Slashdot Mirror
FTC Fines Software Vendor Over False Data Encryption Claims (softpedia.com)
An anonymous reader writes: The US Federal Trade Commission (FTC) has fined a software vendor for lying about its product's encryption capabilities, despite being publicly warned by US Computer Emergency Readiness Team (CERT) not to do so. The software vendor is Henry Schein, who deliberately ignored CERT and FTC warnings and continued to sell its CRM for dentists, even if it knew it did not comply with HIPAA rules. The vendor got "only" a $250,000 fine.
Is the data encrypted using Pig Latin?
Irstfa Ostpa!
This is yet another example of why rolling your own encryption is a very bad idea. Not only is it a weak algorithm but it also relies on obscurity. Their literature even says that due to it's proprietary nature that makes it even more secure because it's more difficult to reverse engineer. Good job, morons!
Why didn't he just replace DES by AES. It is almost drop in except for key and block sizes. Surely not more than a week work?
For all the talk about "never roll your own crypto", we don't exactly see anything better from the self-proclaimed "experts", either!
Just look at all of the major flaws in the OpenSSL library. We're talking about some really serious problems! Even LibreSSL, the fork maintained by the OpenBSD crew, who are among the best and most security-conscious programmers out there, still has bugs. Other libraries like GnuTLS are affected by serious bugs, too.
It would be one thing if these so-called "experts" could write flawless or even near-flawless crypto code. But the code they write is often just as shitty as any code written by others.
yes, they were only fined $250K. Henry Schein is a multibillion dollar multinational company. $250K is "cost of business" expense because they make millions selling their software. this isn't even a slap on the wrist.
Anons need not reply. Questions end with a question mark.
What I find disturbing is that this is the feds, not a court, convicting them.
No, because HIPAA is totally tech agnostic. The security protocols in HIPAA are only a few pages; encryption is "Addressable" yet not "Required" unlike "Unique User Identification". They are designed so a normal "office manager" can do a checklist; they are in no way "security protocols" like an actual IT compsec person would design.
"Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health information."
"Encryption (Addressable). Implement a mechanism to encrypt electronic protected health information whenever deemed appropriate."
That's pretty much the tech level of the entire document, there are no actual technologies referenced in it. Technically you could indeed use Pig Latin as your "encryption", but actually don't need to have any encryption at all.
Good. Now maybe the Federal Trade Commission will go after anyone building back doors in their software or hardware for the criminals at the N.S.A.
I'm an American. I love this country and the freedoms that we used to have.
It seems like someone wrote a basic customer-tracking database for Windows that happened to be focussed on dental patients, and then Henry Schein bought them and built the rest by "buying" (or "licensing") connections to a pile of other third-party software. In addition to MS-SQL and Microsoft Office, this seems to include Adobe Flash in places, "integrators" for at least two different third-party imaging software packages, a messaging system, and who knows what else.
Looking at the CERT notice, I'm guessing they "bought" (/"licensed") their special "proprietary encryption" as a package from Faircom and just bolted it on without any further examination. They were probably happily going along continuing to brag about their encryption because Faircom was, and they figured Faircom could be blamed for it.
It doesn't help that "Dental-patient record tracking software" isn't a particularly big niche, so there's likely very little competition and any half-assed thing they throw together will continue to generate license fees because Big Multibillion-Dollar Corporation can easily outmarket the very few competitors they may have (and who may not actually be any better). Many years ago, I worked for a proprietary retail inventory-and-point-of-sale software developer. Their product was also a rickety pile of smouldering crap, but it still seemed to be better than most of their few competitors back then. Horrifying, but I suspect Henry Schein is in an analogous situation (compounded by being a massive conglomerate).
Hacker Public Radio is our Friend
> No, because HIPAA is totally tech agnostic.
That kind of depends on your definition of "tech." If your records are on paper, they aren't subject to HIPPA privacy protections.
And just to segue a bit - this company getting fined is an amazingly rare occurrence. HIPPA enforcement is toothless. What is the point of a privacy law if there are no consequences for breaking it?
First they wanted to backdoor all encryption, now they've got a fully-backdoored encryption and it's still not good enough.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
So every fine should be placed in to social security for everyone to recoup their loss.
You're partially correct. HIPAA does not require encryption. However: if you want Safe Harbor from HITECH obligations to notify patients of breaches, then the kind of "encryption" you use does matter, and the rule points to NIST standards for that.
And just to clarify an error in the OP wrt: "Henry Schein, who deliberately ignored CERT and FTC warnings:"
This action by FTC followed from a complaint I filed with FTC after I was unable to convince Henry Schein to individually notify all its customers that what it had sold them as "encryption" wasn't encryption. After my meetings with them and comments from cryptographers that I published, Schein did agree to change their branding and their newsletters, but they still wouldn't notify customers individually. And I was already aware of one case where a dentist had a breach, and reportedly innocently - and wrongly - reassured his patients not to worry because the ePHI were "encrypted."
But the FTC never warned or cautioned Henry Schein and I am not aware of Schein ignoring any warnings from the FTC.
As a HIPAA-covered entity myself, I'm glad the FTC acted on my complaint to send a strong message that if you advertise something will help you meet your HIPAA obligations, it should. Calling obfuscation "encryption" gave dentists and their patients a false sense of security.
And kudos to Justin Shafer who reported the VU to US-CERT and then filed a supplemental complaint to my complaint to the FTC.
~~Dissent
OMG, I can't believe that FTC did something. This is where people would chime in and point out a list of FTC accomplishments, if people could.
Ha-ha!
https://www.youtube.com/c/BrendaEM
Not exactly. HIPPA has provisions for both PHI and e-PHI. If your business works with another by passing either PHI or e-PHI, you either have to be compliant or you don't do business with them. In practical terms, this means that if you're a dentist and you want to be reimbursed by insurance, it doesn't matter if you're submitting paper or pixels - you have to be HIPPA compliant. If you want to do a cash-only business and you don't need to work with any other HIPPA-compliant business, you can roll HIPPA up in a ball and trash it. Regardless of whether your records are paper or pixels.