Slashdot Mirror
Cybersecurity and the Tylenol Murders
HughPickens.com writes: Cindy Cohn writes at EFF that when a criminal started lacing Tylenol capsules with cyanide in 1982, Johnson & Johnson quickly sprang into action to ensure consumer safety. It increased its internal production controls, recalled the capsules, offered an exchange for tablets, and within two months started using triple-seal tamper-resistant packaging. Congress ultimately passed an anti-tampering law but the focus of the response from both the private and the public sector was on ensuring that consumers remained safe and secure, rather than on catching the perpetrator. Indeed, the person who did the tampering was never caught.
According to Cohn the story of the Tylenol murders comes to mind as Congress considers the latest cybersecurity and data breach bills. To folks who understand computer security and networks, it's plain that the key problem are our vulnerable infrastructure and weak computer security, much like the vulnerabilities in Johnson & Johnson's supply chain in the 1980s. As then, the failure to secure our networks, the services we rely upon, and our individual computers makes it easy for bad actors to step in and "poison" our information. The way forward is clear: We need better incentives for companies who store our data to keep it secure. "Yet none of the proposals now in Congress are aimed at actually increasing the safety of our data. Instead, the focus is on "information sharing," a euphemism for more surveillance of users and networks," writes Cohn. "These bills are not only wrongheaded, they seem to be a cynical ploy to use the very real problems of cybersecurity to advance a surveillance agenda, rather than to actually take steps to make people safer." Congress could step in and encourage real security for users—by creating incentives for greater security, a greater downside for companies that fail to do so and by rewarding those companies who make the effort to develop stronger security. "It's as if the answer for Americans after the Tylenol incident was not to put on tamper-evident seals, or increase the security of the supply chain, but only to require Tylenol to "share" its customer lists with the government and with the folks over at Bayer aspirin," concludes Cohn. "We wouldn't have stood for such a wrongheaded response in 1982, and we shouldn't do so now."
According to Cohn the story of the Tylenol murders comes to mind as Congress considers the latest cybersecurity and data breach bills. To folks who understand computer security and networks, it's plain that the key problem are our vulnerable infrastructure and weak computer security, much like the vulnerabilities in Johnson & Johnson's supply chain in the 1980s. As then, the failure to secure our networks, the services we rely upon, and our individual computers makes it easy for bad actors to step in and "poison" our information. The way forward is clear: We need better incentives for companies who store our data to keep it secure. "Yet none of the proposals now in Congress are aimed at actually increasing the safety of our data. Instead, the focus is on "information sharing," a euphemism for more surveillance of users and networks," writes Cohn. "These bills are not only wrongheaded, they seem to be a cynical ploy to use the very real problems of cybersecurity to advance a surveillance agenda, rather than to actually take steps to make people safer." Congress could step in and encourage real security for users—by creating incentives for greater security, a greater downside for companies that fail to do so and by rewarding those companies who make the effort to develop stronger security. "It's as if the answer for Americans after the Tylenol incident was not to put on tamper-evident seals, or increase the security of the supply chain, but only to require Tylenol to "share" its customer lists with the government and with the folks over at Bayer aspirin," concludes Cohn. "We wouldn't have stood for such a wrongheaded response in 1982, and we shouldn't do so now."
greater downside for companies that fail to do so
In the US? lol
That must mean you have something to hide.
Perhaps you are the one who contaminated those pills?
The same people that say it is OK that the NSA weakens security paradigms and that take seriously government demands for backdoors in all crypto systems and that OKs spying on everyone is not about to do a complete 180 and actually do anything to build up security. The corporations can do little for better security while the government is busy weakening and limiting all security tools. So simply making more demands on companies is useless.
I have 2 big problems with this story:
1. Wrong Analogy - psychos putting poison into over the counter meds has little if anything to do with protecting personal data from public and private distribution. It does OTOH scary conjure images that incite rash actions. Bravo to the EFF for profiting on the ensuing hysteria.
2. It uses the words "ours" and "We" with the largest brushstroke possible. Could the author at least have tried to discuss the topic of data security without simple collective generalizations? Is it not possible that some institutions are effectively protecting this data (eg. banks) and perhaps others are not (eg. classmates.com)? Maybe these institutions know more than the EFF about what people care about disclosing.
Bad analogy is bad.
Nice adopting the tactics of your enemies though. Using an alarming example to foster support for your agenda, ensuring an emotional response and not a rational one.
In 1982, a much smaller % of the population was on the internet (which wasn't much more than a decade old at that point, long before the WWW), but the ones who were had VASTLY more technical understanding than the average netizen today. The worst aspects of today's internet: Orwellian commercial and governmental surveillance, censorship by various nations, ad-infestment of everything, etc, would simply not have been tolerated on the 1982 internet.
There are definitely some important points to be made in the comparison here, but some of them are a bit off. For one, it makes the comparison to sharing customer lists for Tylenol/Bayer Aspirin/etc, but that's a bit off.
There is a value in 'information sharing', it just depends on the information being shared. Sharing the sorts of data associated with an intrusion, so that others can check their networks for similar activity or vulnerabilities? That's a good thing. The comparison here would be having Tylenol's makers share the information on how their supply chain was possibly compromised in the first place, so that we don't wind up having them fix the problem, only for other companies to get hit with the same thing because the details were kept secret.
That's what's important - the information about the vulnerabilities and exploits, not the customer data. This is why we have to be especially wary about nebulous proposals that hand over truckloads of unnecessary data, since there are certainly agencies in the government that would love to have free access to it in order to entirely unrelated things like go on witch-hunts.
At the same time, we have to keep in mind that most companies won't share information about attacks unless they're required to do so. Imagine if Tylenol had just ignored clear signs of a break-in at their plant, and ignored the possibility that thousands or millions of capsules could have been poisoned, and decided to just pretend nothing ever happened, only for it to come to light years later, because that was roughly what has happened in many past instances of major retailers getting hacked.
It's a oversimplification to say the creators of software and hardware that make up networks and services must be held accountable for security. There is an inherent state that many of the bugs that get exploited are unknowable until somone stumbles upon them. Either the software's creator or the bad-actor finds it first and that's where the trouble lies.
I think the larger issue is the design of the internet is way too open and without any accountability.
Regarding the inevitable use of the internet for data collection: yeah, someone was first, but a metric fuck ton more suspects.Governments, corporations, recruiters, employers, prospective suitors, suspicious spouses, etc.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
It's pretty simple. There were alternatives to Tylenol and they knew if they didn't act it would cost them billions. There is no alternative to the internet so people are pretty much stuck with the standards in use. The losses are socalized enough that there isn't much reason for most people to change. If people personally stood to lose tens of thousands of dollars they might take things seriously.
I love Jesus, except for his foreign policy.
"Patriot [sic] act" and the "USA Freedom [sic] act". I am so disgusted that congress acting to circumvent the Supreme Court through technicalities, while changing nothing at all is being called "surveillance reform [sic]". If you ever hoped that Obama's background as a professor of constitutional meant that he would protect the bill of rights like I did, you just got shat on.
Yes, I understand that having the entire world under surveillance all the time is very convenient for law enforcement and keeps us "safer [sic]" than having any right to privacy would. It's just a shame that no one in the government cares.
Also, do you know how many terrorists they caught with the metadata program? They caught ONE taxi driver who wanted to send a couple thousand to Hamas. That's it. Well, now you know what your freedom used to be worth! Less than one taxi driver's donation.
From TFA:
For example, Johnson & Johnson developed new product protection methods and ironclad pledges to do better in protecting their consumers in the future. Working with FDA officials, they introduced a new tamper-proof packaging, which included foil seals and other features that made it obvious to a consumer if foul play had transpired. These packaging protections soon became the industry standard for all over-the-counter medications. The company also introduced price reductions and a new version of their pills — called the “caplet” — a tablet coated with slick, easy-to-swallow gelatin but far harder to tamper with than the older capsules which could be easily opened, laced with a contaminant, and then placed back in the older non-tamper-proof bottle.
Packaging for over the counter drugs became safer because Johnson & Johnson invested a 100 million dollars to protect their customers with tamper-resistant seals on their packaging and harder to contaminate pills, which showed the rest of the industry how do it as well. Congress passed the law mandating that the rest of the industry follow suit only after Tylenol successfully did it first. In addition, and this is important, the FDA worked with Johnson & Johnson for the common goal of protecting consumers.
With computer security, though, you have the US government that is openly hostile to allowing users to completely secure their systems. For one thing, you have the law enforcement and intelligence branches of the government that lobby Congress for more surveillance laws, and also actively subvert standards for encryption, OS security, and security applications as well as weaponizing exploits of software vulnerabilities. And even when there are companies leading way on how to provide secure applications and services, you have the government stepping in forcing it to compromise its security. Lavabit is just one public example of the government's zeal to snoop overriding consumer's need for secure communication.
Another thing is you have the software industry lobbying Congress against passing laws which would apply product liability rules to software applications. Software companies have been thwarting efforts to hold them accountable for ages. All software has bugs, but a lot of bugs are just howlers that might not have got through to release if companies were held a little responsible for the harm they can cause.
Nope, the Tylenol case and the case for secure computers and networks are not the same. In the Tylenol case, the gov and drug industry had a common goal to protect the consumer. In the case of computer security, the gov and software industry have their own goals, but they're not to protect the common user.
..never was, never will be.
If we the people want our data safe, we have no choice but to keep ever vigilant about defending against laws that allow the government access to data we don't wish be open.
Thank you Dr Paul.
It's obvious the private market responded quicker than the government regarding the Tylenol story. The laws passed afterwards achieved nothing. The response had already been implemented. What goes to show is that our private industry is keeping up as much as the individual companies deem necessary. If tomorrow all ATM's started being hacked easily, there would be responses nation/worldwide. But that simply isn't happening. I guess what I mean to say is, if the need is there, companies will work with each other to help achieve what is necessary. Does it pay for a company to risk its assets more than necessary? At this time some are being targeted more than others. Not Everyone is. Government will achieve nothing but slow whatever it regulates or taxes down. The underachievers work in government...not the other way around.
The Tylenol killer was caught. I remember hearing about it on the CBS evening news - HE did it in an attempt to get the stock price to fall, in order to make money on his short options.
The society for a thought-free internet welcomes you.
I was 22-23, there was a guy at work 10-15 years older that hated me. Why? I don't know. But I was the kind of guy that anything you threw at me I threw 2x back. When this Tylenol poisoning hit I bought a bottle of Tylenol and put it on his desk. No note, nothing, just the bottle.
I ran into him some 20 years later. He told me he didn't know why he didn't like me and apologized for being an ass. I told him I put the Tylenol bottle on his desk, he said "shit Jim, I knew that as soon as I saw it".
"by creating incentives for greater security...".?
huh? and we pull the incentives out of whose a$$?
I know, let's create one 'organization' that will manage and implement all technology communication related devices.
"...one ring to rule them all...."
This is all second hand info, of course, but as a kid I knew a worker at the 'pill' factory.
That chemical is used to clean the pill dies. The theory produced was that it was an
industrial accident (yes, the makers confirmed that that chemical is used to clean the
dies, but downplayed its significance - do the research!). It was my first experience of
a major corporation ducking responsibility and I was taught a good lesson from it.
Because of the egregious way in which people died from the accident, the company
would have been successfully sued into nothingness. It was far more cost-effective
to take the path they took then to admit wrong-doing; that a criminal had contaminated
the medicine. Yes, "good" things came from it, but too many needlessly lost their
lives as a result.
Cindy Cohn writes at EFF that when a criminal started lacing Tylenol capsules with cyanide in 1982, Johnson & Johnson quickly sprang into action to ensure consumer safety.
It was a completely different mentality back then, Johnson & Johnson took measures to ensure consumer safety. Today's corporations won't even consider that an option. Look at BP during the whole Deepwater Horizon fiasco, they deliberately delayed solving the problem for as long as they could while the execs at the top tried to figure out ways they could profit from the disaster.
I'm sure that others have already mentioned that the biggest enemy are oppressive governments like the US who deliberately and continually sabotage world security for their own petty goals.
Engineers in many fields have the opportunity and obligation to take an exam to become formally licensed. No such degree track is available today for computer sciences makers
If we the people want our data safe, we have no choice but to keep ever vigilant about defending against laws ...
So how much did you donate to the 'Ban the bomb' fund? What about writing to your elected representative outlining your disapproval of his policies? Alas, the price of vigilance is perpetually under-estimated. After making the boss happy, then the police and government, then the family, most people aren't interested in bad laws that will affect them on an unknown day in the dimly known future. It's much easier to watch 'American idiot' (reality shows have only 3 premises, where most of them can be titled 'idiot') and forget tomorrow is another struggle to 'keep up with the Joneses'.
Because the list of things she knows clearly does not include the concept of "community based threat intelligence". The sharing of threat intel, especially among industry peers (financial services, healthcare, etc.) can be a very powerful tool. If the security people at Acme Widgets and Cogswel Cogs alert me that their seeing a specific attack coming from a particular IP address, we here at Spacely Sprockets can proactively take steps to defend against that attack.
FTFA:
"Opening debate of the bill on Wednesday, Rep. Devin Nunes, R-Calif., chairman of the House Permanent Select Committee on Intelligence, noted that the legislation “does not provide the government with any new surveillance authorities.” “It only authorizes the sharing of cyber threat indicators and defensive measures – technical information like malware signatures and malicious code,” he said. “In fact, before companies share with the federal government, they must remove all personal information that might be attached to cyber threats. If companies don’t follow those requirements, they will not receive liability protection.”
By what stretch does Ms. Cohn call such activity "surveillance"?
"trusted computing", locked bootloaders, ... controversial stuff like this are all improvements in security that are easy to mandate, are pushed by big companies and closely match the Tylenol example (where tamper resistance was the solution).
The Tylenol safety problem of the 80s and the privacy protection concerns we have today are not synonymous in the way the author depicts them to be; in both cases the response is about the bottom line. Tylenol knew if it didn't respond appropriately, and huge profits could have been lost. In the case of securing private information, if the powers that be were actually to do that, huge profits could be lost. Got it yet?
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ