Slashdot Mirror
US Health Insurer Anthem Suffers Massive Data Breach
An anonymous reader writes Anthem, the second-largest health insurer in the United States, has suffered a data breach that may turn out to be the largest health care breach to date, as the compromised database holds records of some 80 million individuals. Not much is known about how the attack was discovered, how it unfolded and who might be behind it, but the breach has been confirmed by the company's CEO Joseph Swedish in a public statement, in which he says they were the victims of a "very sophisticated external cyber attack." The company has notified the FBI, and has hired Mandiant to evaluate their systems and identify solutions to secure them.
Swedish said the breach is extensive: the vulnerable data included "names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data," though "no credit card or medical information, such as claims, test results or diagnostic codes were targeted or compromised." (Also covered by Reuters.)
Huge databases full of personal info are gigantic targets, and properly securing them is very very difficult (and what's worse, uneconomical, since most of them are owned by publicly traded companies)..
Pandora's box is open now, but don't say the tinfoiled warriors didn't warn you..
He tried to kill me with a forklift!
The hell you say! I'm sure all that money they saved not building an adequate infrastructure is much more than this breach will cost them. Oh, wait...
Never underestimate the power of stupid people in large groups.
Grind your axe somewhere else. You don't like the ACA? Write your congressman. Fuck off.
Never underestimate the power of stupid people in large groups.
So of the roughly 300 million people with SSNs, nearly a third of them are nearly compromised? Great.
Why is a healthcare insurance provider collecting income information on the people they insure? That's none of their business. The answer is probably 'just because they can,' but that doesn't mean I have to like it.
What, you weren't buying medical insurance before Obamacare? I find that hard to believe...
Always stuck me as silly that your SSN was supposed to be secret and is used as a password. But you can never change it and you have to give to everyone including companies like this that lose it. Seems like the SSA should also give you a password that you can update that places could authenticate against. That way if you suspect a breach and you could update that number. Something like they you come in verify your identity and give you a new PIN.
When I see a new doctor, they always demand a SS# along with all of your personal information.
And when I tell them that I am uncomfortable with it, I always get a stern and rude demand. Any explanation of how insecure medical is - those people email and fax that information willy nilly - I get this "I'm full of shit look."
I hope those people get their identity stolen and their credit ruined so they can learn a lesson.
Don't worry, they are going to give you a free trial of credit monitoring... The credit monitoring company probably even gives them a kickback for referring 80 million potential new customers after the 1 year trial subscription expires!
Maybe they should change their name to Anathema Insurance
Demented But Determined.
My congresscritter has managed to vote to repeal ACA 50+ times since it was passed. Got any ideas on how to make him stop? Letter writing didn't help. Voting against him didn't help either.
Hard to believe someone wasn't handing their money over to a private company because the government told them they had to, isn't it? Imagine that, someone taking responsibility for themselves rather than being forced to pour their money down a black hole just to make sure some CEO gets their bonus.
The mind wobbles.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Sadly, in the absence of data protection laws which makes corporations liable for this, this will continue.
Unless companies carry a real cost for failing to secure this stuff, they'll continue to treat this as an afterthought.
But apparently forcing corporations to not be clueless and careless idiots would somehow be a bad thing.
Sorry, but if you need to have private information like that, you need to be accountable. If you aren't going to make companies accountable, don't allow them to have the data in the first place.
Lost at C:>. Found at C.
Simply WTF. If nothing else but "names, birthdays, medical IDs/social security numbers" would've been stolen, that in itself would've been much more then acceptable. Hell, one would expect the most sensitive data of people would be more protected... At the very least, the company should cover IDtheft protection expenses for _all_, for at least a year, maybe more. Plus, they should be fined, with such a large amount that they'd get scared, and start implementing _real_ data protection policies. Yeah, you wish...
At companies and agencies handling such data, _all_ kinds of data leaks or thefts should be treated as criminal offenses and they should be punished, I mean really punished. If you can't handle the protection of the data, don't handle them in the first place.
While I also consider the thieves to be criminals, I'm more angry with those, who simply are inept to protect their best assets, even more so since they have the money, manpower and resources to do so.
Also, I'd like to see a national blacklist established, with all companies and agencies on it, who had similar massive data breaches, and made publicly available, so as everyone could judge and decide whether they'd like to entrust their data to such idiots.
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
Not saying this to be a dick. Saying it because the way you come across right now is as someone who takes pride in stuffing jargon in the faces of others.
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
Well, that's democracy in its current form for you. In 2010 the GOP got to re-draw congressional districts, and they gerrymandered them in such a way that anyone other than a staunch right-wing Republican will never ever get elected. You could run Jesus against the GOP candidate and it would be close.
Never underestimate the power of stupid people in large groups.
Comment removed based on user account deletion
Its nice that they notified us today that our information was breached, but the real question is why they didn't notify us sooner.
They setup a specific website about this breach.
http://anthemfacts.com/
The problem to me is that they just now notified us, yet they registered the domain for the breach on 2014-12-13. Which goes to show that they knew about the breach nearly 2 months (or possibly more) before deciding to inform us.
Why does a Health Insurer need information about income?
And why is all that data in the same database and is anyone allowed to pull ALL data?
I am actually surprised that a private insurance got hacked before healthcare.gov, is the government actually better in securing their data?
Lol, you can't seriously think they bought this domain just for this.
and they gerrymandered them in such a way that anyone other than a staunch right-wing Republican will never ever get elected
You mean, like the Democrats have done forever in places like Maryland? The way they've tortured the district boundaries in that state is a showcase for craven political monoculture at the state legislature level. That even Marylanders got so sick of the lefty power plays that they refused to coronate the dem governor's anointed successor and went with a relatively unknown Republican in November is pretty telling.
Don't disappoint your bird dog. Go to the range.
Yell at them for requiring it.
I don't yell; I sue and file criminal complaints.
In the old days, the insurance companies used your SS# as your member #. They stopped doing that years ago but the doctor's office workers do not know that.
But they also demand it for collection reasons.
That's the REAL reason doctors office demand it: collections. Meaning when you go and the insurance doesn't cover everything and you can't pay the balance, off to a collections agency.
I thinks that all bullshit in this country. If a doctor signs a contract with my insurer for payment amounts, they should take that amount and none of this BS of coming for the balance from the patient. I also think it's unethical.
Unfortunately, Anthem probably still has my SSN, so I'm still hosed. Damn, the magic password leaks again...
So, you've got a 100k of disposable income sitting around just in case you had to say in the hospital for a week? Well, good for you, but I don't want the likes of you setting public policy, you know.
A successful API design takes a mixture of software design and pedagogy.
Ever think it might be because the Democap party, in its current form, sucks so bad that people will take ANYTHING thats not a democrat?
Swedish said the breach is extensive: the vulnerable data included "names, birthdays, medical IDs/social security numbers, street addresses, email addresses and employment information, including income data," though "no credit card or medical information, such as claims, test results or diagnostic codes were targeted or compromised."
Security was breached, personal information was stolen, but no CC or medical information. Can they tell us what prevented the theft of medical information? How can that information be used to prevent the future theft of data with other companies? Using the same methods, could it protect things like employment info and income data? Can systems be designed to be more bullet proof?
My first guess is that the medical information was on different servers, maybe at different locations, and access to those systems was not that easy. Given the fact that systems will be broken into, how can you design these big information systems in such a way that only a limited amount of data can be stolen?
Yes, the behavior is totally defensible because the other side does it as well.
Except, you know, not.
Never underestimate the power of stupid people in large groups.
Has any information been release regarding how the attack was performed?
So it's so gerrymandered towards Democrats a Republican got voted in....yeah seems legit. I just looked at the Delaware voting districts and they really don't look too tortured. Do yourself a favor and look at Texas if you want a good example of gerrymandering. They literally break up cities into chunks with large swaths of rural areas so that there is no way a Democrat could reasonably win, it's actually a very purple state, same with Massachusetts, though I don't think that Mass is gerrymandered, they regularly have Republicans elected into office. I'm not saying it doesn't happen in Democratic states, but that there are a few states in the south where it's comically so and they happen to be Conservative states.
Every new huge data breach means more opportunities for identity theft. More and more ruined (and practically irreparable) credit records.
Eventually enough people will have such bad credit scores, justly or not, that lenders will have to either a) not lend or b) assume higher and higher risk thresholds.
Once a critical mass is reached, the whole rotten credit industry comes crashing down. Panic ensues.
Maybe then we'll get something like effective reform. Or a primitive cash-or-barter economy. Either would be an improvement.
I'm not saying you're this stupid, but why is it that many "libertarians" seem to think that not having insurance and depending on everyone else to pay for their emergency room visits is somehow personal responsibility?
"Taking responsibility for yourself" means by definition not freeloading off the system, as so many "I'm not signing up" douchebags choosing to do. I say let them opt out, and if they get hit by a bus or fall down some stairs or get cancer, fine-- no ambulance, no ER visit, no treatment at all-- leave their rotting carcasses out in the street so everyone else can see a libertarian dying by the terms of their rugged individualism and self-sufficiency. Yes that's sarcastic.
Taking responsibility for yourself means signing up for insurance and not mooching off those who DO pay for your health care when you need it.
Or... feel free to die in the street from treatable illness/injury as a warning to others. I really have no problem with that. Unfortunately as part of having a "society" and all, others are more compassionate for the losers who freeload without stepping up and self-insuring.
Just like the anti-vaxing idiots who opt for "personal freedom" by placing a severe risk of death on those around them and mooching off the herd immunity of others, not signing up for insurance is just selfish freeloading that makes others pay for your benefits and puts others in harms way by raising the systemic costs of those benefits for those who actually do the paying for it.
Don't want insurance? Jesus. The mind wobbles.
The information needs to be accessible. The insurance company has to access it, of course, as well as partners like billing and collection companies, doctors and hospitals query the system, and to enforce ACA the IRS needs access, the state exchange you bought it through ... Probably three more types of entities I'm not thinking of off the top of my head. I'd bet there are at least a dozen different government agencies involved with ACA who can query your information.
If the IRS, the insurance company, the hospital, the state, and the billing company can read the data, the bad guy can read it too. The data may very well be encrypted on-disk, so if someone stole the hard drive they couldn't easily read it. It has to be decrypted by the system, though in order to be useful. Therefore, any encryption used must be mostly "feel good" encryption that doesn't actually do much to protect your data.
To protect it, we first need address the issue that all of these different companies and government agencies get access - treat it as PRIVATE data, not to be passed around. THEN effective measures could be put in place to ensure it never leaves the insurance company's network.
I'll specifically address two things you mentioned:
> why not just keep any encryption keys in memory only where it's that much harder to get them
So the computer system has access to the decrypted data, because it has the key. The bad guy has control of the computer system ...
> these systems are already hugely expensive and it makes it incredibly difficult for anyone without physical access to get at the actual data.
So only the guy in the server room can access any patient^H^H^H^H^H^H customer data, for a company with millions of customers? That's going to be one busy guy! Roughly everyone who works at the insurance company needs some access to their customers' information, so it has to be on the network. The IRS demands access too, so the insurance company has to connect it to the internet.
"Employment information" would potentially cover a lot of different things. Employer, job title, years of service, etc. Verifying title against income, an attacker could easily target employees who would have access to key systems within a corporation, and use the given email address as a starting point to launch those attacks.
Attacking an insurance company provides a goldmine for any nation-state looking that wants to perform espionage against US companies. My first guess is that they didn't WANT the financial information.
Democracy is a big fat fail. Fortunately it's always replaced eventually by a dictatorship.
Its not just naked hypocrisy though. The situation is more like you have a gun on someone, who wants you to put it down; but you are like 99% certain the moment you do they are going to run over pick it up and point it at you.
Dems have use gerrymandering in the past, they would again if positioned to do so; or resort to some other dirty trick like trying to limit corporate donations while leaving the door open for unlimited union contributions. Or for that matter attaching a major heal care overhaul to the budget reconciliation process for the express cause of preventing the other side from having a floor vote or the opportunity to propose amendments they were sure would cause the legislation to fail.
No you can't expect one side to unilaterally disarm. It would be political suicide for those who are in it for the power, and needless surrender for those who are actually fighting for something on principle. The problem is our political system does not really allow for the creation of an enforceable bilateral agreement to "cut the crap" and actually behave democratically rather than seeing what you can get away with via process tricks and legal wrangling. In short there really is no solution until one side manages to suppress the other entirely (where we all lose).
The real question is can the DNC run out the clock until such time the GOP demographically can't win; or with GOP first succeed in sufficiently controlling participation and eligibility such that it won't matter. I am pretty pessimistic that the idea of "government by and for the people" has much chance for survival. So I say choose your sides folks, you can have the socialist boot in your face, or the fascist boot up your ass, its mostly likely going to be one or the other.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Under the current set of regulations, the information needs to be accessible. The insurance company has to access it, of course, as well as partners like billing and collection companies, doctors and hospitals query the system, and to enforce ACA the IRS needs access, the state exchange you bought it through ... Probably three more types of entities I'm not thinking of off the top of my head. I'd bet there are at least a dozen different government agencies involved with ACA who can query your information.
If the IRS, the insurance company, the hospital, the state, and the billing company can read the data, the bad guy can read it too. The data may very well be encrypted on-disk, so if someone stole the hard drive they couldn't easily read it. It has to be decrypted by the system, though in order to be useful. Therefore, any encryption used must be mostly "feel good" encryption that doesn't actually do much to protect your data.
To protect it, we first need address the issue that all of these different companies and government agencies get access - treat it as PRIVATE data, not to be passed around. THEN effective measures could be put in place to ensure it never leaves the insurance company's network. So long as the IRS demands access to query it, it has to be accessible via the internet.
So it's so gerrymandered towards Democrats a Republican got voted in....yeah seems legit.
You're (deliberately, no doubt) confusing congressional elections with gubernatorial elections. That you're even putting forth an opinion on the matter while being (or pretending to be) that clueless is pretty funny. Or would be, if it wasn't clear whether or not you vote using that same brain.
Don't disappoint your bird dog. Go to the range.
"very sophisticated external cyber attack."
Some some kid walked into the server room with a usb key and copied all the files.
That's 80 million social security numbers connected to personally identifiable information.
It should now be illegal to use it as the "secure" way to identify someone.
For sensitive information like financial or medical data, it may be time to physically isolate the main data warehouse so any non-insider breach would only compromise records that had been copied to a "front end server" for short-term use.
Here is how it might work:
You have a back-end data warehouse that holds all of your records.
You have a "smart filter" that mediates access to this back-end database. This filter looks for suspicious behavior and alerts real human beings when things start to look funky. Ideally this "smart filter" would be "invisible" to both the "back-end data warehouse" and the "front end cache" which I will describe shortly. This "invisibility" will make it much harder to compromise.
You have a "front-end cache" that contains holds copies of information from the back-end data warehouse for a very short time - hours or days for most types of information.
It is this "front end cache" that bank tellers, ATM machines, home-banking web servers, etc. access.
If the front-end cache gets compromised and all of its data stolen, there will be a loss but it won't be nearly as big as the loss of having the entire data warehouse compromised.
If the front-end cache gets compromised in a way that causes it to start querying the back-end data warehouse for lots of data, alarms will go off.
This system is designed to mitigate damage, not prevent it entirely. It is meant to augment, not substitute, for existing security measures. By itself, it does nothing to protect against spear-phishing or to protect against a non-greedy adversary who is content to get only a small fraction of the total data available. But depending on how much it limits the damage when a breach does occur, it may be well worth the cost.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I'm not saying you're this stupid, but why is it that many "libertarians" seem to think that not having insurance and depending on everyone else to pay for their emergency room visits is somehow personal responsibility?
Because what passes for "Libertarianism" htese days is selfish pricks that don't want anyone to tell them what to do.
Also that they pay nothing for an emergency room visit that they allow the rest of us to pay for.
Which to me sounds like a socialist money redistribution scheme. Just filtered through our insurance companies/Guvmint in the form of rate hikes.
Anyone that has a brain could see that we were in a positive feedback loop with people falling out of the insured due to price, then getting emergency room care as their primary care, and the costs being passed upwards, and more people dropping off the insured lists. So eventually we were going to get an insane sort of universal health care system that didn't work for shit.
And yet, all these other countries have not performed a divide by zero operation with their health care systems.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
That sort of thing [holding higher-ups accountable] only happens in China
In theory and I'm sure sometimes in practice, it also happens in the US military. In some situations, if a service member violates orders and his boss doesn't fix the problem pronto or fails to see a problem that it's his job to see, he gets punished.
I say "in theory" because as with many organizations where "who you know" and "your perceived value to the organization" are unwritten factors in who takes the blame when things go wrong, there are probably plenty of times when the rules say such punishment should happen but the reality is that it does not.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Youre full of shit.
The dems are the ones who gerrymander to gain the minority swing vote.
Regardless, the electoral college sucks. Just.tally the.damn votes and.pick.a winter already.
You're an actual retard. The GOP gerrymandering of late has been all over the news. Oh that's right, you ONLY trust Fox News because you ARE A MORON.
The potential exposure for individual financial fraud and identity theft is really bad with this but it's not the only concern. With this breach they have SSN plus detailed employment info for what probably amounts to nearly every employee at any company who uses Anthem for their health plans. What do 90% of helpdesks ask for when resetting something like a password or issuing one-time use tokens for 2-factor authentication? Last 4 of your SSN. With a little work to figure out a few things like login ID formats this data could be used as a jumping off point to target any of the thousands of companies that use Anthem for their employee health plans, across who knows how many industries. This could be the breach that keeps on breaching for a long time to come.
I browse on +1 so AC's need not respond, I won't see it.
If you pay for services in advance and tell him you will file your own insurance paperwork for reimbursement, then he will not only want your business more than if you don't, but he won't have any insurance/banking/collection reason to need your SS#.
This will leave only a few reasons why he might ask for it:
* Some federal or state law requires it (doubtful, but possible)
* He's part of a larger practice which requires the SS# (possible)
* His patient-tracking or -payment system chokes without it (very likely) and he doesn't know how to work around that problem (also very likely).
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
A private key should be easy enough to print out.
If everyone had such keys I would make at least two encrypted copies, one each with the public keys of people I trusted and who I believed would be accessible, such as my parents or a sibling if they lived nearby.
Then I would print out the encrypted copies. I would keep one of each for myself and store one of each someplace else.
This way, if I lost my key-fob I could go to one of them and get it re-made. If my house burned down taking my key-fob and my printed copies with it, I could still re-create the key fob.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
So only the guy in the server room can access any patient^H^H^H^H^H^H customer data, for a company with millions of customers? That's going to be one busy guy! Roughly everyone who works at the insurance company needs some access to their customers' information, so it has to be on the network. The IRS demands access too, so the insurance company has to connect it to the internet.
The notion of an operator-provided or operator-unlocked key is the way it used to work "back in the days" when every server had a monitor plugged into it. You would provide a password on bootup which was a mini-key to decrypt the actual SSL/TLS keys. It would get stashed in memory at that point and (hopefully) operator intervention wouldn't be needed again until the next scheduled reboot. Before too long, the threat of in-memory attacks far eclipsed the threat of physical server theft and this practice was ditched.
NO.
The better way to fix this is to require strict liability to the Credit reporting agencies. If they put data in your credit report that is false, If they link you to debt that you actually didn't take out, then they have unlimited liability to damages to you plus statutory punitive damages.
The hell, if when they come and sell me credit protections services isn't extortion i don't know what is.
"Nice credit score you have. It would be a shame if someone stole your identity and messed that up so that we had bad info for you in our database. Pay us per month and we will ensure that doesn't happen"
When credit agencies actually start pushing banks and other creditors for ACTUAL proof that it was that person, then the whole industry will quit using SSN's as ID's, which they aren't.
Yes, the behavior is totally defensible because the other side does it as well.
This coming from the person that (a) was the one that brought up gerrymandering, (b) only mentioned the GOP, and (c) vilified the GOP.
A very consistent thinking process you have. You will slam them publicly when the GOP does it, but you will also make every attempt to avoid saying that the DNC is also doing it.
When confronted with your hypocrisy you shrug it off and again make sure to not directly say that the DNC is also guilty but instead say "the other side."
Intellectual honesty is only intact when its from start to finish. When it isnt from start to finish, you are just a partisan asshole.
"His name was James Damore."
Because what passes for "Libertarianism" htese days is selfish pricks that don't want anyone to tell them what to do.
Its selfish to not want to be told by someone else what to do?
It is the people that think they have an automatic right to tell others what to do that are selfish. This seems to be a common theme in politics today, where a group guilty of something like being selfish, label those that oppose them with what they themselves are actually guilty of.
It is not selfish to want to avoid other peoples tyranny. You dumb fuck.
"His name was James Damore."
So both sides are doing it, but you only want to vilify the GOP for doing it. Is that about right?
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
I wasn't vilifying anyone. Nowhere in that statement did I refer to the GOP, or indeed any particular organization, person, or group. I was making a statement that bad behavior is bad behavior, even when everyone does it. Gerrymandering is hurting our country, and that's gerrymandering both by the GOP AND the DNC.
Now I'm going to vilify someone: Your bias and knee-jerk politics are showing. You're seeing persecution where none exists. I bet you're a fundie, too.
Never underestimate the power of stupid people in large groups.
Seems to be annual ritual now. Just watch accounts and credit histroy.
That is not a bad idea.
Interesting notion, since congressional districts are drawn by STATE governments, and the GOP didn't (and doesn't) control all State governments.
Then, it has to be vetted by the Justice Department. You remember that one, it's run by Eric Holder. And Obama is Holder's boss, not the GOP.
"I do not agree with what you say, but I will defend to the death your right to say it"
The Greeks figured this problem out about 3600 years ago. Don't kill the stupid-f*, go to town and cause everyone else to want to go and kill the stupid-f*. Then go home and watch it on CNN, with a cheap cold beer in your hand.
The bad guys took every other piece of relevant data about you, but not your credit card data; ya, right.
The key thing here is that most of these details are write-once, read-rarely. How often is a Social Security number actually needed? At sign-up and then only if there is a problem, like unpaid debts. So why is it even in the computer to begin with? Put it on a piece of paper, file it in a well organized records room and in that rare case of needing it, have a couple of minimum wage people on staff whose job is to go pull paper records. Same thing with date of birth - nobody needs the specific date, for all medical purposes the year alone is more than sufficient, probably even a 5-year range is good enough.
With paper the risk of wholesale data-theft is reduced to the people who have access to the room and how many file folders they can sneak past a security guard.
The only reason this stuff is in the computer anyway is because of a "collect it all mentality" nobody has considered the risks of electronic records, only the benefits such that even the most minimal benefit is considered sufficient reason to justify putting it in a database. Start doing a full cost/benefit analysis and many of these database choices will look like bad ones.
The GOP controls enough state governments to put them in a majority in both houses of Congress, despite their unpopularity with the general population. Whether it's the national org or the state ones, it's still the same thing. The state parties do what the national party tells them, more or less, lest they find themselves primaried.
Justice is supposed to follow the law, not make decisions based soley on politics. If there were something illegal or unethical in the re-districting that they could make a case against, then they would. If it's clean (albeit distasteful) then what the hell is Justice supposed to do about it? Should Holder have rejected it because he reports to a Democratic president? Sure, Holder can play politics by deciding what to prosecute and how to exercise his executive authority, but if there's nothing there, there's nothing there. And I guarantee you they went over that redistricting with a microscope.
Never underestimate the power of stupid people in large groups.
It placed a SHIT LOAD of trust in the key fob, thus making identity theft a shit load easier!
The more security is put in place, the less it is questioned by those checking authentication. The end result is a less-secure system.
though "no credit card or medical information, such as claims, test results or diagnostic codes were targeted or compromised.
Whew... what a relief! I was really worried there for a minute...
Which has more power: the hammer, or the anvil?
How did they get it in the first place? Probably through my employer of course.
Of course, they do not even acknowledge it on their FAQ any more, that was quickly removed.. Now it only says "employment information".
If the IRS, the insurance company, the hospital, the state, and the billing company can read the data, the bad guy can read it too. The data may very well be encrypted on-disk, so if someone stole the hard drive they couldn't easily read it. It has to be decrypted by the system, though in order to be useful.
That isn't really true. A well-designed system (they do exist) would leave the decryption to a dedicated security module, separate from where the data is stored. To gain access to the data you first establish a secure connection to the data store, authenticate yourself, and retrieve the encrypted data. You then connect to the security module, re-authenticate, and present the encrypted data along with a (crypographically signed) request for decryption. The security module logs and validates the request, decrypts the data, and sends the plaintext back to the client through the encrypted connection. At no point does any system other than the security module and the client's computer have access to the plaintext, and the rules for validating requests can be as strict as you like.
The security module is an obvious target for attack, but it's also a single-purpose system on which you can focus all your security-hardening efforts.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
Not that political parties up here in Canada don't pull self-serving stunts, but how the US has allowed the architecture of its electoral system to become part of the partisan machine boggles the mind.
The world's burning. Moped Jesus spotted on I50. Details at 11.
By now my SSN must have been stolen several times from several different organizations that simply did not do their jobs properly. If there are consequences of this breach for me and I sue Anthem they'll just point to any of the many other ways in which my PII has been mishandled as a reason to dodge blame. Everyone uses the SSN, even costco asked for my SSN to join (I refused, but I bet there are many who didn't).
The change has to be in the meaning of the SSN, If the government wants a unique numeric name for any individual I understand, but it's not the same as proof of ID. Proof of ID needs to be either something biometric or something to do with your relationships to other people (but then, Anthem gave away as much of that as they possibly could too).
Nullius in verba
"Someone's gonna kiss the donkey." -- Battleship
Uh, Linux geek since 1999.
Its selfish to not want to be told by someone else what to do?
It's called civilization. If I want to masturbate in public, or kill people, or be a pedophile, or be a cannibal. Or steal from my neighbors and sell their stuff on ebay, or force my neighbor's wife to have sex with me. I'm not allowed to do those things, It's an infringement upon my freedoms. I am not free to do any of those things without societal repercussions. And I agree with punishments for those things. People should not have the freedom to do those things.
We are a whole lot less "free" than some of us think.
It is the people that think they have an automatic right to tell others what to do that are selfish. This seems to be a common theme in politics today, where a group guilty of something like being selfish, label those that oppose them with what they themselves are actually guilty of.
Read this
http://talkingpointsmemo.com/l...
Now let's discuss.
Okay, I am certain that washing hands after using the toilet is one of those selfish things that intrude upon freedom. It actually is a restriction. If I have to do something, I am not free from doing exactly as I wish. I am restricted from my freedom to get my coliform bacteria laden shit on people's food. And senator Sen. Thom Tillis (R-NC) agrees with that.
Do you? Is fundamental freeddom do whatever you feel like doing so sacrosanct that you would be willing to allow your child to die with their internal organs destroyed be a massive e coli infection just so someone doesn't have to wash their hands? Even if we're not in "Think of the Children mode", are you willing to die because an employee enjoys greater freedom to
He is fine with that. And his other bit of batshit crazy supidity was that he supported restaraunts having to put up a sign saying they didn't require employees to wash their hand after a steaming hot crap. if they don't want to require their employees to have to wash their hands.
Which of course is a regulation, and regulations are bad, and it infringes upon the freedoms of the owner of the restaurant. I is the final answer "Eat Shit and die, it's the way of freedom"?
This is the problem when Libertarianism gets married to Fundamentalist Republicanism. We end up making insane statements. Probably very few people want to eat fecal matter. It's been a known disease vector for a long long time. But when you decide that every law and regulation is an assault upon your freedom, and therefore evil, you get stuck in a potatofest of having to support insane ideas like a complete abandonment of basic hygiene, with Two Girls, One Cup notwithstanding.
It is not selfish to want to avoid other peoples tyranny. You dumb fuck.
Meh, Define that tyranny? Is it being required to wash your hands? Is it not allowing you to kill anyone you feel like killing? Not being allowed to have sex with your daughter? All are societal restrictions on your freedom. You would be much more free if you could do any of those things, without society judging or impeding you.
This is where all of the faux libertarian arguments fail. Everything a litmus test, and when hoist by your own petard, you end up having to make up things like requiring employers to put up sighns that only violate your own litmus tests. There is no civilization without restrictions on behavior. The faux libertarian world is nothing more than modern day crypto-anarchy.
And you calling me a "dumb fuck" is just illustrative of every conversation I have with faux libertarians. All insult, no content.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
So both sides are doing it, but you only want to vilify the GOP for doing it. Is that about right?
Yes. Gerrymandering by the Republicans and gerrrymandering by the Democrats are not the same. The Democrats started it (Gerry was a Democrat) but the Republicans are much better at it. There are plenty of geographic regions that are more than 90% democrat. These are mostly urban areas with large minority populations. But if you go to the reddest of the red states, say some rural county in Utah, you will find that it is only about 70% Republican. Democrats are just inherently more concentrated, and it is easier to isolate their votes into a few urban districts where they overwhelmingly dominate, leaving the Republicans to sweep the suburbs with 55% or so.
Grind your axe somewhere else. You don't like it when people stand up to poor legislation? Write your congressman. Fuck off.
"or medical information, such as claims, test results or diagnostic codes were targeted or compromised."
This is an out and out lie. They are just trying to avoid being on the hook for a bankruptcy-sized HIPAA violation.
I wasn't vilifying anyone. Nowhere in that statement did I refer to the GOP, or indeed any particular organization, person, or group. I was making a statement that bad behavior is bad behavior, even when everyone does it. Gerrymandering is hurting our country, and that's gerrymandering both by the GOP AND the DNC.
Now I'm going to vilify someone: Your bias and knee-jerk politics are showing. You're seeing persecution where none exists. I bet you're a fundie, too.
Well, that's democracy in its current form for you. In 2010 the GOP got to re-draw congressional districts, and they gerrymandered them in such a way that anyone other than a staunch right-wing Republican will never ever get elected. You could run Jesus against the GOP candidate and it would be close.
Try again, dipshit.
Yes, I do have that much money available but I'm not the one forcing people to hand over their money to a private company.
If someone WANTS to do so, that's fine, but the government telling people they MUST hand over their money, at virtual gun point, is not the way to go.
Considering how adamantly opposed to the government sticking its nose into people's personal lives and the rantings against corporations, it sure is funny how you folks have managed to laud and support both the things you despise.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Upon learning about this incident... I immediately logged in and changed my pw at anthem.com. I've also updated passwords on every other thing that I have access to on the internet....
Comment removed based on user account deletion
Comment removed based on user account deletion
The only solution to improve fairness in the US political system is a vast reworking of the entire electoral process. We've got a system right now designed around electing people not parties but have a party based election anyway. If we moved to a weighted party vote system like used in europe rather than an individual based system with a party thrown on top we would do much to return the elections to represent the people.
Now that we have the internet the first thing we should do is an amendment to return the house to a system where each representative only represents about 30,000 people. Then we allow them to vote on bills via the internet. In such a system the staff would be reduced to almost nothing eliminating the problem of the staff in Washington actually doing everything with congresscritters just being the face on the work the staff does. You could even set it up where only two representatives from each state get to go to washington and the rest vote from home. In such a system we'd return the house to a system that represents the actual people. Parties would become almost meaningless in such a system because the house rep would probably actually know everyone in their district.
Utah is the prefect example actually, there are enough democrats in Utah that one to two of the four representatives should be democrats. They've carved the urban area into little slices to try to eliminate that. Matheson finally gave up trying to fight after they moved him from district to district and kept slicing chunks off to try to get rid of him.
>. Why does the IRS need access to medical records, anyway? Financial records, sure -- but diagnostics, etc? Seems a bit odd.
The IRS has a major role in administering the ACA (Obamacare). The agencies in part write their own regulations about what they want to have access to.
It would be possible to architect a reasonably sane national system, yes. I was speaking from the point of view of one insurance company. They have to provide the various agencies that administer ACA the access that the agencies demand. They can't force HHS or IRS to to use the security hardware that the insurance company a selects.
Even with a sane national system, a hospital should be able to query certain information from the insurers. That actually means each low-level hospital employee handling claims can query the data. When the hospital employee clicks on Britney spearssextape.mpg.pif ...
It's an anachronism of the early concerns of the US founders. They wanted to balance the interests of the more populated colonies/states with the interests of the less populated colonies/states. So they setup the house that is strictly based on the proportion of population to "represent the will of the people, and the Senate which has 2 votes per state regardless of population to ensure smaller states aren't drowned out in this republic. They never foresaw the effects of gerrymandering on the House. It's the downside of being the first modern democracy, we had to work some kinks out. I think there is value in discussing proportional representation, but the existing interests would never let that happen.
The statement:
I don't see GOP anywhere. You try again, dipshit.
Never underestimate the power of stupid people in large groups.
We probably got hacked by our own government.
https://www.youtube.com/c/BrendaEM
The post I quoted is the one everyone is attacking you for, and is the one everyone, including oodaloop, is referring to. You don't get to pretend you didn't type it, or that people were referring to something else.
Please DON'T try again, it's pathetic.
Well, *I* know what I was talking about, and it wasn't GOP-related. Don't try to tell me what I meant.
Never underestimate the power of stupid people in large groups.
Canada is little different in regards to its lower house. The House of Commons is elected based on first-past-the-post voting. I believe there is some language in the Constitution about the minimum number of seats in the House of Commons some provinces may have, which does create a long-standing inequity between the growing provinces in Western Canada and the original members of Confederation.
That being said, "riding" (what you call districts) boundaries are set by an independent non-partisan body called Elections Canada. The provinces have similar non-partisan commissions. The intent is to de-politicize the actual mechanics of elections and prevent gerrymandering.
Again, as I said in my first paragraph, there are inequities in the size of ridings (districts) based upon how the House of Commons was originally divided up in 1867, but all in all, there are very few accusations of gerrymandering at the federal or provincial level. Obviously I believe that proportional representation of some sort is needed to truly create a fairly elected legislature that more accurately reflects the will of the electorate.
And then there is the matter of the Canadian Senate, which was modeled on the British House of Lords as it stood in the mid-19th century; along with Bagehot's notion of life peerages (which didn't come into being in Britain until the 20th century). That body is completely partisan in nature; as it is the Prime Minister who advises the Governor General on who to appoint. But in general the Canadian Senate does not defy the will of the lower house, so it is not as big an issue as it seems.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Let me settle this once and for all.
"The word gerrymander (originally written Gerry-mander) was used for the first time in the Boston Gazette on 26 March 1812. The word was created in reaction to a redrawing of Massachusetts state senate election districts under the then-governor Elbridge Gerry (pronounced /ri/; 1744–1814). In 1812, Governor Gerry signed a bill that redistricted Massachusetts to benefit his Democratic-Republican Party."
Democratic-Republican. While, yes, the party being spoken of is different than either of today's parties, I find the naming to be meaningful. It's not the Democrats or the Republicans or the Federalists or the Whigs who are responsible for it. It's all of them.
One party blaming situations on gerrymandering is like pissing into the wind. Yes, they can't win elections because the other party gerrymandered. Of course, they both have done it when they had the power to do it, and will do it themselves again when the power comes back to them.
Nevertheless, things do change in the US, just like everywhere else, but that only really happens when you actually give people a choice of what they can vote for, as opposed to two sides of the same coin, only with one or two hot-button items to make it seem like they are different.
I was speaking from the point of view of one insurance company. They have to provide the various agencies that administer ACA the access that the agencies demand.
Under the system I described, the insurance company can provide any level of access required. Even a full database dump, if necessary—just make sure it's locked down so that such requests can only come the agency needing access. If they want to use their own transfer protocol, arrange for a hardened proxy server and do whatever protocol translation you need at that point. If your database gets hacked through an insecure interface demanded by some external agency, there will be a log entry recording that proxy as the source and everyone will know who is to blame.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
The solution is simple, then: consider how much the cheapest insurance would cost you vs. paying the IRS fines. Do whatever makes financial sense. It won't be a big expense for you. Consider it another tax - and if it happens to be paid to an insurance company, you could even, gasp use the benefits when the time comes to do so!
A successful API design takes a mixture of software design and pedagogy.
Fuck you, I was required by law to get medical insurance and I ended up with Anthem. I didn't want this at all and now I'm a victim of it
The fact that you can only say it while screaming in pain kinda underscores the point.
You're bitching because I didn't name the DNC specifically?
Nope. I'm pointing out that you are obviously a partisan asshole.
What I was saying was more of a generalized statement
Generalized to shaming specifically the GOP, and when pressed we get a nice progression to "the other side [also]" followed by irrational screaming when you finally have to include the DNC by name:
THE DNC ALSO ENGAGES IN GERRYMANDERING. Happy now?
Do you think that you are you intellectually honest now?
"His name was James Damore."
The GOP are a bunch of hatemongering douchenozzles and no matter how much you defend them, it won't change that fact. Willful ignorance IS intellectual dishonesty!
You know nothing, Rockoon
You've got 100K extra just lying around solely reserved for medical expenses? Sounds like it's time to get out the tax hammer and start whackin at your piggy banks, ya greedy prick.
Hey dumb shit! The proper syntax for that statement is one of the following:
It is not selfish to want to avoid other peoples tyranny COMMA you dumb fuck.
It is not selfish to want to avoid other peoples tyranny. You ARE a dumb fuck.
You know nothing, dumbfuck.
The Google Analytics tag on their site is not from Anthem but from http://www.webteks.com/
It is silly that a medical site uses Google Analytics but it is even more silly that the data can be seen by an external small web developer.
It's called civilization. If I want to masturbate in public, or kill people, or be a pedophile, or be a cannibal. Or steal from my neighbors and sell their stuff on ebay, or force my neighbor's wife to have sex with me. I'm not allowed to do those things
Unless you're the government. Then you're allowed to kill people and steal their stuff at will. One rule for the ruled...
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
How can they be the "second-largest" when I've never heard of them, and they don't even show up in the top 125 list:
http://www.freedombenefits.net/affordable-health-insurance-articles/Largest-125-US-Health-Insurance-Companies.html
Well, that's democracy in its current form for you. In 2010 the GOP got to re-draw congressional districts, and they gerrymandered them in such a way that anyone other than a staunch right-wing Republican will never ever get elected. You could run Jesus against the GOP candidate and it would be close.
The thing about this statement, IS Obama is a "staunch right-wing Republican" to many people.
He gave the NSA a free pass for their crimes committed under Bush II...
have torture investigations resulted in charges brought against anyone?
we must "move forward for the good of the country" ...just like after Nixon...
his immigration policies, are just like Reagan.
And to many people, the "staunch right-wing Republicans" are all godless communists.
(the dept. of edu. planning the economy, NSA spying...we have no individual souls).
Try again, dipshit.
Explain to us the difference between the GOP and the DNC then. The labels mean nothing.
The CIA runs things abroad either way. The foreign policy of either party is not relevant.
If Obama makes peace with Cuba, then you can rest assured the CIA has approved that action, for whatever
reason.
You can bash BVis all you want...but there is little difference between the GOP and the DNC anyways, it is a moot issue whether
BVis was playing favorites or not.
The GOP and the DNC have very little say in things. They are subservient to the CIA and the NSA and the FBI.
The thing is, the CIA readily admits to much more than gerrymandering abroad...what evidence do you
have they do not do such things at home?
What makes you think either party has much ultimate say, even if they successfully fix an election?
In the US you give blanket authorization for the healthcare provider to share your information with insurers and other third-parties when you signed that HIPAA authorization form at your first visit. You did read that, right?
Here's a sample authorization form: https://www.caring.com/forms/h....
So, I saw this ad, on Craigslist.
Now, what is described, here, is NOT so much a director's duties, but, rather, more, a senior systems administrator's duties.
And so, apparently, the "director" is title inflation, to offset the lack of salary - which was not mentioned.
But I replied, anyway ...
The Human Resources manager was quick to respond:
I confirmed 10:00, Friday morning ... but never received a reply.
So I sent another email, asking for an acknowledgement.
I also informed them that, between an older version of Skype installed on an older computer, running an older operating system ... and my home's limited bandwidth ... that, as a result of previous experiences with Skype not delivering an adequate grade of interconnectivity ... might we not do the interview, via telephone?
The Human Resources manager then, without replying to my request, rescheduled the interview:
I af