Slashdot Mirror
NHS Fined After Computer Holding Patient Records Found On eBay
judgecorp writes "NHS Surrey, part of Britain's health service, has been fined £200,000 when a computer holding more than 3000 patient records was found for sale on eBay. The system was retired, and given to a contractor who promised to dispose of it securely for free, in exchange for any salvage value... but clearly just put the whole system up for sale."
The government fine itself?
The NHS fine should be doubled for stupidity.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
If prism will be selling their old computers too?
This exact leak of data will happen repeatedly. A cloud provider goes under, machines get sold, the buyer is free to do what they want with the data on them, even if it is a torrent of people's personal and banking info.
In theory, the auction site should blank the machines... but what's a blank? A fdisk is still recoverable.
It does not matter if a contract was not signed, there was still an agreement. All that signing a contract means is that the agreement is provable and, hopefully, responsibilities clearly defined. Here: there does not seem to be a dispute as to who should have deleted the data (destroyed the disks), it is the contractor they should pay every penny of the fine.
All of the above written without knowing exactly what was agreed!
FTFA:
We should not have to tell organisations to think twice, before outsourcing vital services to companies who offer to work for free.
Relevant Dilbert
"I bless every day that I continue to live, for every day is pure profit."
well duh, obviously this was the highest salvage value they could arrange.
world was created 5 seconds before this post as it is.
Fining the NHS is pointless, it only harms the NHS itself... Those responsible don't care because its not their money.
They should fine the contractor instead, as it was his laziness/incompetence that caused this.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Q: Why is starting a comment in the Subject: line incredibly irritating?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
I don't really get this. The NHS contracts out the disposal of the machines to a private contractor, who then royally screws up, and it's the fault of the NHS?
Surely the responsibility lies with the contractor?
FTA:
This seems to me an argument that the NHS cannot outsource or subcontract anything.
What is NHS Surrey supposed to do in this scenario? Use in-house people to analyse the machines to make sure there is no data remaining before disposing of them?
Or just keep data-disposal services in-house? Personally, I think this would be a great idea, but it goes against the dogmatic 'privatise absolutely everything possible' trend in the UK.
Except they didn't work for free: they worked for the salvage value. I can't really see how the low value of the contract proves fault.
Is that the NHS owns any computer equipment with residual value, even for eBay. The average NHS computer is an ancient, square, clunky CRT affair with horrible cheap plastic parts, usually running Win 3.1. Nor is it for lack of spending on "ICT" (don't ask); I wonder where the money ends up. It sure as hell isn't spent on patient healthcare.
but what's a blank? A fdisk is still recoverable.
dd if=/dev/urandom of=/dev/sda bs=1M
dd if=/dev/zero of=/dev/hda bs=1M
Or something equivalent. It's not hard to blank out a hard drive, just time consuming.
a) Who the hell said anything about cloud?
b) That's not how cloud storage works. Data is scattered across thousands of drives, stored in a strange format that requires terabytes of meta data to make any sense of. Having one drive would be like having one drive out of a RAID 5 set: utterly useless.
It's not hard, but who is going to pay me to type that command after the cloud company went bankrupt ?
If the debt collectors think the computers are more worth with software and interesting marketing data than with blank drives, they certainly won't wipe the drives before selling them.
Your records aren't secure or private in the first place, no matter where you live or get health care. I've had 5+ sets of digital AND paper records just magically go missing from several hospitals. The doctors didn't get really care, they just re-ran the tests and in one case the re-run results also went missing. If you believe in an illusion of privacy and security with your countries health care system then you've been fooled.
Of course there's still a small risk that important data has gone to a bad sector which is no longer mapped and thus also not rewritten in the process.
However if confidential data is stored strongly encrypted (as it should be), then as long as your key is reliably wiped out, it doesn't really matter if the rest of the data is still there. Nobody will be able to read it anyway.
Well, unfortunately "should be" is entirely different from "is" ...
The Tao of math: The numbers you can count are not the real numbers.
http://www.bbc.co.uk/news/technology-23286231
Seems like NHS Surrey was being wound up, so I guess they simply didn't give a damn what happened to their PCs and data...
Nice professional job guys...
Since NHS Surrey is now no more, fine will be paid by another Gov department.
Of course, all this is just bullshit, the Gov taking your money out of their left pocket and sticking it back into the right...
Meanwhile, the people who were trusted with confidential patient data, and abused that trust, appear to remain unpunished.
Not just that the thing was found, but also that the contractor did that and caused it to be found out. Getting someone to "promise to dispose of it securely for free" without the right paperwork is not a policy for a government agency.
How hard is it to wipe a machine? I've never been a fan of the wasteful practice of physically shredding hard drives. But a simple policy is that you physically take every drive out of the machine, hook it up to a master machine, and run a reliable drive wiping program. As for the reliability of these drive wiping programs, I have not only not heard of something slipping by them, there is one company that sells hard drives that have been wiped with only zeros and has a cash prize if you can restore the data. So if you are doing a two pass random data wipe you are way ahead of the state of the art.
I am fairly certain I could set up a drive wiping station (with a multi drive connector) for about $200. Then if you occasionally did get a drive with a weird issue where you couldn't wipe it then you use the hammer next to the station and bonk the drive a few times and throw it in a special box for physical destruction.
This is not rocket surgery.
dd if=/dev/zero of=/dev/hda bs=1M
Or something equivalent. It's not hard to blank out a hard drive, just time consuming.
My equivalent is a 9mm round. Pierces a hard drive case easily from 25 feet away. It's a thing of beauty watching a drive buy it.
Close, but not quite. Overwriting with dd won't overwrite sectors which have been remapped by the drive's firmware (and it's not hard to reinstate these sectors so their contents can be read).
The correct way to wipe a drive is with "hdparm --security-erase" or "hdparm --security-erase-enhanced". That will overwrite everything, remapped sectors included. The only downside is that you can't wipe specific partitions (e.g. leaving a factory restore partition intact), only the entire drive.
If you have a drive which is so old that it doesn't support the secure erase command, it's probably too small to be of use to anyone (and who would trust data to a drive that old).
Solid-state drives can't be securely wiped, period. Physical destruction is the only solution.
In theory, the auction site should blank the machines
At least here in the UK, there is no law that would require them to do so as far as I am aware. The only obligation to destroy the data rests with the data controller, who in your scenario is not even the cloud provider. The cloud provider may have undertaken to do so on behalf of the data controller, but I am uncertain if such an obligation would survive the company being declared insolvent: at such a time, recovering the maximum possible revenue for the company's creditors becomes the highest legal priority; honouring existing contracts is relegated to a distinct second place.
When are all these organizations going to learn that NO DATA should ever be on a mobile device? All access should be done through virtual desktops from secured, managed devices using strong authentication and mandatory access controls, period. This is not rocket science and the technology has been available for years. They only have themselves to blame.
This also only works "in theory". The list of drives with hopelessly broken "SATA secure erase" implementations is a long one.
I still don't understand how this kind of breach of data security is even possible. The real question is why the records access system even allows data to be downloaded to a local hard drive for access - surely each PC should contain an operating system and whatever client application is necessary to access medical records. There should never be a need for a local copy to be made - remember these PCs are connected to the hospital's network. It simply shouldn't be possible to export records from the system unless they are suitably anonymised - and access to this export function should be restricted to those involved in research programmes. Fining the NHS trust for allowing the breach does nothing to solve the real problem - that the records storage and access system permits records to be downloaded in the first place. Get the IT requirements right at the design stage and most of these problems go away.
The sad thing is that every disk drive sold this century has a low level secure erase function built in, but practically no-one knows about it. You can activate it with hdparm.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Even better. Use /dev/random instead of /dev/zero. Good luck to anyone trying to recover that data.
Why is /dev/random better? They should not be able to retrieve the data if the drive has been zeroed?
I knew it existed for SSDs, didn't know it also applied to hard drives too.
You see what I did there?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
This isn't the first instance fwiw. I received a mac off eBay that was owned by a KPMG secretary and not wiped before resale. It contained records of all accounts held by KPMG as well as addresses, phone numbers and social security numbers of all KPMG staff at all branches. I reported the breach to KPMG online but afaik they did nothing in response. Shrug, they're lucky the mac didn't get into the hands of a identity thief. But who knows how many other such computers from KPMG are out there on eBay to this day going to god knows who.
/dev/random is slightly better because on a hard drive, the data band is surrounded by guard bands, areas of unused magnetic surface that separate them from the next track. Head positioning and magnetic footprint aren't 100% accurate, so these guard bands get a little magnetic influence from the data written on the data band. If the data band is erased with zeros, the guard bands are not scrambled and can be used to recover the data that had leaked onto them before. If you write random data on the data bands, the leakage into the guard bands will also scramble up the leaked magnetic patterns from the previous data.
Coat [at least] one side with glue.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
The contract should include a clause stating that the contractor must abide by the contract? Should it perhaps include another clause stating that the contractor must abide by the clause stating that the contractor must abide by the contract?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I did not know this. Thanks for enlightening me!
It is the full responsibility of the NHS to make sure patient data isn't leaked. This means it is almost criminal to outsource it, and if they do outsource it, it must be audited. But if they are even too stupid to wipe the hard drives before handing the machines over, they are just incapable of working with sensitive data.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
I had purchased a harddrive upgrade at a liquidation type of event at the local convention center. When I got it home, I ran Norton Recovery software on it and found quite a few "top secret" research files from Dow Chemical... don't have them any more, but I thought that was interesting. I'm assuming that it was the same situation. When I was in charge of getting rid of sensitive data from our servers (where I used to work), we used a large drill bit and drilled the drives; eventually switching to glass platters that we could just hit with a hammer to destroy after doing a multiple pass random write format of the drives. They were literally destroyed to protect the data on them... this wasn't a government agency, but we took the security very seriously -- and did it all in house so we knew it was done right.