Dutch MP Fined For Ethical Hacking

An anonymous reader writes "Dutch Member of Parliament (MP) Henk Krol was fined 750 (US$1,000) by the district court of Oost-Brabant on Friday for breaking and entering the system of the Dutch medical laboratory Diagnostics for You. Krol said he entered the system as an ethical hacker to show that it was easy to access and download confidential medical information. Krol, leader of the Dutch 50plus party, accessed the systems of the laboratory with a login and password he had obtained from a patient of the clinic, who in turn had overheard the information at the laboratory from a psychiatrist that worked there ... In April last year, Krol used the login information to enter the company's Web server and subsequently viewed and downloaded medical files of several patients. He did this to prove how easy it was to get access to the systems, according to the ruling (PDF in Dutch).'"

Comments

Showoff Gets Off Easy

[Anonymous Coward]

So this putz uses a stolen password to steal confidential documents. He claims that this is ethical hacking?

He's not exposing some inherent weakness in the system, he's using a stolen password to steal documents to showoff his "1337" skillz.

Re:Showoff Gets Off Easy

[sabri]

That is an excellent summary of the judge's decision. The judge argues that by not contacting the systems administrator upon logging in, but instead making copies of confidential data, they went from white hat to black hat.

At the same time, the judge argues, the defendant may not have had criminal intentions. So while the "hackers" crossed the line in their efforts to "expose" the bad security, they were not sent to prison as they are not criminals.

Re:Showoff Gets Off Easy

[Teun]

No, the worry is how far he could get with just one user ID.

Re:Showoff Gets Off Easy

[Anonymous Coward]

No, the worry is how far he could get with just one user ID.

No it's not. The worry is how a patient was close enough to the people working in the lab that they could so easily get hold of a password. A technician in a lab has a direct need to access the patient records, he got exactly as far as he was supposed to with that level of login. If he'd gained access to systems unrelated to that tech's job duties, you'd have been correct.

But as has already been noted, and ruled by the judge, there was nothing ethical about what he did. He should have immediately reported the compromised login to the system administrator (or security, etc.) and gone on his way, not used it to see how far he could go.

Re:Showoff Gets Off Easy

[plalonde2]

And on top of it, the fine is reasonable for what amounts to civil disobedience. It might or might not have been the way to protest, but the fine isn't insane, either way.

Re:Showoff Gets Off Easy

[X0563511]

I like this judge. Seems like sound reasoning to me all around, and the sentencing seems entirely fair.

Can we get this judge to come work in the US? Pretty please?

Re:Showoff Gets Off Easy

[Kaenneth]

Three words:

Two Factor Authentication.

A little bit of eavesdropping should not allow unlimited remote access to others medical records.

Re:Showoff Gets Off Easy

[interval1066]

Bad Security? An employee of the lab was overheard speaking the information. They could have the best security in the world, and all it takes is one idiot employee to ruin it.

Thus we have bad security. It needs to be better. I don't know what the solution is, but a user name/pw is inherently insecure.

Re:Showoff Gets Off Easy

[tsa]

We don't have juries in the Netherlands.

Re:Showoff Gets Off Easy

[menno_h]

For the non-Dutch: the 50plus party defends the interests of people above 50 years of age. I was quite surprised when I saw him on the Dutch news last year, showing off his "1337 h4x0r sk1llz".

Thats how civilized countries do it!

[Anonymous Coward]

No 10 million euro claims for damages, no 15 year sentences for terrorism and definitely no FOX news fear-mongering the ignorant masses.

Re:Thats how civilized countries do it!

[tsa]

No and no. All people are equal for the law here, and the guy is quite popular so this will not cost him many votes.

Head in sand

[gmuslera]

Make illegal to get warned that you are insecure and you will deserve being raped by unethical hackers. Is pretty much like suing the ones that could predict quakes, making sure that noone, ever, will warn you till is too late.

Re:Head in sand

[Solandri]

If you read TFA, the judge's decision is quite a bit more nuanced than the summary makes it out to be:

The court, however, agreed with Krol that the detection of defects in the protection of confidential, medical data can serve a substantial public interest. Krol said he acted as a journalist and ethical hacker at the time of the breach.

The fact that he logged into the website and consulted some files was not unlawful, the court said. Similarly, downloading and printing the files to demonstrate the failures and scale of the security risk are defensible, it added. Krol also handled the information carefully because he redacted the printed files, the court noted.

It was however disproportional that Krol proceeded to view and print more files than necessary to prove his point, the court said. In addition, he should have given the laboratory more time to fix the problem and should have tried to contact them more than once before he informed the media, the court said.

Krol only knew of one employee that acted carelessly with login information. "Therefore, the problem was not so acute that immediate use of media was necessary," the court said.

Sounds like the Dutch have some good judges exercising common sense on this issue.

Re:Civil Disobedience

[tompaulco]

So Rosa Parks deserved to be punished?
Breaking an unjust law to call attention to it doesn't alleviate the consequences of it. Despite what the history textbooks say, Ms. Parks was not just a random black woman who decided to make a stand. She was carefully groomed, the act was carefully planned and timed, and she was more than aware of what the consequences could be. She was likely prepared to end up a martyr. As luck would have it, she didn't have to.

He's an MP.

[Anonymous Coward]

If we're being hypothetical, if he were in the US, he'd be a Senator or Congressman, and as a result nothing would happen - hell, he'd probably be applauded.

Now, if you want to strip the political power away, sure - in the US, he'd probably be prosecuted to the fullest extent the law could be twisted in abuse to.

I suspect he'd be a lot worse off in his home country, for that matter, if he wasn't an MP.

Re:He's an MP.

[Anonymous Coward]

I don't think anyone capable of pulling this off could become a senator or congressman in the US.

Re:He's an MP.

[russotto]

Now, if you want to strip the political power away, sure - in the US, he'd probably be prosecuted to the fullest extent the law could be twisted in abuse to.

We don't have to guess. We know what happens. He'd have been driven to suicide, or if he didn't, branded a felon and thrown in federal prison.

Re:It's not Ethical at all...

[Fuzzums]

In my opinion if you report a system with confidential information to be insecure that would be ethical.
If the owner of the system hired him, then it would have been his job. That's something different.

To add a little gory detail...

[thrill12]

..the justice department (yes, you read that right) actually had a login to the same database as it was found following the news on this particular case. One has to wonder if the official story (needed because of certain convicts that have their records in the same medical DB) is even a valid reason, and why they would even be allowed within 10 meters of such a sensitive and secret (medical wise) collection of data.
While Henk Krol is not a 'true hacker' perhaps, this does raise a lot of questions with regards to the security of any person's data in such a medical database; questions that "Diagnostiek voor U" may want to keep secret, so a "wag the dog" (or more popular "Chewbecca") tactic is followed...

Get the details!!

[Aethedor]

Many of you are probably missing interesting details. The login consisted of a 5 number digit with a password that was exactly the same! Another fact is that Henk Krol DID try to warn 'Diagnostiek voor U', twice! But they sent him away because 'that was not the way to report it'. He had to do it in writing. He also contacted two other governmental organisations responsible for organisations like 'Diagnostiek voor U', but they also sent him away saying it was not their problem. Henk Krol was not fined for the actual hacking, but for going to the press too soon. Come again...?

Re:Civil Disobedience

[History's Coming To]

Rosa Parks did what she did knowing she would be punished, that's the whole point of civil disobedience. You do what you believe to be right and in the process force the judicial system to punish you in public, exposing a flaw in the system. If Rosa Parks hadn't kicked up the legal fuss she did then she wouldn't have had an impact that would still be discussed on internet fora decades later.