Outsourced Confidential Data On Children Posted

Kataire writes "MSNBC exposes a grievous blunder in which an outsourced programmer posts highly confidential data to a public website, concerning the daily whereabouts of hundreds of children in upstate New York. Yes, this person did this not once, or twice, but three times, with two different data sets. Even worse, the data was out there, publicly 'visible' for months. Just because RentACoder finally discovered and yanked it, after a coder 'stuck with a tricky formatting issue' posted the specific database he was working on to their messageboards, doesn't mean the damage is undone. The ramifications reach beyond the painfully obvious privacy issues, touching on outsourcing and peer ethics."

Comments

Who do you trust?

[DarkHelmet]

Who do you trust? And who do you get to solve something like this?

Do you say, "Only certain government approved facilities can deal with this sort of information?" Seriously, should I feel that someone "government sponsored" is better off with my information than an outsourced programmer in India? Who gets to play Big Brother? And what will they do with what they know?

You can take this to the extreme, and be wary of anyone to handle private data about you. But then, if there's that sort of outcry, nobody would be able to handle it, would they?

I suppose it's better than having the Smoking Man from the X-Files having a file about you, and a blood sample. I find most programmers to have a certain level of professionalism to what they do.

I personally have access to roughly 10,000 credit card numbers. I'll never abuse the fact that I have access to them. But on the other hand, I'm not stupid enough to post all of them on the net for everybody to see, either.

I hope anybody who ends up doing something that stupid becomes a victim of identity theft. That'll really open their eyes to respecting other people's privacy.

By the way, I hate how everybody gets up in arms over the fact that this is data from children. This is horrible for ANYBODY to have their information posted on the net like this. And it could have been worse. It could have been a list of women tying them to the current Battered Women's Shelter they were staying at.

Re:Who do you trust?

[segment]

Who gets to play Big Brother? That's an easy one ... Choicepoint gets to play Big Brother. They tout 40 billion records... 40 billion records on about 300million Americans?...

And what will they do with what they know? They claim to be able to pinpoint every move you made from college to getting tossed out your duplex etc.,

Re:Who do you trust?

[Skyshadow]

Posting anon for reasons which will become clear:

I work for a large healthcare organization. A while back, we caught some heat because we were transferring a lot of patient data over to India for use in one of our offshore projects and a local newspaper found out about it. Our official response was "Hey, Americans do this work too. It's not necessarily safer there than here."

A month later, one of the outsourced programmers took off with a couple of backup tapes and blackmailed my company.

This exposed the real issue at hand here: Offshore workers aren't in America, which means that we found ourselves unable to bring the weight of American law enforcement to bear on this person. In America, we would have had the FBI kicking in this guy's door within the hour. Instead, this individual simply moved to a different part of India, which is apparently like moving to another planet for the purposes of getting them arrested. The issue was clamped down on by management before the resolution, but the word around the water cooler is that we just paid them off -- really, the amount of money they wanted was insignificant against the massive PR damage we were looking at.

So while it's true that a worker in America can spill private data just as easily as a worker in the third world, *getting away* with it is a completely different matter. Companies which offshore private data deserve the lawsuits they'll face when something like this actually plays out wrong...

Re:Who do you trust?

[Jeremiah Blatz]

The issue with giving sensitive data to outsourcing agencies (who give it to outsourcing agencies (who give it to .... is that after a while, the chain of accountability gets pretty tenuous. When it's your client's sensitive information, it's pretty clear that you should protect it. When it's your boss' client's client's ... client's boss' sensitive information, you're really disconnected from the parties who would be damaged if the information was disclosed.

Re:Who do you trust?

[Greyfox]

Posting anon for reasons which will become clear:

Dibbs on his 3 digit user ID when his company has him killed!

Re:Who do you trust?

[Anonymous Coward]

C'mon, give it up! Do you work for UCSF, Sausalito Transcription Stat, Sonya Newburn or Tom Spires?

And was it India or Pakistan? And was the "Indian" really a Pakistani woman named Lubna Baloch? And was the problem really because UCSF required such little control over the custody of the medical records that it allowed them to be handed of to a chain of at least four levels of subcontractors before they ended up in Pakistan?

Oh, and was it really Sonya Newburn who paid off Baloch?

It's not so super-secret as you think. And the real issue (in your hospital's case) isn't that you couldn't bring the weight of American law enforcement to bear, it's that your organization completely lost control of the data that was entrusted to it.

Incidentally, UCSF has revised its contracts to require its transcriptions firms to reveal who they subcontract with.

P.S., if you click on the little "Post Anonymously" checkbox, your /. ID won't be revealed. Although I don't think that you'll be in much trouble given that the whole business is splattered all over Google.

Re:Who do you trust?

[pwtrash]

Yep, your example would have been worse.

However, the article suggested that these kids are foster kids, which means that at a minimum they were victims of neglect to the extent that the state stepped in and removed them from their birth parents.

It's likely that a number of these kids were victims of sexual abuse. Needless to say, many of them have views on sexual issues that are warped by their experience. A predator would likely know how to take advantage of their experience.

Also, typically, the goal is to re-unite them with their parents. Obviously, some of these parents are not worth anything. But a number of them are genuinely trying to do whatever they can to make their family right. This doesn't help.

My wife works with kids in this situation, and I don't know any names ever. I don't want to know, and she takes her commitment to their confidentiality very seriously.

I hope we get to hear what becomes of Mr. Mark Dennis, the fine bleeding-edge developer who had to ask RentACoder for database formatting help. It would only be fitting if we all got to experience his worst or most vulnerable moment. I'll turn it into HTML for $15.

Re:Who do you trust?

[cait56]

I would prefer to trust someone who has enough sense not to provide confidential data to anyone that has not been properly trained in its handling.

It is all too likely that the person that "released" the data had no real understanding of whether the data was real or what it meant.

This is just plain sloppy procedure. It doesn't matter if the development staff is in-house, local out-sourced, or out-sourced to the other side of the world -- they still don't need the real data in order to develop code.

If this is in response to a specific problem, then the data needs to be exported in a way that strips identities. If they don't know how to do that then they haven't done a proper problem definition, and there are probably other security holes in the system just waiting to be stumbled across.

Re:Who do you trust?

[orthogonal]

Who do you trust? And who do you get to solve something like this?

In this particular case, you needn't trust anyone.

Nothing that Mark Dennis wanted to do -- build the database structure, build the front-end, or get help with his "tricky formatting problem" required that he use supply real data to RentaACoders or other sub contractors

And furthermore, nothing the Livingston County Social Services Commission wanted required that Mark Dennis ever see live data.

This one's simple, folks -- sure, Mark (or someone) needed to do a requirements analysis, sure, somebody had to decide what data entities to capture -- but very little real data was needed.

First, make some dummy data for the developers' use: run through your real data -- if you even need to base the dummy data off the real data --, and replace every name with a random dictionary word. Do the same thing for addresses, and replace Social Security and other id numbers with randomly chosen numbers. In all cases, maintain a constant map of real to dummy, to preserve relations within the data: "Mike Smith" is always translated to "Armchair Landowner" and "1450 Main Street" to "3321 Crumpet Sponge".

Once you've finished your translation, throw away the map.

Now the coder has data that's exactly as diverse as the real data, shows the same frequencies and inter-relations as the real data, is as internally self-consistent as the real data, and yet is (nearly) completely meaningless in terms of the real world, and (nearly) impossible to link to any real persons, places, or identifying information.

(It's possible one could still do traffic analysis on the data, and come up with aggregate data: either more male or more female (but which?) children are in the Social Services system; two zip codes out of six produce 70% of the cases (but which two?). If this is a problem you have to take a weighted slice of the data, and provide the developer with only this weighted slice; that (intentionally) skews your frequencies, but still preserves diverse data and any inter-relations among that data, closely enough to be representative for almost all design and coding needs.)

No trust involved. Just a simple and mechanical translation process that has to take place only once.

(If you really have a situation where the developer must base his requirements and code against gradually accumulating real world data -- and you shouldn't if you've planned at all well -- let one non-out sourced person hold the translation map -- and be held responsible for keeping it secret.)

And a process like I've outlined should be standard for any organization dealing with sensitive data.

Re:Who do you trust?

[segment]

I sincerely hope you were kidding about that. In case you weren't, Choicepoint is in the business of selling data... Yours

source ChoicePoint Acquires National Data Retrieval, Expands Presence in Public Records Field

ALPHARETTA, Ga. - January 2, 2003 - ChoicePoint (NYSE: CPS) today announced the acquisition of National Data Retrieval Inc. (NDR), one of the nation's leading providers of public records information for bankruptcies, civil judgments, and federal and state tax liens. Terms of the acquisition were not disclosed.

National Data Retrieval, which also is based in Alpharetta, has 26 fulltime employees, all of whom will be retained, plus a nationwide network of approximately 400 independent collection contractors. The privately held company was established in 1989.

NDR's products, services and public records databases of nearly 43 million records will complement ChoicePoint's existing Court Research and Retrieval Group (CRRG), which processed approximately 5 million records requests in 2002. NDR's customers will gain access to ChoicePoint's CRRG technology and records collection facilities, supported by ChoicePoint's proprietary database of more than 16 billion public records.

Note I bolded the 16 and the date, there is a page somewhere on that monstrous site which states they have 40 billion. I've seen it a few times unfortunately I can't pinpoint the location right now.

Re:Who do you trust?

[Bald Wookie]

On the other hand, they know you just searched for your name. Check back in a little while...

Re:Who do you trust?

[R2.0]

"By the way, I hate how everybody gets up in arms over the fact that this is data from children. This is horrible for ANYBODY to have their information posted on the net like this. And it could have been worse. It could have been a list of women tying them to the current Battered Women's Shelter they were staying at."

Yes, it would suck if my daily schedule was put up in the internet. Then I'd have to worry about pedophiles or my crazy parent with the restraining order snatching me up.

Oh, wait - I'm an adult male who carries a cell phone, "pocket knife", and just enough martial arts experience to get me out of (okay, into) trouble.

Stories like this about children ARE different. Adults might have the means and methods to deal with the consequences of such a massive blunder. Children DO NOT! Especially lists about kids in day care: children who are pre-selected to be literally unable to take care of themselves.

Oh, and your "even worse" example sucks too. At least women in shelter are somehow connected with help. Think instead of a database of phone calls to an abuse hotline - lots of women who are totally vulnerable.

To borrow from the pigs in "1984": All privacy breeches are equally bad, but some are just way effin' worse than others.

Re:Who do you trust?

[core plexus]

"In America, we would have had the FBI kicking in this guy's door within the hour."

Ha! Highly unlikely. If you really want something done, and done right, you don't call the cops or the lawyers, you call the guy who knows dis guy and he "does this favor for you."

-cp-

President Bush to Liberate Alaska

Re:Who do you trust?

[GundyRage]

Tell those morons in Accounts-Blackmailable that I'm waiting for my last installment.

Now, where is that "Post Anonymously" check box?

Re:Who do you trust?

[nandix]

I know you're talking about your experience, but read the article: all of the programmers involved in this were from the NY and NJ areas
The article even mentions the user name (for rentacoder) for the NY programmer that posted the children's database on repeated ocassions, even after getting a friendly warning from another programmer.

So while it's true that a worker in America can spill private data just as easily as a worker in the third world, *getting away* with it is a completely different matter. Companies which offshore private data deserve the lawsuits they'll face when something like this actually plays out wrong...

Re:Who do you trust?

[afidel]

Thank you, thank you, thank you. That is EXACTLY the kind of thoughts which HIPPA et al are supposed to foster. Real patient data should never be acessible except by people whos jobs it is to use that data. The people whos job it is to track and store the data have no need to see it. Now if only we could get an anti-PATRIOT act passed that forbade the government from accessing an private database for purposes of following its citizenry.

Re:Who do you trust?

[lonesome phreak]

I'm surpised someone didn't end up in prison. That is a direct violation of HIPAA Privacy rulings...your supposed to have a chain of trust agreement, specifically a Business Associate Contract. This states that your company is HIPAA compliant in all areas where you deal with PHI (protected health information). If you outsource, your company is supposed to get a BAC from the people you outsource to.

Your company could probably get hit with a violation of 42 U.S.C. 1320D-6(a), which is a federal law. If management knew (or should have known) that the chain of trust was supposed to be followed, your Privacy Officer can be hit with a $50,000 fine and/or one year in the federal pen. If it was done "with the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm" someone can be hit with a $500,000 fine and up to 10 years in prison.

Go read this http://www.ehcca.com/presentations/HIPAA3/malone_2 .pdf ASAP. If you deal with PHI, then you are probably a covered entity.

Re:Who do you trust?

[Moraelin]

How about "you do _not_ need a 'hidemydata' _coder_".

I've worked on several enterprise projects so far, and in _none_ of them did I need any actual production data while coding the app. All the test databases we worked on were filled with dummy data. Including login accounts, addresses, products/materials, financial data, etc. You name it, it was fake.

What you do need are a few examples that _look_ like the real data. They don't come from a coder, they're not real data that ran through some encription code. They're just bogus.

Where do they come from? They come from the people who work with the real data. Only those need to see it.

_They_ are allowed to see where little Timmy Victim lives and where does he go to school. So they take some records from that data, read it, then replace the name with Bart Simpson, the address with something bogus, and so on. Then send me the database with a few such examples.

What if I need thousands of records, you say? Well, then I, or another "rent-a-hidemydata-coder", takes those bogus samples, and writes a small script to generate thousands that look like those. Voila, now you have thousands, maybe even hundreds of thousands, of bogus records to run those tests on.

If there's a bug that needs fixing -- e.g., to stick to the article, the formatting code sucks -- I don't need production data to reproduce the bug. I just need an example -- _any_ example -- that clearly demonstrates the bug. If it's a bogus example, all the better.

You may notice how at no point did a coder actually see the confidential data. Not the developper of the application, not the "rent-a-hidemy-data coder", not the coder's PHB, not the company's marketroid (who might go "ka-ching! we have all those people's records, let's try to sell them stuff.") The only ones who saw the confidential data are (surprise!) the people who actually have a right to work with that data.

It wasn't that hard, now was it?

What message board?

[The_Rippa]

I'm sure the "it professionals" on alt.pedophiles were more than happy to check out the db issues for him.

Today's lesson:

[American AC in Paris]

When you're looking to cut corners, be careful who you give the scissors to...

Maybe now someone will pay attention.

[Anonymous Coward]

Talk of identity theft, damaged credit, and so on may not rile up the Soccer Moms of the world, but once something affects the children, watch and admire as their mouths begin to froth!

Re:Maybe now someone will pay attention.

[Schnapple]

Now all we need is for one of those children to be the child of a Congressman. Same way we need just one of the RIAA targets to be some senator's kid off at school...

Re:Maybe now someone will pay attention.

[gr0ngb0t]

I doubt that any of the kids would be the child of a congressman, as in the article it says that the database "listed the names, addresses and other details of low-income and foster families".

Now I'm not an american, but I assume that your congressmen are all on pretty damn healthy wages, like they are pretty much everywhere, so I don't think that their children would be involved in this child care program.

I'm not surprised

[samsmithnz]

Myself, I'm always careful about 'stripping' any information when posting code samples or looking for help in Forums. I'm surprised this isn't reported more often...

I wonder if the parent company that hired this 'outsourcer', even knows that their data has been compromised...

Coincidences

[Rosco P. Coltrane]

outsourced programmer posts highly confidential data to a public website, concerning the daily whereabouts of hundreds of children in upstate New York.

In other news: Michael Jackson to move to NY soon.

Downside of outsourcing

[johndiii]

When you outsource, you run the risk that the individuals doing the work do not share your company or even cultural values. If you are not willing to take the time to make sure that your outside contractors are what you expect, this is the kind of thing that will happen. Few companies really understand this.

Re:Downside of outsourcing

[allgood2]

I'd have to say, and the article didn't indicate whether or not the originating company had indicated that the data was private and confidential. I've done data cleaning, analysis, report creation, etc. as an outsourced contract for a slew of organizations, nonprofits, government, and corporate--and I can't say the number of times I've been handed confidential data without any type of NDA or even a brief conversation stating this data is confidential. In fact, it happen so much, that we developed our own policy, indicating to all potential clients that all incoming data would be treated as the exclusive, confidential property of the organization, and only those staff members directly working on the project would have access to the provided data, etc.

The truth is, even in places where HIPAA and other types of policies that demand handling of confidential data, thatbesides for the few items that get drilled into the staff-- oh that database requires a password, you can only view those forms in-house, or only that single computer can be used to transmit data to our insurance agency--most of the staff rarely give it a second thought. Its not that they mean to be careless, its just that administrators have typically given them a checklist of guidelines and those are the only issues they worry about.

Outsourcing overseas, is an issue about legal power or the ability to restrain legal. People will take advantage, aand at least if its an American outsourcer you have some recourse.

But the issue of outsourcing has always been convoluted by who considers what valuable and how well you portray that to a third party. And to that regard, I find, you generally have two camps--those that just decide to put a blanket level of valuability on everything they do--you know the firms that have you sign and NDA, confidentiality agreements, and other legal forms, just so you can tweak their tech support database, and their staff sends email like "hey, had a great time last night" followed by a blanket two paragraph long confidentiality statement, that everyone they communicate with on the regular basis has stopped reading because its typically not relevant.

Then their are those who try to make the legalities relevant to the staff and data that is relevant, but find themselves hopeless at conveying the extent and necessity of why confidential needs to mean confidential. These places are typically of the you can only work on that database on that single machine that isn't connected to the internet, and has four levels of passwords. But you can go to the common printer and pick up pages of customer or client profiles that contain data such as social security number, HIV status, etc., etc.

At the one type, the employees and the people the deal with become inured to the message of privacy and confidentiality because its stapled to everything and at least 90% of the items its stapled to is inappropriate. The others fall into the trap of thinking that security, confidentiality, etc is a thing--that's the secure machine, that database contains confidential data, we have our 5 point checklist, and I use it. That they overlook the multitude of everyday things that deserve to be treated with a level or respect and confidentiality.

Before we bash on outsourcing...

[wan-fu]

... before everyone starts bashing on outsourcing, let's not forget that this problem isn't a result of outsourcing, but an unscrupulous programmer. This could just as well happen on usenet with someone asking for programming advice from any company. It is the programmer who was not careful with data and the fault is on his side (and possibly the company who gave him the data and did not give him specific instructions for care of the data).

Re:Before we bash on outsourcing...

[sporty]

Yes, but when you sue, you can either sue the employee which you have a direct contract with for damages, or the company from which you outsource. With the case of the developer, he has a closer relationship, so is less likely to do wrong since he's not under the protection of a company. With the case of a company, you sue the company and the worse the company may do is fire them. Less vested intereste in what the big boss might say -- depends on who your big boss is.

Re:Before we bash on outsourcing...

[Dimwit]

That's true - this could have happened with any company. However, to play Devil's advocate:

Since this is an outsourced job, there is very little, if any recourse that can be taken against the person in question. Perhaps US companies will see this and think "whoa, if this happens to me, and somebody sues me...who can I sue?"

It's sad that corporations are sending jobs overseas in the name of cheap labour. I frown upon the implications of the term "human resources". However, it's also sad that there are countries in the world poor enough that they can offer labour at those prices. I wish everyone had a standard of living equal to what I enjoy here, and I'm afraid outsourcing may be the way to do it. At this point, all I can hope is that the outsourcing is done in an ethical way - no sweatshops, no gang-ruled factories, no government corruption. Unfortunately, since money is involved, it suffers from all those things and more...

Re:Before we bash on outsourcing...

[laird]

"let's not forget that this problem isn't a result of outsourcing, but an unscrupulous programmer"

I'm not sure it's "unscrupulous" as clueless. Whether he's paid as an employee, a consultant, or a sub-contractor, he's just as responsible to treat sensitive data appropriately. He should have been fired the first time, or at least warned in writing and fired the second time. Allowing this to happen three times exposes both the agency (who's responsible for managing its vendors) and the vendor to tremendous liability because they've obviously not taken this issue seriously.

Re:Before we bash on outsourcing...

[nycsubway]

My guess is that is incorrect. Programmers can certainly make mistakes like this one did. But when you hire programmers and staff to do things so cheaply, you give up the quality control. When you are dealing with personal information, quality control is extremely important. Its also not to say that that kind of thing can't happen in the US. But its unsettling for people to know that they can't even meet the person who is working with their personal information.

If one of the programmers at a children's hospital starts publishing information about it's patients, the hospital will want to start slapping the programmer silly. Its not that easy if the person is overseas.

Quality control with information is much more important than the QA with manufactured products. Cheap products are good for most average people in the US, so outsourcing is ok. But cheap products in airliners and military equipment is not good. Highly personal information should not take the route of cheaply made goods.

Re:Before we bash on outsourcing...

[Kris_J]

You might think it looks like this on the outside, but the environment of outsourcing creates events like this by making it impossible to determine who's competent and who's not. There are so many degrees of separation between the company needing the work and the individual doing it that it's impossible to keep track of what's going on until it's obviously gone wrong or right. Also, outsourcing is so awful that the turnover is very high. This leads to excessive pressure on each new outsourcee as they get employed closer and closer to the deadline -- forcing them to take risks like these in order to do the job "on time". Outsourcing incubates problems like these.

Re:Before we bash on outsourcing...

[Perl-Pusher]

Didn't read the article eh? I'll post the important part.

County attorney David Morris said that programming work for the day-care center had been outsourced to the locally-based Genesee Community College. The manager of the college's program refused to speak to a reporter, but Morris said Dennis was a third party consultant hired by Genesee. Dennis, in turn, used RentACoder to once again subcontract the database work, which ultimately fell to a New Jersey-based programmer. By that time, the programmer actually working on the day-care data was four steps removed from the county's social services program.

So the gist is they outsourced to a CommunityCollege who then outsourced it to a website. The coder who answered the website not only didn't know what he was doing and tried to get someone else to help him, he probably had no idea the significance of the data to begin with. Since nobody who had a clue actually hired him. Outsourcing something that important is exactly what is wrong. I've seen companies outsource jobs that were essential to the well being of the company and nobody in charge (CEO,CIO) will admit that the reason the business failed was due to putting something critical in the hands of others who didn't have the same priorities as them. You should only outsource when the task is not critical and doing it yourself is too expensive. If it's important and you don't have the expertise, hire employees who do. Then when something is needed, you get it when you want it and how you want it. If neither is possible choose another line work.

Sad to say....

[Tangurena]

Folks are too busy cutting back on employees to even think straight. This sort of thing has gone on before and will go on again. Just think of the hospital in Florida that outsourced medical transcription to someone, who outsourced it again, until eventually, some Pakistani woman was upset that that she was not getting paid, and threatened to release all of the info onto the web.

This, and the Florida case will be brought up again and again. And I am sad to say that these are just the beginning of a long decline.

Confidential data on slashdot

[Anonymous Coward]

I have seen some people spread data via slashdot comments encoded with base64 and encrypted. (anyone have a link to a specific occurance - at least one time someone decypted it and posted it) Could slashdot be used as a way to anonymously leak information like this, and use slashdot's general policy of "just mod to -1, don't delete" towards comments as an advantage? Unlike other forums, posting anonymously leaves nothing but a MD5SUM of your ip to be used in court. Also, if you "post anonymously" while logged in, slashdot caches your username. You can verify if you have mod points by noticing that even when you post anonymously AND change your ip address, you can't mod up/down the comment.

Outsourced or not?

[Rosco P. Coltrane]

Officials at the New York State Office of Children and Family Services and in Livingston County, where the incident occured, are investigating. Livingston County's social services office is located in Lima, just a few miles south of Rochester, N.Y.

If it's an outsourced programmer, shouldn't it be Lima, Peru?

Obvious bias in post!

[teetam]

Couldn't a "non-outsourced" developer make the same mistake? What does this have to do with outsourcing at all? Seems to be a very leading post to me, designed to generate the usual angry, anti-outsourcing replies.

Re:Obvious bias in post!

[totatis]

Well, yes and no.

In theory, a non-outsourced developer can do the same mistake. But there is something important called relationship and trust.

If a developer is in-house, if he has talked to clients, project manager, if he had be given a lecture on how the data is sensitive, you can bet that this developer will not mistakenly post that data on the web. Sure he can be corrupted, but that's not what happened here.

On the other hand, if some code-monkey receives some coding to do for an unknown company, in an unknown place, for an unknown application, and he is given a set of data not knowning what it is, then he might publish his data without knowning what he is doing.

The "outsource" stuff is important, not because of some "save jobs" issue, but because it implies the developer should never had received this data in the first place.

If some company/government entity outsources some programming job, it should give said developers only fake datas. And administration jobs with access to the real datas should be done by trusted guys.

Re:Obvious bias in post!

[L-Train8]

Government agencies deal with sensitive data all the time, and have carefully developed practices and policies in place. These have been developed over years and are part of the culture of the workplace.

When you outsource to a company that specializes in IT work, and that gets outsourced to a database contractor, the sensitive data is no longer in an institution used to handling it. Yes, you might have an unscrupulous or incompetent coder in your orginzation, but you are far more likely to have a problem when you hire someone because they are cheap and they can code. The instititional controls and culture that protect the data are not in place after 3 degrees of outsourcing.

Re:Obvious bias in post!

[andy1307]

The morons who gave the september 11 hijackers visa extensions AFTER 9/11 are still working for the government. That wasn't outsourcing. I don't see how a worker for the government agency involved couldn't have made the same mistake.

Look! Outsourcing Bad!! NOT.

[RedHat Rocky]

As much as I feel the outsourcing trend is not a good move, both for my career path and the US industry in general, this 'news' neither adds nor subtracts from the debate.

It would be better titled:

"Idiot makes mistake, exposes private data to Net. Sound thrashing in progress."

Re:Look! Outsourcing Bad!! NOT.

[laird]

"Of course, the thrashing could be inflicted faster & with less preliminary legal wrangling if the culprit had been a regular employee & not an outsourced "consultant.""

Actually, it's far easier in most states to manage a consultant or vendor than an employee, because employees are covered by labor protection laws, while vendors have to live up to their contract. So if the contract is at all reasonable, their should be immediate, significant financial penalties for their violating professional ethics, while for an employee, particularly a state employee, there's a fairly detailed disciplinary process that has to be followed.

Is it really gone?

[AndroidCat]

I wonder if they've checked the wayback machine at archive.org.

Medical Industry

[jamonterrell]

Those in the medical industry such as myself have a deep understanding of these issues. The government of the United States identified the amount of this kind of sensitivy in the information that we keep, and decided to pose some restrictions on how we handle it. For those who are interested, feel free to google for "HIPAA," and be sure to read over the consequences for disclosing "PHI" to unauthorized sources. Perhaps these kinds of sensitive information handling rules should be global, and not industry-based?

Jamon

Peer ethics

[Montreal Geek]

Ethics are hardly involved. This is a question of raw stupidity.

That he has even tought of posting his customer's true dataset is inforgivably moronic. Whether it was data on children's whereabouts, credit card information, or even "just" accounting information on some business.

While it is true that not revealing your customer's data is the ethical thing to do, it's also just plain ol' common sense.

Though I should perhaps say vintage common sense. Seems that product has been discontinued for some years now.

-- MG

You are entirely correct.

[Srividya]

I have tried so far to be patient and tolerant. To be patient and tolerant is to be a good person.

But there is a line.

Every person who is reading this article, every person who wrote this article, is wearing an "outsourced" shirt (maybe even made in India! look at your textile tag!), looking at an "outsourced" watch (usually Taiwan), staring at an "outsourced" computer monitor (again, Taiwan), and ready to drive home from their job which is "threatened by outsourcing" in their "outsourced" Japanese car. This is the way of the world! George Bush, the popularly elected president of America, meets at Free Trade summits, and this is Free Trade! Why should anyone whose entirely life is purchased of "outsourced" products complain of "outsourcing"??

Well my large personal escaping out of the way, it is a tragedy and a flaw what has happened in this article. However I believe it has happened many times before with American firms as well.

http://zdnet.com.com/2100-11-526757.html?legacy= zd nn

No?

So, we are trying not to make these mistakes as well. I can say that at least here the discipline is greater. This person will be beaten for sure.

Re:Hmmm

[MaineCoon]

Very creative, however, if you had read the whole article, you would have realized that the chain of contractors - the university that received the original contract, the programmer they subcontracted, and the programmer that the subcontractor contracted, were all US citizens and/or organizations.

Just because a programmer is located in the US does not make him or her infallible and capable of doing perfect work.

the dumbasses...

[SHEENmaster]

Who the hell thought to give him REAL information about these children in the first place? A fake datase would've worked just as well for development purposes.

Re:the dumbasses...

[johnnyb]

Actually, I've found that they don't. Fake databases usually are well-organized and thought out. The real deal usually has many, many inconsistencies that have to be dealt with. I always require real data to test any program I develop with, because otherwise it's just a nightmare at go-live time.

Re:the dumbasses...

[SirSlud]

actually

1. It's bad to develop with real data, because you make assumptions about what kinda of data you have to process. You should unit test the code, by *trying* to break it by using known invalid formats or invalid data to ensure that your software handles such input inconsistancies gracefully. As in, the only way to be sure your software won't core, or fork bomb, or enter an infinate loop is to test it on test data, which should be created by the developer.

2. You're right about going live tho. You'd never go live with software before you QA'd it in the final go-around with the real data just to ensure you're not going to spend 2 hours upgrading a platform, and 2 hours backing out.

Neither of these points has any bearing on the fact that, as a developer, you will (most of the time) have/need access to the real data at some point, so it really is up to the developer and the contractor to set out rules for the usage of the data, and even to have the developer sign an NDA of sorts to put the accountability where it should belong.

What stories like this really highlight is the sorts of losses that can occur from outsourcing or contracting that dont often show up on a cost analysis of the project. The less control and supervision you have over your 'employees', the higher the likelihood that those employees may do something with their relationship with you that may damage the company. I've had numerous higher-ups in other companies pass me sensitive data just because they need something fixed as soon as possible, and they can't find the experience/ability in house, and I just think its a completely irresponsible way of conducting business. But if I did something dumb with that data, it wouldn't be my ass on the line, because I was handed that data with no legal documentation concerning how I can use it and what I can do with it. Then again, maybe lawyers might see that differently.

All I know is that when it comes to outsourcing, its usually a gain in labour flexbility and cost effectiveness at the expense of a higher risk for the disclosure of sensitive information, be it data or security rights. It's a cost that employers can willfully ignore if they so choose, but again, I think its just bad business practices. Full employees have a far greater vested interest in the success of their employer and are far less likely to do stoopid things that one-off contractees have been known to do. That is, full time employees are more likely consider the legal and financial implications of how they go about providing solutions for product development. Employers hate that to admit it, tho, because it highlites the downside of a their utopian flexible labour force in which there exists little job security for the people actually doing the gruntwork.

Re:the dumbasses...

[johnnyb]

"It's bad to develop with real data, because you make assumptions about what kinda of data you have to process. You should unit test the code, by *trying* to break it by using known invalid formats or invalid data to ensure that your software handles such input inconsistancies gracefully."

That's not really what I'm talking about, though. For example, I've worked with databases where the CS department entered in all X's instead of physically deleting an address. Their programmers had simply coded to ignore records with all X's. If an outsourcer had been given a sample data set, it probably would not have indicated this odd fact.

There's lots of other examples. In most cases, it's easy to make something that fails gracefully or does something, but that's different than working correctly. For example, many datasets use "0" or "-1" instead of infinity. If your program treated -1's as invalid data or 0 or raised an error, it would cause real problems when run against real live data.

Also, when computerizing paper forms, there are lots of pieces of information that aren't listed on the form, but are required to be written in the margins anyway.

Re:the dumbasses...

[orthogonal]

The more interesting question is why he felt the need to post the real data. If I had a database formatting error, I would have written a fake database that was corrupted in a similiar (sic) wayt (sic) and asked about it.

I'm guessing it's because he was a lazy dumbass who just didn't give a rip about the confidentiality of low-income kids in foster care.

Given that the article mentions he was informed that he'd posted live data, responded that he'd made a mistake and wouldn't repeat it, and then re-posted the same data the very next day I think supports my assessment.

As to why you would have gone to the trouble to substitute in fake data, well, you've got some equipment he apparently lacks: professional integrity and an ethical compass.

Multiple Problems

[chamilto0516]

I see several problems:

1) Looks like the IT work was being done on a budget. I mean they are not hiring Anderson to do this stuff right (OK, bad example, I know...)

2) But someone was paying SOME money if it could be subcontracted multiple times and the work was getting done...or was it.

3) It looks like it was contracted DOWN past someone's ability to do the job. It is kind of the opposite of the Peter's principle. Non interesting IT work keeps getting pushed down the chain until it is in the hands of someone that can't do the job. (If I just invented it, please don't call it the chamilto effect as I don't want my handle associated with this behaviour)

4) At the bottom of this there is always some careless sap that didn't know what they were doing wrong should get them slapped upside the head for thinking about it. This person was even worse because the article states that someone pointed out to him his error and then he...DID IT AGAIN!

Incidnet's like this require multiple wrongs and then will require a whole lot of legal work and policies and rules and regulations that will be once again thwarted by the idiots that inhabit this planet.

Not outsourced overseas

[crymeph0]

Rather than mod you down, I'll just let you (and all the other knee-jerks) know that THIS WAS NOT AN INDIAN PROGRAMMER. This was a guy named Mark Dennis. Not a very Indian sounding name. Also, Mark Dennis actually subcontracted the job involving the database out to someone in New Jersey. Maybe IHBT, but the article summary could make you believe this had to do with offshore outsourcing, so that's a misconception we should clear up early.

Re:Not outsourced overseas

[Shut the fuck up!]

This was a guy named Mark Dennis. Not a very Indian sounding name.

True, but if you replace the 'rk' in Mark with 'ndara' and the 'nnis ' in Dennis with 'eptanshu' then you have Mandara Deepthanshu. That, as I am sure you will aggree, sounds Indian to me.

Re:Not outsourced overseas

[crushinghellhammer]

LOL, you xenophobic freak!

And here's some info that you can spout at your next Xenophobes R Us meeting:

Mandara is not an Indian name, Mandira is (added bonus info: that's a woman's name)

I've never heard of Deepthanshu (I'm part Indian, and though I live in the US, know quite a bit about India) and even if it was, it would be a first name, and not a last name.

Re:Not outsourced overseas

[SoSueMe]

True, but if you replace the 'rk' in Mark with 'ke' and the 'nnis ' in Dennis with 'epshiticancause thecompanyiamabouttoquit' then you have "Make Deepshiticancausethecompanyiamabouttoquit" sounds like an inside job to me.

Not "unscrupulous", just stupid...

[Saeed al-Sahaf]

"let's not forget that this problem isn't a result of outsourcing, but an unscrupulous programmer."

Unscrupulous? No, just incompetent. Posting credit card numbers to some hacker site is unscrupulous; this guy's just too stupid to do his job.

Yikes!

[eli173]

County officials have not yet determined if they will tell the families involved about the incident.

"It's kind of a shock," said Morris, the county attorney. "Right now we are consulting with the state office ... to find out what we've got to do."

"not yet determined"!?! Those parents should be informed so they can be alert for trouble.

Re:Really, this is not OT

[MaineCoon]

However, in this case, all the outsourcing was within US borders, as is evident from the contents of the article.

This verges on criminal.

[ezraekman]

The fact that the data went through multiple levels of subcontractors doesn't bother me, so long as each has signed the appropriate waivers and so long as each have been checked out enough to be trusted with the data. But there's no excuse for leaving proprietary and/or sensitive information out there, unprotected.

Password-protecting an entire directory is trivial. 20 seconds to a seasoned user, or a few minutes in a web interface for a newbie. This info wasn't just accidentally left unprotected; it was intentionally posted to a public-facing site, in an attempt to attract programming assistance. This, on it's own, could easily be called criminally negligent. But after being warned of the potential consequences and posting it again the following day... that's verging on knowing child endangerment. Use dummy data, for crying out loud!

Everyone makes mistakes, myself included. I'll admit to posting members-only data in a public area once or twice. But once you know about it, there's no excuse to not fix it. This guy should probably be prosecuted. And while I hope the families get notified... I seriously doubt most of the affected families will ever find out.

Oh... and write this story down, boys and girls. This is yet one more nail in the coffin for TIA-styled programs. "Oh, we're very careful with our data." Right.

Procedure, Procedure, Prodecure

[hellfire]

First of all, the article is fanning the flames by saying this is a database of children's whereabouts. Okay, this is a problem, but then again it doesn't matter if its children or anyone, it just gets "oh please save the children!" sympathy clicks.

It also doesn't address what I think the biggest problem is. It's obvious to me someone assumed this bozo of a programmer had some not-so-common-sense about posting information to a website. I deal with customer data all the time, and my company has taken some steps to make it a little harder for people who should not need the data to not get the data, and our data exchange policy clearly states "Do not give this data to anyone outside of this company or you will be beheaded!"

I get to this day accountants in our company saying "why can't I peek at this customer's data" to which I reply "Do you have a signficant need? If so, tell your manager to talk to my manager, and I'll be happy to give it to you." I get nothing after that. The customer data we have is for support and development use, not an accountant who has no use for inventory and sales information (at least not in this company). It is also freely accessible amongst those people, who typically only share it within others in their department.

One day a manager might get an idea that looking at a customer's data might give them an idea of their open bills, but that might be unethical or illegal so until a manager says to give access, I won't.

My point is, it could be that the policy was not pounded into this dolt's head, or that a proper data exchange policy even existed. If so, he's still a dumbass, but companies frequently hire dumbasses, which is why you sometimes need a policy to help prevent dumbass behavior. The article puts full blame on the programmer and doesn't really give any blame to the company who hired him.

These violations are RAMPANT.

[Anonymous Coward]

I work at a company that makes software for viewing printer protocols (PCL, HPGL, etc.) As such, we often receive problematic files from customers which do not view properly in our viewer.

You would not believe the sensitive information we receive. People don't even think about the ramifications when they send us, for example, somebody's high school transcript, or mortgage closing documents, or people's credit reports. We have secret inventory lists for competing companies, each of which would probably kill to get their hands on that information. We have "insider" information on the international banking industry. We have medical records. Prison records. It goes on and on.

Because of this, we have an extremely tight document policy. Data exists on paper only long enough for testing purposes, then it is destroyed. The bug tracking database is purged of old test cases on a regular basis. Customer files never leave this office, in paper form or otherwise.

In fact, as I write this message, I can think of several ways that we should probably be even more paranoid. Fortunately, the officers of the company take our responsibilities very seriously, and there has never been any serious breach of customer confidentiality. I hope there never is.

The programmer who posted identifiable information to a public web site, because he was too incompetent to solve his own problems, is an idiot who should be fired and beaten with a wicker cane.

Re:Pretty dubious site

[prof_vestanpance]

A bid request? Damn, are they outsourcing virus writing now? Is nothing sacred?

Kidnappings correlated?

[forand]

I hope that the police in upstate New York correlate the kids whose information was posted and missing children reports.

Also for everyone who says: "This could happen with an American programmer just as easily." Yes that is true but you could punnish that programmer but you will have a hard time punishing programmers in other countries.

Stupid coder, stupider company...

[Saeed al-Sahaf]

Unscrupulous coder? No, just incompetent. Posting credit card numbers to some hacker site is unscrupulous; this guy's just too stupid to do his job. But look at this part of the MSNBC story:

"It's not likely all those visitors unzipped the attached database, but there's no way to know how many did, according to RentACoder CEO Dan Ippolito."

This company is so damn stupid they don't know how to check their logs to see how many times that file was downloaded,

Re:Stupid coder, stupider company...

[jas79]

their logs only say how many people downloaded the file. not how many people actually unzipped it.

The answer is simple:

[Anonymous Coward]

Outsourced moderators, of course.

Re:Pretty dubious site

[Pretzalzz]

Additionally, one of the project types is 'Personal Project / Homework Help'(emph. mine). I can't really imagine a situation where solicitating this sort of help on a website wouldn't be considered cheating by most computer science professors/teachers.

Is outsourcing the main problem here?

[belmolis]

What happened here is certainly appalling, but I'm not so sure that outsourcing is the main problem. Outsourcing arguably increases the risk of problems of this sort because an in-house programmer is more likely to know the rules of the game, but this seems to me to be a fine point. On the one hand, in-house IT staff are not necessarily going to be well-informed about privacy issues and the nature of the data they are working with. On the other hand, it is perfectly possible to make such constraints clear to contractors and to make them part of the contract.

It seems to me that there are several other issues here as well. For instance, why would any programmer be working with the whole, real database? I can see that if the job is convert an irregularly formatted text file into a usable database, but that is about the only situation in which the programmer needs the real data. Otherwise he or she just needs to know what the data looks like. If sample data is needed, it can be a small subset, and critical information can be camouflaged. Of course, the same applies to the programmer asking for help on RentACoder. There's no need for him to post his whole database.

It seems to me that the real problems here are:

• the programmers shouldn't have been working with the full, real database in the first place
• confidentiality requirements weren't spelled out.

Before the India/outsourcing bashing begins

[andy1307]

That's how personal details about hundreds of children ended up on the Internet. A user named Mark Dennis, stuck with a tricky formatting issue, posted his question to RentACoder -- and attached a zipped copy of the database he was working on.

This work was outsourced, not offshored. This article has obviously been posted to show how outsourcing threatens the future of our children. This work wasn't offshored. It was done by an American programmer. If outsourcing is bad, why did the navy outsource a 5billion $ chunk of IT work to EDS?

Could be even worse with offshoring

[FunkyOldD]

[paranoia]

This is one of the things that really concerns me about offshoring. As US corporations keep outsourcing software development to another countries, the confidential data will inevitably move there too.

How long before private information like credit histories, medical records etc. is leaked out from some company in Bangalore?

Imagine being blackmailed by someone in a third world country. Given the state of law enforcement over there, you would have no legal recourse.

[/paranoia]

Oops....

[Skyshadow]

Shit. So much for that anon thing. (cringe)

Guess my sig goes double now...

Re:Oops....

[DarkHelmet]

See, this is how ya do it :)

....SHIT!

Re:Oops....

[Ralph Wiggam]

I see you're new here.

-B

Re:Oops....

[cyclist1200]

Actually, I think I heard about this incident. It's a good argument for compartmentalization.

I used to work for a healthcare transaction company, and we developers had absolutely no access to patient data. I had no access to production databases, just dev and staging. Those databases used fake test data only. We weren't likely to be sued by Ima Genius or Homer Simpson over the loss of their records.

Who made the blunder?

[gokubi]

It's great to see how different news orgs handle headlines. MSNBC makes pains to name the Government as the offender in it's headline, "Government agency exposes day-care data". Slashdot is a little less breathy and indicates the true source of the leak, the out-sourced coder.

Both could be called correct, but more interesting is how the positioning of the story indicates the inclination of the news source. MSNBC is part of the mainstream news establishment that has been telling us for years that the government hasn't done a good thing since kicking the British out of Yorktown.

Slashdot speaks to a lot of developers who don't ever want to work for a place called "RentaCoder", and don't have a lot of respect for anyone who would.

Personally, I much prefer the Slashdot take on the story.

Re:Who made the blunder?

[Filibustero]

I think the headline should focus on the government, because the government is the one with the responsibility to protect the information.

Sure, the person who posted the information was wrong to do so, but it is still the government's job to prevent this sort of thing from happening.

google says...

[larryk]

Quick google check (mark dennis lima) finds name, address, phone no. spouse, and three pets. http://www.limademocrats.com/bios/mark.asp

The Real Kicker

[stoolpigeon]

is this little bit at the end of the article

County officials have not yet determined if they will tell the families involved about the incident.

If that isn't sick I don't know what is. I thought it might be more like 'haven't decided how to tell....' not IF they would tell

This is relatively simple...

[John Murdoch]

If you're an independent consultant, your insurance agent has probably mentioned "Software errors and omissions" insurance to you. Software E&O coverage is written to protect your ass(ets) in the event that you colossally screw up and do something that gets your client's client answering awkward questions from major news organizations. (A colleague once observed that, "if, when you walk in the door in the morning, your secretary says that a CBS producer is on the phone trying to schedule you for an interview with Mike Wallace, it's probably a bad day.")

Suffice it to say that if Mark Dennis doesn't have Software E&O coverage, he's going to wish he did. Because he's going to get so sued. Along with the community college, the government agency, and everybody else involved.

Getting sued, however, is the least of this bozo's worries
If he has insurance, it might cover his liability exposure. However, his real problem is the civil fines he is going to have to pay--and no insurance policy in the world will protect you from a criminal court sentence. He'll get a whopping fine--but I doubt he'll do jail time. Unless, that is, somebody can demonstrate that a child molester used the database to identify a victim and attacked him.

There's an important point here
The software community should make it ABUNDANTLY CLEAR that this dumb cluck should have the book thrown at him. We have absolutely zero sympathy--and when his attorney (with nothing else to argue) says "it was all a tragic mistake..." somebody needs to stand up and yell, "LIES! LIES! DAMNABLE LIES!" This was willful, deliberate, with knowledge aforethought stupidity. And this jerk deserves to get run up the (proverbial) yardarm for it.

Simple...

[Vrallis]

:%s/[A-Za-z]/X/g :%s/[0-8]/9/g

Simple. Just obfuscate it, and you can pass it around for people to help with formatting issues all you want. I've done that with payroll data plenty of times.

Just two lines or vi commands could have saved this guy so much trouble....

OT: RentACoder owner is an asshole

[arf_barf]

Just in case all you unemployed geeks consider rentacoder for some work, here is a sample email from Ippolito that I have received a while back:

"... When you try to issue a charge back, here is what I will be doing:

1) I will be reporting you to the VISA (or Mastercard) Internet Fraud
Division with your tracked email address and IP Address (both of which
have been re-confirmed again by the headers in this email you just sent
me!). Every time we've done this, people have lost their credit card
accounts, and I look forward to making you lose yours.

2) I will be reporting "...." to the Better Busisiness Bureau in
Aliso Viejo, California as the deadbeat business that it is. I look
forward to having everyone in your local community know exactly what
kind of business you are.

3) Site rules will force me to inform the coder that you are trying to
stiff him, so we will notify him of this. It's probably one of the
stupidest things in the world to try to stiff a coder as you usually end
up email firebombed or worse. Exhedra does not condone such
activity...but I've been around a long time to know how people react."

It's your call. Either act responsibly for your actions, or suffer
the consequences.

Sincerely,
Ian Ippolito

It's not about India, damnit!

[LilMikey]

But it is about outsourcing in general. Any company with a good amount of highly sensitive data should maintain a chain of trust across their IT personel. Everyone working on the data should have at least some idea of how sensitive it is and what has to be done to protect it. You don't get that from shoving the work off on the lowest bidder. There's a reason they ARE the lowest bidder...

And Rent-a-coder? Come on... it's looking for trouble when there are thousands of out of work programmers of varying quality and you're asking for the cheapest? Crikey! Programmers working on crap data are getting slammed with soul-stealing NDAs and these wankers are forking off kid's names to some shmuck on a glorified web-board? Again I say outsource the management, keep the programmers.

Rentacoder sure seems slow right now...

[Satan's Librarian]

From the speed of the RentaCoder site, I'd say a lot of unemployed slashdotters want to be 'outsourced programmers' too....

I looked too... I'm not sure which is worse though - the fact that the prices on the projects are beneath a living wage for me to consider bothering with them (I'd make more as a barista or a dishwasher), or that half of them seem to be helping some dishonest schmuck in a CS class cheat on his assignment so there will be more clueless dorks that can't program their way out of a paper bag holding CS degrees out there applying for jobs.

I'm cool with competing with Indians - for the most part the Indian coders I've met worked their asses off and knew their stuff, even if they might be willing to do it for half the price I'm used to commanding. If I was in their shoes, I suspect I'd do the same. Feeding your family is a good thing....

It's all the people that fill their resumes with keywords for technologies they don't understand and couldn't use if their lives depended on it that clutter up the application inboxes that annoy me. HR departments encourage that behaviour, as do hiring managers that can't tell the difference, but it still pisses me off - both when I end up having to interview such cluebags and show them to the door, and when I'm competing with them for a job.

The Original Problem

[fatray]

OK the coder screwed up.

The primal problem is that the government agency gave the data to their outsourcing provider. That data should have never left the secure area of the government. Once it is out, it is out. It doesn't matter whether it has gone to Gennessee CC or RentaCoder. Posting it on the web is just a matter of degree.

Everybody is ready to hop all over this clueless coder and blame everybody's favorite boogie man of outsourcing. There is a manager back in the government that originally disclosed the data.

Don't tell me about NDCs. The first rule of confidential data is NEED TO KNOW. It would have taken someone 15 minutes to put in some dummy data for the programmer to work with, but they couldn't be bothered. Now that person wants to crucify the programmer.

The programmer who screwed up is only the last (and most visible) in the chain of screw ups.

The *REAL* Downside of Outsourcing

[Anonymous Coward]

When you outsource, you run the risk that the individuals doing the work do not share your company or even cultural values. If you are not willing to take the time to make sure that your outside contractors are what you expect, this is the kind of thing that will happen. Few companies really understand this.

When you outsource, you run the risk that the individuals doing the work do not give a flying f--k about the security and/or confidentiality of your data, they may even deliberately and maliciously seek to cause you harm. Few management types really care about this, as long as they're saving a buck.

Re:Really, this is not OT

[The_K4]

Ok, take off the tinfoil hat and realize that NONE of this took places outside of the US. They DID hire a US contractor (actually a university) with hired a US subcontractor, who hired a US subcontractor. The guys lived in Nowhere, NY and Nowere, NJ!

This can destroy a company

[Anonymous Coward]

A few years back a leak of a confidential customer database destroyed the Northwind company.

Some notes

[MAXOMENOS]

Do you say, "Only certain government approved facilities can deal with this sort of information?" Seriously, should I feel that someone "government sponsored" is better off with my information than an outsourced programmer in India? Who gets to play Big Brother? And what will they do with what they know?

The difference is that a government employee is easier to discipline. Both can be fired, but the regular employee can be prosecuted more easily than an off-site subcontractor who may be out of state (or country).

It is also easier to train and mentor such an employee versus an off-site contractor, and thus easier to enforce data security.

Does even outsourced matter?

[Uber Banker]

The fact is this person revealed details against their contract code and more importantly, if they are in this position they should have the moral/ethical decency not to do this.

Whether they were outsourced or not outsoured does not matter (IMHO) - they still have a personal moral/ethical judgement... FT government contractors are not great saviours, rather this individual is one with poor/sick ethical judgement (it is in no way 'freedom of speech' to disclose confidential/sensitive information about young kids).

I do not believe outsourcing creates a more or less trustworthy/moral/ethical situations/employees (well, they just have less benefits rights and more legal liability if somethinggoes wrong), it is the individual who makes a better individual and avoids being a piece of scum.

Re:Does even outsourced matter?

[Skuld-Chan]

This is true - but the original post does suport some of the evils of outsourcing in general. And that is any time you outsource you have to give part of your company to another person or company. That company can be here in the US, Canada or in a country you have never heard of. And many times (depending on how the contract is written) its up to the actual outsourcer where that labor is performed - more often than not actually this is the case.

For 2 years I worked in an outsourcing company doing tech support - and pay rate really writes volumes on why tech support agents really truely don't care about you or your problems (for example they were starting people at 9$/hr to support graphics apps most people get paid 50-150/hr to use). The only goals in companies like this are a) to get customers to go away and b) look for a new job between calls (if you have that luxury). More than once I've seen people fired or repremanded not on just my contract but others for stealing, using, exchanging or sending confidential information to people they probably shouldn't have. Usually its details about the contract, what company uses what vendors for outsourcing, working conditions inside the outsourcing company and confidential knowledgebase/email docs on service and support. Many more times I've seen people take this information without anyone ever paying attention.

To me this is a rampant problem since - the only reason this is on slashdot is because someone noticed.

Re:Does even outsourced matter?

[budgenator]

I would hope that as a DBA, if you hired me as a sub-contractor, or even as a sub-of-a-sub-of-a-sub, that the database I was given to develope the prototype of the app with would be populated with dummy data. Posting of the data on the Internet runs afoul of New York state's confidentiality laws, not to mention some federal laws for example:"M,Tue. & Fri when mother attends treatment program and therapy,( approx. 20 hrs per wk)" sure looks like a HIPPA violation to me (IANAL ect.) at $50K/occurance, it passed thru 5 hands, 1 the Livingston County Department of Social Services, 2 Mark Dennis, 3 Genesee Community College, 5 RentACoder.com, 6. The programmer who took the job that $250K in potential fine for just one database record!

It always struck me as ironic that the same people crying the loadest about protecting children, are usualy intrumental in getting them hurt.

Not just stupid -- unscrupulous.

[Frater 219]

Unscrupulous? No, just incompetent.

No -- unscrupulous: lacking in moral measure; unable to discern the moral weight of one's actions.

(A "scruple" is a unit of weight, don't you know.)

Publicly posting government records of children's whereabouts is not a morally neutral act; it is a reprehensible one. The programmer in question was not, it is claimed, ignorant of the nature of the data he had in hand; he simply did not correctly value that data. He failed to make a necessary value judgment: that to post masses of information on children's whereabouts is, in our world, a wrong thing to do.

It is not simply a stupid or ignorant thing to do. It is not simply incompetent, like writing C code with gets() in it, or turning in code to one's boss which won't compile. Rather, it is a form of carelessness that shows that one places no value upon that with which one has been entrusted.

If you're the sysadmin of a mail system, reading other people's mail for fun is an unethical act. However, leaving the mail-system password lying around, so that random hooligans can read other people's mail, is also an unethical act. Not just stupid. Wrong. It shows that you don't value your users' privacy -- that your values do not match up with your users' values. That, while you may be competent to operate a system for them, you are not trustworthy to do so.

That is a very different way to be bad at one's job.

A phrase that will always live on...

[Anonymous Coward]

You get what you pay for.

Potential coppa violations, too

[bugnuts]

If the kids were under 13yo, the programmer could have violated COPPA, the Children's Online Privacy Protection Rule.

In other words, this guy could not only have given a black-eye to the county, but he could even go to jail for it.

If the information lost can be linked to a crime against one of the kids (no matter what age), he better have a good attorney. Gross Negligence and Reckless Endangerment come to mind.

Re: "Who Can I Sue?"

[Tablizer]

Since this is an outsourced job, there is very little, if any recourse that can be taken against the person in question. Perhaps US companies will see this and think "whoa, if this happens to me, and somebody sues me...who can I sue?"

One of the "justifications" for non-open-source-software was that there was a specific company to sue or threaten if something went wrong. It is odd how the very same corporations don't (yet?) see the same problem with intellectual property and confidential information going overseas.

Ewwwwwwwwww

[GoMMiX]

"County officials have not yet determined if they will tell the families involved about the incident.

It's pathetic that they even question whether or not to inform the parents. That's like publicly saying; "Hey, we know we screwed up BIG, we know the media knows, but we're not quite sure if we're going to try and cover our own asses yet or not."

Knowingly endangering a child in any form is a felony. This is simply more proof that allowing the government to act with relative impunity results in criminal acts against citizens. The county is responisble for the leaked information and should be responsible for securing the daily activities of those children, to ensure the leaked data does not allow any harm to come to them.

When I was seven years old, my day-care center had 'accidently' released confidential information about myself and several other children in their care. The day-care center cared for somewhere around 70 children. The leaked information was found in the posession of a convicted child molestor. By the next day, the day-care center was shutdown and the city had filed criminal charges against it's owner and two employees at the facility.

Why is it that when the government does it, everything is not only OK -- but they're not even sure they should bother wasting their time to inform the parents/guardians that their children have been placed at risk.

This bogus trash needs to stop, the government has to be responsible for it's actions. They violate laws on a regular basis as a part of their daily operations. Enron is almost perfect compared to our own government.

That's pitiful.

California SB 1386

[JohnsonWax]

California has a bill designed to deal with these situations, though it's not clear if it would apply to this specific situation.

http://info.sen.ca.gov/pub/01-02/bill/sen/sb_135 1- 1400/sb_1386_bill_20020926_chaptered.html

The problem is that the bill is designed for data theft, not for dipshits giving it away for free. Nevertheless, the bill requires that consumers whose data has been stolen be notified through viable means - email, letter, public notice if they can't be identified. Fines to the company for not doing this and the person responsible for the data is open to civil action.

The main problem I see from the article is that the impacted individuals may not be notified, which is just wrong. Granted, this kind of thing probably can't prevented (minimized, yes, stopped, no) but there's a right way to address the problem and a wrong way. At least notify the affected people of what's happened.

Re:Copyright

[gordguide]

Databases are not always or automatically subject to copyright. Pure factual information (ie the telephone book) has no creative or interpretive value added to it; it's not an "original work", just a list of factual information.

For the purpose of this I'm going to limit most of this to the information itself in the form of pure text, and won't wade too deeply into the details like the "design" of the database form and fields if it were presented in a GUI format.

There is a grey area where purely factual information is not publicly available, and the unauthorized use of it may be actionable, but usually not on the basis of copyright. What would be the deciding factor would be based on how it was copied; ie word for word including the format, page numbers, annotations, etc would probably be copyright infringement.

If it was limited to the factual information only, an action would probably be based on theft of proprietary information. Should that information be posted publicly, it by definition becomes public from that point on, so fair game from then on. Not to say that a court wouldn't have to rule as such; but posting it publicly would be the basis the ruling would hinge upon.

However, keep in mind that you can't photocopy the phone book and expect to avoid breaking copyright law; you could however enter all the information found in a phone book in your own database and publish that info in a "phone book" that factually is identical to the original.

What is different is you copied the design of the phone book in the first instance (the creative component is the design, with the design incorporating in part some factual information) but just the information it contained in the second (no creative component; just the facts).

Another example; if the database contains original work, even if this only amounts to a field where someone writes something like:

"Bob is an engineer; he and his wife Patty have 3 kids. The whole family loves dogs." ... then the copyright stuff can come into play, but again only if that field's text was distributed verbatim.

You could use it as pure information by, for example, putting "Engineer" in a "occupation" field you create and you would be OK.

The pure factual information remains non-copyrightable so one must limit the use to that information only.

There are many instances of factual information that is not subject to copyright itself; even though it might be incorporated into a work subject to rights; for example the title of a song itself is not copyrightable while the title and lyrics together are.

Outsourcing off-shore

[killmeplease]

I think the best point so far is the lack of indenability for off-shore shops. In america we can get the authorities to arrest someone for disclosing IP and data that is sensitive. If you off-shore data or IP, you no longer have the ability to excercise NDAs, enforce patents, enforce copywrite, or enforce licenses. I can imagine off-shore companies creating software for large companies in the US, then selling the same sofware to the UK or some other country with big business.

This is a good idea. I should go to India and start buying UP IP and selling it. I know DELL, HP, and IBM are not outsourcing their sensitive projects because they have a large amount of skilled in house labor and more money than god. But I would like to know who is off-shoring what big projects?

I am a skilled programmer with no experience, unable to get a job in southern california because the market is flooded with highly skilled cheap IT/programmers. How can I compete for a $35,000 a year job with a guy with an MCSE, CCNA, A+, Java Certified, etc ... ... even if I am smarter than him and can program better than him (though slower out of the gate) due to my great schooling at a decent CS program?

Re:Who do you trust? Guess what pal ...

[jeepmeister]

I strongly suspect I work for the same hosed up HMO as this guy, and I'm in a position to know for a fact this happened pretty much as he said it did.

US citizens need a Data Protection Act 1998

[openmtl]

This lack of personal privacy is very much a US-centric concept which divides the EU-US. The EU has a lot more stringent personal privacy and it would be in the interests of slashdotters to read the contents of the e.g. UK Data Protection Act and petition your own local legislators to get this mapped into US law. (substitute President for Majesty and Senate for Lords and Congress for Commons - the law is quite clear). Companies will squeal but its a fantastic law for citizens (voters).

Like many others I'm down as a Data Controller within the meaning of the Data Protection Act. I take this role very seriously even though I have just a few personal details, but also because I have access to a lot of other records and I view it from the point of view of: what if it was MY personal data that was being copied about ? My declaration also states that any data never leave the EU. Personally I see any data sent to the US as secure as posting it on the Internet. Good to see the actual US government confirming my views.