Slashdot Mirror
Dutch MP Fined For Ethical Hacking
An anonymous reader writes "Dutch Member of Parliament (MP) Henk Krol was fined 750 (US$1,000) by the district court of Oost-Brabant on Friday for breaking and entering the system of the Dutch medical laboratory Diagnostics for You. Krol said he entered the system as an ethical hacker to show that it was easy to access and download confidential medical information. Krol, leader of the Dutch 50plus party, accessed the systems of the laboratory with a login and password he had obtained from a patient of the clinic, who in turn had overheard the information at the laboratory from a psychiatrist that worked there ... In April last year, Krol used the login information to enter the company's Web server and subsequently viewed and downloaded medical files of several patients. He did this to prove how easy it was to get access to the systems, according to the ruling (PDF in Dutch).'"
So this putz uses a stolen password to steal confidential documents. He claims that this is ethical hacking?
He's not exposing some inherent weakness in the system, he's using a stolen password to steal documents to showoff his "1337" skillz.
If you ask permission from the site to pen test, they are probably going to say no.
If you are a "so called" ethical hacker, whatever that means, and do it anyway, who is to say you don't find something valuable and keep it? May be you are only "ethical" when you don't find something valuable and then use the experience as free advertising.
The nominal fine seems reasonable.
No 10 million euro claims for damages, no 15 year sentences for terrorism and definitely no FOX news fear-mongering the ignorant masses.
I asked if they could put me through to Anonymous Coward but they didn't seem to know who you were. xD
Make illegal to get warned that you are insecure and you will deserve being raped by unethical hackers. Is pretty much like suing the ones that could predict quakes, making sure that noone, ever, will warn you till is too late.
Based on HIPAA he would be fined at least $100 per document he took, hacker or not.
If the owner of the system did not hire him to do pen testing, then it is not ethical. Sorry.
So Rosa Parks deserved to be punished?
Breaking an unjust law to call attention to it doesn't alleviate the consequences of it. Despite what the history textbooks say, Ms. Parks was not just a random black woman who decided to make a stand. She was carefully groomed, the act was carefully planned and timed, and she was more than aware of what the consequences could be. She was likely prepared to end up a martyr. As luck would have it, she didn't have to.
If you are not allowed to question your government then the government has answered your question.
If we're being hypothetical, if he were in the US, he'd be a Senator or Congressman, and as a result nothing would happen - hell, he'd probably be applauded.
Now, if you want to strip the political power away, sure - in the US, he'd probably be prosecuted to the fullest extent the law could be twisted in abuse to.
I suspect he'd be a lot worse off in his home country, for that matter, if he wasn't an MP.
..the justice department (yes, you read that right) actually had a login to the same database as it was found following the news on this particular case. One has to wonder if the official story (needed because of certain convicts that have their records in the same medical DB) is even a valid reason, and why they would even be allowed within 10 meters of such a sensitive and secret (medical wise) collection of data.
While Henk Krol is not a 'true hacker' perhaps, this does raise a lot of questions with regards to the security of any person's data in such a medical database; questions that "Diagnostiek voor U" may want to keep secret, so a "wag the dog" (or more popular "Chewbecca") tactic is followed...
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
He was able to access multiple patients' records using one patient's username & password. That should NOT be allowed by the system in any way.
Many of you are probably missing interesting details. The login consisted of a 5 number digit with a password that was exactly the same! Another fact is that Henk Krol DID try to warn 'Diagnostiek voor U', twice! But they sent him away because 'that was not the way to report it'. He had to do it in writing. He also contacted two other governmental organisations responsible for organisations like 'Diagnostiek voor U', but they also sent him away saying it was not their problem. Henk Krol was not fined for the actual hacking, but for going to the press too soon. Come again...?
It doesn't have to be like this. All we need to do is make sure we keep talking.
Rosa Parks did what she did knowing she would be punished, that's the whole point of civil disobedience. You do what you believe to be right and in the process force the judicial system to punish you in public, exposing a flaw in the system. If Rosa Parks hadn't kicked up the legal fuss she did then she wouldn't have had an impact that would still be discussed on internet fora decades later.
Please consider this account deleted, I just can't be bothered with the spam anymore.
He was in a radio interview for Dutch Radio 2 this morning. He claims that he did contact the company and they replied that they were not interested, and if he had a complaint that he should write them a letter. That will take weeks, meanwhile leaving the door wide open for others to get unauthorized access to confidential patient records.
He was fined because the judge thought he retrieved more records than necessary to show the issue. During the interview he claimed that he did this to show that with this single user account he could get records from patients who were not with this doctor. During discovery it turned out that anyone with access to the system had access to pretty much all records. Even support people from the company who maintains the system had access to patient records. That's a pretty big f*ckup.
We have discussions here about a national health record system. It is this kind of lame 'security' that make a lot of people not want to participate, including myself. A country-wide central health record is a goldmine for insurance companies, at the expense of the people. Also, the system is supposedly developed by a company with roots in the USA, and US law would allow US government to snoop in our database. Let's just say I pass..
To Terminate, or not to Terminate, that's the question - SCSIROB