Hospital Sends Legal Threats To Researcher, Then Asks For Her Help Identifying Breach Victims
from the sooooo-sorry-about-the-bullets... dept
Shooting the messenger is the most popular response to reported data breach, making the job of security researcher far more dangerous than it should ever be. The twist in the latest "shoot the messenger" story is the shooter coming back around to ask the shooting victim for help. Bad idea. Even if the body is still warm and breathing, it's probably not in the best of moods.
Dissent Doe runs databreaches.net, a site that covers all sorts of exposed data stories. Sometimes, Doe is asked by those discovering security holes to disclose the information to the affected parties. (See above paragraph for why.) In early May, Doe tried to alert the Bronx-Lebanon Hospital Center about confidential patient records left exposed by a contractor. The stuff exposed was deeply personal, containing write-ups of patients' substance abuse problems or mental illnesses.
This didn't go well. The hospital didn't want to talk about it or explain why a third-party had so much access to confidential health records, much less why it hadn't bothered to properly secure the hospital's database. One day after these mostly futile phone calls, someone (not specified in the post) contacted Dissent Doe to let her know the databases had been secured and thanking her for notifying them.
That should have been the end of the story. But it wasn't.
It was a brief honeymoon. On May 9, Kromtech published their report and I published my first report on the incident without any statement from the hospital or vendor, neither of whom had provided a promised statement.
Then on May 12, coordinated threat letters arrived via email from external counsel for both iHealth and Bronx-Lebanon Hospital. DataBreaches.net understands that Kromtech Security also received similar letters.
I’ll let that sink in for a minute: they threatened a person who went out of her way to alert them they were leaking protected health information. Instead of saying, “Thank you so much, and can we also ask you to please securely destroy any data you might have in your possession?” they sent me threat letters.
The stupid, angry letters contained stupid, angry threats. First, the letters accused Doe of improper access. Then they went on to demand she and everyone else in possession of this data delete it and send a certified letter (or something) back to the hospital and vendor confirming the destruction of the data. They also demanded she reveal her sources and not post anything further about the breach.
Doe didn't think much of the demands, but she did retain counsel just in case. An angry, non-stupid response letter from her legal rep changed the tone of the demands into more polite requests. Not that the change in tone won Doe over. A bridge only needs to be burnt once to render it useless. And, in one sense, the angry, stupid threat letter did work: while Doe didn't cave, it appeared that Kromtech did delete the data it had discovered. That resulted in a problem.
Apparently, the hospital and vendor forgot about their earlier bridge-torching efforts. They approached Doe again, this time asking for help identifying which patients had had their personal info exposed in order to notify them.
Now the entities could just notify everyone who had PHI/PII on the server, of course, but it seemed like they were trying to narrow the universe to only those whose data wound up in Kromtech’s hands – or this site’s – or NBC News’ hands. And now Kromtech could not tell them which patients had data in the 500 mb of data they had downloaded and then destroyed.
But Kromtech had sent a subset of that data to DataBreaches.net, who had not destroyed the data it possessed. If DataBreaches.net wanted to be helpful, it could go through all the data and let the entities know which patients had data in there, right?
But why should Doe do this? The two affected entities had already expressed their gratitude using legal threats, not exactly the best foundation for future collaborative efforts.
I might have been able to spare the vendor and hospital some notifications if I was willing to donate my time to going through files to compile information for them, but I’m not willing.
I’m not willing, in part, because I do not want to be going through PHI if it’s not for my reporting purposes. And I’m not willing because why should I have to spend my valuable time compiling information for entities that tried to bully me and who now need my help to help them clean up their mess??
Shooting the messenger kills potential allies. But far too many entities think it's better to shoot first and live with their regrets later. Security researchers aren't the enemy of privacy, but they're often treated as criminals and malcontents by entities who have screwed up their own security efforts.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: dissent doe, leaks, reporting, security, shoot the messenger, threats
Companies: bronx-lebanon hospital center, kromtech
Reader Comments
Subscribe: RSS
View by: Time | Thread
Hmm
I doubt they forgot their earlier bridge-torching. I smell a rat. They probably have enlisted law enforcement and want Doe to turn over the data to prosecute. Because somebody's got to go to prison and it's not the hospital, right?
[ link to this | view in chronology ]
Re: Hmm
More likely, it's this:
(from https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html)
My money is that they're trying to pare down the scope of the breach to get under that 500 record mark, so that they don't have to go on the 5:00 news to advertise it.
[ link to this | view in chronology ]
Re: Hmm
[ link to this | view in chronology ]
Re: Hmm
Turning over the names would serve the dual purposes of confirming 'possession' and limit the number of people they will need to contact.
It's not important that there was no crime committed, and no conviction possible. Just putting someone through the criminal system is an effective punishment -- expensive, time consuming and embarrassing punishment.
[ link to this | view in chronology ]
Re: Re: Hmm
They just wanted to tell as few patients as possible that their data had been breached to save face.
[ link to this | view in chronology ]
Re: Hmm
[ link to this | view in chronology ]
On the one hand, she needs to do nothing more than send back the portion of data she received from Kromtech. Hardly an effort.
On the other hand, all this does is show what data (or a subset thereof) security researchers had, which is pretty pointless.
If they really want a number, they can fairly well guess within a range from the size of the data originally downloaded. But the real point is, their entire db and who knows what else, was exposed. They need to be concerned about other parties who may have found this and copied more than a sample of the db. Funny their internal filesystem hasn't kept notes.
[ link to this | view in chronology ]
hospitals like this
[ link to this | view in chronology ]
lETS SEE...
Lets ask...
WHO would you rather get a notice from a lawyer??
An agency trying to help, and ISNT COSTING YOU MONEY..
OR to have a consumer, that is protected by TONS of privacy laws, that has found his PRIVATE RECORDS ON THE NET??
WHy do we make it so Hard to be NICE..to be fair..
It costs little to nothing to be nice, unless they want to PUT you in jail..
Strange concept by SOME FOLKS, is that WE/YOU/I are the only smart people in the world, and NO OTHER person will figure this out..
Who to blame? You have an Automated system, and SOMETHING didnt close an Access point..
[ link to this | view in chronology ]
[ link to this | view in chronology ]
"Yeah, no."
In her shoes I'd send back a letter 'reminding' them that they made it abundantly clear that they didn't want her to have anything to do with the data, and as such she has no obligation or interest in assisting them in their CYOA efforts.
If they want to try to find out who had their data compromised that is entirely on them, they already made clear how they respond when people try to help them.
[ link to this | view in chronology ]
"about confidential patient records left exposed by a contractor."
[ link to this | view in chronology ]
So they leaked data they are legally obligated to keep secure, demanded destruction of evidence of their failure, & now are trying to get the number as small as possible to not have to pay for fucking up. I see felonies there, perhaps a DA would agree.
For the bonus round not only did they fail to secure the data, they had no controls or logs to show them who accessed what files.
Much like needing a Federal Anti-SLAPP law, we need a law to shield researchers who discover & properly disclose leaks. Using a series of other researchers, who often have to work hard to be taken seriously & then deal with baseless threats, there should be a solid clearing house on some level.
A clearing house that informs the leaking entity, discloses a leak happened, verifies its been secured, & notifications are wide ranging. We can't keep expecting people to do this out of the goodness of their heart when they are often attacked & threatened with legal hassles for being responsible messengers.
It is obvious that the laws we have in place to protect this data don't have strong enough punishments. Perhaps multipliers to the fines (and civil suits) might get them to think paying for security is cheaper than the liability of saving a couple bucks.
[ link to this | view in chronology ]
Re:
I have a better idea: How about going through the files to find the identities of the people whose information was exposed and contacting them directly to let them know that the hospital leaked their private information. Not only are the affected people informed, the hospital will probably have several rather pissed off patients to contend with and might even find itself on the receiving end of lawsuits.
[ link to this | view in chronology ]
Re: Re:
I know this situation, I'm "That Anonymous Coward" and it took me WAY to much effort to be taken seriously. If I emailed random people and said I saw your leaked medical info... what would be the response? A visit from one of the acronyms I am sure. Then I have to convince the acronyms I'm not a hacker, threat, terrorist, or anything else their small minds decide. Much easier for me to use a trusted conduit to put the data into the hands of authorities and walk away. (but keep an eye out for notifications & reporting).
[ link to this | view in chronology ]
CSI Cyber
Right after the episode aired, I went online to post that they were more likely to have CFAA charges filed against them.
[ link to this | view in chronology ]
Should have thought about saving face before they fired off legal threat letters. A lot of people are willing to forgive the incident, but not many are willing to forgive the cover up.
[ link to this | view in chronology ]
[ link to this | view in chronology ]