Slashdot Mirror
BPAS Appeals £200,000 Fine Over Hacked Website
DW100 writes "A UK charity that provides help and guidance for women seeking abortions has been fined £200,000 after a hacker breached its website in 2012 and was able to gather data on 9,900 people that had requested help from the organization. The hacker was given almost three years in jail for the attack. The charity's CEO has condemned the decision, arguing it rewards the hacker for his efforts."
The data was unintentionally stored in their CMS after miscommunication with a contractor, and they never performed security audits. Martin S. writes "The BPAS is appealing a £200,000 fine imposed by the ICO after their website was hacked by an Anonymous anti-abortion extremist. The amount is particularly egregious when perpetrators of willful data theft often attract fines of only a few thousand pounds."
lucky them
If the perpetrator was sent to jail how is this 'anonymous'?
How do you know this wasn't a simple extortion for money scheme?
Well I mean there do need to be penalties for companies not storing customer data correctly, especially in the medical field. Im not versed enough on abortion cliniques to know if 200K is justified or not but they should get some sort of fine no questions
have you seen my sig? there are many others like it but none that are the same
If this were a for-profit corporation, this verdict would have never been tried, much less decided on. The target was easy and fairly defenseless.
I have no sympathy. They need to be required to pay the fine so everyone else who handles personal data gets the message that you don't handle it negligently.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
This was a big mistake, especially considering the danger from some extremist anti-abortion people, but this seems like an overly large fine against a charity.
Ignorance is no excuse, of course, but I'm sure they didn't intentionally leave that vulnerability. They hired the wrong people, didn't give enough oversight, and it lead to the potential harm against their clients/petitioners and great financial harm against themselves. (and, by extension, the people who funded their efforts who will have a good portion of their charitable funds go to waste due to mismanagement and this fine)
I'm pretty sure the 'hacker' would rather not have been sent to prison. Sometimes we need to take *some* responsibility even if a government is being excessive in its condemnation and punishment. It seems that maybe there aught to be some liability on the part of the contractor... maybe. I'm a little leery on that only because for that to be true there should be significant increases in the amounts charged, a contract that stipulates it in F'ing bold and clearly shows that additional payment for such guarantees. And after all that there should be some company insuring it in the event of a security lapse. Ultimately a contract stating this should have been the liability of the company/CEO and his duty to have gotten an insurance policy in the event of a lapse. Any failure in that deservedly should come from his paycheck (though, if its a non-profit, at a reduced liability, provided the non-profits in the UK are the same as in the US, whereby employees get sub-standard pay compared to the commercial companies they could be working for).
that's only about £20 per victim of the attack. I think £1,000-£10,000 per victim is more reasonable. There is no reason in this day and age for any company to not have their data properly secured.
This wasn't a corporate site nor was it a medical services site. This was a non-profit charitable organization. Suppose I set up a website of my own, not for profit, in which I provide information on where to get an abortion. Suppose I don't secure my web server enough and a hacker gets a copy of my access.log files and is thus able to determine who visited my site and suppose they publish that information. Would I be subject to big fines as well? What if it was a website about some other subject like building model trains? I understand in this case the hackers probably got more than just IP addresses, but where exactly is the line drawn? Is anyone who has a website in danger of running afoul of these laws?
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
In the case of the data protection act, inappropriate disclosure of data is a strict liability offence. Just because an instituition or person subcontracted it out and the contractor and the contractor was negligent is neither a defence nor a mitigating factor. The holder of the data takes absolute responsibility for its safe keeping, and this responsibility cannot be waived.
As a case in point, one hospital needed to dispose of some old servers. They contacted a data destruction contractor with experience of high security data disposal. However, a new hire at the contractor stole the drives, issued fake certificates of destruction. The drives subsequently turn up on eBay with data intact. Hospital guilty, fined £400k for failing to supervise the contractor.
Is that they're fining a non profit organization supported by donations.
If this was a business I would see more sense, but somehow fining charities doesn't sit well with me.
This is nonsense. "data theft" and "failure to secure personal data" are two completely different crimes - it's perfectly normal for different crimes to have different penalties.....and failing to secure the personal details of 9900 patients is a far more serious crime than breaking into a computer and copying files.
... and jail time.
You are a charity, ask for people to donate to help out.
Many thousands of women from the Republic of Ireland have to travel to the UK in order to get a safe abortion, as abortions are virtually illegal in Ireland. What makes this particularly serious is that Ireland has moved towards making it illegal for Irish citizens to have an abortion anywhere in the world; and so if this information had leaked then thousands of women could have become liable for prosecution or at least investigation.
I find this outcome incredibly offensive. The hacker is probably so radically anti-abortion that he doesn't give a shit about his fine or jail-time. All this really does is damage the charity, which was probably his goal in the first place: to get them fined for not securing data. And, as has already been mentioned, the charity probably isn't even responsible for the data breach. All the work was probably contracted out. Besides, if Stratfor and Sony and damn near everyone else can't securely store data, what makes you think this charity magically can?
All of our systems are hackable. Everyone is vulnerable to an advanced persistent threat.
I find this outcome incredibly offensive. The hacker is probably so radically anti-abortion that he doesn't give a shit about his fine or jail-time. All this really does is damage the charity, which was probably his goal in the first place: to get them fined for not securing data. And, as has already been mentioned, the charity probably isn't even responsible for the data breach. All the work was probably contracted out. Besides, if Stratfor and Sony and damn near everyone else can't securely store data, what makes you think this charity magically can?
All of our systems are hackable. Everyone is vulnerable to an advanced persistent threat.
Anonymous because
1) 'James Jeffery' defaced the the site with Anonymous logo and anti-abortion rhetoric.
2) Posted claim on @Anonymous on twitter
3) Was 'Ratted Out' by FBI informant Sabu.
Hacker Makes Anonymous Look Like Assholes By Attacking Abortion Provider In Their Name
If fact the negligence in this case was the fault of an external IT contractor who stored the captured data on the website CMS, after the requirements has been change to specifically exclude this feature because of security concerns. However the DPA doesn't take this into account. Data loss is an absolute offence, no negligence is necessary. If the organisation loses the data they are guilty.
The size of the fine is not a reflection of the degree of negligence but a result of the damage done . In this case very serious damage because the extremely sensitive nature of the data and who was able to access it.
It is rather trivial to extract the user database of slashdot through the beta front end. I am about to sue slashdot for 1 billion dollars for emotional harm caused by the release of my personal information that I found on numerous file sharing sites.
Your bank wastes so much money on security to keep your money safe. Why the hell should the bank spend penny one, when if it is robbed, the fault lies entirely with the criminals responsible?
Is that fair? Is that right? Without crime there would be no need for security, so use 'punishment' of the criminal as a 100% substitute for the concept of 'security'.
I'm a BETA, dribble dribble. I sat through endless hours of High School, that taught me all about 'critical thinking', dribble. This argument by the abortion charity makes perfect sense, dribble, dribble. I mean, it just follows from any reasonable analysis of the facts, dribble. That's why the owners of Slashdot are pushing this propaganda here, dribble. To help us push for a better way, dribble, dribble. I mean, you either on the side of the operators of websites, or you are on the side of the hackers, dribble, dribble, dribble, dribble.
How DUMB do the owners of Slashdot think YOU are?
beta or not ...
there's no https to "http://ico.org.uk"?