Slashdot Mirror
FBI Raids Dental Software Researcher Who Found Patient Records On Public Server (dailydot.com)
blottsie writes: Yet another security researcher is facing possible prosecution under the CFAA for accessing data on a publicly accessible server. The FBI on Tuesday raided Texas-based dental software security researcher Justin Shafer, who found the protected health records of 22,000 patients stored on an anonymous FTP. "This is a troubling development. I hope the government doesn't think that accessing unsecured files on a public FTP server counts as an unauthorized access under the CFAA," Orin Kerr, a George Washington University law professor and CFAA scholar told the Daily Dot. "If that turns out to be the government's theory -- which we don't know yet, as we only have the warrant so far -- it will be a significant overreach that raises the same issues as were briefed but not resolved in [Andrew 'weev' Auernheimer's] case. I'll be watching this closely." It was also reported this week via The Intercept that a provision snuck into the still-secret text of the Senate's annual intelligence authorization that would give the FBI the ability to demand individuals' email data and possibly web-surfing history from their service providers using those beloved 'National Security Letters' -- without a warrant and in complete secrecy.
How is anon FTP not authorized? I give my "name" (anonymous), and credentials (email address), and the system makes the decision to let me in , based on the configuration the sysadmin set. If that's not authorization, what is?
"National Security is the chief cause of national insecurity." - Celine's First Law
terrorist pedo. this is easy.
...dental software security researcher ...
That's, er, pretty specialized!
I have a lot of "issues" with so-called "security researchers", which in many case are either opertunistic hackers or script kiddies. But really, how can it be "hacking" to access data that does not require "breaking in" to anything? Sure, the dude was not invited, but if it's out there, not fire-walled, and all you need to do is type in some random URL, how can that be illegal?
Now, there may very well be laws, rules, whatever about medical records, but if anything than it's on the medical provider for violating HIPAA or something. On the other hand, disclosing other people's medical records publically available or not might very well be against some law, and maybe it should be...
If you want news from today, you have to come back tomorrow.
The moral of the story is that if you discover something like this, close your browser and tell no one.
Reporting a vulnerability or data breach has come to mean that "you're some kind of criminal" and must be punished, regardless of the circumstances.
Just cruising through this digital world at 33 1/3 rpm...
An anonymous FTP server is like a park bench. Literally anyone can use it.
This is like alerting the owner of a bag of money which is on a park bench, and then being penalized for sitting on the bench or looking in the bag.
If only they'd go after Wall Street as ferociously as they go after those who investigate company security. But then, the reason they go after those who cross big companies is the same reason they don't go after the people in big companies.
He is not the first one. The popular racket is simple, they scan for rich doctor files accidentally left online. Once they find something, they offer a "security service" for $###,###. Sure, they don't report their paying "clients" to government for medical records protection violation. It doesn't apply to non-clients. It is not kiddie game.
The purpose of anonymous ftp is for anybody do come in and get files.
Setting up the site is publishing the data.
FROM http://www.webopedia.com/TERM/A/anonymous_FTP.html
"A method for downloading public files using the File Transfer Protocol (FTP). "
If the site was in fact anonymous FTP, then what he did was walk in through a door with a big sign on it that said 'come on in'.
To arrest someone when they were invited seems odd.
An arrest might be reasonable for the person publishing private health data, not the person discretely informing them of their error.
Such a person might have reason to obscure the facts?
Either the facts are something else, or the FBI fell for a really dumb story.
Hopefully, they are smart enough to sort it out.
The article describes him as a "dental software security researcher". Does that means it's his job? If so, was he working for the company whose computer he accessed? If so, isn't this authorized access as part of his job? Or was he accessing the system of a competitor of his client? That would be almost certainly unauthorized. I read the linked article and it is light on those details. I think this case would come down to whether or not he was doing this as part of his job and was therefore authorized to access these records. If not, he could be a in a boatload of trouble, but one would have to wonder why he would be trying to access systems of someone who wasn't his client.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
First, that's not how locks work. A normal lock has only one keying. Master keyed locks are done do by larger organizations. To get that master key you have to either get it from them in an authorized manner, or steal it somehow. It isn't like the manufacturers maintain an "all locks" master key and hand it out to people.
However more to the point an anon FTP is an implicit invitation to anyone to come in, just like a public HTTP server. In terms of the real world, it is like an open store. If you enter an unlocked store, you are not trespassing. If they tell you to leave you have to, but simply entering is allowed because the fact that they are presenting themselves for the public to use and have not locked their door is saying "We want you to come in." That's different than a place that is locked. The lock is an explicit "keep out" message.
There's many aspects which goes against the "security researchers": It's medical records, which need to be password protected. If the researcher knew what he was doing, he would understand that medical records are always under password protected area. Seeing those records anywhere should indicate those "experts" that they have _already_ exceeded their authorisation. Also the article wasn't exactly clear whether it really was anonymous ftp access -- at some point it claimed that the researcher had "explored the fixed passwords" of some equipment. That explanation didn't sound like anonymous ftp access. Instead it sounds like guessing passwords based on how other such equipment works, which is clearly illegal activity. It is classic case of exceeding authorisation. And the dental software company clearly knows what they're doing, since they can summon the appropriate legal mechanisms for exactly that situation. So their action is accurate response to illegal hacking.
on the other hand, the security researchers did try to report their findings. I dunno what special rules need to be followed when reporting such issues publicly. But medical records definitely have strict rules how such disclosures should be handled, so that criminals can't get access to the data. Random people on the internet trying to report their findings can do nothing but more harm to everyone...
and woe to the subject who points out that fact. Forget 'security by obscurity' - the gubmint seems hell-bent on 'security by denial'. These days it's safest to pretend not to see security failings. Failing that, it almost seems to be the safer, wiser course of action to profit illegally from said security flaws than to point them out in the hope that they'll be fixed.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
If I access a router with a known backdoor password, and someone failed to patch it, that is breaking and entering. It is clear that such access was not intended by the owner of the device, and I am effectively breaching their perimeter without their permission. In this case the guy use anonymous FTP. The entire purpose of anonymous FTP is to allow anyone to download files. FTP technology and anonymous access is routinely employed by companies and websites specifically to exchange files with everyone. Therefore, given the plain and regular use of the technology, one can easily argue that they effective were inviting file downloads. Until this guy was able to validate the content of the files, he would arguably not have known that the files were supposed to be protected. The fact that he reported the finding shows that he was not behaving maliciously and acting in good faith.
Make an anon release to a news outlet. Hilarity ensues.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
If I leave my car door open, key in the ignition, parked in front of your house, it doesn't give you permission to touch my car, let alone enter it, let alone drive it, not securing your property is not a crime, interfering with others unsecured property without permission is called trespassing or theft.
However intentions count in some circumstances.
I think he broke the law, and I think the people holding the records broke the law too, both should be charged or fined.
Boy some of you guys must be pretty young. Have you ever used anonymous ftp? Anonymous ftp works by entering the host, then your username, coincidentally: "anonymous" or "ftp", and then you enter your email or the password "guest". It doesn't even check if these are correct. It just let's you straight through
Society use your Sciences
Nah, the lesson is to report anonymously so they get exposed for doing wrong and so you don't face reprisal.
So long as they continue to discourage people from notifying the public about this type of activity, then they win.
Public means "hey I have this server over here, if you want to use it, go nuts"... not "I was doing a port scan of this network range, and found a FTP server and decided I would try logging into it". The latter is considered "computer trespass" or "unauthorized access of computer networks and data". If he did the crime, then I'm sorry, and I hope his court wait isn't lengthy.
That is completely nonsense. It is like walking up to a shop with the lights on and no Open or Closed sign or any posted hours and opening the door and entering the shop if the door opens.
I don't recall when I first accessed an anon FTP server, but it was certainly well over 25 years ago and I've used anon access many times. If user 'anonymous' and an arbitrary email address is accepted as a password, it's open for the public to access anything that the user can get to -- everyone knows that and everyone knows that every administrator who configures a system presumably intends it to be that way.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
The "computer security" industry has explicitly cultivated an image of being dangerously edgy, give-us-money-or-your-stuff-is-in-danger, then confused the issue by spinning their tales such that nobody, not even themselves, could clearly answer just who was doing right and who was doing wrong.
So while this seems a throwback to early days where people got prosecuted essentially because the accusers didn't know much less wanted to understand what was really going on, but this is much worse. We're seeing the chickens coming home to roost. It may not be what the "security researchers" wanted, but it sure is what they've been shooting for all along.
There is also that the USoA "justice" system has essentially gone rogue, but since the field they're operating in has been well and truly muddled, that's just fertile soil for promotions within the justice department, as there is no morality left on which to rebuff the rogue agents of justice.
To the general public, "computer security" is nothing but shady bunches of tech-y shady people that would probably best be locked up anyway, lest they lock up your computer. It doesn't matter what the "computer security researchers" think of this, since nobody understands them anyway. Except that they talk about how much they like being illegal all day, like they're in a bad western or something. It has even anchored itself into the very words used. Syeah, nothing much you can say against that, really.
And you left your whole pension on the bench for all to see and you don't want to be notified?
If you have nothing to hide, you should not be worried, they said. The government is there to protect us, they said. The government has a right to do those things, they said. The government would never cross the line, they said.
Well, I would say at this point it is probably past the "too late" stage and you are stuck with the monster which decades of apathy and "blind misplaced patriotism" has created.
The US government has so much power at this point, I find it hard to imagine the people could ever take it back without a lot of bloodshed. I hope I am wrong.
Every time I go to the hospital they have no ability to access my previous records!
:T:R:A:N:S:
This poor schlub is being prosecuted because he's highlighted one of the pitfalls of the ACA's requirements that medical records be converted to and stored as computer data...that, even barring malicious and intentional hacking, leaks and poor security practices will ensure that patient data will be exposed regardless of any laws or legal penalties put in place. Something those in power assured us would not happen.
He's getting screwed-over because he dared expose the dishonesty of those in power.
The lesson? If you just happen to discover a way to access any of the US government's law enforcement/intelligence networks, do not notify them of a vulnerability. Either sell the method of access and/or the data acquired, or simply post it on the 'net on a server located in Ecuador.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
If they aren't supposed to, then put a fence around it with a combination lock to open the gate, and only give the combination to people who are supposed to be there.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
What will they do with your information US citizens.
So he legitimately logged in but didn't have authority to access the files? Juries have gotten dumb of late but I doubt any juror will swallow that double-think.
I think it's more like finding a wallet and going to return it, contents intact, only to be called a thief and be arrested.
But this case doesn't even need analogies. It's pretty simple, unless there's some evidence no one knows about. The FTP was public. His path to finding it seems legitimate. What he says he did after finding also seems legitimate and there are other entities to back him up at every step.
This isn't even an overreaction, because this needed NO reaction by authorities against him. Only the company that DID fail to secure the records. This is plain and simply wrong on every possible angle that has been brought to light.
I await a stupidly argued prosecution, for what didn't happen, and his life to be really unpleasant for as long as they can make it, just because.
"front lawn" = implied private domain, access is a violation
"park" = implied public domain, accessible by deliberate design, open channel to access it is intentionally placed and maintained (and used)
We hear enough "victim" bullshit in other headlines, thanks. Those games don't work when you explicitly publish files or data to an internet location.
The US is tripping over itself to become a police state as soon as possible.
Requiem for the American Dream
Second point is that although access to enter was granted, access to download is not implicit. One logged on, you are effectively in someone else's house. If this were a house and the door was left wide open, I think even entering may be construed as trespassing. If in said house, the owner left all their confidential information on their office desk, you are not allowed to take pictures of them with your phone. To go back to the original thread, if the researcher ended up on this frp server by following a link that the server owner provided, either directly or indirectly by having a link on a public web site saying 'Hey, go look at these documents', then I would exonerate the guy.
Net servers assume business rules, not residential.
Access implies permission to download in an anon FTP server. The whole purpose of anon FTP is to distribute data freely to the public (remember, it pre-dates HTTP).
The defendant's "crime" is as follows: He picks up the store manager's wallet off of the tray under the "Please take one" sign, holds it up and calls to the manager "Hey, I don't think you meant to leave this here". Suddenly cops with assault weapons appear behind him and take him away.
The icing on the cake? They completely ignored the muggers openly shaking down elderly customers in front of the store.
Your problem is use of the house/doorway metaphor where it does not fit. Even if you could make a case (which I'll not address here) that allowing someone to log into a server does not automatically grant the right to download files to which they have been given read access, you certainly cannot make such a case for an FTP server, which is dedicated to allowing downloads and/or uploads of accessible files. The fact of its being an FTP server that allows the user access counts as the "Please download" sign.
Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety.
The wrong person was arrested.The absolute idiot that exposed secure info should be arrested, fined, and banned from any IT job or function for life. Further, the HIPPA regs need to be made clearer and more encompassing, and enforced. If my info were in that compromised data, I'd be very angry at NOT Mr Shafer, rather the blithering idiot that made these data so available!
Self-importance and self-indulgence is the root of ALL evil.