Private Medical Data of Over 1.5 Million People Exposed Through Amazon

Gizmodo reports that a wide variety of information about 1.5 million people -- everything from police injury reports, doctor's notes about their patients, and social security numbers -- "all were inexplicably unveiled on a public subdomain of Amazon Web Services. Welcome to the next big data breach horrorshow. Instead of hackers, it's old-fashioned neglect that exposed your most sensitive information." From the article: Tomorrow, [Texas-based researcher Chris Vickers, who discovered the breach] will turn over the data to the the Texas Attorney General, where it will be destroyed. But that doesn’t mean Systema is in the clear. Vickers may not be the only person who downloaded those millions of records as they sat out in the Amazon cloud. We don’t know how long the information was available for everyone to see. But no matter what the timeframe, the neglect could be a HIPAA violation: Systema failed to protect the security of patients’ electronic medical information.

Comments

but...but... the cloud

[Anonymous Coward]

is secure enough to store sensitive personal data....

Re:but...but... the cloud

[davester666]

It totally is. You just need to disconnect all the computers that are part of the cloud from the internet.

Re:but...but... the cloud

[Anonymous Coward]

It totally is. You just need to disconnect all the computers that are part of the cloud from the internet.

At least the entity that failed us this time was Systema. But was the breach caused by Systemd??

Re:but...but... the cloud

[PTBarnum]

Shockingly, AWS allows you to configure your servers in an insecure manner. Clearly, the cloud must be insecure.

Re:but...but... the cloud

[Skapare]

i have uploaded files to AWS S3. the default permission setting allows anyone to read files if they know (or can guess) the bucket name. S3 users need to be more proactive. they need to lockdown access to their S3 buckets (often used for backups). the defaults can be changed.

copy_tags_from_spot_request_to_instance.py

Re: but...but... the cloud

[Anonymous Coward]

I think that might have been true several years ago, but the default bucket policy used now is restricted to the owner.

http://docs.aws.amazon.com/AmazonS3/latest/dev/s3-access-control.html

Re:but...but... the cloud

[Jawnn]

Shockingly, AWS allows you to configure your servers in an insecure manner. Clearly, the cloud must be insecure.

Well, at it's essence, "the cloud" means "someone else's servers". This being the case, it should be abundantly clear that there is no magic there. If you use "someone else's servers in an insecure manner, it's not the someone else that is at fault. Even Amazon tacitly admits as much. Ever tried to get them to sign a Business Associate Agreement (a statutory requirement when you let a third party handle records covered by HIPAA regulations)? They will, but only after you've satisfied them that your use of their platform is sufficiently secure. It's a cinch that Systema didn't have a BAA with Amazon. Guess who's going to get fined?

Re: but...but... the cloud

[Anonymous Coward]

Some of Systema clients picked low cost hosting and many were victims of their own poor price only choices, RFP's and consultants that help them pick the wrong tech that should have known better.

Re:but...but... the cloud

[gzuckier]

Shockingly, AWS allows you to configure your servers in an insecure manner. Clearly, the cloud must be insecure.

Well, at it's essence, "the cloud" means "someone else's servers". This being the case, it should be abundantly clear that there is no magic there. If you use "someone else's servers in an insecure manner, it's not the someone else that is at fault. Even Amazon tacitly admits as much. Ever tried to get them to sign a Business Associate Agreement (a statutory requirement when you let a third party handle records covered by HIPAA regulations)? They will, but only after you've satisfied them that your use of their platform is sufficiently secure. It's a cinch that Systema didn't have a BAA with Amazon. Guess who's going to get fined?

wouldn't people with a little skepticism at least encrypt their files before uploading them, even with something trivial like zipping them with a password?

Not really related to Amazon.

[Anonymous Coward]

Should probably be pointed out that this has nothing to do with amazon other than it was their web hosting used.

Re:Not really related to Amazon.

[Etherwalk]

Should probably be pointed out that this has nothing to do with amazon other than it was their web hosting used.

Amazon is a big name. Amazon is related to the story because it makes more people read the story. It's like if you have a story that Donald Trump's barber is secretly Sweeney Todd. The story becomes Donald Trump.

Re:Not really related to Amazon.

[paiute]

The bigger story would be that Trump had a barber.

Re: Not really related to Amazon.

[Anonymous Coward]

That's kind of the point actually. Not specifically Amazon but it's an utterly predictable indictment of cloud computing.

Setting up cookie cutter hosted servers and such is reasonably easy. Maybe too easy because doing it correctly still requires knowledge and skill.

It is far too easy for the unskilled to set up critical systems and besides the absolute inherent insecurity and untrustworthiness of anybody's cloud infrastructure, not just Amazon's, the low barrier to entry practically guarantees this sort of thing regardless of the specific cause this time.

So...Amazon's fault? Not really. Proof that public cloud computing is a dumb idea, especially for some workloads...absolutely.

Re: Not really related to Amazon.

[Anonymous Coward]

It's more the fault of insurance being a scam for those who take care of their bodies and health. To stay in business, insurance companies must pay out less than they take in. This means for 50% of those insured, it's a scam. And in fact, the numbers are probably higher than 50% because a small percentage of people disproportionately need medical care.

Anyone who pays insurance is paying for those who eat fast food every day, pop out babies yearly (different fathers, if they even know the father), abuse drugs, take risky behaviors (speeding, excessive drinking, fighting), and their idea of exercise is walking to the fridge to get another beer. Assuming you're not a fuck up in life, insurance is pointless. Even if you have one expensive hospital visit per ten years, you'll save more by not paying insurance for those ten years and investing the saved money and then paying for the hospital visit in cash.

And now thanks to the wonderful Obamacare, we're all forced to purchase insurance. This drives up the price for everyone and discourages healthy habits. Great job Obama and his Democrat cronies!

Medical reform is needed in the US, but something like Obamacare has only made things worse than before.

Re:Not really related to Amazon.

[antdude]

Or Mr. Trump got his haircuts from Dogbert.

Re:Not really related to Amazon.

[Dunbal]

You're making the mistake of assuming that that thing on his head is hair. My understanding is that it's an alien being that has bonded with "The Donald" and taken possession of his body many years ago, using him as a marionette. It's quite obvious that his current run at the Presidency of the United States would benefit this alien race no end if he succeeded.

Re: Not really related to Amazon.

[Anonymous Coward]

You don't understand insurance. The whole point is that you're paying a fixed premium to eliminate a risk. You're paying for certainty. Without health insurance, you risk that some unpreventable medical problem makes you go into crippling debt for the rest of your life. That can happen regardless of how healthy you are.

Re: Not really related to Amazon.

[MyAlternateID]

You don't understand insurance. The whole point is that you're paying a fixed premium to eliminate a risk. You're paying for certainty. Without health insurance, you risk that some unpreventable medical problem makes you go into crippling debt for the rest of your life. That can happen regardless of how healthy you are.

Sure, but when you smoke two packs a day, or when the doctor tells you you're 50 pounds overweight and you keep hammering the buffets, shoveling fried food into your corpulent mouth, and not getting any significant exercise, well then we're no longer talking about "unpreventable", are we? That's not the same thing as driving down the road, having a deer jump out in front of you that no one could have seen in time, and getting injured in the crash.

Yes they can apply surcharges and rate some people as much riskier than others, but the entire concept of insurance is much better suited for the latter case than it is for the former. What a lot of people want is to appease their sense of justice by having some assurance that those who are at least attempting to be healthy are not forced to subsidize those who blatantly aren't.

A huge number of people think it's "inconvenient" they can't have everything they want with no downsides. They can't claim ignorance and they're setting themselves up to learn a hard lesson. The adults who understand that decisions carry consequences -- and make their choices accordingly -- don't want any part of the results. That's what I mean by a sense of justice. Whether you agree with it or not, that's where the concern about precisely how the insurance is implemented is coming from.

Re: Not really related to Amazon.

[Anonymous Coward]

But some people don't need that protection. Namely those who take care of themselves. Sure, there's always a slight risk, but it's one I'd be willing to take. Of course, it's irrelevant now in my life because my job pays for my insurance, but before I had this job, I'd rather have no insurance than lay for supporting the scum of society's medical bills.

Re: Not really related to Amazon.

[MyAlternateID]

Eh sorry to double-post, but there's another aspect to health insurance that complicates things.

Basically, if car insurance worked like health insurance, then every single time you got an oil change or put gasoline in your tank, you'd file a claim and make a co-payment. If homeowner's insurance worked that way, you'd file a claim and make a co-payment every time you re-shingled your roof, repainted your house, or replaced the mulch in some landscaping.

In every other instance, insurance is for rare and catastrophic events only. It's not something you use on a regular basis every time you perform what would be called routine maintainence in any other context. It's one reason contributing to why health insurance is so expensive.

Re: Not really related to Amazon.

[Anonymous Coward]

It's like the lottery in reverse. You're paying monthly taxes (insurance premium) in the extremely unlikely event that you "win." And over 98% of us will never win.

Re: Not really related to Amazon.

[mrvan]

1) The car analogy actually works better than you think - nowadays 'private lease' is becoming more and more popular, where indeed the leaser/driver doesn't even pay for oil change and in some instances gasoline. You pay a fixed monthly sum and you get a car (and of course the lease costs are higher because people stop taking care of the car as well as they would with their own car)

2) Any insurance scheme (whether company or government) wants to minimize costs. This can be done by discouraging claims (with co-payments, thresholds, or exclusions) but also by encouraging good behaviour. Often, small medical costs (e.g. GP visit) should be encouraged rather than discouraged, even if only 1% of these visits can prevent (or spot early) a condition that can be tremendously expensive. A house insurance can force you to have a smoke detector installed, or they can pay a smoke detector for you - it doesn't really matter since in the end the costs come out of your pocket. Politically, it can be better to pay a GP visit for someone than to force them to visit a GP at their own expense, especially because enforcement is difficult and voiding someone's insurance in the case of serious illness without having made the required GP visits can be seen as inhumane, and emergency visits are often guaranteed by the state even for the uninsured, two risks which are less so with housing/car/etc insurance. So, just paying out the small claims can be easily a winning option if it prevents later costs. In the Netherlands, some (privately run) health insurance companies even subsidize gym/fitness subscriptions or diet advice, so apparently they believe that these costs can be recouped due to decreased risk and/or improved public image or sales.

3) Relating to an earlier post made above, that health insurance is a scam and as a healthy person you'd be better off paying out of pocket: It's correct that insurance encourages risky behaviour, and that people at risk are more likely to value insurance, which is for example why disability insurance for self-employed people is ridiculously expensive (at least down here). However, health insurance in general suffers a bit less from these problems than other forms of insurance, since people don't actually like being sick, and getting a $2M payout for your cancer treatment doesn't actually leave you any richer (of course, some people still engage in short-term behaviour with long-term risks such as listed by GP). Moreover, a lot of really catastrophic health risks are simply random and impossible to pay out of pocket unless you're Warren Buffet.

4) Relating to the GP that obamacare is bad because it forces people to buy insurance: By forcing everyone to participate, you reduce the problem that risky/unhealthy people are the only ones buying insurance, driving up the premiums and further discouraging health people from participating in the risk pooling. If there is a strong negative societal effect from uninsured people, it can be worth it to sacrifice some individual rights to self-determination to help avoid the vicious cycle of unhealthy insured people and high premiums.* And there are strong negative effects of uninsured people: the direct dollar cost of providing them with emergency service and (later) medicare for conditions that would have been cheaper to treat in an earlier stage; the indirect cost of decreasing taxes and increasing social spending when people are sick and disabled; and the humanitarian cost of having people suffer from treatable conditions just because they're poor and/or unlucky. So, there are strong benefits to universal coverage even for the healthy, and due to the risk premium the only way to achieve it is if it isn't voluntary.**

*) In fact, the reason why the US system of employer-tied insurance works at all is precisely because it forces healthy employees to participate, thus greatly reducing the premiums compared to buying private insurance (in the old system, at least).

**) Of course, if you're ideologically libertarian, you would simply not pay emergency service, medicare and social benefits and simply not care if some poor person dies from pneumonia, but in that case I'm not too sure I really want to have this conversation with you :)

Re:Not really related to Amazon.

[thejynxed]

I never knew Tribbles were capable of this kind of dastardly plot.

Re: Not really related to Amazon.

[Anonymous Coward]

In the case of you without insurance, you join the ranks of the scum of society by virtue of passing off the shared responsibility onto everyone else.

Re: Not really related to Amazon.

[pnutjam]

It's interesting that this sort of rhetoric comes from the far right, while at the same time they defend ignoring external costs that of things like fracking. Your paying for those too. Whether it is a necessary evil, or not, it is almost certainly less efficient and carefully done then it would be with some sort of oversight.

You object to individuals saying, "I'm healthy", but you allow businesses to say, "we're doing the best", "we have good environmental practices", and "we are financially sound" with little (preferably no) oversight.

Re:Not really related to Amazon.

[drolli]

Definitely as far as I understood some stupid left database dumps on amazon S3 with permissions for the whole world to read.

In my experience, such idiots actually dont need any cloud computing to make clowns of themself. Usually they even try operate own system and find obscure excuses like "but only our customers know our IP" for insecure settings or "we dont need to update, since only one application is running on the machine".

Re: Not really related to Amazon.

[Anonymous Coward]

Nothing like a little social Darwinism to brighten your day.

When you're part of a team, the strong help the weak for the good of the team as a whole. You are under the misconception that your life is not closely intertwined with everyone else's.

Re: Not really related to Amazon.

[Anonymous Coward]

No, won't happen. You should rather worry about every prospective employer learning the you're a moron instead.

Re:Not really related to Amazon.

[Anonymous Coward]

During the sales/due diligence phase at a shop that has to comply with HIPAA regulations, application vendors with cloud options hosted on Amazon have referred questions about HIPAA compliance to Amazon. With the story title phrased this way, it might help get through to some of the people who have been under the impression that simply having an application hosted on Amazon means that it is somehow automatically compliant. If this data been on an company intranet web server without any password controls, it would have still been a problem, but wouldn't have been directly exposed the data to anyone with an Internet connection.

I thought the article summary was pretty clear that the negligence was on Systema's part, rather than Amazon's, though.

Re: Not really related to Amazon.

[FranTaylor]

Sure, there's always a slight risk, but it's one I'd be willing to take.

Sadly society does not leave its citizens to die in the gutter, so in the end WE pay for you and your stupidity

Re: Not really related to Amazon.

[Anonymous Coward]

Basically, if car insurance worked like health insurance, then every single time you got an oil change or put gasoline in your tank, you'd file a claim and make a co-payment. If homeowner's insurance worked that way, you'd file a claim and make a co-payment every time you re-shingled your roof, repainted your house, or replaced the mulch in some landscaping.

3) Relating to an earlier post made above, that health insurance is a scam and as a healthy person you'd be better off paying out of pocket: It's correct that insurance encourages risky behaviour, and that people at risk are more likely to value insurance, which is for example why disability insurance for self-employed people is ridiculously expensive (at least down here). However, health insurance in general suffers a bit less from these problems than other forms of insurance, since people don't actually like being sick, and getting a $2M payout for your cancer treatment doesn't actually leave you any richer (of course, some people still engage in short-term behaviour with long-term risks such as listed by GP). Moreover, a lot of really catastrophic health risks are simply random and impossible to pay out of pocket unless you're Warren Buffet.

I think a lot of the bad optics on Obamacare could have been solved if they'd just permitted over-30s to purchase catastrophic policies the same way under-30s can.

My premiums went up, substantially, but the premium increase was consistent with the fact that I no longer need to worry about pre-existing conditions; when I get expensively sick, the insurer can drop my coverage, but I can always re-up with another insurer at the next open enrollment. (And should I get the $2M cancer bill, I can even re-up at Gold/Platinum coverage for about the same $10000 in premiums and $0 copays that I'd pay for $4000 in bronze premiums +$6000 in copays)

Nevertheless, as one who is presently healthy, I'd be much happier with the ability to pay $2000 in premiums and $8000 in copays instead of the $4000/6000 split currently offered. Then again, maybe the reason PPACA, which was written by insurance lobbyists, doesn't offer catastrophic for over-30s is because there aren't enough healthy over-30s to make such a plan viable.

On the gripping hand, the fact that the highest costs in a worst-case year of bronze/platinum coverage are essentially the same is actually a feature, not a bug: it tells me that the coverage offered really does reflect the costs of providing the services.

Re:Not really related to Amazon.

[Anonymous Coward]

Amazons servers have been firewalled by us for some years now.

They regularly host malware sites, spam site, port scanners, etc.

Their complain/resolution service is rubbish, we no longer bother informing them.

Re: Not really related to Amazon.

[jaygridley]

In the case of you without insurance, you join the ranks of the scum of society by virtue of passing off the shared responsibility onto everyone else.

How exactly does that work if the person pays in cash?

Re: Not really related to Amazon.

[MyAlternateID]

It's interesting that this sort of rhetoric comes from the far right, while at the same time they defend ignoring external costs that of things like fracking. Your paying for those too. Whether it is a necessary evil, or not, it is almost certainly less efficient and carefully done then it would be with some sort of oversight. You object to individuals saying, "I'm healthy", but you allow businesses to say, "we're doing the best", "we have good environmental practices", and "we are financially sound" with little (preferably no) oversight.

Actually I want one of two scenarios: insurance goes back to its intended purpose - protecting against rare and catastrophic events; or, a government-funded health care system like you would find in many European nations.

In my mind, external costs like those caused by fracking are a separate issue. If you want to fix that issue, you need to deal with the problem of regulatory capture. The simplest way to do that would be a new law forbidding anyone who has worked at a regulatory agency from ever seeking employment with any company engaged in that industry, with severe criminal penalties for the former regulator and exhorbitant fines for any company that tries to hire him or her.

Re: Not really related to Amazon.

[sjames]

Hear Hear!

The problem with the insurance scam is that it does very little to contain out of control medical costs. In fact, it makes it worse since opting out entirely and self-treating becomes impossible, even for conditions that used to be treated at home as a matter of course.

Really I think at this point, a European style system is our best bet. The entire industry is so thoroughly addicted to unnecessary tests and outrageous margins that it will take legal price controls or a unified negotiator to get it under control. That will, in turn, drive internalization of the health care externalities of pollution.

Re:Not really related to Amazon.

[gzuckier]

The bigger story would be that Trump had a barber.

Oh no, that hair is definitely styled.

Re: Not really related to Amazon.

[gzuckier]

You don't understand insurance. The whole point is that you're paying a fixed premium to eliminate a risk. You're paying for certainty. Without health insurance, you risk that some unpreventable medical problem makes you go into crippling debt for the rest of your life. That can happen regardless of how healthy you are.

you're talking to somebody who undoubtedly believes that Obama invented the concept of insurance and is a socialist and is funneling money to his bosses on Wall St.

Re: Not really related to Amazon.

[gzuckier]

It's more the fault of insurance being a scam for those who take care of their bodies and health. To stay in business, insurance companies must pay out less than they take in. This means for 50% of those insured, it's a scam. And in fact, the numbers are probably higher than 50% because a small percentage of people disproportionately need medical care.

Anyone who pays insurance is paying for those who eat fast food every day, pop out babies yearly (different fathers, if they even know the father), abuse drugs, take risky behaviors (speeding, excessive drinking, fighting), and their idea of exercise is walking to the fridge to get another beer. Assuming you're not a fuck up in life, insurance is pointless. Even if you have one expensive hospital visit per ten years, you'll save more by not paying insurance for those ten years and investing the saved money and then paying for the hospital visit in cash.

And now thanks to the wonderful Obamacare, we're all forced to purchase insurance. This drives up the price for everyone and discourages healthy habits. Great job Obama and his Democrat cronies!

Medical reform is needed in the US, but something like Obamacare has only made things worse than before.

I've personally seen a 3 million dollar medical bill. (well, not the original, I admit). if you can save that much from ten years of not paying insurance premiums, i would like you to adopt me.

Re: Not really related to Amazon.

[gzuckier]

You don't understand insurance. The whole point is that you're paying a fixed premium to eliminate a risk. You're paying for certainty. Without health insurance, you risk that some unpreventable medical problem makes you go into crippling debt for the rest of your life. That can happen regardless of how healthy you are.

Sure, but when you smoke two packs a day, or when the doctor tells you you're 50 pounds overweight and you keep hammering the buffets, shoveling fried food into your corpulent mouth, and not getting any significant exercise, well then we're no longer talking about "unpreventable", are we? That's not the same thing as driving down the road, having a deer jump out in front of you that no one could have seen in time, and getting injured in the crash. you realize that the much maligned high deductibles decouple the bad risky folks who ring up $1500 of bills a year from the good careful ones who have like one $75 checkup per year, because the insurer doesn't pay for either. Of course, that screws the people who have birth defects or MS or cystic fibrosis or asthma, but screw them, they should have been more careful to get born into a healthy body. Yes they can apply surcharges and rate some people as much riskier than others, but the entire concept of insurance is much better suited for the latter case than it is for the former. What a lot of people want is to appease their sense of justice by having some assurance that those who are at least attempting to be healthy are not forced to subsidize those who blatantly aren't. A huge number of people think it's "inconvenient" they can't have everything they want with no downsides. They can't claim ignorance and they're setting themselves up to learn a hard lesson. The adults who understand that decisions carry consequences -- and make their choices accordingly -- don't want any part of the results. That's what I mean by a sense of justice. Whether you agree with it or not, that's where the concern about precisely how the insurance is implemented is coming from.

Re: Not really related to Amazon.

[gzuckier]

You don't understand insurance. The whole point is that you're paying a fixed premium to eliminate a risk. You're paying for certainty. Without health insurance, you risk that some unpreventable medical problem makes you go into crippling debt for the rest of your life. That can happen regardless of how healthy you are.

Sure, but when you smoke two packs a day, or when the doctor tells you you're 50 pounds overweight and you keep hammering the buffets, shoveling fried food into your corpulent mouth, and not getting any significant exercise, well then we're no longer talking about "unpreventable", are we? That's not the same thing as driving down the road, having a deer jump out in front of you that no one could have seen in time, and getting injured in the crash. Yes they can apply surcharges and rate some people as much riskier than others, but the entire concept of insurance is much better suited for the latter case than it is for the former. What a lot of people want is to appease their sense of justice by having some assurance that those who are at least attempting to be healthy are not forced to subsidize those who blatantly aren't. A huge number of people think it's "inconvenient" they can't have everything they want with no downsides. They can't claim ignorance and they're setting themselves up to learn a hard lesson. The adults who understand that decisions carry consequences -- and make their choices accordingly -- don't want any part of the results. That's what I mean by a sense of justice. Whether you agree with it or not, that's where the concern about precisely how the insurance is implemented is coming from.

well i messed that reply up. let's try again.
you realize that the much maligned high deductibles decouple the bad risky folks who ring up $1500 of bills a year from the good careful ones who have like one $75 checkup per year, because the insurer doesn't pay for either. Of course, that screws the people who have birth defects or MS or cystic fibrosis or asthma, but screw them, they should have been more careful to get born into a healthy body.

Re: Not really related to Amazon.

[gzuckier]

But some people don't need that protection. Namely those who take care of themselves. Sure, there's always a slight risk, but it's one I'd be willing to take. Of course, it's irrelevant now in my life because my job pays for my insurance, but before I had this job, I'd rather have no insurance than lay for supporting the scum of society's medical bills.

and when you get run over by a bus; would you become one of the scum of society with your medical bills paid for by others, or would you choose to die in the gutter without benefit of treatment?

Re: Not really related to Amazon.

[gzuckier]

In the case of you without insurance, you join the ranks of the scum of society by virtue of passing off the shared responsibility onto everyone else.

How exactly does that work if the person pays in cash?

how much cash to do you have, exactly? you realize that the number one cause of bankruptcy in the US is medical costs, for people who DO have insurance?

Re: Not really related to Amazon.

[gzuckier]

Eh sorry to double-post, but there's another aspect to health insurance that complicates things. Basically, if car insurance worked like health insurance, then every single time you got an oil change or put gasoline in your tank, you'd file a claim and make a co-payment. If homeowner's insurance worked that way, you'd file a claim and make a co-payment every time you re-shingled your roof, repainted your house, or replaced the mulch in some landscaping. In every other instance, insurance is for rare and catastrophic events only. It's not something you use on a regular basis every time you perform what would be called routine maintainence in any other context. It's one reason contributing to why health insurance is so expensive.

indeed, medical coverage is not insurance any more. in other countries it's "health plan" or "sickness fund" or something.
one thing that makes it different from car insurance is that your maintenance of your car has very little effect on your ability to avoid a crash, and vice versa, the expensive consequences of not changing your oil ever are not covered by insurance. whereas as you yourself pointed out, a lot of the worst medical expenses are avoidable a priori. so, do you spend $75 for a checkup out of pocket to avoid the insurance company spending a ton of money on you later?
or, a related question, does it make sense for the insurance company to spend a lot of money managing your high blood pressure through your working life, when the savings that eventually come down the line will most likely be enjoyed by Medicare?

Amazon?

[bondsbw]

So Systema is at fault for not securing the data, but the headline pins it on Amazon?

Re: Amazon?

[Anonymous Coward]

Yes, it's better clickbait that way.

Re:Amazon?

[Anonymous Coward]

It does not pin it on amazon. I'm in IT though, and I understand Amazon offers storage services that IT departments use. I also understand the definition of 'through' in this context

Re:Amazon?

[MobileTatsu-NJG]

Bear in mind that Slashdot generates revenue from clicks.

Re: Amazon?

[Anonymous Coward]

No, Slashdot (and just about any other website) gains revenue from clicked ads. Doesn't matter how many fucking times I read the story when I don't even see ads (and I assume most others in the Slashdot reading demographic also use at least an ad-blocker). I'll click on the story, leave a couple of good AC trolls, and then vanish back into the darkness, and Slashdot will be no better for it (and possibly worse if my trolls have turned the thread into a political or racist argument).

And BTW, to dice and Slashdot, clickbait stories and especially intrusive ads (the ones that play sounds, cover up the screen, etc.) make me turn on that ad blocker, if not search for another site to visit enitely. Why these companies think pissing off their userbase to make a quick buck is the solution to all their problems I'll never know...

Re: Amazon?

[Anonymous Coward]

No matter how shitty systema is, it can't be shittier than systemd.

Re:Amazon?

[AmazingRuss]

Amazon once bit my sister.

Re: Amazon?

[Anonymous Coward]

If you're not viewing their ads they don't want you. We're just wasting their bandwidth.

Re:Amazon?

[martin-boundary]

Why not mention Amazon?

1) Companies have to follow due diligence when handling private medical data.

2) Companies want to use a cheap cloud computing platform to mine medical data.

3) Story: Amazon cloud services are not suitable for 1)+2)

I don't know about you, but I've learned something, and I know what I'll ask my health care provider about how they handle my data.

Re:Amazon?

[Anonymous Coward]

Amazon once bit my sister.

That was right after you went back to west virginia and fucked your sister, so who cares?

Re: Amazon?

[mentil]

No, Slashdot (and just about any other website) gains revenue from clicked ads.

Not anymore they don't. Due to click-fraud, ad networks don't generally pay for ad clicks, but 'impressions' aka views. It's alot easier to fake a thousand unique clicks than a million unique views.

Re:Amazon?

[Cyberax]

Actually, Amazon _is_ suitable for medical data. It complies with all the HIPAA regulations and can sign a BAA with an organization willing to use Amazon services for sensitive data ( https://aws.amazon.com/ru/comp... ).

Of course, nothing can prevent a clueless operator from putting data on a publicly accessible share.

Re: Amazon?

[Anonymous Coward]

Not true. Google Adsense (one of the highest paying ad platforms out there) primarily uses CPC, NOT CPM. CPC Revenue per thousand visits is $2-$xxx. CPM (Views per thousand) is typically half a dollar, maybe a dollar if you have a high volume site. Google has anti fraud measures in place to detect invalid clicks and it does a pretty good job protecting advertisers. Disclaimer: I'm a publisher that makes money off from advertising.

Re:Amazon?

[Mashiki]

Amazon once bit my sister.

Let me guess, she started working there the next day and now puts in 160 hour work weeks.

Re:Amazon?

[gavron]

But do you understand the definition of "asshole" in this context?

Because when all you do is
a. Lie "it does not pin it on Amazon" (The headline most certainly does.)
b. Talk about yourself "I'm in IT"
c. Be a dick "I also understand the definition of 'through' in this context"

It's clear you're either a narcissistic sociopath or just an asshole.
That's why I asked if you know the definition.

E

Re:Amazon?

[MyAlternateID]

But do you understand the definition of "asshole" in this context?

Because when all you do is a. Lie "it does not pin it on Amazon" (The headline most certainly does.) b. Talk about yourself "I'm in IT" c. Be a dick "I also understand the definition of 'through' in this context"

It's clear you're either a narcissistic sociopath or just an asshole. That's why I asked if you know the definition.

E

I'm not the AC, and I also don't believe that AC was being, in any way, an asshole. I believe he was constructively criticizing the way the summary/article was written, which on this site, doesn't happen often enough. I also believe you're overreacting to the point that you're making him look very good.

Re:Amazon?

[Anonymous Coward]

Perhaps you should follow the old adage of removing the stick from your own ass before attempting an ass raping, or something like that. The point being, you might have a point, but it was lost in dickery.

Re: Amazon?

[AK Marc]

No, Slashdot (and just about any other website) gains revenue from clicked ads.

https://en.wikipedia.org/wiki/...

You should have at least the smallest clue about something before you correct others on it. CPM is quite common, and requires no clicks.

Re: Amazon?

[AK Marc]

Not true. Google Adsense lets you bid on CPM or CPC, or even CPA, though their internal bid process essentially turns all the various bids into a CPC equivelent to evaluate them. But you can pay Google only for sales from your ads (CPA), or only for impressions (CPM), as well as the basic CPC.

Re:Amazon?

[martin-boundary]

Interesting, but confusing. Why does the Amazon web page you link to state "There is no HIPAA certification for a cloud provider such as AWS."

Whose responsibility is it to ensure the data is safe? Surely, a "clueless operator" should not be able to put data on a publicly accessible share in the first place, if Amazon complies and is the entity hosting the data?

I'm curious how the legalities are interpreted to bypass the HIPAA protections in this case.

Oh... shit

[Anonymous Coward]

This is incredibly serious

will be sold on Monday

[fermion]

Unfortunately, Paxton is being prosecuted for being a con man who convinced a number of people to invest under false pretenses. I can imagine that by Monday he will put the data up for sale on the 'Dark Web' to fund his defense and imminent life as a fugitive in an undisclosed tropical locations.

Re:will be sold on Monday

[Harlequin80]

Out of interest, who is Paxton? I cant see anything about him.

Re:will be sold on Monday

[Harlequin80]

Sorry Paxton is the Texas Attorney General.

Re:will be sold on Monday

[Anonymous Coward]

Perhaps we can give it to Hillary Clinton who understands how to properly secure information.

Re:will be sold on Monday

[Hognoxious]

Why the hell did his parents give him a name like that?

Re:will be sold on Monday

[MyAlternateID]

Why the hell did his parents give him a name like that?

To make sure he grew up to be tough.

Jail, bankruptcy?

[whoever57]

So someone is going to jail for this and the company will soon be bankrupt, right?

Oh wait, none of this will happen, because the government is controlled by corporations. Just like the GM story where the cover-up led to people dying. No one will ever serve any time for killing people in this manner.

Re:Jail, bankruptcy?

[Anonymous Coward]

Yep. You, one out of 7+ billion people, are expendable. You are only worth as much as your bank accounts say you are worth. You can't expect someone who's never met you to give a shit about you. That's the world you and I live in. Nothing new here.

Is it amoral? Yes. Is it unethical? Yes. Do companies and governments around the world ignore things like this because they don't have to care? Hell yes they do. Until the world (not just one group or one individual) stands up to their governments and corporations and demand to be treated like human beings rather than a number on a balance sheet despite any threat or use of force the governments and corporations want to use against them, the public will always be treated this way. Expendable.

Re:Jail, bankruptcy?

[Anonymous Coward]

So someone is going to jail for this and the company will soon be bankrupt, right?

Nobody is going to jail over this. Fines for HIPAA violations top out at $1.5 million per year maximum. The real damage comes from being widely known as one of the few firms to have paid a $1.5 million dollar HIPAA fine and the associated loss of reputation. Basically, many healthcare providers will never trust Systema again with their HIPAA protected information. Can their insurance business survive that? I don't know.

Re:Jail, bankruptcy?

[AmiMoJo]

We need really harsh penalties for companies that use this data. None of them will do it openly, but you can bet insurance providers and employers are accessing it (through multiple third party reports, to insulate themselves legally).

Re:Jail, bankruptcy?

[Anonymous Coward]

That peanut company CEO is looking like he'll get life in prison for the people he killed by permitting salmonella in his product. I guess he wasn't a big enough campaign contributor to get off the hook.

Wow!

[Anonymous Coward]

So you know about snot. Good luck selling that. Even those from the ukraine known better that to buy snot. Most of them.

Roll 'em!

[Ol Olsoc]

This didn't really happen - I looked at thei the AWS website, and they tell us it's secure.

Sounds legit.

Re:Roll 'em!

[Anonymous Coward]

You looked at thei the website?

Re:Roll 'em!

[Ol Olsoc]

You looked at thei the website?

https://aws.amazon.com/ Why yes, yes I did. Awesome thing, this intertoobz

Dudes! It's totally OK!

[AmazingRuss]

"Tomorrow, Vickery will turn over the data to the the Texas Attorney General, where it will be destroyed. "

See? They're going to destroy it!

Re:Dudes! It's totally OK!

[Anonymous Coward]

That's the "hold up" part for me. You can't hand someone data. You can make a copy for them and they could delete that copy to "destroy" it but...

I was going to type more on this but my brain is giving up. There is only so much I can handle and this one sentence as managed to go beyond that.

Re:Dudes! It's totally OK!

[Anonymous Coward]

And there shall be no backup anywhere!

Cloud is cloud

[Anonymous Coward]

Systema mistake is to move the servers from inside their firewall to the Cloud outside. If they'd made the same mistake with their own servers, then it would be exposed to their internal network, not the whole Internet.

Cloud marketing aside, the basic idea of moving your private company data to a publicly accessible server, means you have to do extra work securing the link, and maintaining the connection, even then you're reduced to trusting Amazon not to misuse your data.

MIGHT be a HIPPA violation?

[Anonymous Coward]

How can this possibly be "Might be a HIPPA violation?"

It is precisely what HIPPA was created to protect against.

Re:MIGHT be a HIPPA violation?

[MyAlternateID]

How can this possibly be "Might be a HIPPA violation?"

It is precisely what HIPPA was created to protect against.

I'm not remotely a lawyer but I can offer an opinion. It's the whole "spirit of the law" versus "letter of the law" deal, I would assume.

For an analogy - that's the main reason Constitutional law can get so complex. Otherwise language like "shall make no law" and "shall not be infringed" isn't difficult to understand. No I don't think the authors of that document intended for physical papers to enjoy certain protections but not computers, cellphones, and other future replacements for paper not known to them at that time. No sane person who knows anything about them would truly believe that. Not for "terrorism" or for anything else. But motivated people worked hard to find ways of skirting the obvious intent by twisting the words and their definitions. Now the restrictions amount to "... oh, unless you really want to."

So this "might be" a HIPAA violation the same way warrantless domestic spying "might be" unconstitutional. With a sufficiently dense layer of surrounding laws and rulings, nearly any position can come up with some kind of "justification", however flimsy.

Re:MIGHT be a HIPPA violation?

[AK Marc]

Not even remotely. HIPAA was about "portability" before "accountability". Last I looked, there had been fines levied for not releasing medical records, but not a single one for releasing them inappropriately. The consultants all lied about the law to drive up their business, and medical practices are conservative about risk, so everyone thought about it as a "security" law, but it was more about access and portability for one's own records, and the penalties for leaks were not the reason or primary goal for the law.

And it's hard to take you seriously when you talk about it, but can't even spell it.

Cha-ching

[Anonymous Coward]

1.5 million people are about to become very wealthy.

Headline decieving

[Anonymous Coward]

Not even sure why Amazon is even mentioned in this and certainly does not deserve headlines? Can't blame a hosting server for someone using it as a distribution point.

Semi-OT: Why does plain text still exist?

[gilgongo]

Why does plain text still exist? Or put it another way, why is anyone who has data they must protect able to put such data into a program that will export, import or otherwise be accessed by an external system *without* an encryption key?

I know it's a stupid question, but being able to just dump a database to text is just totally wrong, no? Nobody seems to be phased by SSL over HTTP, after all. Excel, Outlook, Oracle, MySQL, etc. - stop the madness!

Re:Semi-OT: Why does plain text still exist?

[Anonymous Coward]

On a very secure system there might be a reason to not have "export to csv" but as a universal format it has it's place. Do you ever plan to upgrade your database software? Do you want to dump a couple fields and integrate them with another set of data in excel?

As far as export only with key, again do you plan for upgrade or your vendor going belly up?

It doesn't have to be easy or exposed to the internet but there are reasons export to plain text still exists.

Re:Semi-OT: Why does plain text still exist?

[godrik]

Well, I am not sure what they were doing with that data. But if you are going to make any kind of multi pass analysis on it, you probably don't want to pay the runtime cost of encryption/decryption. Also, if your system has any kind of external connectivity, it is typically for authorized querying of the data, so the system certainly needs a way to decrypt it.

Re:Semi-OT: Why does plain text still exist?

[gilgongo]

Well yes, runtime costs of encryption might be an issue, but that's sort of what I meant when I said nobody seems to be phased by SSL and how that works with trusted keys, etc. In short, why can't all data (like medical records) be encrypted inside systems that are incapable of exporting the plain text and can't be accessed by anything that doesn't have the cryptographic ability to do so?

Obviously, and attacker could steal the keys and write an application that read that data and then exported it as plain text. But encrypting by default would seem to a good way of preventing accidental or just stupid data breaches as so often seem to be perpetrated by idiots.

Re:Semi-OT: Why does plain text still exist?

[AK Marc]

Why does plain text still exist?

Because searching an encrypted database for "gilgongo" isn't trivial. And when passing "gilgongo" to middleware over unencrypted XML, how do you encrypt the individual fields? Because if you send encrypted XML (IPSEC or such) then you'd send the fields inside unencrypted, so the dB on both ends would be unencrypted, or import/export unencrypted.

Makes a mess for migrations and support.

HIPAA violation!

[AndyKron]

Fuck all these people. They need to be held accountable. This should be a capitol offense. That would put a chill into all these so called "programmers", who are really nothing more than glorified mop masters.

Why all the Amazon love?

[Anonymous Coward]

I don't understand why we constantly make multi-billion dollar corporations irresponsible because "all they're doing is providing a service and it's up to the customer to make sure things are secure". Indeed, most of the power asymmetry on the modern Internet comes from the work of storing and processing data being contracted out to third parties, but with no responsibility on their part for data handling, whether that's Facebook or Amazon. They want to be treated as common carriers without any of the regulations that come along with that label. If someone hands my business some sensitive data and tells me "here are some procedures for processing it, but I want you to be the one actually doing the storage and processing", then it is my responsibility to put safeguards on the procedures to make sure my systems don't accidentally let the whole world read the data.

If I say to one of Amazon's machines, "Give me private medical data on patient XYZ" and Amazon's machines running Amazon's system software on Amazon's network respond with that data, it seems to me that Amazon is making the free choice to provide that data in order to collect revenue. Amazon may have provided a degree of control to a third party (Systema) to flesh out the details of the service, and might wish to deal with Systema's failure not to change the default-readable for cloudy files. But Amazon was the one that chose to provide a service whereby Systema could store private medical data - in particular, in a way that by default would be accessible by anyone, or would be accessible by anyone if custom software isn't well-coded (because they don't by default provide stringent firewalling).

This is not like a tenant being responsible for what they do in their building, over which they have a high degree of control, not least thanks to physical presence. The Systema contracting someone else with a nebulous bunch of computers thousands of miles away to store and process medical data, providing some custom routines to do so. Systema is one up in the chain of responsibility, but Amazon is no less responsible.

Re: Why all the Amazon love?

[hawkeyeMI]

"This is not like a tenant being responsible for what they do in their building, over which they have a high degree of control"

Have you ever used S3? That is almost exactly what it is like.

Re: Why all the Amazon love?

[Anonymous Coward]

I have physical control of all the hardware and software and connections to the outside world, then? I can literally see if someone is trying to walk into the building to read/take stuff while I'm there, and lock it up when I'm not?

Re: Why all the Amazon love?

[hawkeyeMI]

You have extremely fine-grained software control over what does and does not reach the machine.

We have come a long way

[burtosis]

At least the guy isn't being criminally held liable for bringing this to everyone's attention.

Just another private company screwing up

[smooth wombat]

So Amazon, or whomever, lets 1.5 million personal medical records get into the wild. Will there be Congressional investigations considering this is substantially more than what happened to the IRS?

Where were the investigations about Target and its breach of 40 MILLION credit and debit card numbers?

Or is this simply another example of private industry doing it better than government?

Did TX outsource to a lowball bidder?

[Anonymous Coward]

I don't know what Systema is, but is it some lowball IT consulting company? Will there be repercussions for going with a lowball company instead of getting professionals to do quality work?

insecure or unsecure???

[Anonymous Coward]

is it to be or not to be?? lol - could not figure out if the cloud has feelings... insecure vs unsecure... - just saying....

encryption

[Anonymous Coward]

Holy smoke, is anyone really using non-anonimized, non-encrypted data with services like this?