Slashdot Mirror
Outsourced Confidential Data On Children Posted
Kataire writes "MSNBC exposes a grievous blunder in which an outsourced programmer posts highly confidential data to a public website, concerning the daily whereabouts of hundreds of children in upstate New York. Yes, this person did this not once, or twice, but three times, with two different data sets. Even worse, the data was out there, publicly 'visible' for months. Just because RentACoder finally discovered and yanked it, after a coder 'stuck with a tricky formatting issue' posted the specific database he was working on to their messageboards, doesn't mean the damage is undone. The ramifications reach beyond the painfully obvious privacy issues, touching on outsourcing and peer ethics."
Who do you trust? And who do you get to solve something like this?
Do you say, "Only certain government approved facilities can deal with this sort of information?" Seriously, should I feel that someone "government sponsored" is better off with my information than an outsourced programmer in India? Who gets to play Big Brother? And what will they do with what they know?
You can take this to the extreme, and be wary of anyone to handle private data about you. But then, if there's that sort of outcry, nobody would be able to handle it, would they?
I suppose it's better than having the Smoking Man from the X-Files having a file about you, and a blood sample. I find most programmers to have a certain level of professionalism to what they do.
I personally have access to roughly 10,000 credit card numbers. I'll never abuse the fact that I have access to them. But on the other hand, I'm not stupid enough to post all of them on the net for everybody to see, either.
I hope anybody who ends up doing something that stupid becomes a victim of identity theft. That'll really open their eyes to respecting other people's privacy.
By the way, I hate how everybody gets up in arms over the fact that this is data from children. This is horrible for ANYBODY to have their information posted on the net like this. And it could have been worse. It could have been a list of women tying them to the current Battered Women's Shelter they were staying at.
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
When you're looking to cut corners, be careful who you give the scissors to...
Obliteracy: Words with explosions
Talk of identity theft, damaged credit, and so on may not rile up the Soccer Moms of the world, but once something affects the children, watch and admire as their mouths begin to froth!
When you outsource, you run the risk that the individuals doing the work do not share your company or even cultural values. If you are not willing to take the time to make sure that your outside contractors are what you expect, this is the kind of thing that will happen. Few companies really understand this.
Floating face-down in a river of regret...and thoughts of you...
I have seen some people spread data via slashdot comments encoded with base64 and encrypted. (anyone have a link to a specific occurance - at least one time someone decypted it and posted it) Could slashdot be used as a way to anonymously leak information like this, and use slashdot's general policy of "just mod to -1, don't delete" towards comments as an advantage? Unlike other forums, posting anonymously leaves nothing but a MD5SUM of your ip to be used in court. Also, if you "post anonymously" while logged in, slashdot caches your username. You can verify if you have mod points by noticing that even when you post anonymously AND change your ip address, you can't mod up/down the comment.
Couldn't a "non-outsourced" developer make the same mistake? What does this have to do with outsourcing at all? Seems to be a very leading post to me, designed to generate the usual angry, anti-outsourcing replies.
All your favorite sites in one place!
I wonder if they've checked the wayback machine at archive.org.
One line blog. I hear that they're called Twitters now.
Rather than mod you down, I'll just let you (and all the other knee-jerks) know that THIS WAS NOT AN INDIAN PROGRAMMER. This was a guy named Mark Dennis. Not a very Indian sounding name. Also, Mark Dennis actually subcontracted the job involving the database out to someone in New Jersey. Maybe IHBT, but the article summary could make you believe this had to do with offshore outsourcing, so that's a misconception we should clear up early.
It should be illegal to say that freedom of speech should be limited.
However, in this case, all the outsourcing was within US borders, as is evident from the contents of the article.
Hunt your preferred prey at Aliens vs Predator MUD. Join the war at avpmud.com port 4000
First of all, the article is fanning the flames by saying this is a database of children's whereabouts. Okay, this is a problem, but then again it doesn't matter if its children or anyone, it just gets "oh please save the children!" sympathy clicks.
It also doesn't address what I think the biggest problem is. It's obvious to me someone assumed this bozo of a programmer had some not-so-common-sense about posting information to a website. I deal with customer data all the time, and my company has taken some steps to make it a little harder for people who should not need the data to not get the data, and our data exchange policy clearly states "Do not give this data to anyone outside of this company or you will be beheaded!"
I get to this day accountants in our company saying "why can't I peek at this customer's data" to which I reply "Do you have a signficant need? If so, tell your manager to talk to my manager, and I'll be happy to give it to you." I get nothing after that. The customer data we have is for support and development use, not an accountant who has no use for inventory and sales information (at least not in this company). It is also freely accessible amongst those people, who typically only share it within others in their department.
One day a manager might get an idea that looking at a customer's data might give them an idea of their open bills, but that might be unethical or illegal so until a manager says to give access, I won't.
My point is, it could be that the policy was not pounded into this dolt's head, or that a proper data exchange policy even existed. If so, he's still a dumbass, but companies frequently hire dumbasses, which is why you sometimes need a policy to help prevent dumbass behavior. The article puts full blame on the programmer and doesn't really give any blame to the company who hired him.
"All great wisdom is contained in .signature files"
You would not believe the sensitive information we receive. People don't even think about the ramifications when they send us, for example, somebody's high school transcript, or mortgage closing documents, or people's credit reports. We have secret inventory lists for competing companies, each of which would probably kill to get their hands on that information. We have "insider" information on the international banking industry. We have medical records. Prison records. It goes on and on.
Because of this, we have an extremely tight document policy. Data exists on paper only long enough for testing purposes, then it is destroyed. The bug tracking database is purged of old test cases on a regular basis. Customer files never leave this office, in paper form or otherwise.
In fact, as I write this message, I can think of several ways that we should probably be even more paranoid. Fortunately, the officers of the company take our responsibilities very seriously, and there has never been any serious breach of customer confidentiality. I hope there never is.
The programmer who posted identifiable information to a public web site, because he was too incompetent to solve his own problems, is an idiot who should be fired and beaten with a wicker cane.
Outsourced moderators, of course.
Guess my sig goes double now...
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
The fact is this person revealed details against their contract code and more importantly, if they are in this position they should have the moral/ethical decency not to do this.
Whether they were outsourced or not outsoured does not matter (IMHO) - they still have a personal moral/ethical judgement... FT government contractors are not great saviours, rather this individual is one with poor/sick ethical judgement (it is in no way 'freedom of speech' to disclose confidential/sensitive information about young kids).
I do not believe outsourcing creates a more or less trustworthy/moral/ethical situations/employees (well, they just have less benefits rights and more legal liability if somethinggoes wrong), it is the individual who makes a better individual and avoids being a piece of scum.
actually
1. It's bad to develop with real data, because you make assumptions about what kinda of data you have to process. You should unit test the code, by *trying* to break it by using known invalid formats or invalid data to ensure that your software handles such input inconsistancies gracefully. As in, the only way to be sure your software won't core, or fork bomb, or enter an infinate loop is to test it on test data, which should be created by the developer.
2. You're right about going live tho. You'd never go live with software before you QA'd it in the final go-around with the real data just to ensure you're not going to spend 2 hours upgrading a platform, and 2 hours backing out.
Neither of these points has any bearing on the fact that, as a developer, you will (most of the time) have/need access to the real data at some point, so it really is up to the developer and the contractor to set out rules for the usage of the data, and even to have the developer sign an NDA of sorts to put the accountability where it should belong.
What stories like this really highlight is the sorts of losses that can occur from outsourcing or contracting that dont often show up on a cost analysis of the project. The less control and supervision you have over your 'employees', the higher the likelihood that those employees may do something with their relationship with you that may damage the company. I've had numerous higher-ups in other companies pass me sensitive data just because they need something fixed as soon as possible, and they can't find the experience/ability in house, and I just think its a completely irresponsible way of conducting business. But if I did something dumb with that data, it wouldn't be my ass on the line, because I was handed that data with no legal documentation concerning how I can use it and what I can do with it. Then again, maybe lawyers might see that differently.
All I know is that when it comes to outsourcing, its usually a gain in labour flexbility and cost effectiveness at the expense of a higher risk for the disclosure of sensitive information, be it data or security rights. It's a cost that employers can willfully ignore if they so choose, but again, I think its just bad business practices. Full employees have a far greater vested interest in the success of their employer and are far less likely to do stoopid things that one-off contractees have been known to do. That is, full time employees are more likely consider the legal and financial implications of how they go about providing solutions for product development. Employers hate that to admit it, tho, because it highlites the downside of a their utopian flexible labour force in which there exists little job security for the people actually doing the gruntwork.
"Old man yells at systemd"
California has a bill designed to deal with these situations, though it's not clear if it would apply to this specific situation.
5 1- 1400/sb_1386_bill_20020926_chaptered.html
http://info.sen.ca.gov/pub/01-02/bill/sen/sb_13
The problem is that the bill is designed for data theft, not for dipshits giving it away for free. Nevertheless, the bill requires that consumers whose data has been stolen be notified through viable means - email, letter, public notice if they can't be identified. Fines to the company for not doing this and the person responsible for the data is open to civil action.
The main problem I see from the article is that the impacted individuals may not be notified, which is just wrong. Granted, this kind of thing probably can't prevented (minimized, yes, stopped, no) but there's a right way to address the problem and a wrong way. At least notify the affected people of what's happened.