Slashdot Mirror
Dutch MP Fined For Ethical Hacking
An anonymous reader writes "Dutch Member of Parliament (MP) Henk Krol was fined 750 (US$1,000) by the district court of Oost-Brabant on Friday for breaking and entering the system of the Dutch medical laboratory Diagnostics for You. Krol said he entered the system as an ethical hacker to show that it was easy to access and download confidential medical information. Krol, leader of the Dutch 50plus party, accessed the systems of the laboratory with a login and password he had obtained from a patient of the clinic, who in turn had overheard the information at the laboratory from a psychiatrist that worked there ... In April last year, Krol used the login information to enter the company's Web server and subsequently viewed and downloaded medical files of several patients. He did this to prove how easy it was to get access to the systems, according to the ruling (PDF in Dutch).'"
So this putz uses a stolen password to steal confidential documents. He claims that this is ethical hacking?
He's not exposing some inherent weakness in the system, he's using a stolen password to steal documents to showoff his "1337" skillz.
He is Krol, ruler of the planet Omicron Persei 8 and member of the dutch Parliament!
Krol used the login information to enter the company's Web server and subsequently viewed and downloaded medical files of several patients.
He didn't have the company's permission. Did he have the patients' permission?
It doesn't matter what point you're trying to make; you are not allowed to do things you're not allowed to do.
is still disobedience. Accepting the punishment is something to think about before you decide to break the law for your cause.
I got the password from your father's brother's nephew's cousin's former roommate. What does that make the labratory's security system? Absolutely nothing.
And all he got was a slap on the wrist for still breaking the law.
Seems fair.
the slap on the wrist fine.
Wonder if a politician in the US did that, would they get a fine, jail time, or have it swept under the rug?
And what if some non-political schmuck did it?
15-50 years?
He could have sent the user id and password to the company stating how he had obtained it and the company would have been made aware of the situation. Instead he decided to be flashy and break the law.
If you ask permission from the site to pen test, they are probably going to say no.
If you are a "so called" ethical hacker, whatever that means, and do it anyway, who is to say you don't find something valuable and keep it? May be you are only "ethical" when you don't find something valuable and then use the experience as free advertising.
The nominal fine seems reasonable.
No 10 million euro claims for damages, no 15 year sentences for terrorism and definitely no FOX news fear-mongering the ignorant masses.
Then you're not actually doing it.
Though the smart thing to do would be to post it anonymously, or in some venue when you can't be held accountable, or redact the dangerous parts.
For example, if I were a US Congressperson, I'd say it there, and then the only people who can speak on it would be other Congress people.
He downloaded, viewed and printed medical data from several people. That was more than needed to prove his point. Next to that he made very little effort to contact the company to get the problem fixed and published almost right away.
The judge explicitly explained that the "hacking" itself was good, but it was the way he handled it that was not ethical and that is why is was fined.
I asked if they could put me through to Anonymous Coward but they didn't seem to know who you were. xD
Wow $750,000 seems a little steep...
Using someone else's username and password is NOT hacking.
Nobody is hacking n00b! I'ts called skills.lol. Learn2play. drool drool duhhhh.
How did he "hack" anything? He used a username and password that someone gave him after over hearing it from someone else. It's not like he identified an sql injection vulnerability that allowed him to dump a db or an xss vuln that compromised an admin account. He just logged in.... wow, that's some real high profile hacking there! sheesh!
Make illegal to get warned that you are insecure and you will deserve being raped by unethical hackers. Is pretty much like suing the ones that could predict quakes, making sure that noone, ever, will warn you till is too late.
Based on HIPAA he would be fined at least $100 per document he took, hacker or not.
Your system is easy to hack! People are at risk!
No it's not
Yes it is
No it's not
Yes it is, look: see? Got proof!
Yawn... oh, mr. policeman?
{sound of handcuffs clicking}
No it's not.
The end.
It's not ethical if you don't have permission. If he was ethical he would report the password breach, not try to be some "hero".
If the owner of the system did not hire him to do pen testing, then it is not ethical. Sorry.
In the US, he'd probably get 10 years in Club Fed. Mike Tyson went upstate for only 3 years for rape, so we know the priorities of our justice system.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Hey, I never asked him to do anything!
If we're being hypothetical, if he were in the US, he'd be a Senator or Congressman, and as a result nothing would happen - hell, he'd probably be applauded.
Now, if you want to strip the political power away, sure - in the US, he'd probably be prosecuted to the fullest extent the law could be twisted in abuse to.
I suspect he'd be a lot worse off in his home country, for that matter, if he wasn't an MP.
Exactly what part of using an overheard user name and password to access patient information is ethical?
I nominate him for the Captain Obvious award for showing a valid user name and password combination gives access to a server.
Privacy is terrorism.
..the justice department (yes, you read that right) actually had a login to the same database as it was found following the news on this particular case. One has to wonder if the official story (needed because of certain convicts that have their records in the same medical DB) is even a valid reason, and why they would even be allowed within 10 meters of such a sensitive and secret (medical wise) collection of data.
While Henk Krol is not a 'true hacker' perhaps, this does raise a lot of questions with regards to the security of any person's data in such a medical database; questions that "Diagnostiek voor U" may want to keep secret, so a "wag the dog" (or more popular "Chewbecca") tactic is followed...
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
med lab and the judge deserve fucked with jackhammers. dutchbag is shit cream.
Many of you are probably missing interesting details. The login consisted of a 5 number digit with a password that was exactly the same! Another fact is that Henk Krol DID try to warn 'Diagnostiek voor U', twice! But they sent him away because 'that was not the way to report it'. He had to do it in writing. He also contacted two other governmental organisations responsible for organisations like 'Diagnostiek voor U', but they also sent him away saying it was not their problem. Henk Krol was not fined for the actual hacking, but for going to the press too soon. Come again...?
It doesn't have to be like this. All we need to do is make sure we keep talking.
You aren't "ethical" just because you say you are. If you do not have permission and you are breaking into computer systems, you are not an "ethical" hacker.
He was in a radio interview for Dutch Radio 2 this morning. He claims that he did contact the company and they replied that they were not interested, and if he had a complaint that he should write them a letter. That will take weeks, meanwhile leaving the door wide open for others to get unauthorized access to confidential patient records.
He was fined because the judge thought he retrieved more records than necessary to show the issue. During the interview he claimed that he did this to show that with this single user account he could get records from patients who were not with this doctor. During discovery it turned out that anyone with access to the system had access to pretty much all records. Even support people from the company who maintains the system had access to patient records. That's a pretty big f*ckup.
We have discussions here about a national health record system. It is this kind of lame 'security' that make a lot of people not want to participate, including myself. A country-wide central health record is a goldmine for insurance companies, at the expense of the people. Also, the system is supposedly developed by a company with roots in the USA, and US law would allow US government to snoop in our database. Let's just say I pass..
To Terminate, or not to Terminate, that's the question - SCSIROB
Man commits a computer crime, man happens to be an MP, man gets a tiny fine.
The only news here is that this criminal only got a tiny fine.
During the interview he claimed that he did this to show that with this single user account he could get records from patients who were not with this doctor.
When someone dies because a patient's physician is not available and the records can not be accessed I bet you will have a different opinion about this issue. I would rather have all doctors have access to my records but I would also like to have my doctor informed when another doctors looked at them. That way my doctor, or his staff more likely, can monitor and question who has been accessing my records.
Even support people from the company who maintains the system had access to patient records. That's a pretty big f*ckup.
When an issue is reported and/or a bug needs to be fixed it has to be replicated. How can someone replicate a bug if they do not have the same access as the user reporting the bug?
It is this kind of lame 'security' that make a lot of people not want to participate, including myself
Any system that uses user id/password credentials is only as secure as the people who hold the credentials. When users do not keep their credentials secure it is the user's fault not the system. What alternative is there than educating the people who hold the credentials?
A country-wide central health record is a goldmine for insurance companies, at the expense of the people.
It is a gold mine but to get that gold there would have to be a great deal of data accessed which would be very obvious and easily prosecuted. I would love a national database that contained my health records. That way when I am in another province the attending physician will have access to all my records which may save my life. The small chance that an insurance company may use my records in a marketing campaign is worth the risk.
If he'd murdered someone for not thinking Allah is the best thing EVAR he'd have been sentenced to 30 seconds picking up litter.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."