Slashdot Mirror
Dutch MP Fined For Ethical Hacking
An anonymous reader writes "Dutch Member of Parliament (MP) Henk Krol was fined 750 (US$1,000) by the district court of Oost-Brabant on Friday for breaking and entering the system of the Dutch medical laboratory Diagnostics for You. Krol said he entered the system as an ethical hacker to show that it was easy to access and download confidential medical information. Krol, leader of the Dutch 50plus party, accessed the systems of the laboratory with a login and password he had obtained from a patient of the clinic, who in turn had overheard the information at the laboratory from a psychiatrist that worked there ... In April last year, Krol used the login information to enter the company's Web server and subsequently viewed and downloaded medical files of several patients. He did this to prove how easy it was to get access to the systems, according to the ruling (PDF in Dutch).'"
So this putz uses a stolen password to steal confidential documents. He claims that this is ethical hacking?
He's not exposing some inherent weakness in the system, he's using a stolen password to steal documents to showoff his "1337" skillz.
is still disobedience. Accepting the punishment is something to think about before you decide to break the law for your cause.
I got the password from your father's brother's nephew's cousin's former roommate. What does that make the labratory's security system? Absolutely nothing.
He could have sent the user id and password to the company stating how he had obtained it and the company would have been made aware of the situation. Instead he decided to be flashy and break the law.
If you ask permission from the site to pen test, they are probably going to say no.
If you are a "so called" ethical hacker, whatever that means, and do it anyway, who is to say you don't find something valuable and keep it? May be you are only "ethical" when you don't find something valuable and then use the experience as free advertising.
The nominal fine seems reasonable.
No 10 million euro claims for damages, no 15 year sentences for terrorism and definitely no FOX news fear-mongering the ignorant masses.
He downloaded, viewed and printed medical data from several people. That was more than needed to prove his point. Next to that he made very little effort to contact the company to get the problem fixed and published almost right away.
The judge explicitly explained that the "hacking" itself was good, but it was the way he handled it that was not ethical and that is why is was fined.
I asked if they could put me through to Anonymous Coward but they didn't seem to know who you were. xD
Wow $750,000 seems a little steep...
I see what you did there.
Make illegal to get warned that you are insecure and you will deserve being raped by unethical hackers. Is pretty much like suing the ones that could predict quakes, making sure that noone, ever, will warn you till is too late.
Yes it is.
Hell, one of the primary goals of hacking, from the start of computer/network related hacking, was to get hold of someone's username and password, which included keylogging, dumpster diving, conning people to reveal their usernames and passwords etc.
Based on HIPAA he would be fined at least $100 per document he took, hacker or not.
If the owner of the system did not hire him to do pen testing, then it is not ethical. Sorry.
In the US, he'd probably get 10 years in Club Fed. Mike Tyson went upstate for only 3 years for rape, so we know the priorities of our justice system.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Hey, I never asked him to do anything!
If we're being hypothetical, if he were in the US, he'd be a Senator or Congressman, and as a result nothing would happen - hell, he'd probably be applauded.
Now, if you want to strip the political power away, sure - in the US, he'd probably be prosecuted to the fullest extent the law could be twisted in abuse to.
I suspect he'd be a lot worse off in his home country, for that matter, if he wasn't an MP.
..the justice department (yes, you read that right) actually had a login to the same database as it was found following the news on this particular case. One has to wonder if the official story (needed because of certain convicts that have their records in the same medical DB) is even a valid reason, and why they would even be allowed within 10 meters of such a sensitive and secret (medical wise) collection of data.
While Henk Krol is not a 'true hacker' perhaps, this does raise a lot of questions with regards to the security of any person's data in such a medical database; questions that "Diagnostiek voor U" may want to keep secret, so a "wag the dog" (or more popular "Chewbecca") tactic is followed...
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
He was able to access multiple patients' records using one patient's username & password. That should NOT be allowed by the system in any way.
Many of you are probably missing interesting details. The login consisted of a 5 number digit with a password that was exactly the same! Another fact is that Henk Krol DID try to warn 'Diagnostiek voor U', twice! But they sent him away because 'that was not the way to report it'. He had to do it in writing. He also contacted two other governmental organisations responsible for organisations like 'Diagnostiek voor U', but they also sent him away saying it was not their problem. Henk Krol was not fined for the actual hacking, but for going to the press too soon. Come again...?
It doesn't have to be like this. All we need to do is make sure we keep talking.
He used a psychiatrists password, which was overheard by a patient. Still not a good system, but not as bad as if any patients username/password could be used.
He was in a radio interview for Dutch Radio 2 this morning. He claims that he did contact the company and they replied that they were not interested, and if he had a complaint that he should write them a letter. That will take weeks, meanwhile leaving the door wide open for others to get unauthorized access to confidential patient records.
He was fined because the judge thought he retrieved more records than necessary to show the issue. During the interview he claimed that he did this to show that with this single user account he could get records from patients who were not with this doctor. During discovery it turned out that anyone with access to the system had access to pretty much all records. Even support people from the company who maintains the system had access to patient records. That's a pretty big f*ckup.
We have discussions here about a national health record system. It is this kind of lame 'security' that make a lot of people not want to participate, including myself. A country-wide central health record is a goldmine for insurance companies, at the expense of the people. Also, the system is supposedly developed by a company with roots in the USA, and US law would allow US government to snoop in our database. Let's just say I pass..
To Terminate, or not to Terminate, that's the question - SCSIROB
During the interview he claimed that he did this to show that with this single user account he could get records from patients who were not with this doctor.
When someone dies because a patient's physician is not available and the records can not be accessed I bet you will have a different opinion about this issue. I would rather have all doctors have access to my records but I would also like to have my doctor informed when another doctors looked at them. That way my doctor, or his staff more likely, can monitor and question who has been accessing my records.
Even support people from the company who maintains the system had access to patient records. That's a pretty big f*ckup.
When an issue is reported and/or a bug needs to be fixed it has to be replicated. How can someone replicate a bug if they do not have the same access as the user reporting the bug?
It is this kind of lame 'security' that make a lot of people not want to participate, including myself
Any system that uses user id/password credentials is only as secure as the people who hold the credentials. When users do not keep their credentials secure it is the user's fault not the system. What alternative is there than educating the people who hold the credentials?
A country-wide central health record is a goldmine for insurance companies, at the expense of the people.
It is a gold mine but to get that gold there would have to be a great deal of data accessed which would be very obvious and easily prosecuted. I would love a national database that contained my health records. That way when I am in another province the attending physician will have access to all my records which may save my life. The small chance that an insurance company may use my records in a marketing campaign is worth the risk.
If he'd murdered someone for not thinking Allah is the best thing EVAR he'd have been sentenced to 30 seconds picking up litter.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."