Backup Tapes With 2 Million Medical Records Stolen

Lucas123 writes "A vehicle used by an off-site archive company to transport patient data was broken into on March 17. The University of Miami just made the theft public last week, saying the thieves removed a transport case carrying the school's six computer backup tapes. On those tapes were more than 2 million medical records. In fact, the archive company waited 48 hours before notifying the university itself. A University spokeswoman said the school has stopped shipping backup tapes off-site for now."

Comments

Easy case

[plover]

This case should be pretty simple to solve. Just track down whoever buys a 9-track tape reader off eBay in the next month and nail him to the wall.

Hmm.

[Ethanol-fueled]

From TFA:

After learning about the data breach, the university contacted local computer forensics companies to see if data on a similar set of backup tapes could be accessed. Menendez said security experts at Terremark Worldwide Inc. "tried for days" to decode the data but could not because of proprietary compression and encoding tools used to write data to the storage tapes.

Proprietary compression and encoding tools? the article reeks of FUD but proprietary technologies still aren't without their faults...but eh, it's not like they used this "09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0", right?

Re:Hmm.

[Anonymous Coward]

When questioned further, Terremark employees answered, "what's EBCDIC?"

Re:Hmm.

[cobaltnova]

Proprietary compressions and encodings: the poor man's encryption... Except that it costs a buttload

Re:Hmm.

[DigitAl56K]

Encryption is never mentioned, and I believe if there had been any encryption that it certainly would have been, and that they would not even bother having someone try to decode data on a similar tape.

Re:Hmm.

[cobaltnova]

Exactly. Had proper protocols been followed, the data would have been encrypted, and this would not have been a story.

Instead, they are checking if their encoding could be reversed, and thousands of patients information has been put at risk.

Re:Hmm.

[Thalagyrt]

Proper protocols are followed.

"IT Security has been asked that all departments and schools verify that all backup tapes being sent offsite are encrypted. Tapes being kept within the University must be stored in a secure location, if they are not encrypted. If any unencrypted tapes have been sent offsite, please contact IT Security or myself."

I've said it twice now, just figure I'll reply to people here. TFA is incorrect, our tapes are encrypted, not encoded.

Re:Hmm.

[cobaltnova]

I stand corrected. And feel much better about the world, too.

yes but what's the value

[goombah99]

Why would someone steal the tapes? What is there value.

Re:yes but what's the value

[Z00L00K]

As usual - computers will be of value for anyone needing money for drugs. To a drug-addict that means that tapes must have some value too.

Re:yes but what's the value

[Jhon]

Why would someone steal the tapes? What is there value.

What would YOU pay for 2 million social security numbers?

Re:yes but what's the value

[WaltBusterkeys]

Why would someone steal the tapes? What is there value. From TFA: The stolen backup tapes hold names, addresses, Social Security numbers and health information

On the black market these days, a full identity (name, SSN, address, bank information, etc) can go for $14 each. If the tapes had full identities, that's 2 million x $14 = $28 million payday for a bunch of crooks. Even assume a "volume discount" for these guys and they're still in the many million dollar range. Even if it's just name, address, and SSN there's some value on the black market for these tapes.

When you're breaking into a vehicle filled with stuff that looks like computer equipment, it's hard to know whether the data is going to be social security numbers (valuable), credit card numbers (valuable), medical records (valuable if there's addresses and SSNs), or routine corporate records (not all that valuable). Enough data brokers are sloppy enough with their security that there's a good chance to get some identity information that has value.

These guys were either extremely lucky or knew exactly what they were doing. Or they're complete idiots who are wondering why these tapes won't play on their 8-track player.

Re:yes but what's the value

[Safiire Arrowny]

I wouldn't.

Re:yes but what's the value

[Digestromath]

Not to mention there is also the potential for blackmail. If anyone on the tapes has a serious, publically undisclosed, and socially stigmatic medical condition its ripe.

For Example: Alot of people don't want to publically share that they have STDs etc. Especially not if the files are cross linked with a list of their sexual partners.

While sale for identity fraud would most likely be the most profitable, there are alternative uses for this data. Given the enterprising nature of most criminals, this is a gold mine.

Re:yes but what's the value

[pclminion]

Among things mentioned by others, it enables you to blackmail people who have sensitive medical conditions they don't want the whole world knowing about.

Re:yes but what's the value

[Anonymous Coward]

from TFA: They are encrypted

Re:yes but what's the value

[Anonymous Coward]

LOL it's a very geeky drug addict the one that is able to turn a profit from stealing computer tapes.If he knows what they are, he knows they are next to worthless, if he doesn't know what they are, he's a crazy bum whose survival in the street is a miracle: who is going to give him money for random "garbage".

The key is obviously in the content of the tape.
There are too many precedents.

Re:yes but what's the value

[Anonymous Coward]

I wouldn't buy a stolen rolex for 30$ either, therefore no stolen rolex is ever resold.
Awful logic isn't that?

The correct question is: how much would you pay for 2M medical records if you were in the insurance business?

Re:yes but what's the value

[eldorel]

The exact same thing happened at Louisiana State University in sept of last year.
That time it was the fasfa records for the entire school.

I'm actually starting to get a little bit suspicious that there is a pattern forming.

I started to try and compile a listing of backups, laptops, Usb keys and hard drives stolen from universities, but the listing quickly grew beyond what I would like to post on slashdot.

Instead, i'll just post a site that has most of them listed already. Just do a search for the word UNIVERSITY.

http://attrition.org/dataloss/

Re:yes but what's the value

[Anonymous Coward]

Doubtful it's worth that much. Usually bulk items like this go for much-much less because it was stolen all at once. I bet someone could get hold of the whole thing for $5k or so (maybe even less).

Re:yes but what's the value

[Anonymous Coward]

Or they're complete idiots who are wondering why these tapes won't play on their 8-track player.

If they are wondering why a 9-track tape won't play on a 8-track player, they are complete idiots for other reasons. A 9-track tape drive might be the "proprietary compression and encoding tools" described in the article.

Re:yes but what's the value

[BoRegardless]

Well after the "complete idiots" who stole the tapes read Slashdot, they know know they hit the jackpot.

Gotta be a lot of retired mainframe guys around who would "do a consulting job".

Re:yes but what's the value

[Thalagyrt]

I work for the University of Miami. These tapes will be entirely useless to anyone who snags them, and no, we haven't stopped off-site shipping. All of our off-site tapes are highly encrypted. We aren't idiots.

Re:yes but what's the value

[Crudely_Indecent]

The last time I bought tapes (SDLT2 600GB tapes) they were $80 each. $80 x 6 = $480

Beyond that, the value depends on how resourceful you are. If it were me (running across tapes..not stealing them) I'd spend some time getting to know the data involved. Then, I might start investigating parties who might be interested in that data.

Your average car thief doesn't have the skills or the thousands of dollars of equipment necessary to really utilize that data.

If I had to guess...the case was sold (if it was a nice one) after the thief threw the tapes in a dumpster.

Re:yes but what's the value

[SavvyPlayer]

$0.00, before court, legal fees, etc.

Re:yes but what's the value

[Cramer]

We aren't idiots.

That has yet to be proven. If the tapes are encrypted and thus unreadable outside the university, why is the theft even being announced? The data is no more at risk today than last week. Publicity? Scare tactics? Bad press for the off-site storage company? An attempt to shame the theives into returning the tapes?

*Still* no encryption??

[DigitAl56K]

There needs to be a law regarding data encryption. Virtually every time data is stolen, be it on CDs, laptops, backup tapes, missing hard drives, and so forth, it is not encrypted. In fact, I can think of only one case that has made press in the last 4-5 years that I can remember encryption being used to safeguard the data.

Transporting confidential data off-site via any medium, including the Internet, without industry-recognized encryption (not something that is proprietary and untested) ought to be a criminal offense with severe penalties.

TFA talks about proprietary compression and encoding and not about encryption. I simply do not believe that it is difficult to recover that data - whatever proprietary software wrote those files can be obtained from somewhere for a price. You can probably Google the file extension or some information in the header to determine the format and/or software.

"The university feels confident that the person who took [the tapes] doesn't know what they have." They do now!

"Even though I am confident that our patients' data is safe, we felt that in the best interest of the physician-patient relationship we should be transparent in this matter." That data is not safe. At best it is in an obscure, but not secure format.

It's incredible, really. Since TrueCrypt 5.0 arrived,I don't even carry my work laptop or flash drives around without either full disk encryption or encrypted container files on them, and they do not contain anything as sensitive as 2 million medical records.

Re:*Still* no encryption??

[WaltBusterkeys]

You can probably Google the file extension or some information in the header to determine the format and/or software. Not everything is on Google. If we're talking tapes, we're probably talking old mainframe-level systems. That means the problem might even be at the level of accessing the tape at all. The data coming off the tape is still just a string of ones and zeroes to them.

This isn't a question where they've got a file sitting on their desktop called "Data.abx" and all they need to do is figure out what program creates an ".abx" file. In all likelihood, there's an old custom or semi-custom mainframe system that wrote this to the tape that didn't format in FAT32. (Nor would it make sense to even both with a filesystem on this type of backup system -- you're not backing up files, you're backing up a database.) From looking at a stream of data dump, there's no way to immediately make sense of it. If there's no file headers, there's not as much of a clue as to where to start. It just looks like an endless string of hex (2 million records is a lot of data).

Somehow I doubt that this is just an Access file, sorry. Or even a SQL dump. They're not complete idiots.

Re:*Still* no encryption??

[DigitAl56K]

If we're talking tapes, we're probably talking old mainframe-level systems. Thats a bit of a supposition. How long has it been since tape drives hit the mainstream for large backups on cheap media? A really long time!

Why would you still use antiquated mainframes for your backups, particularly if it's 2 million records? If something happened at your site you'd need a similarly antiquated mainframe just to get your data back. That makes very little sense.

Re:*Still* no encryption??

[Xtravar]

Somehow I doubt that this is just an Access file, sorry. Or even a SQL dump. They're not complete idiots. Chances are, since it's a health system, it probably uses a post-relational database, typically of this variety: http://en.wikipedia.org/wiki/MUMPS

Which means the file format could be anything...

I'm just glad they're not our customer. 8-)

Re:*Still* no encryption??

[gedhrel]

If they're shipping tapes regularly offsite to external storage, those aren't old reel-to-reel tapes, which is what you appear to have in mind.

LTO4 includes on-tape encryption as part of the spec.

These'll be modern tapes (which are still very much in use).

Re:*Still* no encryption??

[apathy maybe]

I knew that I would see a post saying something like this.

Yes encryption is a great thing and should be used all the time, especially on laptops. Well actually, there is one time when it *shouldn't* be used (or at least, not automatically). Want to know when that is?

For backups. Want to know the easiest way to render your carefully planned backup system useless? Forget the password for the system and not have another way in.

Oh sure, they could just write down the password (which is a good option often), but the point is, that encryption should not be automatic when making backups.

Otherwise yes, you have a point. Transferring data offsite should be encrypted. Physical security is good too, and in this case would have been more important.

Re:*Still* no encryption??

[stephanruby]

Not everything is on Google. If we're talking tapes, we're probably talking old mainframe-level systems. That means the problem might even be at the level of accessing the tape at all. The data coming off the tape is still just a string of ones and zeroes to them.

Actually, this is not rocket science.

You could hook up/jerry rig any tape player that's remotely close to the backup tape in question, in terms of size and reading area of the magnetic head (the magnetic head could be bigger too), the rotation speed of the tape wouldn't matter either (it would be corrected for after the fact). The tape player would need a serial output, a headphone jack or a usb jack would work (although, for the usb connection you'd need to google for instructions to select the right pins to insert into the right holes of your serial input port).

Now if you were to hook up this tape player to a speaker, and could slow down the speed of the tape slow enough, this series of ones and zeros would start sounding like an audible pulse.

But you wouldn't need to go that far. On a Windows PC, you have HyperTerminal. On a Mac, you have Zterm. On the unix flavors, you have something else (I forget what it's called, but a scripting language should be able to do the trick for you if you just listen to the right device on the right port with the right library). With your terminal software, you will be able to tune it to the right data rate (the data rate is essentially the same thing as the timing of each pulse).

Then don't be surprised if you get to see a big dump of ascii text right in your terminal window. Also, if you examine the first bytes that come your way, don't be surprised if the parent poster was right about the header information. In the vast majority cases, it will give you the right header information right off the bat.

However if you still only see non-ascii gibberish on your terminal window, it will mean it's still in binary format, and the header information doesn't pan out (which will only happen a minority of the time). Then there is always WireShark (formerly Ethereal), that you can always google around for some screencasts on learning how to use it (youtube should have something too). WireShark will be able to infer a lot. And unless the data backup was encrypted (which is technically what they were supposed to do) then WireShark should be able to read some of that data successfully.

Re:*Still* no encryption??

[asc99c]

Lots of new mainframe level systems still use tapes. Many customers prefer tape drives for backup of any sensitive data - it means that you don't have to put the systems on the open internet to get offsite backups done. While tapes aren't the most robust medium for constant access, it's a very good format to write to and throw into a store room for backups.

Remember also hardware-wise, tape is still a pretty interesting format. LTO currently uses 800GB tapes with 1.6 and 3.2 TB versions planned. The 120MB/sec transfer rate is much quicker than network backups. It's also much quicker than backups to CDs/DVDs and even matches the speed of top-end hard discs.

I'd hope it's not an Access file, but my guess is that it quite possibly is a database dump from something like SQL Server / Oracle / Informix.

Re:*Still* no encryption??

[stephanruby]

LTO4 includes on-tape encryption as part of the spec. These'll be modern tapes (which are still very much in use).

Forget my previous post, if this university was located in my jurisdiction, it may not even be legally required to notify anyone about its loss (although, I couldn't be sure about that since I do not work in a Medical field). So please, someone chime in if you know about that.

Re:*Still* no encryption??

[jimicus]

Why would you still use antiquated mainframes for your backups, particularly if it's 2 million records? If something happened at your site you'd need a similarly antiquated mainframe just to get your data back. That makes very little sense. Three reasons:

1. It works.

2. IBM (assuming they are using IBM kit) mainframes are still being built today, and while they're totally different internally to the systems of 30 years ago, they're still compatible.

3. This is what companies like SunGard and IBM (yes, they have a DR consultancy team) specialise in. You tell them what equipment you'll need in a disaster recovery scenario, they agree to loan it to you. In which case, who cares how old the system is?

Re:*Still* no encryption??

[jimicus]

I knew that I would see a post saying something like this.

Yes encryption is a great thing and should be used all the time, especially on laptops. Well actually, there is one time when it *shouldn't* be used (or at least, not automatically). Want to know when that is?

For backups. THANK YOU. I'm glad I'm not the only person who thinks this.

The backup software I use (http://www.bacula.org - a fantastic piece of work) does have the facility to encrypt everything.

But I've considered the risk to the business in the event of tape loss versus the risk to the business in the event that we can't decrypt the data because for whatever reason the office has burnt to the ground and the offsite copies of the keys aren't recoverable.

I concluded that if it's a choice between explaining a lost tape and explaining the fact that I have the tape but the sun will have burnt itself into nothing before anyone can read it, "oops, I lost the tape" was easier to explain and rather less likely to result in the business going to the wall.

Re:*Still* no encryption??

[ErroneousBee]

Do you inform your customers that their data is shipped to remote sites unencrypted?

Yes, failure to restore due to password loss is a risk, but then so is data escape.

Having identified the password issue, you need to have a scheme to protect against password loss, particularly long-term backups. Just not encrypting replaces one problem with another.

Re:*Still* no encryption??

[mwvdlee]

If we're talking tapes, we're probably talking old mainframe-level systems.

Tapes are still the norm for large-scale backup.
Unless you still consider GB-sized files to be "large" ofcourse, in which case other technology might suffice.

Re:*Still* no encryption??

[urcreepyneighbor]

They're not complete idiots. Famous last words. :)

Always assume the person is a complete idiot, unless proven otherwise.

Re:*Still* no encryption??

[jabuzz]

I would add to this that every enterprise backup system that I know of has had the ability to encrypt the backup for ages. It's number six on the Tao of Backup, and that is 11 years old.

If the contents of your tapes are encrypted it matters not if they go missing.

Re:*Still* no encryption??

[jabuzz]

Assuming it is an IBM mainframe, it will be LTO or 3952, anything else and it might also be a DLT/SDLT variant. The market is rapidly converging on LTO, and the latest iteration LTO4 offers on drive encryption of your data. As has any decent enterprise backup software for like a decade.

Nobody uses 9" real to real tapes these days.

Re:*Still* no encryption??

[Anonymous Coward]

I bet many of the companies just don't report loss of encrypted data in the first place (it was encrypted so they can't recover).. Thats actually worse in some ways since we can't tell if they used a good password or not. Better than not reporting non encrypted data, of course.

I guess there should be a rule like "you can not publically report the loss iff your data was encrypted according to NIST standards and as long as you privately report". The small loss of security would be worth the vast gain..

Re:*Still* no encryption??

[Chris Mattern]

They're not complete idiots.

We believe they may be lacking some critical parts.

Re:*Still* no encryption??

[Chris Mattern]

You have a very good point. I would say that backups that stay in the data center and are just shelved back in your tape vault should *not* be encrypted. Backups that go outside the high-security area of your data center or pass into the hands of people who shouldn't be reading them (and your off-site storage people may be trusted to hold your backups, but they still have no business reading them) need to be encrypted.

Re:*Still* no encryption??

[Anonymous Coward]

If we're talking tapes, we're probably talking old mainframe-level systems.

Really? How else do you back up your windows servers? Burn to DVD? Haha.

My company has a number of LTO-4 tape drives - they hold 800 gigabytes (uncompressed) and are faster than most hard disks. They also support native AES encryption.

Re:*Still* no encryption??

[The Second Horseman]

Ok, so, let's say you've got a regulatory requirement to keep certain records for a long time (medical records are a good example of this). And you've got to guarantee that you can recover them no matter what. Even if the hospital is reduced to a smoking crater, or the actual company that made the backup software (or encryption software) went out of business 20 years ago. You could have a problem with conflicting regulations. You also have to factor in everything that could go wrong with the encryption system (either hardware or software based) as part of your disaster recovery plan. That's fine in the sort term, but ten years out, 20 years out, that's difficult. I'm not saying they shouldn't try, I'm just saying (having had to even worry about this a little, as well as talking to folks who have worked in healthcare) that it's not always as easy as you'd think, due to technical, budget and regulatory reasons. One way around this, of course, is to treat archiving / records retention as a different problem than backups / disaster recovery (which it is) and make sure you're using the right tool for the job. A lot of legacy systems make that split more difficult. Laptops, I agree, there's not really an excuse.

Re:*Still* no encryption??

[filthpickle]

I work for an insurance claims clearinghouse. The company I work for takes the HIPPA laws very seriously. One big mix up with patient data and no matter how good you are nobody will want to use you.

2 million lost records is a lot, so just about any company would be compelled to own up to it...and they really aren't at risk here since they didn't knowingly or recklessly (geek level arguments about data transport aside) release the data.

Since they didn't technically violate any HIPPA laws, I don't think that they are required to report it to anyone. You can check for yourself http://www.hhs.gov/ocr/hipaa/

I can also tell you that by their own admission, HIPPA enforcement is complaint driven, they don't do anything until someone informs them of a violation.

Re:*Still* no encryption??

[rampant_gerbil]

There are laws regarding data encryption, at least when it comes to PHI (personally identifiable health data). I work with health data every day, and we encrypt the hell out of everything because of HIPAA.

The reason you don't see more press articles about encrypted data being stolen is that companies are not required to announce incidents to the press provided that the encryption is strong enough. My company encrypted all our laptops nationwide precisely so that if one goes missing, we're not obligated to call a press conference and jump into a shitstorm like this one.

Re:*Still* no encryption??

[budgenator]

HIPPA is the 800 lbs gorilla in healthcare IT and I believe that unauthorized release of identifiable medical data is a $50,000.00 fine; I'm not sure if losing backup tapes with 2 million records is one release or 2 million releases! I expect lawyers to get rich on this one when it goes class action, that's when everybody on the tapes will get notified.

Re:*Still* no encryption??

[tfiedler]

What, you never see a tape? Tapes are still the primary backup destination for almost all data. We don't have a mainframe, haven't in a decade but we still use tapes. Even though we may go to disk first, our ultimate archive destination is tape and will remain so for a significant period of time. Anyone that think tapes=mainframe isn't a geek, they are either naive or stupid.

Re:*Still* no encryption??

[Anonymous Coward]

How the hell is this even close to "Interesting"? If anything, it's horribly ignorant!

Tapes are used widely for off-site data retention, not just for mainframes. Sure, home users have shied away from the popular Travan style tapes of not so long ago, but large installations with complicated data retention schemes will most certainly still be using tape today.

Tapes are STILL cheaper and more reliable than hard drives for off-site storage. Tapes can withstand a wider range of environmental conditions, not subject to failure from static discharge, and can be respooled in the event the physical tape unit is damaged.

Re:*Still* no encryption??

[PapaZit]

Consider the relative difficulty involved in sending an occasional tape to your offsite facility that's clearly labeled "backup decryption keys".

You're using the same facilities that you trust for your other backups. Recovery is relatively straightforward. Only now, if a tape goes missing on its way to the facility, you don't have to worry as much.

(Yeah, I know that some of you send a dozen tapes to different facilities guarded by warring factions of ninja assassins and you encrypt your encryption keys such that 9 different people have to authenticate 9 different sub-keys in order to reconstruct the master key. I'm not talking to you. I'm just saying that some encryption to protect against random idiots is better than none.)

Re:*Still* no encryption??

[DarkOx]

Not to mention anyone who has worked with tape knows its not usually the most reliable media. One of the main reasons your rotate through multiple backups is because you exepect unrecoverable CRC errors and like from tape. You go to your next oldest set and pull whatever file/files/database you could not get from the bad set of tapes and pull that from there. When you do major upgrades or equipment moves where the expectation of needing the backup go up good admins will want the prior two backups in the roatation to be done on newly out of the shrink wrap tapes.

This is where consideration needs to go into encryption as well. Encrypting things at the archive level will be extreamly risky because errors might make the entire tape impossible to decrypt! You better make sure you are using some sort of sector level or on drive encryption and understand it if your are going to do that. The same goes for any type of compression, you want to compress individual units of data and then stream them into the archive, rather then compress the archive stream so that a few errors don't render the entire thing unreadable.

In most cases for a backup(which you as the admin control or should) I for one think its best to maintain good physical security around the tapes while they are onsite. Drive is in your locked datacenter where the only people who have access to the tapes have root level access to the systems being backed up any way. Then you hand them to the offsite storage guy yourself. That guy works for a company that is bonded and has agreed to be liable for any breach if those tapes are stolen or lost while in their possession. They should be asking you to sign a form when they take the tapes from you and when you bring them back. You should get carbon copies.

Now you would hope they have good security in place, but if they don't its there problem not yours. They are going to be responsible if those tapes go missing.

Re:*Still* no encryption??

[Thalagyrt]

All of the university machines have full drive encryption on them using, you guessed it, TrueCrypt. The drives will look like garbage to anyone who sees them.

The data put on our tapes is fully encrypted, and on top of that encoded with wtfever our tape backup system uses.

Re:*Still* no encryption??

[rebelcan]

Nobody uses 9" real to real tapes these days. That's because the tapes to backup anything more than a few hundred GB is ridiculously expensive. At my work we were looking at getting a tape backup system, but decided against it because the tapes are way too expensive.

Re:*Still* no encryption??

[rebelcan]

Yeah, 1.6TB is nice for a backup solution, but those drives are probably going to be priced way out of range for nearly anyone who needs that kind of storage. Seriously, when you compare the pricing for hard drive/ram/any other storage media to tapes, it's pretty ridiculous.

Re:*Still* no encryption??

[dosguru]

There is actually a good chance this is oracle data or MS SQL. I work for a F100 company doing backup and storage, and most of our data is not mainframe based. However, the way modern tapes interleave data, compress it, and break it up across tapes, it does make it hard to read back if you don't know which of the five or six enterprise backup software companies made the backup or the order of the data. For all of you disk backup fanboys out there who don't work in the trans-PB world, it's hard and very, very expensive to keep the 1.5PB of backup data I have on disk or replicate it somewhere. 500GB 120MB/s tapes are still the cheapest storage for most backup data. For all you 'green' people out there, tapes are way more power effective than spinning thousands of 15K FC or 7.2K SATA drives.

As for why everyone doesn't use encryption... imagine the cost of converting several PB of different technologies and ages to use encryption and then be able to read it back in the seven, 30, or infinite years the government or lawyers require us to keep some records. It's a many-multi-million dollar problem with no good solution.

Re:*Still* no encryption??

[firewood]

Print the keys out on paper and stick them in a fire proof safe, taking copies to a bank vault far offsite well before shipping a set of backup tapes using that key. It's not like even a 4096 bit key takes more than a page.

Re:*Still* no encryption??

[dot45]

What do you mean, you can get an Ultrium2 tape that holds 200Gb native/ 400Gb compressed for $45 each, how is that expensive? Tapes are more reliable as storage media than hard disks, although with holographic discs coming out, they may no longer be the media of choice.

Re:*Still* no encryption??

[Anonymous Coward]

What realistic environmental conditions will destroy a stack of parked drives (but not a stack of tapes)? They're all shipped and stored in bulk with nothing more than an anti-static bag and a sachel of silica gel, and nothing seems to go wrong.

LTO-3 tape has a price advantage right now but it's under 20% ($43/400 GB vs. $100/750 GB for disk) so you have to buy at least 123 tapes (49 TB, $5289) just to break even on the $1,275 drive you need to read the damn things. And you really need to keep a second known-good drive on hand because LTO-3 will inevitably become obsolete in a few years (while SATA and EIDE controllers will remain available for a long, long time).

Makes me wonder why nobody is offering a reasonably-priced modern archival medium. If I only take a 20% price hit for bundling a new SATA controller and two motors in every backup I make, something is seriously wrong with the market.

Re:*Still* no encryption??

[stephanruby]

HIPPA is the 800 lbs gorilla in healthcare IT and I believe that unauthorized release of identifiable medical data is a $50,000.00 fine; I'm not sure if losing backup tapes with 2 million records is one release or 2 million releases! I expect lawyers to get rich on this one when it goes class action, that's when everybody on the tapes will get notified.

But that's the point, that tape they lost was encrypted (apparently to a high enough level). The contingency plan was this encryption. The system looks like it worked. And it really doesn't look like any lawyer/crook will get rich on this one.

Re:*Still* no encryption??

[Cramer]

EMC/Legato Networker doesn't, or didn't for many years -- current versions made in the last few years might.

Just because your data is "encrypted" doesn't mean it's safe. The encryption could be laughablly weak even when the company claims it's AES. Your password(s) could, eventually, be guessed (or stolen as well.) Etc. Etc. Bottom line, your data is never safe forever.

Didn't know ...

[Rhabarber]

The university feels confident that the person who took [the tapes] doesn't know what they have....

Ah, and how exactly does it make sense that you just told the world? (Not that I did beleve you in the first place.)

Re:Didn't know ...

[owlstead]

Well, now they do...

Why-O-Why?

[BlackHole Basement]

Can these hospitals not be able to use armored vehicle services, such as Brinks, to take these tapes to a bank with safety deposit boxes?????
What would be so hard to set something up like that for any of the states VIP information storing?
I'm getting a little sick and tired of the lowest guy/girl on the totem pole who is in charge of delivering off site critical information and losing it. Ok, I'm done!

Re:Why-O-Why?

[DigitAl56K]

All they need to do is create a TrueCrypt container or the like and write the data to be backed up into it before copying it to the archival medium. Then you don't need an armored vehicle, or even a stun gun. You could literally walk down the street with a disk in your hand inviting people to steal it, because it wouldn't matter at that point - the data is secured to such a degree that it is questionable whether even the government could access it. Of course, you wouldn't handle the archive that way regardless, but I would not care so much if a disk containing my details was lost if it was encrypted with AES/256-bit key and upon investigation a reputable agency (i.e. the FBI) released a statement saying that the passphrase met certain standards for data security.

Re:Why-O-Why?

[Anonymous Coward]

I'm getting a little sick and tired of the lowest guy/girl on the totem pole who is in charge of delivering off site critical information and losing it. Ok, I'm done!

The reason it keeps happening is because of a scheme where a higher-up appoints a minion to move sensitive data, then arranges for it to be stolen and sold off to identity theft rings. It looks like an accident, the unfortunate delivery boy gets canned, the higher-up gets an official slap on the wrist, and collects a smooth several hundred $K on the identity black market. Don't ask how I know.

Re:Why-O-Why?

[BlackHole Basement]

All they need to do is create a TrueCrypt container or the like and write the data to be backed up into it before copying it to the archival medium. Then you don't need an armored vehicle, or even a stun gun.

That's just it. It's becoming very mind numbing knowing that, to this day, after several "oooopppssss", this is still happening with hardly any use of encryption, especially at the health care level. I really am wondering why there are not any protocols setup with use of encryption in mind?

If encryption protocol is too complex, then why not use armored vehicles during their normal money pickups and drop them off into the companies safety deposit box within the bank?
Information is just wayyyyy too valuable to leave on the seat of any car.... IMO.

Re:Why-O-Why?

[zippthorne]

I imagine the armored car companies refuse to transport them: the tapes are considerably more valuable per volume than anything else in the truck, and may be more valuable than the entire truck (if it's transporting mixed bills, for instance)

It might be that the armored car companies don't want to increase the profile of their trucks that much. The security is designed to make attacks more costly than the contents, which is defeated by transporting things of too significant a value.

Re:Why-O-Why?

[zippthorne]

It's a tape backup. they don't even need truecrypt. They could just pipe it through openssl.

Re:Why-O-Why?

[The Second Horseman]

Yes, in fact, you can. I know of one data destruction company in NJ that will work with Dunbar Armored and can transport stuff from most areas to their facility. However, that type of transportation could be well beyond the budget of many organizations.

Re:Why-O-Why?

[budgenator]

The Hospital would rather hire a licensed, insured and bonded contractor that is responsible for picking the tapes up at the Datacenter door and delivering to the Datacenter door when needed. This fuck-up is probably Archive America Ltd's responsibility by contractual agreement and they aren't some fly-by-night newbie but an established company with lot's of experience in the field so pleading ignorance isn't going to work for them.

Do not panic

[Psychotria]

A University spokeswoman said the school has stopped shipping backup tapes off-site for now." Well, I am sure that makes everyone sleep a little easier tonight--it's obviously all under control.

Re:Do not panic

[Anonymous Coward]

If anyone has a gripe with the University - now's the time for that firebomb attack since they're not backing up offsite ;-P

(i'm only posting anonymous as I can't be bothered to register - this isn't a pre-emptive confession!!!)

$ 100,000.000

[Rhabarber]

Not to mention the fact that those records might be worth more than $100,000,000 on the black marked.

Re:$ 100,000.000

[Rhabarber]

And again /. ate my reference. I know that is why they invented the preview button.

Re:$ 100,000.000

[maxume]

If some joker tried to sell $100 million of stolen information yo someone with the resources to buy $100 million of stolen information, they would end up dead, not rich.

Hell, the very availability of that much stolen information would destroy its value.

Re:$ 100,000.000

[Rhabarber]

Hmm, in case they make sense of the raw data they could mine it a bit. Most of the records will be quite useless (common diagnostics on common people). Some might be more interesting and worth more money.
Eventually fatal diagnoses you probably can (indirectly) sell to the live insurance marked. There _is_ a black marked in that area.
With records on celebrities go for classic blackmailing.
I'm sure a trained criminal mind can think of many more possibilities.

2 million records, or people?

[pclminion]

The article is very careful to phrase it as "2 million medical records." I somehow doubt that this means the medical records of 2 million separate individuals -- if it did, surely the news outlet would have said so, as it is much more dramatic. I bet a "medical record" is a single row in the database, and what was really stolen was a DB with 2 million records (as in "rows") in it. I seriously doubt the medical records of 2 million people are all collected on a single set of tapes.

Re:2 million records, or people?

[networkzombie]

Probably right. TFA mentions "all patients at university medical facilities since Jan. 1, 1999" and "Financial data from approximately 47,000 people". The University would need over 18,000 patients per month to have two million patients over nine years. That's a lot.

As far as proprietary encoding goes, that data is owned. If it's Windows just start with Arcserve, Backup exec, etc... If it's UNIX just start with cpio, tar, dump, etc... The big question is why the vehicle was parked with the tapes in it.

I like the part where TFA states "we're not transporting anything until we conduct our own internal evaluation of the incident and see if there's anything that could have been done differently or better." I wonder how long it will take them to come up with "Don't park the van at the Cheesy Burger." (Idea stolen from previous post).

Re:2 million records, or people?

[MichaelSmith]

If it's Windows just start with Arcserve, Backup exec, etc... If it's UNIX just start with cpio, tar, dump, etc... Strings

Re:2 million records, or people?

[palewook]

Whoever had the hardware sitting in a car, needs to be fired and then sued by every person affected.

Re:2 million records, or people?

[e9th]

The Jackson Hospital System is Miami-Dade county's public health care system, and is U of M's teaching hospital. It could easily have treated 2 million individuals over 9 years.

Re:2 million records, or people?

[Anonymous Coward]

Bullshit, I work at a hospital that sees over 18,000 people per year, and we're a small hospital.

Re:2 million records, or people?

[networkzombie]

Do you mean 18,000 patients per month is impossible or that because you are a small hospital, a large hospital could do 18,000 patients?

Still want your medical records to go digital?

[sweet_petunias_full_]

It was only a matter of time before something like this happened.

Medical staff and any other people untrained in information security just aren't going to have the computer literacy or "computer common sense" to handle millions of peoples' medical records adequately.

On the other hand, if they were thoroughly trained, certified and passed through the wringer for those leet skillz, then the overhead for medical costs would balloon even higher as yet another bureaucracy (to manage *that*) is created within health maintenance providers.

But it's all in the name of tracking your every move, so I guess it's OK.

Even better

[Psychotria]

"The university feels confident that the person who took [the tapes] doesn't know what they have. Even if they do know what's contained inside, it's very difficult to extract that information," remarked Menendez. I am sorry Menendez, but difficult for who exactly. Your school is not unique, nor is it the pinnacle of knowledge (no school is). If we could decrypt things 50 years ago, how is a "compression" method hard to work out?

Re:Even better

[Anonymous Coward]

Did they even mention once in the article that the data was encrypted? I am guessing they just had their own custom format they were using. Not that hard to decode if you knew what you were looking for.

Re:Even better

[Psychotria]

You're saying the same thing as me. Compression can be viewed as a weak encryption (and a relatively easy "encryption" to decode).

Re:Even better

[MMC Monster]

And if it's worth 20+ million (at $14 per identity * 2 million individuals), I'm sure they can rent the help of some black hats to help them decode a tape from a proprietary system.

My new data security plan.

[Digestromath]

Physical Security: Lock the damn doors to the van when you leave it parked outside the Cheesy Burger.

Multi key, multi volume encryption: Lock each of the tapes in a different cabinet in the van, each with a different key.

Security through obscurity: Remove large sign on van reading "Secure Data Transport, 'Transporting your valuable data since 1991'" replace with "Flowers By Irene"

Introduce comprehensive staff security training: Hold their families hostage, and tell them that if they lose the data...

Re:My new data security plan.

[bev_tech_rob]

You're joking, right? These couriers probably visit over 100 different businesses each day loading up with boxes of tapes and printouts for storage and/or destruction. You can't possible think that the courier's driver, being paid a little over minimum wage; is going to take the time to sort out tapes and put them in different bins. They grab the boxes, throw them in the back of the van and move on to their next stop.

The customer of said courier needs to make sure that sufficient encryption is in place on their tapes in case of loss or theft.

Re:My new data security plan.

[Cramer]

These sorts of things can easily be reduced, if not completely stopped, by having one person in the van at all times.

Having worked for the NCDOT I can tell you, the mere presence of another person is enough to quell the theiving instinct in 99.9% of people.

Re:My new data security plan.

[matuscak]

Better yet, de-duplicate the data and then replicate it over a WAN connection to a remote site. No tapes to go missing or bad, no waiting for media to get driven around. To quote a Data Domain ad: "Tape Sucks".

Old school

[LoudMusic]

Tape is so last millennium. Anybody who's anybody backs up to hard drives across the internet.

Re:Old school

[houghi]

Backup across the the Internet is last millenium as well:

Only wimps use tape backup: _real_ men just upload their important stuff on ftp, and let the rest of the world mirror it ;) Torvalds, Linus (1996-07-20).

Re:Old school

[PoisenLoaf]

..unless you have hundreds or thousands of TB of data to protect then tape is far less expensive. A $80 LTO4 cartridge these days holds 800GB and depending on hardware compression you could get 2-3x that on a single tape.

Encryption?

[deke_kun]

If the IT staff are worth their salt then these backup tapes wont be worth anything. Anything that is in danger of being stolen should be encrypted.

I work in Health IT, and it is standard practice for us to, at a minimum, GPG encrypt any backup going offsite. Infact a practice cannot pass accreditation unless this is the case.

If this wasn't the case in this situation, then all parties involved need to have a serious think about what they're doing.

Re:Encryption?

[tfiedler]

GPG, really? Where do you work? I kind of doubt you really work. Kind of doubt you work with any real health IT systems. Kind of hope I don't have any records at any place you might work too.

Re:Encryption?

[qzulla]

Poster actually meant GPS. I use it all the time.

qz

Re:Encryption?

[deke_kun]

GPG. I don't quite understand your troll...

Crooks hoping for physical, got useless tapes

[spineboy]

More often than not, homeless people, and petty crooks just steal AYTHING out of cars hoping to get pennies on the dollar for whatever they stole. A nice looking, shiny case was probably thought to have some nice stuff in it, other than tapes. I bet the tapes are in some sewer drain or dumpster by now, and the case is being pawned for 5 dollars.

Re:Crooks hoping for physical, got useless tapes

[Cramer]

Actually, I bet they're on eBay right now. LTO/SDLT tapes will net a tidy sum -- even for a half dozen tapes. And the case could be worth hundreds -- nobody has given a detailed description of the "transport case"; it could be a 20$ plastic turtle case. It's almost impossible to track down a stolen data tape. (raise your hand if you record the serial numbers of your tapes.) The data on the tapes will almost certainly be unrecognizable junk, assuming the theives have one of the $2k drives (stolen?) necessary to read them at all.

Didn't mean to imply all homeless steal

[spineboy]

Just stating that some people, desperate for cash , might steal anything. Obviously there are plenty of homeless who are law abiding citizens, just down on their luck.

Re:Didn't mean to imply all homeless steal

[Anonymous Coward]

Just stating that some people, desperate for cash , might steal anything. That's human nature and certainly not limited to folks who are unlawful by nature. Extreme poverty does strange things to one's mental psyche.

Obviously there are plenty of homeless who are law abiding citizens, just down on their luck. Been there done that, I got a 6 figure job out of a homeless shelter after an extremely bad run of luck and poor decisions on my part.

Many homeless people are evil, but not all.

Who waited how long?

[Skapare]

Let's see here. Archive America waited 2 days. Then the university waited 27 more days. Who needs to do the most explaining?

Proprietary compression?

[Skapare]

Proprietary compression cannot be cracked? I can tell you that this can be hard to do. And this is from experience. I once worked at a company where a project one year involved writing some programs to extract data from files stored be various competitor products to enable customers to easily migrate to our products. I was given the one that the managers thought wasn't even possible to do, because the data look like gibberish (because, unknown to them at the time, it was compression). It took me FIVE weeks to reverse engineer it. It was not quite as good as UNIX compress, but it was much better than run length compression.

Whether these data tapes are crackable is unknown to me. But if they were encrypted by today's strong forms of encryption, then I know I could not crack that.

Tape encryption is avaliable for all, use it.

[vallef]

Hopefully people will use tape encryption now, it's been available for years. As I am afraid that tape is still the most efficient for moving large amounts of data. Also the tape encryption is uses very strong algorithms e.g. AES-256 etc.

Some vendors like Sun and IBM give the key management stations away for free if you use encryption. People just do not understand how hi-tech tape is nowadays. Everyones perception of tape is old DAT, people need to look at Sun T10000, IBM TSxxxx or LT04. If you are archiving data for a long time there is no other ecological option than tape. It's longevity (of the quality products) has been proven over the last 20yrs. Tape is not that interesting, but it is like brushing you teeth, you know it is a good thing for the long run.

Re:Tape encryption is avaliable for all, use it.

[Skapare]

What we need to do is get a law passed that mandates strong encryption and proper key handling for all qualifying data (anything with personally identifying information, including SSN, bank account numbers, CC numbers, health information, etc), held by any entity (corporate, organizations, governments), that is transported, transferred, or exchanged offsite by any means (tapes, disks, internet, private data circuits). There should be a minimum violation penalty for cases where the data was not stolen or taken, and stiffer penalties if it was stolen and not encrypted.

Re:Tape encryption is avaliable for all, use it.

[maxume]

How do you fine a government agency?

Alternatively, how do you fine the employees of a government agency if there aren't any, because no one was crazy enough to expose themselves to getting fined while working at government rates?

What do you do if the budget machinery of the government they are working for won't provide funding for encryption?

It has to start with definition of reasonable practices and funding of those practices. For government, external review and control(i.e. a check or a balance) is a good idea, but it would be very hard to implement in terms of penalties or fines.

Re:Tape encryption is avaliable for all, use it.

[budgenator]

How do you fine a government agency?

Alternatively, how do you fine the employees of a government agency if there aren't any, because no one was crazy enough to expose themselves to getting fined while working at government rates? No you just promote them to Information Technology Liaison
Person for the Distant Early Warning Station 150 Km north of Where-Polar-Bears-Shit-On-Ice, Canada for a nice stable 3 year tour of duty.

Re:Tape encryption is avaliable for all, use it.

[ToasterMonkey]

Some vendors like Sun and IBM give the key management stations away for free if you use encryption Who gives them away for free? IBM, SUN, or HP?
Enterprise grade encrypting tape drives cost as much as a SUV anyway, so I wouldn't think they're above this tactic, I just haven't heard of it.

The cheap end, LTO4 encryption, is still way too new. Search the links for LTO... Give it a year or so before major backup software natively supports it well. If you just want your tape library managing the encryption keys, well, have at it I guess.
IBM
SUN

I think the best bet for cheap, solid tape encryption at the moment would be with HP. I don't believe they have high end drives to fuss about, so they're all about LTO4.
HP

Re:Tape encryption is avaliable for all, use it.

[atraintocry]

More laws? Why not just let the free market decide?

(Get's SSN stolen)

Ooooohhhh. Now I get it.

TFA does NOT say they were encrypted

[Skapare]

There's nothing in the article that says they were encrypted. They were compressed and some kind of encoding was involved. But encoding could be any number of things, and quite possibly the coding used by medical records systems to compact common terms to numbers. It could be hard to make use of the data. But if it was an "inside job", or the perps can get the software used on this, it can be cracked easily. This is not strong encryption.

Re:TFA does NOT say they were encrypted

[Mysticalfruit]

Let the fuckers steal our backup tapes... good luck it's encrypted with AES256... that should keep them busy for a couple billion years.
And yes, we do recall random tapes to ensure that we can restore from the encrypted volumes.

In this day and age of "Information Warfare" you should consider every system for moving data vulnerable and take measures to ensure that attempting to steal that data would be more work than what it's worth.

Re:TFA does NOT say they were encrypted

[frdmfghtr]

In this day and age of "Information Warfare" you should consider every system for moving data vulnerable and take measures to ensure that attempting to steal that data would be more work than what it's worth.

In the case of physically moving backup high-value drives/tapes to off-site storage, that would mean an armored courier. That data is money to somebody, so protect it like money. Sure it's more expensive that the local Speedy Messenger cargo van, but so is losing control of the data.

Re:TFA does NOT say they were encrypted

[Anonymous Coward]

The idea of the sophisticated tape encrypting systems today is that the physical safety of the media isn't crucial. No, you don't want to be giving tapes away but if a tape is lost/stolen, it's still safe as you only have one piece of the puzzle. It's an important piece, but not the only one. You wouldn't need to hire an armored courier to move the tapes around.

Re:TFA does NOT say they were encrypted

[Thalagyrt]

This is standard military grade encryption. I work for the school, I know how our backups work. TFA is incorrect.

Re:TFA does NOT say they were encrypted

[guruevi]

I work at a University with a large medical site/hospital/research and I've worked in several businesses that have to have HIPAA or SoX compliance. The laws state and the legal advisors make sure you know this: if your data was encrypted and then lost disclosure is not mandatory and thus the agreement of the employer then takes over, if you disclose it anyway, you lose your job.

Another example: If you have a database, it is sufficient to only protect/encrypt one of the (i think it's five) identifiers to be compliant. For example if you have name, first name, address, ssn and birthdate, you only would have to encrypt the ssn to be safe. Although in another database or even table you can have partial ssn, customer number and credit card number, you encrypt credit card number and your safe. If both are compromised neither have to be disclosed if both tables were not used in the same application and thus had different access controls. Anyone with some database knowledge of course knows that as superuser (what you're usually hacked as) you can easily join the tables to get a more complete picture.

I know of places that have lost, have been hacked into or have misplaced thousands of data records including credit card numbers etc. and have not needed to disclose simply because they used 'some form of encryption'. That the encryption/decryption keys could've been compromised at the same time or at another time is none of their concern, they abide by the law.

Read the important words

[ZorbaTHut]

"For now".

I highly suspect this translates as "until we think people have forgotten about this". Why fix the problem when we can just pretend it's gone away?

Time for Brinks

[Statecraftsman]

It shouldn't be easy to steal these things. It's time valuable data is treated like it has value. That means armored vehicles for transport.

Maybe they should list SSNs, Birthdays, and Addresses in the foreign exchange markets so people will get a clue.

In 2025 those will still be valid SS numbers

[plantman-the-womb-st]

Get your most closely kept personal thought:
put it in the Word .doc with a password lock.
Stock it deep in the .rar with extraction precluded
by the ludicrous length and the strength of a reputedly
dictionary-attack-proof string of characters
(this, imperative to thwart all the disparagers
of privacy: the NSA and Homeland S).
You better PGP the .rar because so far they ain't impressed.
You better take the .pgp and print the hex of it out,
scan that into a TIFF. Then, if you seek redoubt
for your data, scramble up the order of the pixels
with a one-time pad that describes the fun time had by the thick-soled-
boot-wearing stomper who danced to produce random
claptrap, all the intervals in between which, set in tandem
with the stomps themselves, begat a seed of math unguessable.
Ain't no complaint about this cipher that's redressable!
Best of all, your secret: nothing extant could extract it.
By 2025 a children's Speak & Spell could crack it.

You can't hide secrets from the future with math.
You can try, but I bet that in the future they laugh
at the half-assed schemes and algorithms amassed
to enforce cryptographs in the past.

Re:In 2025 those will still be valid SS numbers

[Anonymous Coward]

Hey buddy
why are you
manually
inserting
carriage
returns in
your post?

Don't you
know that
you need
to keep
typing even
when you
reach the
edge of
the little
text input
box?

Re:In 2025 those will still be valid SS numbers

[schmiddy]

Correct Attribution:
Artist: MC Frontalot
Title: Secrets from the Future

Full lyrics: here.

Parent omits the second half of the song.

Re:In 2025 those will still be valid SS numbers

[Dr_Barnowl]

The math sayeth ; you are wrong.

Mathematics are about the one part we can have certainty in.

Nothing can crack a one-time pad ; not a real one with proper random numbers. Not even a quantum computer could do it.

Other than that, a nice poem :-)

Re:In 2025 those will still be valid SS numbers

[Anonymous Coward]

Yes, just ignore the convention used for poetry and lyrics for the last thousand years...

Re:In 2025 those will still be valid SS numbers

[Anonymous Coward]

So I assume you don't bother to lock your door at night, because any idiot with a lockpick gun could open it about 3 seconds? Or just use some other brute force method (kicking it down)?

By that same logic, why did you even get that computer you are using, because by 2025 a childern's Speak & Spell will have more power then your current PC? Or even buy anything because it might possibly be stolen in the future?

And since you don't seem to care about protecting your SSN why not just give us it with your name, address and other personal information because by 2025 someone will already have stolen it, and have it even if it was encrypted be able to use it. Why fight the future?

Re:In 2025 those will still be valid SS numbers

[Anonymous Coward]

By 2025 a children's Speak & Spell could crack it.

Considering you decided to include a one time pad, I very much doubt it. Unless you fucked up the implementation, or you were careless with the key, one time pads offer perfect secrecy. That is, there is a mathematical theorem which essentially says that given the ciphertext of a OTP, every plaintext of the same length is still equally probable. It's not a matter of computational power, the OTP is quite unique in that it has actually been proven impossible to crack a correct implementation of it. The best you can do is hope that the sender was careless with the key or implemented it incorrectly.

Re:In 2025 those will still be valid SS numbers

[plantman-the-womb-st]

Actually I don't lock my door, or my car for that matter, and you're welcome to my SSN (488-22-1086) I have the worlds *worst* credit score good luck using it for fraud... but that's beside the point. The point is not that I don't care about security, but that the GGP(parent to my Frontalot quote) was saying *gasp* it might take 5 months! So? why would the thief care how long it took? I wouldn't if it was me. I mean hell, in three years those SSNs will still be valid, the Gub'ment don't reissue those you know, and they'll still have value. Hell, in three years the folks the data was stolen *from* will probably think that the crooks were idiots and the heat'll be off. So, see what I mean?

You keep your backups safe - why not your keys?

[Animaether]

Anybody who uses encryption wisely knows that they should guard the key with their life (not literally), not just from being stolen but also from being -lost-. That typically includes keeping a second set of the keys (protection against loss; unless both sites are hit at the same time) somewhere only you know about (protection from targeted theft) in a way that makes it nigh impossible to determine what they're for (protection from random theft); or just useless once realized they're compromised (change the keys, change the location, move on).

Encryption is pointless if the key itself is stored with the encrypted content (as various media protections show), and dangerous if the key can be 'lost'.

Re:You keep your backups safe - why not your keys?

[zippthorne]

Photometer data, seismic measurements, tide levels, temperature logs, astronomical images, ephemeris data, past lotto numbers, emergency procedures, core sample measurements, and many others are all examples of things that shouldn't be encrypted. (and should probably be stored in plain ASCII delimited lists, uncompressed as well, if possible)

Identifying information about real people does not fall on that list. It's not really *your* information to lose. It is far better that you should forget a key and have to put out a call for patients to be reexamined to rebuild the database (or in many cases simply do without information you cannot re-aquire) than to betray patients who trusted you with personal information.

Re:You keep your backups safe - why not your keys?

[Anonymous Coward]

I don't understand why this concept is so difficult for some people to grasp. Get a small safe deposit box at the bank. That's totally secure, reasonably-priced key backup.

I *thought* the GP was going to raise some kind of sensible objection, like if a piece of the tape gets corrupted, the entire encrypted blob would be lost. I think the best overall approach is encrypted transfer (whether through encrypted tapes or streaming over fiber), then unencrypted storage in a secure facility.

Mod parent up

[Anonymous Coward]

I thought the exact same thing, mod it up!

Doesn't modern tape backup software encrypt data?

[Futurepower(R)]

"On the black market these days, a full identity (name, SSN, address, bank information, etc) can go for $14 each."

Good answer. Next question: Doesn't all modern tape backup software encrypt all data?

Even my personal DVD backups are encrypted automatically.

How many times does it have to happen?

[barzok]

It's going to keep happening. This sort of sloppy data handling is going to continue until there's proper incentive to protect data. And that means (IMHO) crippling penalties for those involved. Penalties so immense that the business nearly goes under. Penalties for the individuals who allowed unencrypted data to be put at risk - not just the peons swapping tapes, but the executives who didn't mandate/allow proper procedures. All the way up the food chain.

This stuff has to be taken seriously, but right now - no one does.

Re:How many times does it have to happen?

[SRA8]

If people cared enough, they would reach out to their lawmakers and have such a law passed. California's laws were a start, but we have a ways to go. I have reached out to my representatives, but clearly it isnt a priority for most, or we'd already have laws.

Re:How many times does it have to happen?

[pclminion]

Why do you want to punish the underling who was ordered to transport something probably without even being told what it was or how important it was? This sort of thing is the job of an armored car. For wanting to punish the least responsible party involved, you are an asshole.

Re:How many times does it have to happen?

[budgenator]

The Hospital hired an experienced, insured and bonded company specializing in document storage and retrieval services for the Medical Legal and Business comunities.

Re:How many times does it have to happen?

[barzok]

And yet they were still able to fuck it up beautifully.

Totally unnecessary

[Sir_Real]

I wonder if the HIPPA compliance officer got canned. Why the hell wasn't this data encrypted?

Re:Doesn't modern tape backup software encrypt dat

[drinkypoo]

Good answer. Next question: Doesn't all modern tape backup software encrypt all data?

1. Define "Modern"
2. No

HTH, HAND :)

Seriously though, there's overhead and hassle involved with encrypted backups. The value of a backup is greatly diminished if you can't restore it.

Relative Risk

[PIPBoy3000]

I work for a health care organization. We ship our backups off-site just like these guys. When it comes to encrypting hard drives, what you say makes sense. When it comes to backup tapes, it's not going to happen. The main reason is that encryption is slow. If I have to restore 500 GB of data and decrypt it, suddenly you're telling physicians that they can't get to the patient information they need to treat the patient even later than before. If someone loses the encryption keys, the information patients need to stay alive is simply gone forever.

I think it's important to safeguard information. At the same time, I see these sort of cases sensationalized and lawyers demand decisions that are incredibly stupid. We don't save e-mail past a year any more because of legal issues. This means that I can't solve issues or know what was going on unless I take cumbersome actions to save data off somewhere (made deliberately difficult). What you're suggesting is that lawyers should run even more of our business.

Re:Relative Risk

[ColdWetDog]

Bah, I would disagree. And IAAP (I am a physician) - who has worked in IS intermittently for decades.

First, if your recovering from an off site backup tape, something went down and it's going to take a while to get it running again. Decrypting can't add much more than 20 - 30% (number pulled from appropriate nether region) to the time. If it does you need to upgrade those C-64's you're using in the server room.

Second, if the data is bulk stuff going off site, it's obviously not a primary rapid-response data restore. It's likely historical and most likely business data with very little clinical information. Probably just ICD9 / CPT codes (diagnosis and procedure codes, look it up only if you're very, very bored).

And thirdly, if your docs are so addicted to the computers that they're going to kill people without them, they should start rethinking their approach to medicine. That sort of historical data just isn't that important. We've treated people for centuries without computers. Having all that clinical information at your fingertips is great, wonderful and certainly to be encouraged, but lack of it isn't life threatening.

Having Google go down on the other hand ....

Re:Relative Risk

[Captain Segfault]

Two issues: firstly, how often are you actually restoring from tape? Decryption isn't slow compared to physically getting the tape from offsite. If someone loses the tape that same information is gone forever, too. And, in any event, I work (ob plug) on a hardware tape encryption product that solves all these problems.

In many cases the law does the right not-heavy-handed thing here -- if you lose tapes with my info on it you get a scandal. If you lose tapes with my encrypted data on it you haven't leaked any information at all, and don't even need to report it.

Re:Relative Risk

[Cramer]

I grew up in the sticks, so I remember the doctor's office being >50% file room. We used to do everything on paper. Today, everything is done on computer. "x-ray's" aren't even done with film anymore... (granted, those aren't actually x-ray's.) We aren't quite to the point where nurses and PA's are walking around with tablet computers, but that day is coming. (I've had my order taken at McDonalds by a kid standing the parking lot with a wireless tablet :-) That place had a dual lane drive thru for a while.)

Re:Relative Risk

[Cramer]

Plus, most modern CPU's can handle encryption/decryption at speeds exceeding the streaming rate of the tape drive. However, modern drives are pushing that, but then they have hardware encryption built into them.

I've worked on tape encryption

[pinguwin]

I've worked on a project from a very large software company that deals with encrypted tapes and is on the market. The idea is that the tape has been stolen. Who cares? You need to get the key that encrypted it, the key of the tape drive that wrote the tape, and get a drive itself. Not easy as they vet who buys. Yes, it can be done but not by your ordinary thief. Could it have contained 2 mil medical records? I don't know, the tapes we were using two years ago were 400 gig. One person mentioned it must be related to a mainframe. Nope, modern workstations and tape drives. Tape is a thriving medium in some circles. A buttload of storage the size of a cigarette pack that is dirt cheap. The system I've worked on is on the market and the idea is very good. There were some serious problems with the project and I don't know (and truthfully don't care) if they've been worked out. However, a thief without a large, well equipped organization behind them would still be at a loss what to do with the encrypted tape.

archive company?

[Danzigism]

I really don't understand why companies use "archive companies". It's like online backup as well. I don't trust ANYONE with my freakin data. It works simply in our shop. Every morning I take the tape from the day before and put it in my briefcase. I take it home with me so it is offsite. Why didn't the school simply just have a trustful employee take the tapes home with him? taking tapes offsite is definitely a good thing in case the building were to catch fire and whatnot, but christ, what the fuck is an archive company and why would you trust them?

Re:archive company?

[Anonymous Coward]

Every morning I take the tape from the day before and put it in my briefcase. I take it home with me so it is offsite. Why didn't the school simply just have a trustful employee take the tapes home with him?

And why would they trust you? What if you get fired?

Do you have a temperature & humidity controlled tape safe, UL-rated against fire & theft? What if you get robbed/carjacked on the way home? Can you store hundreds/thousands of tapes at home, all indexed & inventoried?

There is a reason archive companies exist. Iron Mountain has been very successful at it.

Re:archive company?

[filthpickle]

so if your house burns down your company will lose all it's backups?

Dislaimer: I don't want your house to burn down.

Re:archive company?

[tfiedler]

Next time you stop for a beer, I hope someone steals your car or just your briefcase. Trustful or not, doesn't matter. THe person doing the stealing isn't trustful and you aren't perfect which gives someone all the opportunity they need. When you grow up and go work for a real business, one where backups require 100s of tapes then you come back and comment on tape backup companies, until then realize that your experience means exactly bunk.

Re:archive company?

[v1]

I've seen it work both ways, but normally, archive companies are supposed to be more responsible than Joe Watercooler, and that's what you're paying them for so they should know what they're doing. Employees are sloppy with tapes and sometimes don't use common sense. They'll stop for groceries on the way home from work and leave the car unlocked. They'll toss the tapes on the floor when they get home and the dog will chew-toy them. They'll set them on top of the radiator or their computer monitor.

As far as trust goes, that could mean do you trust them not to violate your privacy of information, or trust them not to be reckless with it that it gets stolen, or trust them not to be reckless with it that it gets damaged.

For privacy, you'd be stupid to hand your data to anyone without it being encrypted. Really it shouldn't leave the building unencrypted, for any reason, so the issue of privacy is moot if you are being sensible.

For theft, you have to assume they will take reasonable precautions during transport. Really they should not be using a car without a car alarm and should not leave the vehicle unless necessary, and only for short periods of time. Preferably never while transporting your tapes. Once it gets to "the vault", it should be secured under lock and alarm.

For recklessness, they should be educated in proper handling of media and have common sense.

Random coworkers do not possess the training or education for the latter two, and that's why you pay professionals to do this important thing for you.

Re:archive company?

[budgenator]

Our dental office has about 432 cubic feet of unused records with a data retention period of 30 years and it grows at about 9 cubic feet a year; I would love for everything to be on tape or even a pile of CD's!

Re:archive company?

[Renraku]

Lets say Employee A decides that he'd make a good off-site backup person. Lets go on to say that he's an honest hardworking man who has no intention of making a million overnight by copy/pasting the data and shipping it to some benefactor.

The tapes come up missing. Employee A is fired, jailed, and probably sued for everything he's worth as he only has $20 an hour or so for the past 5 years to hire a lawyer with. Supervisor A is fired, Manager A might be fired too..because they both knew about it. People ridicule the hell out of the company for giving a random employee the backups for all the important data, and business slows dramatically.

Second scenario.

You're the supervisor who advises that this backup agency is a good idea. You give your data to the backup agency who stores them. It gets stolen or copied, etc. You sue the pants off of them for damages, and you don't lose business. No one gets fires, as it was the backup agency's fault entirely.

Re:archive company?

[qzulla]

This is so wrong I don't know where to start.

qz

Re:archive company?

[Anonymous Coward]

Our dental office has about 432 cubic feet of unused records with a data retention period of 30 years and it grows at about 9 cubic feet a year; I would love for everything to be on tape or even a pile of CD's!

Dentists have to keep data for 30 years? Where I live it is seven years after they stop being a patient (your jurisdiction may vary).

Even if you have to keep it that long, there are specialized companies that will scan everything and convert to tif/pdf files, which makes storage/indexing/retrieval much easier.

Re:archive company?

[budgenator]

the way I understand it is,
3 years statute of limitations of litigations, (Malpractice),
7 years statute of limitation for tax liability (IRS and dentists get audited a lot),
30 years for OSHA and some FDA required records for medical devices (Dental implants and sleep apnea and anti-snoring devices and anything of foreign origin); so the ADA just recommends 30 years for everything.

Re:archive company?

[Cramer]

The point is to take "clones" off-site. If you lose the on-site tapes, you still have all the data in the second set off-site. And vice versa. As for fire, I used to keep the off-site sets in "fire boxes" to cover that nagging "what if your house burns down" issue. (rated for 1000F for 4 hours, it's insanely heavy for tansporting a half dozen tapes.)

Ulitmately, your house is just as insecure as your car. Off-site storage companies typically have large, climate controlled warehouses with cameras and armed guards. Tapes getting stolen from the warehouse is rare and almost always an inside job.

I've said it before, and I'll say it again...

[Anonymous Coward]

tar -cf myimportantstuff.tar myimportantdir/
gpg -r me@mysecureplace.org -e myimportantstuff.tar
scp myimportantstuff.tar.gpg me@mysecureplace.org:~/

pretty valuable for cherry-picking risk pools

[ridgecritter]

If I ran a medical insurance company, those tapes could let me know whose applications to deny and whose to accept. Very valuable indeed.

Has nothing to do with medical staff

[filthpickle]

Medical staff and any other people untrained in information security just aren't going to have the computer literacy or "computer common sense" to handle millions of peoples' medical records adequately.

But it's all in the name of tracking your every move, so I guess it's OK. Your network should be secure (they don't set that up)

The software they use should be secure (they didn't write it)

The method you use to transmit your claims should be secure (they don't set that up)

All you have to tell them is "don't email claim/medical record files" I have taught literally hundreds and hundreds of shockingly stupid people (the people at your doctor's office or the hospital that do the billing are almost certainly the lowest paid people in the chain...in the ballpark of minimum wage) how to zip and encrypt a file so they can email it. With 7zip it is a 3 step process.

Insurance companies have to track your every move when it involves you going to the doctor/hospital.

Re:Has nothing to do with medical staff

[sweet_petunias_full_]

"Your network should be secure..."

It should if you spend the cash to secure it. My bet is that it won't be, because it'll eventually lapse as a priority as health costs rise.

"The software they use should be secure..."

But it isn't. With the highly trusted Microsoft leading this effort, let me go out on a limb here and predict they're going to use Windows for this purpose. Duh. M$ has no incentive to make their product perfectly secure because they want to give you update bloat and want to be able to sell you their next OS (or a subscription at some point) and if you lack nothing, they won't be able to make money. Thus, their product will have security gaps and you (the health customer) will be the loser.

"The method you use to transmit your claims should be secure"

Transmission is only one part of security. Even if that is secure, there are plenty of other ways to get at your data.

Once your data becomes public, it will stay public. Before it is tracked down it can be transmitted to so many places that there is no way to be sure you have erased all of the copies of it. You should just assume that it is a one-way deal when data leaks.

"All you have to tell them is "don't email claim/medical record files" "

You can tell them things until you're blue in the face but you can't make people who lack computer sense into the sort of stoic user who dares not click on the little flashy icon inviting them to install the spyware, rootkits and so forth. At that point it doesn't matter how well they follow their other so-called security procedures.

Your data will get out. It will *pour* out like the blood from a samurai B-movie. Just ask the record companies and the movie companies. That's just the reality of converting anything over to a digital format.

There already is for Health Data

[filthpickle]

http://www.hhs.gov/ocr/hipaa/

The key here is knowingly or recklessly doing it, The university is in the clear here. They had every reason to expect that the company they were using was protecting the data they gave them.

If I used the same company and heard about this I would immediately switch companies, so although they probably won't get in any legal trouble they will certainly pay a penalty for it.

Yeah, but ...

[CustomDesigned]

Complete idiots don't read Slashdot. Oh, wait ...

I do this.

[Anonymous Coward]

I an a UNIX Admin at a very large group of Hospitals. At our hospitals, there are no more paper charts, even radiology is not on film anymore. When we need to send data offsite, (not backups) it is encrypted. (GPG even). This is primarily for transport. But nightly backups, no way. We depend on the vendor in armored cars to get it there safely. There is no HIPPA requirement for data on tape to be encrypted. It would be impractical anyway. Anyone here responsible for encrypting multi-terabyte databases? Know how long that takes? Even with multi-site HACMP clusters, the need to get the data backed up, offsite, quick time to recover (gotta decrypt it in a disaster), trumps security. Imagine 500 patients in a bed, the system is down, and your waiting on decryption of backup tapes.

Re:I do this.

[Anonymous Coward]

I'm pretty sure any desktop made this century can run AES-256 fast enough to saturate local disk. I can't imagine what you're running that's so deficient it can't even keep up with a tape drive. The patients at your mercy deserve better.

Why Uni need 2 Million medical records in 1st pl.?

[Adeptus_Luminati]

Mr. Obvious asks:

What does a University need with 2 Million medical records? Since when did patients agree that Universities could have a copy of their information?

Re:Why Uni need 2 Million medical records in 1st p

[Thalagyrt]

University of Miami partially runs one of the largest hospitals in Miami, Jackson Memorial.

We needs laws regulating private data!

[Anonymous Coward]

I know many Slashdotters are adverse to such laws, but it seems there is a recent trend in this sort of crime. Stolen laptops with credit card information, social security numbers, etc... It seems things are spiraling out of control. Organizations that store such data need to be regulated on how they store, backup, transport and share this data. With the recent trends in thefts and subsequent identity theft, I think we should all be concerned. The Federal government needs to take charge to protect citizen's private information.

Ever heard of encryption?

[gweihir]

Apparently not. Incompetents.

Can we get a new tag for this?

[zerkshop]

Every week there is a new article about tapes stolen, backups lost, website reveals SSN's, X thousand/million SSN's or personal info...

idtheft?
idiotsloosedata?

I've never been happier...

[thegnu]

I've never been happier to be unable to afford to go to a doctor. :D

Oh, fuck yes.