her much more then the regular intern. Otherwise you had better have some other way to keep their attention.

Re:Not outsourced overseas

[SoSueMe]

Chicken.

Do you wear a visor when playing hockey?

Joking.

Don Cherry is a Dork!

Re:Not outsourced overseas

[Anonymous Coward]

Is that you, Mr. Cheney?

Re:Not outsourced overseas

[Anonymous Coward]

But the Day Care Center said he was "Honest, Intellegent and a pleasure to work with."

Re:Not outsourced overseas

[Anonymous Coward]

Arent you the knee-jerker by assumming that everyone will think "outsource" means "to India"? Once you figure it out, you assume everyone else has misread the headline too. Then you take the first post you see and assume they are thinking incorrectly and flame them.

Re:Not outsourced overseas

[Luigi30]

That's harder to say than Samir Nayeenaga... naga... nagagonnaworkhereanymore?

Not "unscrupulous", just stupid...

[Saeed al-Sahaf]

"let's not forget that this problem isn't a result of outsourcing, but an unscrupulous programmer."

Unscrupulous? No, just incompetent. Posting credit card numbers to some hacker site is unscrupulous; this guy's just too stupid to do his job.

Re:Not "unscrupulous", just stupid...

[nehril]

the kind of data that was disclosed was stuff like parent's schedules, birthdays, names, addresses etc.

all the kind of stuff a criminal could use to gain the trust of the child. "hi, your mother is still at the therapist, she sent me to come get you. and she told me today's your birthday... here's a gift..."

(yes, in some cases the parents therapy schedules and times were posted too). that's why this rises beyond the merely stupid.

Yikes!

[eli173]

County officials have not yet determined if they will tell the families involved about the incident.

"It's kind of a shock," said Morris, the county attorney. "Right now we are consulting with the state office ... to find out what we've got to do."

"not yet determined"!?! Those parents should be informed so they can be alert for trouble.

This verges on criminal.

[ezraekman]

The fact that the data went through multiple levels of subcontractors doesn't bother me, so long as each has signed the appropriate waivers and so long as each have been checked out enough to be trusted with the data. But there's no excuse for leaving proprietary and/or sensitive information out there, unprotected.

Password-protecting an entire directory is trivial. 20 seconds to a seasoned user, or a few minutes in a web interface for a newbie. This info wasn't just accidentally left unprotected; it was intentionally posted to a public-facing site, in an attempt to attract programming assistance. This, on it's own, could easily be called criminally negligent. But after being warned of the potential consequences and posting it again the following day... that's verging on knowing child endangerment. Use dummy data, for crying out loud!

Everyone makes mistakes, myself included. I'll admit to posting members-only data in a public area once or twice. But once you know about it, there's no excuse to not fix it. This guy should probably be prosecuted. And while I hope the families get notified... I seriously doubt most of the affected families will ever find out.

Oh... and write this story down, boys and girls. This is yet one more nail in the coffin for TIA-styled programs. "Oh, we're very careful with our data." Right.

Re:This verges on criminal.

[StrawberryFrog]

The fact that the data went through multiple levels of subcontractors doesn't bother me, so long as each has signed the appropriate waivers and so long as each have been checked out enough to be trusted with the data.

Well, it bothers me. When a chain gets long enough, the probability that there's a weak link in there somewhere approaches 1. You want confidentiality? You must pay for it by limiting access to data.

This is yet one more nail in the coffin for TIA-styled programs. "Oh, we're very careful with our data." Right.

Exactly. Never mind this screwup, the whole concept is flawed. You don't get best security at lowest prices.

Procedure, Procedure, Prodecure

[hellfire]

First of all, the article is fanning the flames by saying this is a database of children's whereabouts. Okay, this is a problem, but then again it doesn't matter if its children or anyone, it just gets "oh please save the children!" sympathy clicks.

It also doesn't address what I think the biggest problem is. It's obvious to me someone assumed this bozo of a programmer had some not-so-common-sense about posting information to a website. I deal with customer data all the time, and my company has taken some steps to make it a little harder for people who should not need the data to not get the data, and our data exchange policy clearly states "Do not give this data to anyone outside of this company or you will be beheaded!"

I get to this day accountants in our company saying "why can't I peek at this customer's data" to which I reply "Do you have a signficant need? If so, tell your manager to talk to my manager, and I'll be happy to give it to you." I get nothing after that. The customer data we have is for support and development use, not an accountant who has no use for inventory and sales information (at least not in this company). It is also freely accessible amongst those people, who typically only share it within others in their department.

One day a manager might get an idea that looking at a customer's data might give them an idea of their open bills, but that might be unethical or illegal so until a manager says to give access, I won't.

My point is, it could be that the policy was not pounded into this dolt's head, or that a proper data exchange policy even existed. If so, he's still a dumbass, but companies frequently hire dumbasses, which is why you sometimes need a policy to help prevent dumbass behavior. The article puts full blame on the programmer and doesn't really give any blame to the company who hired him.

Re:Procedure, Procedure, Prodecure

[R2.0]

"Do not give this data to anyone outside of this company or you will be beheaded!"

Does that mean your company has a Chief of Cervical Separation? Or do you just call him the Head Beheader?

Re:Procedure, Procedure, Prodecure

[griann]

If the article puts full blame on the programmer, then I don't think that is unreasonable. I seem to recall reading one point in the article in which one of his respondents on the site actually advised him that posting the data was questionable, ethically. Our friend then acknowledged his mistake and then proceeded to post it again (with another question?) the very next day.

Now, to leaven the argument out, I don't think he should have had any access to real data in any case. Argue with me if you will about differences between test data and live data. That's what I've been dealing with day in and day out for the last six years. I don't believe that there is ever any need to hand an outside developer sensitive internal data. Perhaps a better abstraction through the data structure layer might have been employed. That way the developer only needs to know the absolutes of the structure. Getting the data into that structure would then be a separate task and could be more closely monitored.

I have never come up with a case where actual live data was needed for basic development. Fine tuning during parallel testing still does not require a developer to see any more of the data than what exists in the current process which generated the fault.

Re:Procedure, Procedure, Prodecure

[hellfire]

Well my argument is not that the company is purely to blame, it's that the company this person hired shares some of the blame. The article to me pins all of this on one lone stupid programmer, and hints only slightly at the beauracracy of subcontracting being the problem. Like i said... this programmer is a boob, but if the company had no clear policy, it shares some but not all of the blame.

I in fact share the feeling that customer data is not necessary in general, but I'm in support, not development. I personally feel having to get so much customer data is truly a waste, and the time should be spent ahead of time with better testing procedures, but I really have little say over this. What I am saying is if you feel this is necessary, get yourself a corporate policy.

These violations are RAMPANT.

[Anonymous Coward]

I work at a company that makes software for viewing printer protocols (PCL, HPGL, etc.) As such, we often receive problematic files from customers which do not view properly in our viewer.

You would not believe the sensitive information we receive. People don't even think about the ramifications when they send us, for example, somebody's high school transcript, or mortgage closing documents, or people's credit reports. We have secret inventory lists for competing companies, each of which would probably kill to get their hands on that information. We have "insider" information on the international banking industry. We have medical records. Prison records. It goes on and on.

Because of this, we have an extremely tight document policy. Data exists on paper only long enough for testing purposes, then it is destroyed. The bug tracking database is purged of old test cases on a regular basis. Customer files never leave this office, in paper form or otherwise.

In fact, as I write this message, I can think of several ways that we should probably be even more paranoid. Fortunately, the officers of the company take our responsibilities very seriously, and there has never been any serious breach of customer confidentiality. I hope there never is.

The programmer who posted identifiable information to a public web site, because he was too incompetent to solve his own problems, is an idiot who should be fired and beaten with a wicker cane.

Re:These violations are RAMPANT.

[Anonymous Coward]

One of the handful of people who knows about the situation at your office, posted that AC message. The handful-minus-one all know who the AC was.

Re:These violations are RAMPANT.

[Anonymous Coward]

I'm not quite sure I understand your point.

What are we supposed to do when receiving sensitive materials other than immediately destroy them (which is what we do)? You can't prevent people from being stupid and sending things to you they shouldn't be sending.

Re:These violations are RAMPANT.

[Chanc_Gorkon]

While I won't say that sending a file to your company or another company is the wrong thing to do, sometimes in cases such as this it is unavoidable. Case in point, I work with Xerox day in, day out. Xerox is VERY careful with the data I send them. In fact, if a problem crops up again, I invariably have to resend the data to them. Soemtimes, all I do is send the code, and a obfsucated copy of the data that follows it. Sometimes, though, the obfuscation of the data DOES get rid of the bug. You GOT to send the file. Sometimes I wish encrypting your mail could be easier (as in not having to think about it). This points out...SMTP really needs to be changed. SO does POP3 and other mail protocols. Eevn the ARRL uses certificates for signing data for the LOTW and thats just to make sure your not sending a bogus file.

BEFORE INDIA OR ANY OTHER NON-US COUNTRY IS BASHED

[Anonymous Coward]

RTFA....it says

"County attorney David Morris said that programming work for the day-care center had been outsourced to the locally-based Genesee Community College. The manager of the college's program refused to speak to a reporter, but Morris said Dennis was a third party consultant hired by Genesee. Dennis, in turn, used RentACoder to once again subcontract the database work, which ultimately fell to a New Jersey-based programmer."

Are we children to you?

[Srividya]

Can no other race learn from their mistakes? Do you think this will not send shockwaves through the companies, that we will not learn?

We are not as stupid as you think!

Re:Are we children to you?

[DylanQuixote]

I think the worry is that it is perhaps easier to do things like this in developing countries. Not sure if an assumption of less law enforcement is a fair assumption or not. I lack data to make such an assumption. *shrugs*. Anyway, I, as a American college student, say that while I worry a little about my financial future, do not think you're stupid. We are not as greedy or lazy as you think, either. "All men are born equal" We're all brothers and sisters, yes?

datase?

[Anonymous Coward]

would there be gaping holes in it?

Kidnappings correlated?

[forand]

I hope that the police in upstate New York correlate the kids whose information was posted and missing children reports.

Also for everyone who says: "This could happen with an American programmer just as easily." Yes that is true but you could punnish that programmer but you will have a hard time punishing programmers in other countries.

Re:Kidnappings correlated?

[forand]

Strike the last part of the above comment, at least concerning this case. It is still a valid point for offshore outsourcing.

Re:Kidnappings correlated?

[Anonymous Coward]

I just don't get why people think that information about people is likely to be used to stalk them. If I wanted to stalk someone, why shouldn't I just pick a phone number at random? Why not just follow a random car home? Why not just walk by a school at closing time and snatch a child? How does this information help bad guys?

Re:Kidnappings correlated?

[Grishnakh]

Because stalkers don't just pick victims at random. There's something about them that they desire. Having information easily available just makes it much easier for them to do this.

Would Darl McBride be getting harassed so much if someone hadn't posted his address and phone number on Slashdot? Would that famous spammer (forgot the name) have gotten tons of junkmail if someone hadn't found his mailing address and posted it on the internet?

Sure, some child molester might just pick a kid randomly, but having YOUR kid's info posted on a public forum suddenly increases the chances that your kid will be the one molested dramatically.

Stupid coder, stupider company...

[Saeed al-Sahaf]

Unscrupulous coder? No, just incompetent. Posting credit card numbers to some hacker site is unscrupulous; this guy's just too stupid to do his job. But look at this part of the MSNBC story:

"It's not likely all those visitors unzipped the attached database, but there's no way to know how many did, according to RentACoder CEO Dan Ippolito."

This company is so damn stupid they don't know how to check their logs to see how many times that file was downloaded,

Re:Stupid coder, stupider company...

[jas79]

their logs only say how many people downloaded the file. not how many people actually unzipped it.

Re:Stupid coder, stupider company...

[Saeed al-Sahaf]

Chances are high that if someone downloaded it, they took a look-see...

children

[dan2550]

what does the fact that the info was about children? although they may be more at risk to pedophiles, it is ALWAYS a bad thing when confidentially is broken.

The answer is simple:

[Anonymous Coward]

Outsourced moderators, of course.

Is outsourcing the main problem here?

[belmolis]

What happened here is certainly appalling, but I'm not so sure that outsourcing is the main problem. Outsourcing arguably increases the risk of problems of this sort because an in-house programmer is more likely to know the rules of the game, but this seems to me to be a fine point. On the one hand, in-house IT staff are not necessarily going to be well-informed about privacy issues and the nature of the data they are working with. On the other hand, it is perfectly possible to make such constraints clear to contractors and to make them part of the contract.

It seems to me that there are several other issues here as well. For instance, why would any programmer be working with the whole, real database? I can see that if the job is convert an irregularly formatted text file into a usable database, but that is about the only situation in which the programmer needs the real data. Otherwise he or she just needs to know what the data looks like. If sample data is needed, it can be a small subset, and critical information can be camouflaged. Of course, the same applies to the programmer asking for help on RentACoder. There's no need for him to post his whole database.

It seems to me that the real problems here are:

• the programmers shouldn't have been working with the full, real database in the first place
• confidentiality requirements weren't spelled out.

Re:Is outsourcing the main problem here?

[laird]

"why would any programmer be working with the whole, real database?"

While it's true that you can do most of the development using a subset of the data, you can only do the final testing using the real, full database because any subset may be non-representative. Also, it may be that the "product" wasn't a conversion routine by the converted data, in which case by definition he'd need the full data set.

That being said, this screw-up had better cost RendACoder a _ton_ of money. Even if the individual programmer didn't realize the privacy implications of posting the details of hundreds of kids on a public BBS, his management should have -- and fired him. For missing this, they should be hurt, badly.

Re:Is outsourcing the main problem here?

[Anonymous Coward]

Outsourcing could be seen as the problem because it is harder to verify quality standards when dealing with external programmers. The very advantage of outsourcing is also its biggest problem: You get to choose the specialists (or those with the lowest bid), but that means you are going to choose different people all the time, so you don't know as much about them as you know about your own coders. In consequence you have to take many more precautionary measures (such as not allowing tests with real data). That costs money, so it is avoided whenever possible, and sometimes it's avoided when it shouldn't have been.

Re:Is outsourcing the main problem here?

[fatray]

I disagree. The problem is the clueless manager that allowed the live, confidential data sent out in the first place. If I hire an outside programmer to work on my live, confidential data, he will do it on site on my computers. He can do the bulk of the programming on his site, but if the real data is involved he has to come to me. If there is a design problem, like how long to make the name field, we can look in the live db and tell him that the current longest name is 20 chars, so let's make it 32.

If you are sending you confidential data out to these sorts of contractors, then you don't have confidential data.

Re:Is outsourcing the main problem here?

[Anonymous Coward]

this screw-up had better cost RendACoder a _ton_ of money

What's RentACoder got to do with this? They're acting as a broker and have no real control over what's posted. Do they have to inspect each job posting and each file upload? What if the two people sent the zip file to one another in email? Is RentACoder liable then?

Re:Is outsourcing the main problem here?

[laird]

I have to admit that I've not used RentACoder, so I don't know exactly how they work. If all they do is provide a service to match programmers with jobs, then you're right, they aren't responsible for the situatuation. But if they're like a normal placement agency, they're at least somewhat responsible for the people that they place, and in most states that'd make them partially liable.

Before the India/outsourcing bashing begins

[andy1307]

That's how personal details about hundreds of children ended up on the Internet. A user named Mark Dennis, stuck with a tricky formatting issue, posted his question to RentACoder -- and attached a zipped copy of the database he was working on.

This work was outsourced, not offshored. This article has obviously been posted to show how outsourcing threatens the future of our children. This work wasn't offshored. It was done by an American programmer. If outsourcing is bad, why did the navy outsource a 5billion $ chunk of IT work to EDS?

Re:Before the India/outsourcing bashing begins

[OneFix at Work]

I don't think the concern is that they outsourced something...it's what they outsourced to a group that didn't respect the security of the data.

The truth of the matter is that this guy (regardless of where he was) either didn't care or didn't know how sensitive the data was.

The real question is why wasn't this college being kept on a tight leash??? Why were they even allowed to outsource it at all??? The real problem lies with the county for not specifying "no sub-contracting"...

Re:Before the India/outsourcing bashing begins

[Anonymous Coward]

If outsourcing is bad

Apples and oranges. The Navy's business is to keep their subs running and blow up stuff. What EDS handles is the routine back office work. I would hope that the Navy keeps a core set of programmers around to do the "real" work.

In this case the health services agency outsourced their prime business concern: protecting the confidentiality of the children. You should never do that, and you get whatever you deserve.

Re:Before the India/outsourcing bashing begins

[Anonymous Coward]

Because they wanted a Fscked Up job that only EDS know how to truely do.

Re:Before the India/outsourcing bashing begins

[Grishnakh]

Furthermore, the Navy outsourcing $5 billion worth of work to a company with a long reputation and billions of dollars in value is very different from outsourcing private data to some random programmer on RentACoder.com.

First, the Navy probably is much more careful with their confidential information and how it's handled when they outsource work. Obviously, whoever outsourced this database work with childrens' info wasn't very scrupulous.

Secondly, if EDS screws up really bad, there's serious consequences. EDS accepts a lot of liability for work like that I'm sure, and has a lot to lose, considering their worth. So they're going to be careful in how they handle any confidential data, just like any other government contractor (Raytheon, Boeing, etc.) is. These companies don't develop decades-long relationships with the military by acting incompetently with classified info. Outsourcing your work to some guy you found on some "rentacoder" website doesn't give you these kinds of assurances.

"Outsourcing" isn't a problem in and of itself. The government outsources all kinds of work to private-sector companies, including the production of most military equipment, and they've been doing it for over a century or more. The problem with outsourcing in the past few years has been that companies are doing it solely to save money, and are sending it to whoever will do it cheapest, regardless of all other variables.

Re:Before the India/outsourcing bashing begins

[Stormshadow]

I would have to say the retirement package the Admiral in charge of that decision helped. Nothing quite like approving a project, getting out of the Navy shortly thereafter ... and going to work as a exec for the company. Sounded fishy to me.

Outsourcing not the real issue...

[toddgater]

The real issue is the basic problem of free will. Any individual working in a position that requires it, outsourced or inhouse, would have the ability to handle privilidged data. Security can never be gauranteed when working with a system that is controlled or in this case programmed or coded by beings (human or otherwise) that have control over there own free will. Outsorcing may elevate the security risk since there isn't a good way to take good precautionary measures that might be possible when maintaining developement inhouse, but ultimately there is still a risk. How much do you trust your average programmer?

Could be even worse with offshoring

[FunkyOldD]

[paranoia]

This is one of the things that really concerns me about offshoring. As US corporations keep outsourcing software development to another countries, the confidential data will inevitably move there too.

How long before private information like credit histories, medical records etc. is leaked out from some company in Bangalore?

Imagine being blackmailed by someone in a third world country. Given the state of law enforcement over there, you would have no legal recourse.

[/paranoia]

Re:Could be even worse with offshoring

[YrWrstNtmr]

How long before private information like credit histories, medical records etc. is leaked out from some company in Bangalore?

Your info is already offshore. Quite a lot of banks use services offshore for data entry. Buying a car a couple of years ago, I overheard "It needs to be written that way so the people in Mexico can transcribe it correctly."
I still went through with the deal, but it is already happening.

Oops....

[Skyshadow]

Shit. So much for that anon thing. (cringe)

Guess my sig goes double now...

Re:Oops....

[DarkHelmet]

See, this is how ya do it :)

....SHIT!

Re:Oops....

[Anonymous Coward]

Yup. You failed it.

Oh wait. Is SkyShadow your given name? Is it really that much more traceable than if you had posted AC?

Re:Oops....

[Anonymous Coward]

But on the bright side, you didn't risk any more karma with a karma bonus...

Re:Oops....

[Ralph Wiggam]

I see you're new here.

-B

Re:Oops....

[cyclist1200]

Actually, I think I heard about this incident. It's a good argument for compartmentalization.

I used to work for a healthcare transaction company, and we developers had absolutely no access to patient data. I had no access to production databases, just dev and staging. Those databases used fake test data only. We weren't likely to be sued by Ima Genius or Homer Simpson over the loss of their records.

Re:Oops....

[Anonymous Coward]

The thing is that you need to actually *stop* working when reading and posting to Slashdot at work. Trying to work at the same time will only break your concentration, causing you to forget important details.

Re:Oops....

[Anonymous Coward]

I've dealt with several databases that normally contant all sorts of personal data. It has been a standard practice at multiple companies that we don't develop and unit test with the real data. We use the real schema. But except for performance tests and customer acceptance tests, we use small databases with bogus data. Aside from eliminating privacy concerns, it allows you to construct test data to test error conditions that you hope won't ever occur in the real data.

Who made the blunder?

[gokubi]

It's great to see how different news orgs handle headlines. MSNBC makes pains to name the Government as the offender in it's headline, "Government agency exposes day-care data". Slashdot is a little less breathy and indicates the true source of the leak, the out-sourced coder.

Both could be called correct, but more interesting is how the positioning of the story indicates the inclination of the news source. MSNBC is part of the mainstream news establishment that has been telling us for years that the government hasn't done a good thing since kicking the British out of Yorktown.

Slashdot speaks to a lot of developers who don't ever want to work for a place called "RentaCoder", and don't have a lot of respect for anyone who would.

Personally, I much prefer the Slashdot take on the story.

Re:Who made the blunder?

[fishbowl]

"MSNBC makes pains to name the Government as the offender in it's headline"

Rightly so! The "contractor" who is being maligned here was only the LAST in a series of people to violate the basic principle of keeping confidential data confidential. Some government functionary had to drop this ball first, and that person is not only keeping his or her job, but is also not being named in the media.

I want the name of the FIRST person who released this data, not the LAST one!

Re:Who made the blunder?

[Filibustero]

I think the headline should focus on the government, because the government is the one with the responsibility to protect the information.

Sure, the person who posted the information was wrong to do so, but it is still the government's job to prevent this sort of thing from happening.

Re:Who made the blunder?

[wooftronics]

I agree with your point that it's interesting to see the differences in blame-placing...

But is the "mainstream news establishment" anti-government...?!?!?

On the contrary, the "mainstream news establishment" here in the USA seems to be pretty much just a fourth "Public Relations" branch of government.

(Which is why, in the USA, a "balanced" debate in the popular media is usually between one person who thinks the President is "really, really good" and another person who thinks the President is "really, really, really good.")

google says...

[larryk]

Quick google check (mark dennis lima) finds name, address, phone no. spouse, and three pets. http://www.limademocrats.com/bios/mark.asp

The Real Kicker

[stoolpigeon]

is this little bit at the end of the article

County officials have not yet determined if they will tell the families involved about the incident.

If that isn't sick I don't know what is. I thought it might be more like 'haven't decided how to tell....' not IF they would tell

Next "news" in Slashdot...

[teetam]

"Left Handed programmer writes a virus"

This raises serious questions about employing southpaws in software projects!!!

This is relatively simple...

[John Murdoch]

If you're an independent consultant, your insurance agent has probably mentioned "Software errors and omissions" insurance to you. Software E&O coverage is written to protect your ass(ets) in the event that you colossally screw up and do something that gets your client's client answering awkward questions from major news organizations. (A colleague once observed that, "if, when you walk in the door in the morning, your secretary says that a CBS producer is on the phone trying to schedule you for an interview with Mike Wallace, it's probably a bad day.")

Suffice it to say that if Mark Dennis doesn't have Software E&O coverage, he's going to wish he did. Because he's going to get so sued. Along with the community college, the government agency, and everybody else involved.

Getting sued, however, is the least of this bozo's worries
If he has insurance, it might cover his liability exposure. However, his real problem is the civil fines he is going to have to pay--and no insurance policy in the world will protect you from a criminal court sentence. He'll get a whopping fine--but I doubt he'll do jail time. Unless, that is, somebody can demonstrate that a child molester used the database to identify a victim and attacked him.

There's an important point here
The software community should make it ABUNDANTLY CLEAR that this dumb cluck should have the book thrown at him. We have absolutely zero sympathy--and when his attorney (with nothing else to argue) says "it was all a tragic mistake..." somebody needs to stand up and yell, "LIES! LIES! DAMNABLE LIES!" This was willful, deliberate, with knowledge aforethought stupidity. And this jerk deserves to get run up the (proverbial) yardarm for it.

Re:This is relatively simple...

[Pakaran2]

Unless, that is, somebody can demonstrate that a child molester used the database to identify a victim and attacked him.

Yep. And it's interesting to note that even the most hardcore gang members and heroin dealers in prison have some very interesting ways of treating anyone who even resembles a child molester. To be blunt, he would get reamed out by more than his employer,

Re:This is relatively simple...

[Anonymous Coward]

Because he's going to get so sued

How do you figure that? He was given a task to do: format this data. I bet no where in his contract specified "You're not to leak this info out."

Re:This is relatively simple...

[John Murdoch]

Hi!

How do you figure that? He was given a task to do: format this data. I bet no where in his contract specified "You're not to leak this info out."

To the contrary--he was hired as a consultant. And being hired as a consultant carries with it an implicit assertion of expertise. He wasn't picked out of the line at the local unemployment office, taught how to use a keyboard, then told to do this as an assignment. He was hired as a consultant--which means he represented himself as having at least some professional skill.

Apart from the question of professional responsibility...
I was an independent consultant for 15 years--and am presently an engineering manager for an electronics company--and among my responsibilities I work with the company attorneys on software licenses and other contracts. Every consulting contract I've ever seen included language stipulating that no customer data of any kind could be revealed to anybody. And every consultant I've ever discussed it with regards that contract clause as a waste of paper--because no professional in his right mind would even think of doing something that dumb.

Sorry--I have absolutely no sympathy for this guy.

Re:This is relatively simple...

[kfg]

I got ABC for Baba Wawa. Not quite as heart stopping and it turned out ok in the end.

They wanted to interview me as a positive example of something.

Go figure.

KFG

Re:This is relatively simple...

[Anonymous Coward]

To the contrary--he was hired as a consultant.

Again, you don't know that. Just because he has some special skill doesn't mean he's a "consultant" (do you hire "drywall consultants" to work on your house?). He probably responded to a post asking for a person to do some work.

I'm not excusing his behavior, but showing that he's liable in this case will be hard to do. He can just say "Why did they give me real data anyway, most other places give you fake stuff"

Re:This is relatively simple...

[John Murdoch]

Again, you don't know that. Just because he has some special skill doesn't mean he's a 'consultant'.... He probably responded to a post asking for a person to do some work.

According to the article, quoting a New York state official, Dennis was hired "as a consultant" by Genessee Community College. It strikes me that he has two issues: first, he clearly isn't very competent as a consultant to do something like this; and second, I would think that Genessee Community College might object to his re-posting their consulting assignment (even without confidential data) on a board named RentACoder.

But that's beside the point: liability is the least of this guy's worries. He's likely to be prosecuted, and if/when convicted he will be fined. (I'd be flummoxed if the guy got jail time.) "I'm too stupid to use a little common sense" generally doesn't fly as a criminal defense. It is even less likely to be successful if the guy held himself out to be a professional consultant. And what's important is, this guy deserves what he gets. And probably more--there are things in any profession that are deemed inexcusable. And I'd think in practically any consultant's book that posting client data on the Internet is one of those inexcusable things. And there's simply no excuse for not knowing better (especially since this joker was warned by another user of RentACoder on January 26th, acknowledged that he shouldn't have done it, and then posted another copy of the database the next day). That goes past dumb or irresponsible all the way out to conscious, deliberate stupidity.

Simple...

[Vrallis]

:%s/[A-Za-z]/X/g :%s/[0-8]/9/g

Simple. Just obfuscate it, and you can pass it around for people to help with formatting issues all you want. I've done that with payroll data plenty of times.

Just two lines or vi commands could have saved this guy so much trouble....

Re:Simple...

[wowbagger]

And simple for anybody to reverse, too.

Simple letter frequency analysis, coupled with a few dictionary searches, and bingo - I've recovered the data.

Did it get a Google Cache

[kyoko21]

I wonder if Google got it cached somewhere in its basement of servers and servers?

Lima...

[Compenguin]

Officials at the New York State Office of Children and Family Services and in Livingston County, where the incident occured, are investigating. Livingston County's social services office is located in Lima, just a few miles south of Rochester, N.Y.

Lima, where the men are men and the sheep are nervous

HERE is the problem...

[dbc]

County officials have not yet determined if they will tell the families involved about the incident.

The county has lost sight of it's moral obligations. How could they *not* tell the people involved? Some may have double-damn-good personal safety reasons for knowing that their privacy has been compromised.

Really, why give a contractor real data? You can copy the schema into a toy database and make up dummy records for all the interesting programming cases. *That* is the only thing that should go out of the house. Anything else is just stupid.

And *not* telling people that you have compromized their privacy and perhaps the personal safety of their children is simply immoral. It should be illegal, and it most certainly is grounds for a big-time law suit against the county.

Of course, the county attorney knows that and will fix it when he gets involved... let's hope he reads SlashDot :-)

Who is sending this information?

[nuggz]

Unless you are bound by the privacy legislation or agreements, they shouldn't send you this information.
The second issue is that even if you are not bound by legislation, there could be an assumed level of confidentiality, however that isn't of the same strength.

Re:Who is sending this information?

[Anonymous Coward]

As I said, we have nearly a hundred thousand customers, and if they have a problem viewing a file, they will typically send us the file without thinking of the sensitivity of the information it contains.

Some institutions, primarily banks, are very careful to properly anonymize the test cases they send to us. However, sometimes this "anonymization" makes the bug go away, and they are forced to send us a genuine document to illustrate the bug.

All employees sign NDAs for various customers who send us large amount of sensitive information.

We obviously cannot stop people from emailing this stuff to us. If they have a problem, they send us the file. We fix the problem, try to boil down the test case to something anonymous, place that in our QA database, and destroy the original. We have very specific procedures for doing this.

Often, we receive stuff where it is fairly obvious we should not be in possession of it. We destroy these files immediately. However, the damage is really already done, since there is someone inside the other company who is willing to transmit confidential files via unencrypted email -- if they sent it to us, they've probably screwed up other times as well.

OT: RentACoder owner is an asshole

[arf_barf]

Just in case all you unemployed geeks consider rentacoder for some work, here is a sample email from Ippolito that I have received a while back:

"... When you try to issue a charge back, here is what I will be doing:

1) I will be reporting you to the VISA (or Mastercard) Internet Fraud
Division with your tracked email address and IP Address (both of which
have been re-confirmed again by the headers in this email you just sent
me!). Every time we've done this, people have lost their credit card
accounts, and I look forward to making you lose yours.

2) I will be reporting "...." to the Better Busisiness Bureau in
Aliso Viejo, California as the deadbeat business that it is. I look
forward to having everyone in your local community know exactly what
kind of business you are.

3) Site rules will force me to inform the coder that you are trying to
stiff him, so we will notify him of this. It's probably one of the
stupidest things in the world to try to stiff a coder as you usually end
up email firebombed or worse. Exhedra does not condone such
activity...but I've been around a long time to know how people react."

It's your call. Either act responsibly for your actions, or suffer
the consequences.

Sincerely,
Ian Ippolito

Re:OT: RentACoder owner is an asshole

[Ozone Depletion]

actually, he seems like an okay guy, I'd want someone looking out for my paycheck.
And if you were trying a stiff someone you should burn in hell.

Re:OT: RentACoder owner is an asshole

[The Bungi]

Moral and technical (nee quality) considerations of things like "Rent-A-Coder" aside (which seems to employ foreign or very junior developers as a rule) this tells me that a) At some point you considered using their services. I'd have to question your wisdom in that; and b) The guy, while of course looking out for his revenue stream, is also protecting the poor sod that actually slaved to produce the code. That can't be bad.

Re:OT: RentACoder owner is an asshole

[arf_barf]

Yes, I did use the service a while back. The dispute was about a technicallity: I sent a link to my page to the graphic artist, and btw. the work was done in Canada and I paid fair price for the service rendered.

Re:OT: RentACoder owner is an asshole

[arf_barf]

I wasn't. The dispute was about a technicallity. No work has been performed and I suggested that if they have a problem with me that I will take my business elsewhere. That's when I got that email.

And btw, guess what: my CC company sided with me because I have not received any goods or services for my payment (rentacoder requires a payment before any work will commence)

Re:OT: RentACoder owner is an asshole

[Anonymous Coward]

I will be reporting "...." to the Better Busisiness Bureau in
Aliso Viejo, California as the deadbeat business that it is

You can't post his email without the context. Did you use his service and then stiff a coder? That seems to be what he's implying.

Re:OT: RentACoder owner is an asshole

[arf_barf]

Nope, you have to pay them prior to receiving any deliveribles (code/service). No work has been performed at the time.

Re:OT: RentACoder owner is an asshole

[Anonymous Coward]

Nope, you have to pay them prior to receiving any deliveribles (code/service). No work has been performed at the time.

So then you're just stiffing the RentACoder operator then?

Re:OT: RentACoder owner is an asshole

[arf_barf]

Yes.

They are a business. If they have a problem with me then don't do business with me. Like I said in some of my replies in this thread: I offered to go away and not do business with rentacoder.com. In response I received the above email.

Btw, the disagreement that we had: I had a link to my home page in my profile.

The job that they lost: 25 icons for $300.00

Re:OT: RentACoder owner is an asshole

[robnauta]

You don't pay them, the money is held in escrow (according to their website, not sure if that can be done to money), and will be delivered to the coder when he finished his work and you approve it. If you rent someone for a $1000 project, he starts working on it and then you get the $1000 back using a credit card chargeback, what's the other guy working for ? He might spend 100 hours working only for you to say 'sorry don't need it anymore'.

It's not about India, damnit!

[LilMikey]

But it is about outsourcing in general. Any company with a good amount of highly sensitive data should maintain a chain of trust across their IT personel. Everyone working on the data should have at least some idea of how sensitive it is and what has to be done to protect it. You don't get that from shoving the work off on the lowest bidder. There's a reason they ARE the lowest bidder...

And Rent-a-coder? Come on... it's looking for trouble when there are thousands of out of work programmers of varying quality and you're asking for the cheapest? Crikey! Programmers working on crap data are getting slammed with soul-stealing NDAs and these wankers are forking off kid's names to some shmuck on a glorified web-board? Again I say outsource the management, keep the programmers.

Rentacoder sure seems slow right now...

[Satan's Librarian]

From the speed of the RentaCoder site, I'd say a lot of unemployed slashdotters want to be 'outsourced programmers' too....

I looked too... I'm not sure which is worse though - the fact that the prices on the projects are beneath a living wage for me to consider bothering with them (I'd make more as a barista or a dishwasher), or that half of them seem to be helping some dishonest schmuck in a CS class cheat on his assignment so there will be more clueless dorks that can't program their way out of a paper bag holding CS degrees out there applying for jobs.

I'm cool with competing with Indians - for the most part the Indian coders I've met worked their asses off and knew their stuff, even if they might be willing to do it for half the price I'm used to commanding. If I was in their shoes, I suspect I'd do the same. Feeding your family is a good thing....

It's all the people that fill their resumes with keywords for technologies they don't understand and couldn't use if their lives depended on it that clutter up the application inboxes that annoy me. HR departments encourage that behaviour, as do hiring managers that can't tell the difference, but it still pisses me off - both when I end up having to interview such cluebags and show them to the door, and when I'm competing with them for a job.

Slightly OT, I know, but...

[Txiasaeia]

... two articles today that are related to _Jennifer Government_ (book) makes for a serpendipidous day! For example: Nike corporation wants to sell shoes, so they hire one of their own employees to kill a certain number of kids wearing these shoes, therefore giving them "street credit." The guy doesn't want to do it, so he outsources it to the Police corporation, who then in turn outsource it to the NRA. The NRA completes the job.

Point of correlation: outsourcing hurts kids!

Offshore - not

[Anonymous Coward]

Before you get cursing India, China and the money hungry CXOs, this was not offshore outsourcing. RTFA. Some NJ programmer posted this on rentacoder. Amazing how people would get into this looking at the word outsourcing.

You get what you pay for...

[Anonymous Coward]

And when you want to pay shit money, you get shit. You can't expect paying Nissan Micra money for a Lexus...

Roman Catholic church moving to Rome

[Anonymous Coward]

Rome, NY

The Original Problem

[fatray]

OK the coder screwed up.

The primal problem is that the government agency gave the data to their outsourcing provider. That data should have never left the secure area of the government. Once it is out, it is out. It doesn't matter whether it has gone to Gennessee CC or RentaCoder. Posting it on the web is just a matter of degree.

Everybody is ready to hop all over this clueless coder and blame everybody's favorite boogie man of outsourcing. There is a manager back in the government that originally disclosed the data.

Don't tell me about NDCs. The first rule of confidential data is NEED TO KNOW. It would have taken someone 15 minutes to put in some dummy data for the programmer to work with, but they couldn't be bothered. Now that person wants to crucify the programmer.

The programmer who screwed up is only the last (and most visible) in the chain of screw ups.

I know those kids

[earlums25]

my girlfriend and i graduated from SUNY Geneseo and are now both teachers. She has worked extensively in that area in several different day care facilities. We are horrified about the situation and concerned for those kids. what has happened to the programmer and can he be held liable for any crimes against the children and/or parents whose info he leaked?

The *REAL* Downside of Outsourcing

[Anonymous Coward]

When you outsource, you run the risk that the individuals doing the work do not share your company or even cultural values. If you are not willing to take the time to make sure that your outside contractors are what you expect, this is the kind of thing that will happen. Few companies really understand this.

When you outsource, you run the risk that the individuals doing the work do not give a flying f--k about the security and/or confidentiality of your data, they may even deliberately and maliciously seek to cause you harm. Few management types really care about this, as long as they're saving a buck.

That's Ian Ippolito!

[Metasquares]

The CEO of RentACoder is Ian, not Dan, Ippolito. He's the same guy who brought us PlanetSourceCode.

This can destroy a company

[Anonymous Coward]

A few years back a leak of a confidential customer database destroyed the Northwind company.

Re:This can destroy a company

[marko123]

Pissed myself. Thanks!

Re:This can destroy a company

[jgoemat]

LOL, wish my mod points hadn't expired :)

Some notes

[MAXOMENOS]

Do you say, "Only certain government approved facilities can deal with this sort of information?" Seriously, should I feel that someone "government sponsored" is better off with my information than an outsourced programmer in India? Who gets to play Big Brother? And what will they do with what they know?

The difference is that a government employee is easier to discipline. Both can be fired, but the regular employee can be prosecuted more easily than an off-site subcontractor who may be out of state (or country).

It is also easier to train and mentor such an employee versus an off-site contractor, and thus easier to enforce data security.

Re:Some notes

[jazman_777]

The difference is that a government employee is easier to discipline. Both can be fired...

Well, theoretically.

The government, in its infinite wisdom...

[Anonymous Coward]

... will probably arrest the individual and then give him the Kevin Mitnick treatment.

Does even outsourced matter?

[Uber Banker]

The fact is this person revealed details against their contract code and more importantly, if they are in this position they should have the moral/ethical decency not to do this.

Whether they were outsourced or not outsoured does not matter (IMHO) - they still have a personal moral/ethical judgement... FT government contractors are not great saviours, rather this individual is one with poor/sick ethical judgement (it is in no way 'freedom of speech' to disclose confidential/sensitive information about young kids).

I do not believe outsourcing creates a more or less trustworthy/moral/ethical situations/employees (well, they just have less benefits rights and more legal liability if somethinggoes wrong), it is the individual who makes a better individual and avoids being a piece of scum.

Re:Does even outsourced matter?

[Skuld-Chan]

This is true - but the original post does suport some of the evils of outsourcing in general. And that is any time you outsource you have to give part of your company to another person or company. That company can be here in the US, Canada or in a country you have never heard of. And many times (depending on how the contract is written) its up to the actual outsourcer where that labor is performed - more often than not actually this is the case.

For 2 years I worked in an outsourcing company doing tech support - and pay rate really writes volumes on why tech support agents really truely don't care about you or your problems (for example they were starting people at 9$/hr to support graphics apps most people get paid 50-150/hr to use). The only goals in companies like this are a) to get customers to go away and b) look for a new job between calls (if you have that luxury). More than once I've seen people fired or repremanded not on just my contract but others for stealing, using, exchanging or sending confidential information to people they probably shouldn't have. Usually its details about the contract, what company uses what vendors for outsourcing, working conditions inside the outsourcing company and confidential knowledgebase/email docs on service and support. Many more times I've seen people take this information without anyone ever paying attention.

To me this is a rampant problem since - the only reason this is on slashdot is because someone noticed.

Re:Does even outsourced matter?

[confuse(issue)]

I do not believe outsourcing creates a more or less trustworthy/moral/ethical situations/employees

I agree. However, a confidential database should be worked on by people close to the data source (though anyone posting childrens data is a moron). For example as a DBA if I was hired by Kentucky fried chicken to write an inventory database and I post to the web for help how am I supposed to know that it is a bad thing if somebody types select * where type = spice and gets a solution set with 11 members? But again, that is not a defense for the moron posting childrens data.

Re:Does even outsourced matter?

[budgenator]

I would hope that as a DBA, if you hired me as a sub-contractor, or even as a sub-of-a-sub-of-a-sub, that the database I was given to develope the prototype of the app with would be populated with dummy data. Posting of the data on the Internet runs afoul of New York state's confidentiality laws, not to mention some federal laws for example:"M,Tue. & Fri when mother attends treatment program and therapy,( approx. 20 hrs per wk)" sure looks like a HIPPA violation to me (IANAL ect.) at $50K/occurance, it passed thru 5 hands, 1 the Livingston County Department of Social Services, 2 Mark Dennis, 3 Genesee Community College, 5 RentACoder.com, 6. The programmer who took the job that $250K in potential fine for just one database record!

It always struck me as ironic that the same people crying the loadest about protecting children, are usualy intrumental in getting them hurt.

Re:Does even outsourced matter?

[confuse(issue)]

sure looks like a HIPPA violation to me

Nice catch, it sure does.

going, going...

[djupedal]

I personally have access to roughly 10,000 credit card numbers

Since you've found it necessary to share that information with the world, your access has been removed and you can now proudly proclaim...

I personally had access to roughly 10,000 credit card numbers

Re:going, going...

[Anonymous Coward]

See my response to the other fellow. Apart from someone breaking into my house to physically get my private key (after hacking the rest of the site), broadcasting that I have access to them really doesn't change much.

At the same time, I should probably put the CD in my safety deposit box, since it's one of those things I never use.

--DH

Re:500 Trolls and a Indian.

[Anonymous Coward]

And so is goat.cx

Look! Employer Bad!!

[darnok]

Why didn't the company involved strip or mutilate all the sensitive data their contractors were given to work with? There's absolutely no excuse to give contractors sensitive data for this type of work.

Hell, even replacing every letter with a random letter and every number with a random number in sensitive fields would probably be enough; rather than "Mrs Joan Smith", they could've been working with "Grc Meas Fesze" without any impact. Change all names, addresses and "comments" and that would just about do it.

Doing this would completely remove the possibility of this problem happening.

If I was "Mrs Joan Smith", I'd be suing the retainer of my personal data on this basis. No wonder they're still considering whether to tell the victims what has happened...

Re:Look! Employer Bad!!

[Anonymous Coward]

Why didn't the company involved strip or mutilate all the sensitive data their contractors were given to work with? There's absolutely no excuse to give contractors sensitive data for this type of work.

I can give you one example of why they might not "anonymize" the data as you suggest.

Sometimes companies exchange documents because of interoperability problems -- the document is somehow incompatible with another piece of software. Thus, they send the document back to whoever wrote the software to figure out why it isn't working properly. Often, they try to anonymize the data. But sometimes, this causes the bug to go away!

So sometimes the companies are "forced" to give out legitimate data because it is the only way to demonstrate a bug in a piece of software. This is unfortunate but difficult to work around. My company is placed in this situation often, as we produce document imaging software. We are extremely careful to destroy all data when it has served its useful purpose. Most of the time, we are able to "boil down" the issue to a simple, anonymous test case, but we clearly cannot expect the customer, who has no knowledge of the file formats, to do this for us. Once we've boiled it down, we immediately destroy the sensitive information.

Re:Look! Employer Bad!!

[darnok]

I've been in that same situation too - it was at a bank where they said they "couldn't" create anonymous data so all development and testing was done using copies of live production data. Yep, that includes personal and corporate account data. My response was to send email to the CIO, close my accounts at that bank and inform all my friends.

While I was there, and in spite of dire warnings, it became common practice for contractors to copy "stuff" onto their laptops from the systems we were working on, take it home and read through it. I assume they were only taking home code and/or documentation, but I didn't really want to know.

There is *no* excuse for supplying sensitive data to contractors. As you point out, it may be non-trivial to anonymize data in some cases, but it has to be done to preserve the integrity of the relationship with your customers.

Umm, shouldn't that have instead been...

[Anonymous Coward]

Procedure, Procedure, Procedure

Developers! Developers! Developers!

Along with the sweaty underarms and rant-dance?

Not just stupid -- unscrupulous.

[Frater 219]

Unscrupulous? No, just incompetent.

No -- unscrupulous: lacking in moral measure; unable to discern the moral weight of one's actions.

(A "scruple" is a unit of weight, don't you know.)

Publicly posting government records of children's whereabouts is not a morally neutral act; it is a reprehensible one. The programmer in question was not, it is claimed, ignorant of the nature of the data he had in hand; he simply did not correctly value that data. He failed to make a necessary value judgment: that to post masses of information on children's whereabouts is, in our world, a wrong thing to do.

It is not simply a stupid or ignorant thing to do. It is not simply incompetent, like writing C code with gets() in it, or turning in code to one's boss which won't compile. Rather, it is a form of carelessness that shows that one places no value upon that with which one has been entrusted.

If you're the sysadmin of a mail system, reading other people's mail for fun is an unethical act. However, leaving the mail-system password lying around, so that random hooligans can read other people's mail, is also an unethical act. Not just stupid. Wrong. It shows that you don't value your users' privacy -- that your values do not match up with your users' values. That, while you may be competent to operate a system for them, you are not trustworthy to do so.

That is a very different way to be bad at one's job.

Ramifications

[phorm]

The ramifications reach beyond the painfully obvious privacy issues, touching on outsourcing and peer ethics.

To hell with outsourcing and peer ethics, how about outsourcing and accountability. We know that there is quite often a loss of quality and/or integrity caused by outsourcing, especially with such touchy information. What I want to know, is that when the sh*t hits the fan and damages me or somebody I care about, whom do we hold accountable?

Unconscionable conduct

[odeee]

What I think is unconscionable is that county officials have not yet determined if they will notify the families involved... Surely they have an obligation to do this and those families would have every right to launch a class lawsuit against the county.

The fact that the county is considering not telling them shows what sort of a priority they place on the peoples privacy!

Re:Unconscionable conduct

[Anonymous Coward]

"county officials have not yet determined if they will notify the families involved"

The unspoken part of this is that they don't actually know if they will be *able* to contact the families. Remember the origin and purpose of this data. Welfare info for state-supported day care.

There are social-work implications that may not be obvious at first blush. Simply making contact with some of these people may be sufficient to trigger an instance of abuse to the child. Often, one of the *parents* is the very person from whom this information must be kept confidential. They don't even really know where some of them live, and for those they do, they probably do not have the money or personnel needed to send social workers out to do this notification. You think these folks have phones? Mailboxes? You must live indoors and eat two or three meals a day!

A phrase that will always live on...

[Anonymous Coward]

You get what you pay for.

Re:A phrase that will always live on...

[Anonymous Coward]

Does this include Linux?

So why was he working with real data?

[Jaywalk]

The last gig I had that dealt with sensitive data did the sensible thing up front and diddled the info to start with. Real names, addresses and account data was used, but we fed it through a scrambler that swapped all the information around so it was "realistic" but not "real". It looked and felt like real data, but had no other practical use.

But the real question is, "What was the policy?" Was there a policy that said development should not be done on real data? Did he have to have access to real data, or would dummy data have worked just as well? After all, the programmer himself could be a pedaphile. Whenever I see something like this that says a programmer made some kind of error, I want to know what the programmer's managers did to prevent it. They should had known that the data was sensitive and taken steps to to keep it confidential.

Ugh

[be-fan]

The title of this article is a crime to the English language. The way it's worded, it implies that the childrens' data was outsourced. I assume that simoniker contorted the sentence because he or she wanted to get "outsourced" into the start of the title.

Simoniker: Please tell me that English is not your primary language!

Re:Ugh

[fishbowl]

"The title of this article is a crime to the English language."

You must be new here!

Here's info on 2000+ kids

[Anonymous Coward]

This filemaker pro database is available on-line. No password.

Anybody know a Mark Dennis

[Anonymous Coward]

who has recently been fired?

Live data sets?

[anonymous cupboard]

Wtf were you doing giving out live data sets? Your company deserved to be screwed and in Europe it could have been sued as well.

We had a project with a lot of info, something like half a million very confidential names and addresses. We just ran a perl script which transformed names and addresses to something that was reasonable (no duplicate data where it shouldn't be) and munged everything. Yes, the data wasn't completely sanitised, but it would be pretty damn hard to reverse engineer.

Potential coppa violations, too

[bugnuts]

If the kids were under 13yo, the programmer could have violated COPPA, the Children's Online Privacy Protection Rule.

In other words, this guy could not only have given a black-eye to the county, but he could even go to jail for it.

If the information lost can be linked to a crime against one of the kids (no matter what age), he better have a good attorney. Gross Negligence and Reckless Endangerment come to mind.

Re:Potential coppa violations, too

[YrWrstNtmr]

If the kids were under 13yo,...

IF? Part of this data was for a daycare center. "Under 13" is a given.

One Moderator In need of Clue, Will pay top dollar

[Anonymous Coward]

This moderator needs a clue. Parent is on-topic and addresses the blind side of the slashdot community by pointing out that this programmer is a person too. In all reality he'll probably lose his job which paid for food for his entire family of 24. People need to acknolodge that the people doing outsourcing are humans too, and that this person probably made a mistake that cost his family dearly.

Re: "Who Can I Sue?"

[Tablizer]

Since this is an outsourced job, there is very little, if any recourse that can be taken against the person in question. Perhaps US companies will see this and think "whoa, if this happens to me, and somebody sues me...who can I sue?"

One of the "justifications" for non-open-source-software was that there was a specific company to sue or threaten if something went wrong. It is odd how the very same corporations don't (yet?) see the same problem with intellectual property and confidential information going overseas.

It is called due dilligence...

[anonymous cupboard]

some idiot didn't sanitize the data before it went out. Once the data passes out of direct control, it should be cleaned. It really isn't that much of a deal and is something that good old Perl does well.

An example

[Anonymous Coward]

here is an example of such a comment from last August. I'm sure more exist if you google for start-base64

Re:An example

[Anonymous Coward]

That's a terrorist Al Quaeda communication. Asscroft has been notified.

See, you really can find EVERYONE on the Internet!

[Proudrooster]

This just goes to show that if you surf around long enough, you can indeed find everyone and everything on the Internet. Additionally, I can't tell you how many database search forms I found that suffer from simple SQL injection problems. Next time you run into a cheesy web form, try putting a '%' in instead of search text. You may get a dump of the whole database. It is amazing to me how bad and insecure some web apps are and, how much personal data is stored in them.

NOT REDUNDANT

[Mod Me God]

Care to take a read and see the relation of this to the main story???

This is irrelevant

[amplt1337]

Look, as far as outsourcing goes, this does not matter.

Outsourcing will continue unless the parent company is held financially responsible for the non-economic problems caused by their decision to outsource. (This is technically known as "internalizing market externalities" -- for instance making someone pay for the social/environmental/etc bad effects of something they do that doesn't affect their business directly).

Even if they're held financially responsible, if the outsourcing is still cheaper, it'll still continue. Even if major firms have to pay hush money on 5% of the data they use. or, of course, if they just have to pay to write a couple perl scripts to randomize the characters in a data set... (It's a couple hours max, if you're slow.) So don't go looking for privacy issues to be the magic bullet that saves your IT job...

(N.B. this case was not actually an instance of outsourcing; I'm just making a point about the economics driving the outsourcing movement.)

Post or moderate.. ahhh the dilemma!!!

[haggar]

So I decided to post. I think you'll like the story, though: I work for a large and very famous company (you all used our products, one time or the other in your lives) and a couple of years ago some bright manager decided it's safe to outsource most of the dev work on a certain product to this Indian company whose name begins with W. Apart from very varying degree of quality (they were supposed to have UNIX expertise, that's why they were chose. Not much of it, there, though). The most comical episode must have been when they created a distribution media for our product and it shipped to a few customers. The media contained the whole source tree for our product! Just a little screwup, except that we're not an opensource company, and that product certainly wasn't.

Luckily for them, our managers took in in their stride, but under the laughs they were furious.

Mark Dennis

[Anonymous Coward]

There is one Mark Dennis listed in Google in Lima, New York. This same Mark Dennis is also listed as the webmaster and treasurer for the local democratic committee in NY (http://www.limademocrats.com/bios/mark.asp). From there he volunteers a wealth of information about himself, including his email address.

I'm sure the 1200 families affected by his decision wouldn't mind finding out how to contact him.

Re:Mark Dennis

[Anonymous Coward]

A cached copy of the page is at:

http://216.239.57.104/search?q=cache:http://www. re ntacoder.com/RentACoder/misc/BidRequests/ShowBidRe quest.asp?lngBidRequestId=117149

No download, so it's "safe".

MY information "Leaked" out.

[Stupid White Man]

10:00am: Subject Wakes up
10:05am: Subject takes a piss
10:08am: Subject opens fridge... peruses shelves, closes door.
10:09am: Subject eats some left over chips and salsa for breakfast.
10:15am: Subject sits at computer
10:16am: Subject checks E-mail
10:17am: Subject checks Slashdot
10:18am: Checks E-mail
10:19am: Checks Slashdot
subject continues to sit at computer till 8:30pm
8:31pm: subject goes to bathroom with certification book.
9:15pm: user comes out of bathroom holding nose, and turns on techTV.
10:01pm: subject sends out resumes, while playing Everquest.
2:00am: subject rolls off of chair and crawls to bed.

repeat.

Professionals have duty to public

[bigberk]

I'm speaking from a Canadian viewpoint, and am unfamiliar with professional practices in other places such as the US.

It seems to me that the work should have been outsourced to an actual Engineer, i.e. someone who has acquired a degree in engineering and who practices as a Professional Engineer (e.g. electrical or computer engineer). The reason being that an Engineer, like other professionals (doctors, laywers) has a particular duty to the public which is enforced under tort law, and additionally governed by a regional body responsible for engineering practices in the area.

Where I live, computer scientist != engineer. If a professional were to make a blunder such as the one described here, they would likely be disciplined by the professional body (not to mention the legal system, for negligence under tort law). The point: hire a professional, it's worth it.

Paranoia...

[Anonymous Coward]

You people are full of paranoia. Watched to much horror movies? Or got to much 9/11? If one wants to kidnap a child it can be done without a online database.

Ever growing problem

[YrWrstNtmr]

And this is one of the main objections I have to such deals as EzPass, GPS locators, etc.

Not so much gubbmint abuse (although that IS a potential problem) but accidental, or stupid, releasing of the data. And once it's out there, you can't get it back.

Ewwwwwwwwww

[GoMMiX]

"County officials have not yet determined if they will tell the families involved about the incident.

It's pathetic that they even question whether or not to inform the parents. That's like publicly saying; "Hey, we know we screwed up BIG, we know the media knows, but we're not quite sure if we're going to try and cover our own asses yet or not."

Knowingly endangering a child in any form is a felony. This is simply more proof that allowing the government to act with relative impunity results in criminal acts against citizens. The county is responisble for the leaked information and should be responsible for securing the daily activities of those children, to ensure the leaked data does not allow any harm to come to them.

When I was seven years old, my day-care center had 'accidently' released confidential information about myself and several other children in their care. The day-care center cared for somewhere around 70 children. The leaked information was found in the posession of a convicted child molestor. By the next day, the day-care center was shutdown and the city had filed criminal charges against it's owner and two employees at the facility.

Why is it that when the government does it, everything is not only OK -- but they're not even sure they should bother wasting their time to inform the parents/guardians that their children have been placed at risk.

This bogus trash needs to stop, the government has to be responsible for it's actions. They violate laws on a regular basis as a part of their daily operations. Enron is almost perfect compared to our own government.

That's pitiful.

Re:Good job moderators!

[Shut the fuck up!]

Oh, shut the fuck up. It was a joke.

Copyright

[J2000_ca]

Any chance this guy could get screwed on copyright as well? He was allowing people to copy the db.

Re:Copyright

[gordguide]

Databases are not always or automatically subject to copyright. Pure factual information (ie the telephone book) has no creative or interpretive value added to it; it's not an "original work", just a list of factual information.

For the purpose of this I'm going to limit most of this to the information itself in the form of pure text, and won't wade too deeply into the details like the "design" of the database form and fields if it were presented in a GUI format.

There is a grey area where purely factual information is not publicly available, and the unauthorized use of it may be actionable, but usually not on the basis of copyright. What would be the deciding factor would be based on how it was copied; ie word for word including the format, page numbers, annotations, etc would probably be copyright infringement.

If it was limited to the factual information only, an action would probably be based on theft of proprietary information. Should that information be posted publicly, it by definition becomes public from that point on, so fair game from then on. Not to say that a court wouldn't have to rule as such; but posting it publicly would be the basis the ruling would hinge upon.

However, keep in mind that you can't photocopy the phone book and expect to avoid breaking copyright law; you could however enter all the information found in a phone book in your own database and publish that info in a "phone book" that factually is identical to the original.

What is different is you copied the design of the phone book in the first instance (the creative component is the design, with the design incorporating in part some factual information) but just the information it contained in the second (no creative component; just the facts).

Another example; if the database contains original work, even if this only amounts to a field where someone writes something like:

"Bob is an engineer; he and his wife Patty have 3 kids. The whole family loves dogs." ... then the copyright stuff can come into play, but again only if that field's text was distributed verbatim.

You could use it as pure information by, for example, putting "Engineer" in a "occupation" field you create and you would be OK.

The pure factual information remains non-copyrightable so one must limit the use to that information only.

There are many instances of factual information that is not subject to copyright itself; even though it might be incorporated into a work subject to rights; for example the title of a song itself is not copyrightable while the title and lyrics together are.

Mark Dennis RentACoder page.

[Anonymous Coward]

Here's his Rent-A-Coder page:

Mark Dennis

I've also managed to find the job that was being discussed:

The Job

Seems the job has been "deleted"

Re:BEFORE INDIA OR ANY OTHER NON-US COUNTRY IS BAS

[Grishnakh]

Quit your knee-jerking. This issue is about outsourcing; the country being outsourced isn't as important as the issue of outsourcing itself. When a company (or govt agency) decides to outsource work, they're losing a measure of control over it, and if they divulge confidential information by outsourcing the work, they're creating a huge security risk.

The issue of the country being outsourced to is also important, but as an additional factor. Imagine if the DoD outsourced important embedded programming work for the F-22 fighter; if they outsourcing it at all, it'd be a terrible decision because of the security risk. But at least if the work went to some American who leaked some secrets, they'd be able to get the FBI to bust the guy, track who was involved, etc. If it went to some foreign country, they'd be screwed. Similarly, if this posting of childrens' whereabouts had been done by an Indian programmer, there'd be no way to hold that programmer personally responsible, only the people that outsourced the work to him.

The bottom line is: when you're dealing with confidential data, you need to keep it as close to yourself (or your organization) as possible, and outsourcing simply isn't compatible with this. If you have work to be done which involves anything confidential, it simply shouldn't be outsourced anywhere.

Whereabouts of children?

[Anonymous Coward]

concerning the daily whereabouts of hundreds of children in upstate New York

Try a search for 'school'...

California SB 1386

[JohnsonWax]

California has a bill designed to deal with these situations, though it's not clear if it would apply to this specific situation.

http://info.sen.ca.gov/pub/01-02/bill/sen/sb_135 1- 1400/sb_1386_bill_20020926_chaptered.html

The problem is that the bill is designed for data theft, not for dipshits giving it away for free. Nevertheless, the bill requires that consumers whose data has been stolen be notified through viable means - email, letter, public notice if they can't be identified. Fines to the company for not doing this and the person responsible for the data is open to civil action.

The main problem I see from the article is that the impacted individuals may not be notified, which is just wrong. Granted, this kind of thing probably can't prevented (minimized, yes, stopped, no) but there's a right way to address the problem and a wrong way. At least notify the affected people of what's happened.

Re:California SB 1386

[fishbowl]

"The problem is that the bill is designed for data theft, not for dipshits giving it away for free. "

Let's see... so if I steal your car, take a joyride, and then give it away for free, I shouldn't worry about prosecution?

social secuity number blackmail

[peter303]

Its been mentioned a few times in slashdot and elsewhere about the medical transcription service who outsourced to an Asian country. There was the dispute about pay and the contractee threatened to post the medical record SS# on the web. FYI- almost all medical database use your SS# as your id. (CA passed a law to change this, but not retroactively.)
Hospitals and doctors involved say they always contract out to bonded US transcibers. However these firms sub-contract out abroad as mush as 70% of their work.

MSNBC repeats the blunder?

[pwiringa]

So I was just looking at the MSNBC article and greatly enjoyed their (real?) leading graphic. For that screenshot, the smaller caption was

This is a screenshot of some of the day-care data made publicly available on the Internet. MSNBC.com has blurred out specific names.

Now, is it just me, or can you make out the first two names that have been "blurred out"? My guess, nobody who cares will see the graphic and say, "Oh, that's my XXXXXXX," or, "Is that little XXXXXXXXX they're talking about?"

But how bad is this, MSNBC just reposted it, only to a lesser extent.

Re:MSNBC repeats the blunder?

[pwiringa]

just checked back on the MSNBC site, having emailed them four or five hours ago now and not heard back, and, who would have guessed, the names have actually been blurred out now. should've saved a copy of the original graphic... sad, replying to myself...

HAVE PITY - mod down!

[Anonymous Coward]

yeah, interesting, but help a guy out and mod him down. It least it won't be splashed all over the page....

-oh it's hopeless. I've been there myself and it hurts. my sympathies, dude.

Re:See, you really can find EVERYONE on the Intern

[MikeBabcock]

This reminds me, if you're doing a web search feature that accesses your backend database, make sure the *data* it accesses is secure.

GRANT SELECT ON PublicDatabase.SpecificTables TO websearch@hostgroup ... ... don't go doing something stupid like thinking "well, my search form only lets people read specific information." Trust me, you'll make a mistake. It'll suck. You'll feel bad. Hopefully, you'll get your ass sued into next century for not thinking ahead.

Please think.

outsourcing

[Anonymous Coward]

I'm sure the programming wing of pedophiles international would be glad to help for free! ;( I's not "what were they thinking", but why didn't they thoughtfully consider what they were doing?
All of the data formats could have been faked and then submitted for analysis. I would suspect something very, very scarily wrong going on here.

Are you really that clueless?

[djupedal]

broadcasting that I have access to them really doesn't change much

You think someone knowing you have them is the issue?

Try telling your boss you just shared that info here, and see how long you keep your job...what a marroon :)

Re:Are you really that clueless?

[GSloop]

Marroon ... Hmm....

Macaroon: a cookie with coconut?
Maroon: brownish-crimson?
Maroon: stranded on an island?

Or, are you just a moron?

*grin*

Cheers,
Greg

Re:Are you really that clueless?

[djupedal]

Did you duck when that joke went over your head, or are you more tight than anyone could possibly imagine?

...sad when someone misses a joke that bad...maybe hand-puppets and a whiteboard next time.

Outsourcing off-shore

[killmeplease]

I think the best point so far is the lack of indenability for off-shore shops. In america we can get the authorities to arrest someone for disclosing IP and data that is sensitive. If you off-shore data or IP, you no longer have the ability to excercise NDAs, enforce patents, enforce copywrite, or enforce licenses. I can imagine off-shore companies creating software for large companies in the US, then selling the same sofware to the UK or some other country with big business.

This is a good idea. I should go to India and start buying UP IP and selling it. I know DELL, HP, and IBM are not outsourcing their sensitive projects because they have a large amount of skilled in house labor and more money than god. But I would like to know who is off-shoring what big projects?

I am a skilled programmer with no experience, unable to get a job in southern california because the market is flooded with highly skilled cheap IT/programmers. How can I compete for a $35,000 a year job with a guy with an MCSE, CCNA, A+, Java Certified, etc ... ... even if I am smarter than him and can program better than him (though slower out of the gate) due to my great schooling at a decent CS program?

h8 @ "news"

[Anonymous Coward]

"The ramifications reach beyond the painfully obvious privacy issues, touching on outsourcing and peer ethics."
NO THEY DON'T. IT'S NOT A SOCIAL DILEMA FINALLY OPENING OUR EYES TO THE UGLY TRUTH, IT'S RETARDS BEING RETARDS. It's not news. It's not an eye opener. It's not worth of discussion. It's not worthy of being posted on a "news" website. "Someone fucked up? NO WAY!"

Christ, what's next? Articles on Yet-Another-OOP-Vapourware? Links to articles with worse grammer than Snoop Dog hosted on shit like "eliteproxy.com"? Maybe the LASTEST BREAKING DEVELOPMENT in the SCO case?
Oh wait...

You misread the regular expression

[Anonymous Coward]

He mapped all alphabetic characters to X and all numeric characters to 9. The data will look like this:

XXXXXXXXX XXXXXXXXXX 9999 XXXXX XXX 999-999-9999
XXXXXXXXX XXXXXXX 999 X XXXXX 999-999-9999
XXXXXXX XXXXXXXXXX 999 XXXXX XX 999-999-9999

Which is fairly obfuscated. Obviously it looks like name, address and phonenumber and a skilled logician might be able to extract information based on the lengths of the data fields, but it's pretty secure.

Re:You misread the regular expression

[wowbagger]

And now when you sort the data base, your sort is useless because all the data is alike.

So you have to make the data be sortable, yet obfuscated. And that is where you run the risk of data leakage.

So, if you have an algorithm that will yield sortable data but is not trivially reversable, then you should be able to create random data rather than basing your data upon a real dataset.

Re:You misread the regular expression

[Anonymous Coward]

Haha. You didn't understand what the vi commands did. Now you're saying something else.

Of course, there are other ways to generate sample data to post. That's what the original poster was pointing out -- that it's easy to do.

really now.

[Anonymous Coward]

numerous chillun' between the ages of 11 and 14 will be emerging at or around 3PM from a building near you.

it's called a "middle school".

hope my liability insurance is paid up.

Excellent post! I've been saying this for ages.

[Genjurosan]

Thank you to the poster and the moderators.

Will Paranoia Slow Outsourcing Down?

[$criptah]

Although this accidnet has happened in the United States, it gave me some food for thought. What if you expose companies that oursource personal data to foreign companies? Will people be motivated enough to stop doing business with firms that move private information across the world?

I think that it might work. See, despite everything that you have learned in high school, the world is a cruel place. Americans do not trust Russians and Russians do not trust Americans (take my world for it, I lived in both of the countries long enough to find that one out). What will happen if somebody tells people that their credit card numbers and bank accounts go to India, Russia, and China? Will Americans, who are still trying to forget racial inequality of the past, let _insert_your_racial_slur_here_ manage personal data of American citizens? I think not.

Mark my words, it will take only one person to sell personal information on the black market and Americans will look at outsourcing and offshoring through a different pair of glasses. You know that something has gone terribly wrong if you get a credit card statement stating that you have spend $10,000 in Bombay if you haven't traveled outside the U.S. in years.

...Poor enough to offer labour at those prices...

[Anonymous Coward]

I know that there are many places where it is very bad to live, but the crazy thing is it's all a numbers game.

US dollar is worth 1.33 canadian dollars, but it takes 1.66 US dollars per U.K Pound. The quality of life in America, Canada or U.K isn't that much different. A US dollar is 45 Rupees.

The funny thing is the standard of living has very little to do with exchange rates. Economics is crazy. Work is the price you pay for money. How many loafs of bread is that per hour of work? Someone could live like a king in some countries for an amount that would put me on the streets.

I don't know how to fix it, but it seems we are all trapped by our own self intrest. I would really like to help those people in some other country, but I think I'll get that new Mini-van instead.

Forget a Victory Garden - in this war you need to buy a Victory SUV.

Outsourcing has its own issues...

[Goonie]

Regardless of whether the work is done in your own country or offshore, outsourcing has issues in terms of quality control, responsibility for non-delivery or other problems (like this one), and whether it makes as much financial sense as is often claimed.

Not stupid, not unscrupulous, just fucking stupid

[Lurgen]

Sorry, but the guy is obviously a complete idiot. He published personal data about kids, then gave a total stranger access to the data. Get him up against the wall...

Outsourced as in not out of the country

[Anonymous Coward]

I guess this article is trying to ride on the coat tails of the rising resentment against off-shoring. If you read the article you will notice that the coding job was contracted out to someone in the US not in Russia, India or Mexico.

Rent A Coder is where I first became aware...

[Anonymous Coward]

of what Offshore Outsourcing was going to be like.

RentACoder.com was created by Ian Ippolito who originally founded the Planet Source Code website (pscode.com). I started visiting PSC back when it first opened sometime in 1997. It was a good place to share code with other programmers and was at first mainly a Visual Basic site. It's since expanded to other languages, but it's still dominated by VB.

In 2001 an announcement was posted on PSC on the formation of Rent A Coder. I remember think "Hey, I'm a good programmer and I could make a few bucks on the side, this could be a good deal." Little did I know that the "few bucks" part was the only accurate part of that thought.

How it works is a company posts a software job they want completed and how much they want to spend and when they want it done. Registered coders then bid on the job. This is where the "few bucks" part came in. Jobs where being posted for ridiculously low amounts of money. Now, I figured that no one would bid on the jobs: I was wrong. The bidders were primarily from India, Pakistan, Russia, and the Pacific Rim. No job was too small, and no contract was too small. College students would post IS homework projects for $5 and they would get done. There was a job posted for a complete custom web-based store with requirements for security, inventory, dynamic presentation, remote admin, credit cards, user accounts, database, the works with the company asking a price of $400 maximum. It got bid down to $75. That's where I got my first taste of what outsourcing was going to be like. $75 for a job that would probably take at least 200 hours to complete and that was in 2001. I don't know if they still keep the stats on the coders, but they used to keep job satisfaction ratings and average price per project in a top ten list of coders. There was a guy in the top 3 who had done over 50 projects and had an average price per project of under $80. I went through most of the job proposals he won just to see what he worked on and it was astounding. Projects that you couldn't get a decent consultant to even talk to you about for under $500, he would do for $50. There was one project he did for $300 that really caught my eye. The reason it did was because the company I worked for at the time had just won a contract for a project that was similar in function and scope, and our winning bid was $8000. That $8000 was as tight as we could trim it with the owner of the company hoping he would see a less than 8% profit from the project.

Welcome to the new world order.

Re:Who do you trust? Guess what pal ...

[jeepmeister]

I strongly suspect I work for the same hosed up HMO as this guy, and I'm in a position to know for a fact this happened pretty much as he said it did.

IRC

[Anonymous Coward]

At least he didnt get kicked from an irc channel
for pasting to much information to the channel and
not to a pasting facilty.

A bias... Why YES!

[Anonymous Coward]

I'm the American who wrote the original post. I used to be a full-time consultant (meaning I took outsourced jobs) and I still do small, extracurricular jobs occasionally, in my spare time. Still, I don't want my relatively new full-time job to be outsourced. I've come to believe that there has to be a balance between in-house and outsourcing, and the American economy is still attempting to find that balance.

I was disgusted by this news. I felt it was important to bring out the outsourcing issue because there are certain standards, responsibilities, and trusts that professionals must maintain in order for the balance between outsourcing and in-housing to be met. This is one rough example of the risks of outsourcing that obviously people were so unprepared to handle that it went on for months (with multiple incursions!)

Consultants and outsourcers alike, everywhere, should be hanging their heads low in shame for this... myself included, for any part in making outsourcing seem such a thoughless activity.

I'm also a daddy-to-be (my first baby is due in weeks) and the thought of something like this happening... Don't even get me going there.

Also note... in the original post, I said outsourced, not off-shored. :-)

God bless ya!

It was bound to happen

[Anonymous Coward]

I usually just read /., and I've only commented a few times here and there. But I feel this is kind of important.

RentACoder kind of had this coming. When I was struggling to be a, "real," programmer... wait, I'm still struggling.

Anyhow, I used to bid on some of those jobs at RaC. Not for the money, but to actually have something to put on my resume. This was way way back when RaC was just starting out. The site was very lightweight. Light on the cookies and HTML. Fast to download. Fast to browse.

I did a few jobs here and there. Picked up a couple of decent things to put on my resume. I felt things were looking good. After a while, there was one coder in particular who was beating me out on my bids. The strange things was that he was beating me out on every single job! "Well," I thought, "that's a part of competition."

One day, I was browsing an entirely different web site for help with a pet project of mine when I spotted a request for help. The title of the request for help was exactly the same as a project I got beat out on at RaC. Looking into the body of the request, I discovered the request was identical to one at RaC, right down to the typos!
So who was the person who was requesting help on this other site? Why none other than the very same person who beat my bid at RaC. I did a little research on the site and a few others and found dozens of projects that have been outsourced by the low bidder at RaC. At the time, I still had ideals, so I contacted the site admin/owner and pointed this out. Noting that the other sites had a point reward system (if any reward system at all) whereas RaC was exchanging money for the work.

I was appalled at the answer I got back. I was told that this was the ultimate in outsourcing and he would not bother intervening.
And yes, he is from India. This was well before the Indian outsourcing issue became big in the public eye. So I never really attached any importance to that, other than having a very unusual name (to my American ears).

To be clear, I was angry at the outsourcing of the work. But, what really irked me to no end was that this guys resume claimed he was a skilled programmer who worked on dozens of jobs! I sent off another eMail to RaC that I lost my respect for the web site and that I would no longer promote the site to anyone looking to outsource any work. I vowed never to return looking to increase my skill marks.

After this incident, I started paying more attention to other, "programmers," around me. The amount of outsourcing appalled me. A Visual Basic programmer who got extremely low marks in school the following semester (he couldn't build a simple tic tac toe program and, "borrowed," the source from another student instead.) manage to snag a decent job building UI to Database applications at a small telecom installation company.

A few years later, I caught a, "senior," programmer outsourcing a closed source and propriety database interface application on a web site. I knew it was the project I was working on since the requests were exact copies of my own internal requests for bug fixes to the programmer, again, right down to the very same typos!

I can't begin to express my disappointment about this sort of thing. Years of studying a half dozen different languages and all I needed to do was outsource everything I did to land that perfect job?

I get more satisfaction working in a retail warehouse and having customers screaming at me for their own stupidity.

US citizens need a Data Protection Act 1998

[openmtl]

This lack of personal privacy is very much a US-centric concept which divides the EU-US. The EU has a lot more stringent personal privacy and it would be in the interests of slashdotters to read the contents of the e.g. UK Data Protection Act and petition your own local legislators to get this mapped into US law. (substitute President for Majesty and Senate for Lords and Congress for Commons - the law is quite clear). Companies will squeal but its a fantastic law for citizens (voters).

Like many others I'm down as a Data Controller within the meaning of the Data Protection Act. I take this role very seriously even though I have just a few personal details, but also because I have access to a lot of other records and I view it from the point of view of: what if it was MY personal data that was being copied about ? My declaration also states that any data never leave the EU. Personally I see any data sent to the US as secure as posting it on the Internet. Good to see the actual US government confirming my views.

What was he thinking?

[mrkurt]

One of my clients is a youth services agency that deals with children and families. First of all, in the development work we do, we're not using a live database, and we would NEVER EVER post the database on the Internet! If this programmer wanted to show other people what the database looked like, he could have emptied the tables or simply described the table definitions. I have a confidentiality clause in my contract, and I take it seriously. It's because the agency got their ass caught in the state's grinder before that I am doing this project.

Slashdot and awareness of forced adoptions

[mbstone]

What's amazing to me from reading the previous 350 or so posts is the prevailing attitude towards kids like those whose records weren't proected -- they are foster kids, who are all too often "snatched" from their parents, who are all too often put up for forced adoptions, and who are all too often abused in their new "placements." All for money -- the local government gets federal money according to the number of children taken away. And it doesn't just happen to "them" -- being normal by geek standards is enough get your kid snatched in many jurisdictions. Lots of these victimized kids get killed. And all the records of the child deaths, thousands every year, are sealed to prevent public scrutiny. It's not just the data that doesn't get protected.

Just an observation

[Felinoid]

Companys paranoid that a group of geeks won't properly peer review the code they write will then chouse to hire profesionals... outsourced profesionals they can't watch over and won't be able to implement any sort of review process themselfs (trusting yet annother organisation do to that).

I've nothing wrong with outsourcing so much as how companys don't trust peer review anymore. Seams pritty dumb to me.

Good Idea

[Tangurena]

When I worked at a big website (had more than $1,000,000 per month in real sales, about 10% of overall sales), there were 3 systems in use: development, QA and production. Once per month we would refresh the data in the dev and qa environments. The process that copied the data deliberately munged up the ssn/taxID as well as the credit card info. At that time, it was not considered important to munge up more of the data.

Since there was an ongoing battle to make new and improved reports, the sales data was not munged so that side by side comparisons of live and dev reports could be made. If they had been, figuring out whether the new reports meet the specs would have been rather hard.

Refer to

[Anonymous Coward]

google dorks news item. outsourcing or not, its just bad administration. Q.E.D.

It's almost habitual to outsource or H-1B now...

[Anonymous Coward]

I think it has become habitual for some employers to not consider Americans now. Just today, I found this posted to a bulletin board at my office:

Kaiser Foundation Hospitals is seeking approval of a labor condition application for the period of February 26, 2004 to February 26, 2007 to permit employment of one H-1B worker in the classification of Programmer Analyst. The salary for this job is $77,501 per year. The H-1B worker will be employed at our facility located at 501 Lennon Lane, Walnut Creek, California 94598. The labor condition application relating to this employee is available for public inspection at our main office located at One Kaiser Plaza, Oakland, California 94612. Complaints alleging misrepresentation of material facts in the labor condition application and/or failure to comply with the terms of the labor condition application may be filed with any office of the Wage and Hour Division of the United States Department of Labor.
Posted January 26, 2004
(can't read the signature)

So I guess the good news is that the tech recession is over -- this company in the San Francisco Bay Area can't find a local unemployed programmer willing to work for $78,000 a year, so they are forced to go overseas...

I spent Sunday with a programmer friend with a family who would take this job for much less than this. I am ashamed of my employer.

Kill the agenda

[b-baggins]

Tell you what. Incompetent jackass progammers of the home grown variety are available by the truckload, too.

Re:Who cares?

[eln]

Having once signed up for rent-a-coder toward the latter part of my 6-month unemployment a couple of years ago, I can safely say that if he was bidding $3.50 an hour, he was probably the highest bidder on the project by a factor of at least 5.

Yes!

[fireboy1919]

This once again points to an important argument for not hiring other people.

They make mistakes. The only one you can really trust is numero Uno.

This is exactly why more companies need to hire me. I know all about myself, and can therefore trust myself, and therefore, you can trust me. Too many companies are making the idiotic mistake of trusting people that I don't know, and therefore can't trust, and therefore they can't trust either.

Lets do it!!!

[pantycrickets]

Lets start slamming outsourcing with whatever we've got!!! /sarcasm

Re:Who do you trust? Guess what pal ...

[Anonymous Coward]

Well then an idiot like you(or at least your company) deserves it all. What kind of moron outsources actual senisitive data ? Too lazy to make up a few fake sample records ? What were you doing being party to such moronic acts and not objecting at all ?

It is akin to supplying state secrets to another country and then bitching about how the other guy is somehow responcible for *your* act of treason.

RTFA

[Moraelin]

RTFA, lemming.

It's right in there that he _is_ an American programmer. Working in the US. It's also been posted 20 times already in this thread.

So you can get off the "if it was an American programmer" high horse already. Again: he _is_ an American programmer.

Re:RTFA

[Anonymous Coward]

But... an incompetent American programmer?! Surely that's impossible!

Re:RTFA

[Moraelin]

Seems to me like incompetence and irresponsibility all the way. A database with real data _that_ sensitive gets basically given to the first guy who wants it, on a web site.

Surely because he's cheap, it's got to mean he's also qualified, ethical, etc. And surely he can be trusted with real live secret data, no other questions asked.

Sorry, on an irresponsibility scale, it pegs the meter.

Even ignoring the enormity of what this idiot did: did anyone even think about quality when we're talking data _this_ sensitive? No, seriously.

You take the cheapest guy which takes the job off a web site. How do you know he's even qualified to deal with that kind of data?

Does he even know even the most basic kinds of threats? Like buffer overflows? Or like people editing URL's by hand?

I.e., can his _program_ be trusted to not have a backdoor you can drive a bus through? Or maybe, 6 months later, would it have exposed the data to every script kiddie on the planet? Or maybe, someone this irresponsible and unethical, might even leave some _intentional_ backdoor? (Not even maliciously intended. Just for his personal convenience, in case he later needs to see why some data doesn't work.)

That's what pisses me off at the current trend of hiring the cheapest moron, regardless of competence or qualifications. While there is plenty of work to do with incompetent novices, I'd expect to have at least one experienced programmer on the team. Someone who knows about the security dangers, and who can design, code and review to avoid them.

I do _not_ want my personal information to depend solely on some clueless moron who's strung together some COM controlls in VB (or Java, or PHP, or whatever) without any clue what he's doing. And who needs to ask on a web site every two days how to do something like string formatting.

When my data, or some children's data, is entrusted to some program, I'll want that program to be as armoured and bullet-proof as a bank vault. _Not_ the equivalent of a shoddy paper box in the middle of the street.

So, as I've said, I wouldn't say that Denis is the only incompetent there. I'd say that the whole chain of idiots that allowed that data to get to him, should be shot at dawn.

Amen

[Moraelin]

All I can say is "Amen, brother." It so pisses me off to see clueless HR droids hire _completely_ incompetent burger-flippers. Based on faked resumes and having the right colour socks.

I'm talking people who:

A. Have never even _read_ about the technology they claim to master.

B. At most have a superficial understanding of the language's syntax, but _not_ the standard libraries, best practices, pitfalls, etc.

C. Have never even heard of bog-standard vulnerabilities and security risks (e.g., if you code a web-based GUI, FFS, don't assume that everyone _has_ to click on your links to get to a page. People do edit URLs. Do check that the currently logged in user does have the right to view that data.)

D. Have no clue of even the most elementary algorithms or data structures.

E. All the above.

Yet some clueless HR droid will hire them anyway. Because, hey, "it's just typing. Anyone can learn it."

I find it just insulting. Especially coming from some people who can't even program their VCR's clock. I'd like to see them do my work, and _then_ decide if it's easy.

too lazy

[Anonymous Coward]

See what happens when you are too lazy to create a proper set of test data ...

10 bucks says

[Anonymous Coward]

It was an open source project at rentacoder.

See, open source is evil.

Your privacy protected by the lowest bidder eh?

[SmallFurryCreature]

It is an old army joke that your weapon is produced by the lowest bidder.

Nice to see we can now laugh about social services as well. Not like they don't already have enough screw-ups by dismissing child abuse claims when a kid been admitted dozens of times for broken bones and still claim nothing is wrong when finally the kid goes to the doctor for the last time. The coroner.

Idiots.

I think you mean Onshore Insourced moderators...

[ErnstKompressor]

...this is 'slash-bindhi' isn't it?...

WHOM do you trust?

[sulli]

Someone who uses proper English?

Try throwing an Indian in jail for this.

[wcrowe]

This is a big reason why outsourcing to India should not only be discouraged, but should be illegal. At least if someone in the U.S. does something like this, they can be prosecuted. It's going to be a little harder to prosecute some .head company under American laws.

rentacoder sucks

[Anonymous Coward]

>90% of the project bids are written by either complete retards who have no idea what they want, or college people who just don't want to do their projects and can get daddy and mommy to finance the few hundred for someone else to...

Off on a tangent from that

[fizbin]

(Yeah, offtopic, whatever)

I've often wondered about a variation on that theme - using -1 AC posts to communicate information over slashdot. The specific application I've been thinking of is trojan horses that need to phone home.

Right now, the typical trojan horse phones home by joining some specific channel on some (private or not) irc network. On that network, they announce to whoever's listening their IP address and how to gain remote control of the victim's machine. (Perhaps this announcement is encrypted somehow, or requires that first a message with password be sent to them, or something similar)

The thing is - this is pretty easy for corporate networks to trace (just flag outgoing IRC connections), and places that have a "no outgoing TCP, only outgoing web traffic through this specific proxy" policy in place are clearly protected to some extent.

It also allows law enforcement to start up the trojan in a controlled environment and monitor the connection for clues as to the ultimate controller of these little beasts.

But what if these trojans communicate through follow-ups to the lowest-moderated troll on the first article of each day? Or what if they simply receive their directions by looking for comments with specific subject lines? (Steganography, meet Natalie Portman's hot grits) Of course the person controlling these would work through some random anonymous proxy in Asia - every day, spammers send me hundreds of proxy IP addresses, and there are convenient anti-spam sites that will tell me exactly what those proxies can do.

And it's not just slashdot - many main stream news sites now allow comments posted anonymously with a minimum of fuss, and then there's the idea of looking for certain blog comments, or postings to certain newsgroups on google.