Hackers hijack and publish mental health data of hundreds of people

The poster was simply providing their viewpoint on the state of mental health that differs from yours.

I understand these things can cause strong emotions, but you don't do yourself or your stance any favors by letting it get the best of you here.

https://www.psychologytoday.com/us/blog/out-the-darkness/201...

You might have "skin in the game" but then it is depressing you do not know that almost all mentally ill people would in the long run be healthier without these pills. They mostly only work short-term and absolutely destroy ones health long term. You should be advocating for people to get short-term medically help and long term medicine-free therapeutic help if you really care.

I consider that offensive"

You might also consider, that other people might have a "skin in the game", with close, intimate relationship to mental illnes patients, too. Some of them tragic.

And my experience simply is not, that in general psychotherapy evolved a lot. I see rather a trend to favor pills to keep people calm as this is cheaper, than deep psychoanalytical therapy.

So consider that offensive, if you must, downvote, if that makes you feel better, but it does not change my personal experience.

However, support for people with mental health problems is still severly underfunded. The improvements we have seen say as much about the terrible treatment of the past as they do about how well we are doing now.

Almost all studies I have read find that a combination of medication and other therapies provide for the best outcomes. Most people can only get funding for medication, which is often better than nothing, but it really falls short of what society could, relatively easily, provide.

It is really a tragedy, not just to the individuals suffering from mental health problems, but also to society as a whole which misses out from all the untapped productivity and creativity.

CBT is great and I personally benefited from it, but it's not a recent phenomenon and its effectiveness is very hard to evaluate. There was a meta-study analysis in 2015 that pointed at a decline in its effectiveness between 1977 and 2014. I wonder whether it's because studying anything to do with a human brain is hard and we can't trust the numbers or if it's because of changes in society that caused people's personality to shift in a direction which makes CBT less effective.

Autism and schizophrenia were differentiated in 1980, so that's not in the last 2 decades.

Homosexuality stopped being a mental illness in 1973 (or 1987 if you include sexual orientation disturbance), so that's not in the last 2 decades. This was a great success, there were studies that pointed at a marked decrease in suicides among people in same-sex relationship over time.

Gender Identity Disorder stopped being a mental illness in 2013 but I think the issue has been politicised and the outcome doesn't necessarily make a lot of sense. I can bring a personal anecdote from a friend of mine who started using a female name for a period and wanted to perform a reaffirmation surgery, who later changed his mind.

- Most kids who experience gender dysphoria before puberty grow out of it.

- Suicide rates are high even after reaffirmation surgery and even in western societies, which are accepting of transgenders. Moreover, if discrimination was the cause of suicide rates, I think we would see a high suicide rate in minorities. There is way more discrimination towards people of color than towards transgender.

- If Gender Identity Disorder is not a mental illness, shouldn't we be consistent and label Body Integrity Dysphoria (aka people who believe they're amputee) as diversity and approve of cutting off of healthy limbs?

I'm skeptical on including this as a win for the field.

> Suicide rates ... are skyrocketing.

I'm confused. You seem to be suggesting that having more conversations about mental health is to blame for an increase of people committing suicide.

This is the exact opposite of my lived experience.

Conversations about my mental health and my problems are why I'm alive (and have no intention of taking my own life) today.

If you have a different lived experience, then fair enough.

But I'd respectfully suggest to take care painting with such a wide, sweeping brush next time. Life ain't binary. Especially when it comes to mental health.

Not globally. A search suggests suicide rates are down 15% in 10 years. That is, suicides have gone down remarkably.

If we're talking about the UK/US (which I haven't sourced but I can believe), it's more likely that conservative policies are driving people to feel they have no alternative.

Secondly: a bacteria infection and the treatment with antibiotic is very well understood - and is actually solving the issue.

The brain is not at all understood. Lifting peoples mood with drugs is not solving, why they were constant unhappy in the first place.

https://en.m.wikipedia.org/wiki/Ten_Days_in_a_Mad-House

As further evidence (albeit anecdotal) I have noticed, especially in light of prominent suicides in the last few years, that the information posted seems to be getting more attention, with, as you called it, meme-like inclusion almost everywhere and every time suicide is discussed. This has correlated with an increase in the number of calls they receive.

They have received more than 12,000,000 calls since 2005, with 8,500,000 just between 2014-2018, much faster than the increases in suicide rates.

[0] https://suicidepreventionlifeline.org/wp-content/uploads/201...

They won't call the suicide hotline for you. They won't transfer you. They won't share their number. What they'll do is send the police.

I can safely say, in retrospect, that although I survived it, it took nearly a decade to fully heal from that event. But in the mean time, I also learned (thanks to posts like these) about the Samaritans and later in the UK, they helped me get through the tougher moments of this process.

I don't know how significant the effect is, but it's non-zero. :)

Is this service confidential?

Yes, except for in certain situations where our safeguarding policy means we may tell someone, for example, by calling an ambulance. Read more about when we do this.

On the phone

When you call Samaritans, your number is not displayed to our volunteer. The phones we use don’t have caller display information on them.

We might ask your name, because it’s a natural question to ask in a conversation, or because of something you have said to us, but you don’t have to tell us if you prefer not to.

Via email

If you've emailed us, your email address will not be shown to the volunteer.

In person

You don’t have to tell us your name if you don’t want to. In the unlikely event that you see the Samaritan volunteer that you spoke to later on the street, the Samaritans volunteer will not acknowledge you, unless you do so first. This is to respect your privacy and the confidentiality of your visit, unless you wish to recognise it.

By Letter

We will need your name and address to reply, but to maintain confidentiality, your letter will be shredded once we have sent you our response.

I feel grateful that you've not only built the tool and put it out there, but that you took the time to share with me a little of your story and that it sounds like you have also felt the weight of such a decision. I'm sure other people feel it as well, I just rarely, if ever, have heard someone articulate the saving a life vs taking a life aspects of such technology.

Thank you.

I don't think the system can work in the ideal way I would like - the system's priority is the system itself, regardless of the wishes of the individual. As you say, doctors would be sued. I would say that suing, etc relates to the culture that has grown up around the system. And perhaps the medical system was always this way - ie system-centric, rather than patient-centric. With the onset of the 'IT age', we get to see that system-centric fruit fully 'ripen' such that everyone's data can be seen by anyone.

You might say - as I do - that it is for the person who is being treated to be the collector of their information. A different culture would have grown had we had the patient at the center of our considerations.

I'm sure people have been warning all the way down the line, about the issues over privacy. It is frustrating that at every turn the expediency over the system overrides all other concerns. After, what 100 years(?) we find ourselves where we are no, with the patient having no control (and often no knowledge) of the issues that relate to them, while the system has it all. I would go further and say that this outcome is by design, as those running the system - those who govern us - would prefer that we were ignorant while they are informed. Its pretty dystopian anyway.

Ppl will likely die because of this leak, I don't think there was any informed decision weighing the risks of both approaches before making the choice.

Every year I see leak after leak in medical data, I am only an developer not in the industry, but the nature of the leak has always indicated massive incompetentence and poor design or ops, rather than than real need for patience care.

Storing data in public S3 bucket has nothing to do with patient care, unwilling to invest to upgrade from windows XP has nothing to do with abiltiy to give care. Ransomware attacks because of aging stack has nought to do with privacy or care.

There is very very little need to aggregate data given the risk of leaks, and very little value to any single patient when his data gets aggregatated. A system not influenced by pharma or software industry would make it incredibly expensive or hard to collect aggregate data, while keeping individual records usuable

The harsh reality is hospital administration and regulation tends to be skewed with doctors, it is the same with legislators who tend to be lawyers, or professional management tend to be sales than tech. None of these groups understand the nuances of tech always to manage or regulate them better, sometimes they are smart or trust their advisors and get it right, but it hit and miss.

Data is money today , so industry is not interested in better safety of medical data either, preventing aggregate collection will loose a lot of value for med tech companies.

Are you sure your expertise in this area is up to date?

Even with "unlinked": Signal can do discovery without the server storing a social graph. There's nothing stored on a server for a hacker to ransom.

Rank speculation, but I'd imagine there are current designs even at Apple that protect user's health data, and those designs contradict your claim of a shrug-while-we-work dichotomy between "privacy and effectiveness."

Edit: clarification, added a barb :)

they probably have loopholes the size of trucks where they could hire outside sources to do such things but hide their sources.

Each individual company might try to motivate slightly better behavior in their own clients but overall they want their administrative percentage of a growth industry so they drive up absurd costs like the US health care industry.

Yes, I did. I provided you with this solution: "simply invest that money in better security to begin with"

> "Wouldn't it be better to simply do the right thing." is not a solution.

I never said that. But what I did say is indeed a solution.

> What I propose is a set of policies and incentives that archive what you want.

Well, it certainly makes incentives, but probably not the ones you had in mind. For instance it incentivizes middlemen to scrape off valuable resources that could have been used to secure the actual data. At best this lowers the profit margin left over for the hospital to improve the security, but it's way worse than that. Instead the middleman actually incentivizes hackers to crack into the very system the middleman "insures," exactly because huge insurance payouts are involved.

Perhaps the hackers could fake a mental disorder and get committed at the hospital, which would make it far easier to get insight into how the data security system works, and then plant a backdoor or leak that way. This means the hacker would both get money from blackmail and money from insurance payouts (win-win for him), making the incentives from the insurance scam absurdly bad. But perhaps that was the goal all along?

Meanwhile the owner is already disincentivized from securing the system further, because he can claim that he already did enough to secure it, while what he actually means is that he insured it... Whatever he paid for, was certainly not free! The only one incentivized to look into the matter, is the insurance company itself, because they're the ones who stand to lose the most money if the system fails. And even they don't want to waste money on a matter they might not even understand themselves. Meanwile their biggest incentive isn't to secure the data, but to not pay money to the patients. And perhaps the easiest way to avoid that, is to hire a PR consultant instead of fixing the data system.

Certainly the least of their worries are the patients, who are the real losers here, from being trapped in a game of exploitation for profit, and who quite possibly have to pay a much higher fee for the services of said institution because of it. Luckily, Finland is a welfare state, so that extra cost probably won't be billed individual patients (depending on how this privately owned hospital operates), but instead it will most likely be forwarded to the taxpayers, which – while spreading the cost on more hands – is still extremely bad.

Overall, introducing an insurance scheme only adds another problem, without fixing the initial one, because how would you rate the probability of the system failing? That's what sets the insurance fee, after all. Thus, for the insurance companys part, it's far better to overbill, which would just result in increasing cost, without much benefit to anyone.

Most importantly car accidents have a known variance and are statistically predictable.

There are insurers that will take on one-off unpredictable risks (reinsurance), but equating cybersecurity to car insurance makes little sense.

They'd just need to post a bond or similar, if they don't want to insure.

(Any insurance company would need to do something similar.)

Currently cybersecurity insurance pays the company, so actually the company itself has less incentive to fix real security issues (albeit with more incentive to resolve the specific security-audit needs of the policy.). And expensive policies reduce the pot of money available to fix problems.

Government policies that make directors criminally liable, and ways to spread that liability for criminally negligent security faults, would probably have a better effect than monetary fines.

I'll note that the whole password on a sticky note example is not ideal, but doesn't weaken such systems against what is likely the biggest risk they face: network systems being compromised remotely.

This is of course not ideal, but a far cry better than not having such policies in place.

What if you suspect that there's been medical malpractice done on you and you've purged your data? Or there's some sort of an investigation where the authorities need to get in contact with a certain doctor's patients or something?

I spent 5 years fixing various messes written in it for people as a contractor in the mid 00’s.

Similarly, I don't hold any credence to a black hat saying "but look at how insecure they were".

We have to stop designing systems where if one administrative task is mistakenly skipped, the result is catastrophic. Imagine if when you tried to start your car that if you didn't have the brake fully pressed that your car blew up. Would you say "Oh, wow, how irresponsible it is to not fully press the brake"? No, you'd blame the manufacturer for building an exploding car.

Systems should not start if strong admin credentials are not the first thing that are set up.

Of course, I agree that the care provider also did something wrong (as well as the hacker(s)) and that the people are also victims, but "the people vs. the care provider" is a separate matter from "the care provider vs. the criminal".

Do you mean store without names? The conditions, times, places, etc, are inherently PII themselves.

My wife gave birth on a given day in a given hospital. She also broke her ankle once. No names, but record uniquely identified.

That said, Snowden disclosures and others indicate that if there's an email, voice call, location information or any other digital piece of information, it is accessible to the NSA, not warrants required.

At least locals. In the news, I remember a story about drunk tourists finding a drivable electric golf-cart standing around. It's much less likely to run over a person than drive into the sea. Which they did. None was injured (by luck, that particular cliff wasn't high enough), the court forced them to pay for destroyed property.

As a sidenote, where do you live that firearms owners are obligated to store them unloaded? They're of little use that way. I grew up around loaded guns all over the house, not hidden at all; I knew that if I ever so much as touched one, my father would tan my hide beyond belief. More importantly, I knew I'd just end up hurting myself or others.

There definitely are highly publicised cases that happened just because of gross negligence in handling that data. But to some extent, every system is vulnerable, and there are also attacks that are, using your gun and car analogies as an example, the equivalent of stealing the gun from your safe or taking your car at gunpoint while you're stopped at a red light.

You seem to have in mind people who experienced something traumatic in the past, and/or are fearful of sth. I wonder if things like bipolar or borderline or OCD or depression or schizophrenia didn't occur to you? Then there's not always any past trauma to be resilient against?

> should also be told that, in the end, it's just data, and how they react to other people becoming privy to it is something they can exert control over

This data can in some cases get them fired from a job, or bullied, and more,

I think it's not true that it's just data -- it's more like a threat.

Sorry, I don't have a news page to link.