Pfizer-Biontech vaccine data stolen in cyber attack | Hacker News Reader

Pfizer-Biontech vaccine data stolen in cyber attack

reuters.com

246 pointskleiba176 comments

There shouldn't be any private data to steal.

We grant these companies patents so they can be open about their tech.

If they have secret data, that really ought to be a reason to withdraw their patent.

> There shouldn't be any private data to steal.

Vaccines require the running of clinical trials during development and approval. Trial data was not stolen in this case (according to the companies), but obviously this is private "vaccine data".

The article specifically states "we are unaware that any study participants have been identified through the data being accessed".

The breached data concerns "confidential information about the vaccine and its mechanism of action, its efficiency, its risks & known possible side effects and any unique aspects such as handling guidelines". What strikes me is the fact that this information is confidential at all.

Perhaps this was an NSA job.

I know, this was exactly of my point: I felt that OP didn't read the article, and it didn't occur to them that "vaccine data" could also refer to personal information in their blanket dismissal. In this concrete case it wasn't the case, but that all "vaccine data" should be open is certainly privacy nonsense. Once you introduce that definition I agree.

> > There shouldn't be any private data to steal.

For technical information (how to make the vaccine) this means it's not private.

For personal (including medical) information about clinical trial participants this means Pfizer-Biontech should not have the information in the first place.

I came here to say the same thing. There have also been many stories recently about bad state actors trying to gain access to research, citing only UK / US state. It is interesting to see South Korea included in the list of countries.

Such stories to me do not seem to survive the slightest bit of critical thought, and yet the same stories keep getting pushed repeatedly. The only potential negative I can foresee for the public is that if there were an abundance of data available publicly, funded anti-vaxxers may be able to misrepresent them – but I still think the benefits would outweigh such downsides. In any case, public faith is rather lower than many would have hoped.

One kind of private data that strikes me as necessary and vulnerable at the same time is private data (including medical history) of people who took part in the trials.

Which the article states very clearly was not the data stolen.

Yes, but we're discussing the grandparent comment which says "nothing should be secret".

Yes, within the context of what was stolen. "Nothing of what was stolen should be secret." was the statement referred to.

But we don’t know what was stolen, so it infers nothing should be secret (with the exception of personal data from the clinical trial).

"Personal data from the clinical trial" should not be present in the first place.

To use a more obvious example, your bank account information should in fact be secret, but that does not invalidate the claim that Pfizer-Biontech shouldn't have any private data to steal, because they should not have that data.

This data was stolen from the EU drug regulator. You're saying the gov't shouldn't have patient level data from clinical trials? How do they evaluate the drug?!?

And Pfizer-BioNTech is running the trials and analyzing the data. Why wouldn't they have that data? Are you suggesting they try to get their drug approved without it?

I'm so confused.

> How do they evaluate the drug?!?

Personal data about a (particular) patient should be possesed only by that patient and probably their doctor. The party distributing drug doses knows "<patient UUID> care of <doctor's post office box> is recieving <experimental/placebo>", but doesn't know who the patient is and ideally shouldn't even know which doctor they're mailing it to. The evaluators (plural) each recieve "patient with <age/sex/preexisting conditions/etc> equal to <value> <improved/worsened> <a lot/a little/not detectably>", with each evaluator bucketing and adding up the data for their particular trait (eg "18-25-year-olds did this well, 25-40-year-olds did this well, etc"). The company that has a obvious conflict of interest (incentive to corrupt the trial results) shouldn't be involved at all besides shipping a crate of medication to the dose distributer.

In practice things wouldn't be quite as strictly compartmentalized as they in principle should be, but if the patients' personal infomation is ever all present in one place to get 'stolen', your healthcare system is so fucked up it's not even funny.

(Note, preemptively, that I am not claiming that your healthcare system is not so fucked up it's not even funny. I'm making normative claims here, not descriptive ones.)

It's clearly apparent you have zero clue how clinical trials are actually run and what needs to happen with the data collection and analysis.

Yes, the company has a conflict of interest, but by sharing patient level data, the gov't can replicate any analysis. It's transparency in the process, data collection and data that makes for a reliable system. Masking personal data to the point that the gov't doesn't even know what the data represents sounds stupid.

I mean, your personal doctor collects all this data and stores it. Why would you not do the same with clinical trial data? It's medical treatment, albeit, experimental medical treatment.

And you think the Canadian healthcare system is "so fucked up it's not funny"? Or did you just assume I'm American?

I don't think it's unreasonable to keep the personal details of trial participants secret, for example

Apparently this is not what has been breached. From the article:

> no BioNTech or Pfizer systems have been breached in connection with this incident and we are unaware that any study participants have been identified through the data being accessed

I find it interesting that you argued for hiding this kind of information, while not knowing what was stolen.

Yes, your argument is trivially true, how does it help us move forward?

The grand-parent commenter wrote "If they have secret data, that really ought to be a reason to withdraw their patent.".

The parent commenter helpfully explained how such statement is trivially false, in that there is value in keeping some data secret even though patents are involved.

I see it - there is something there. Ill read it again and inspect my own reactions to it.

Thank you! I mean that

Do they need to collect this information in the first place?

Is it being collected?

Yes, you want to contact them if some issue comes up which was not immediately clear.

Pfizer should not have this data, normally it doesn't leave the investigation site. Pfizer has only coded data (pseudoanonymous) that does have subject names replaced with numbers.

edit: note that subjects can still be identified with this data, just not directly.

CROs handle that data. Also adverse effects are strictly handled by third parties.

This is likely an attempt at IP theft. Probably a second rate state actor.

CROs act as an agent of the Pharma company, so shouldn’t have it either. Patient identifiable information shouldn’t leave the investigator’s site.

No, there should be no reason for Pfizer to collect this data. This could be done by a third party.

Those are never, ever stored with the pharma companies. If FDA finds out they are you can close shop.

Where they are stored? At the investigator of the trial?

Yeah, wherever they are usually stored.

As I said in another comment - the only data the pharma company gets to "take home" is anonymized (partially, ie. a number instead of a name) and blinded (you don't know if they received drug or placebo)

The company must reconcile the patient data with the trial data (on premise), in a scenario like: "liver enzymes abnormal after administration of vaccine, is there anything in the patient data that could clarify that (apart from the vaccine itself)". Someone has to painstakingly go through all that data.

Source: this was my job

After the study is concluded, won't they get the non-blinded (still anonymous) version?

During efficacy/side-effect analysis you should definitely use only blinded data. After confirmatory statistical analysis, it seems reasonable to go over the data in an exploratory pass to possibly discover/hypothesize why/when/how the medicine works/fails/interacts. Or do they just get the aggregate report?

It looks like this was an attack on the EMA, so that data could have been present there

if by close shop you mean, pay a token fine as the cost of doing business and move on, the yeah.

if it were useful to big pharma to have that info, they’d have it.

It's not useful to them.

And even if it was, they'd be breaking half a dozen rules at the risk of getting the whole study trashed and billions lost, for almost no benefit.

Getting a study invalidated is the nightmare scenario of every pharma company. And it's not just the FDA or EMEA but also scientific journals that go through this stuff.

Not only is it reasonable, it's required by law (HIPAA).

Are they patented yet? Or at least could china patent in its system like those trademark in basket thing. (Seems the approach of chinese and western is a bit different. Hence if they patent not along their approach we know.)

As said good luck to humanity.

Parents cover only one part of the whole story. The rest are "business secrets" which are allowed to be secret...

Which is an abuse of the intent of the patent system.

The deal with patents was transparency in return for a short-term monopoly.

If we get one and not the other, it's a bum deal.

So just because a company has a patent on "X", say some very specific mRNA stuff, it has to disclose all its other non-patentable production secrets? That seems unreasonable.

A patent isn't "this stuff exists and it's ours now", it's protection of the process of creating it. What other production secrets are there? If a patent can't be replicated using only public information, it shouldn't be valid

there can be a lot of business related information e.g. what exact machines with what configuration they use to produce this vaccine.

If you can’t make something without knowing the exact machines or their configuration, that info should be in the patent for it to be valid.

Anything can be called 'business related information'

EU patent office says a patent must provide enough information to be reproduceable by a competent proffeshional - that's the whole point of a patent, to be usefull after it expires. It is not there to list things the company would lile to protect.

https://www.epo.org/law-practice/legal-texts/html/caselaw/20...

US patents must provide enough information for one of ordinary skill in the art to practice the inventions recited in the Claims of the patent.

Thus, depending on what the claims cover, plenty of detail about complete systems can be omitted from the patent specification. For example, if the claims of a patent are directed to cache management for a messaging platform, most details about how the messaging platform works can be omitted as long as the cache management system is sufficiently described.

If there are unique features of the messaging platform that enable the new cache management system to work, detailed description of those features would need to be included in the patent specification. But unrelated stuff, such as, routing mechanisms, protocol optimizations, security, and so on, that may be part of the messaging platform can be omitted from the cache management patent specification.

Thus, the messaging platform org could keep plenty of trade secrets about other parts of their platform while still obtaining a patent on their cache management system.

> it's protection of the process of creating it.

That's if it's a process patent. There's also molecule patents, etc. I could be wrong but typically pharmas don't take out process patents because they are hard to prove and you need a warrant which has a nearly unattainable level of discovery to get on premises and determine if the process has been copied. With a molecule patent you can buy a sample and prove infringement with an analytical technique.

While the fda has disclosure requirements on a pharma manufacturing process, it does not have to be disclosed to the public.

Yes, and the idea that those could be stolen is the process working as intended. The fact that they could be stolen and little recourse would be possible is the incentive for companies to apply for patents, which are supposed to be better for the public good that trade secrets.

you're not understanding. If I patent a process, I am required to publish the process. Then, a competitor can copy the process (because it is published). How do I as, the process patentor defend against infringement?

Because it is a process, I have to go on their premises and prove that they are stealing my process. You must obtain a warrant to do that (because otherwise it is trespassing), and because competitors could just willy nilly claim "you're stealing my process" in a spurious fashion to gain access to the premises (and learn about what competitors are doing), judges typically put up a very high burden of proof to issuing those warrants.

You'll effectively never be able to enforce a process patent, so you're better off never patenting it and keeping it a trade secret instead, that way you have a bit of a moat.

By contrast, for a molecule or plant patent, the existence of the product is proof of infringement, so it's easier to enforce infringement.

For a molecule patent, you do not need to disclose the method you use to make it. IANA(P)L, You might be required to disclose one way of making the molecule, but it almost certainly doesn't have to be the way that you do it "in prod".

If you are talking purely about a process patent, then yes, you will have such an issue. But process patents aren't the only way you can protect your production process, you can also patent various necessary equipment.

Ultimately, if you rely on keeping a process secret, you will most likely fail. Processes are trivial to copy, patent or not, and if you don't file a patent then it's not even illegal to copy your process when, not if, it becomes known.

For big companies, you need one whistleblower. You hire one employee over. They say "Oh gosh. We were doing the same thing." It's hard to keep that sort of thing secret.

Warrants are granted to law enforcement, not in civil suits between corporations. The word is subpoena, and if you knew even the basics of what you're talking about, you'd use correct terminology.

Legal discovery usually doesn't have a "very high burden of proof," because there are very reasonable ways to compartmentalize information. Legal discovery usually leads to a ton of transparency, at least to the legal teams on both sides (and a firewall, so that can't go over to the engineers).

MOST executives are diligent about responding to subpoenas. Judges have broad discretion for contempt-of-court, up to and including prison. If you're the CEO of BioCorp, and you can:

1) Respond promptly, completely, and accurately. Risk: You might wipe $200 million off of your books and cost each investor $2

2) Stonewall the court or lie. Risk: You might get thrown in prison.

Which do you do? Most executives pick responding promptly. Not all, but most.

Most companies are super-careful not to infringe patents that they know about, because it's not fun. Unless it's a case of mutually-assured destruction. There are whole industries where everyone infringes, and no one sues anyone.

No, that’s not a reasonable take at all. The patent itself should provide a clear description of the technology and enough detail to replicate it. It doesn’t require disclosure of every small detail that isn’t relevant to actually executing the technology, like say quotes from suppliers for glass vials.

> We grant these companies patents so they can be open about their tech.

No. Hard no.

A patent is used to grant some exclusivity to the patent holder because it assumes the patented thing can be readily duplicated.

The idea is that they want the patent holder to have time to profit from their idea before it can be copied and undercut.

It has nothing to do with being open or sharing.

If a patent is for a tool, there is no requirement that the patent cover things like how to manufacture said tool. If the patent is for a process, there's no obligation that you provided details on the exact application of the process and it's intended purpose.

That is absolutely wrong. See European Patent Office - key consideration is that a patent shall enable the invention to be reproduced by a competent proffeshional. If that is not the case, you can strike down the patent in court. That is the whole point of patents.

https://www.epo.org/law-practice/legal-texts/html/caselaw/20...

It doesn't however require you to disclose exactly how to reproduce it or how to do it cheaply or affordably. That information can be kept as a trade secret.

Part of the reason for patents is that someone else could devise a method of reproducing your patent cheaper or more affordably and undercut you.

In particular the tools to make the things are separately patentable. It is common to make something useful in the lab, and then a few years latter patent manufacturing tools that enable you to make it. It isn't unheard of for a competitor to find a better way to produce something than you and then you cross license each others patents so both of you can produce the thing but nobody else. (before attempting this consult a lawyer - the rules of when you can make something patented are complex)

> It has nothing to do with being open or sharing.

Wrong. In exchange for being granted a patent, the "invention" needs to be described in great detail, with all the necessary information, so that others can replicate it (once the patent protection expires).

At least, that's how it is supposed to work.

> with all the necessary information, so that others can replicate it

There's no requirement that the information in the patent be via beyond replicating the patent.

If the patent can be reproduced via alternate means that are cheaper or faster, those need not be disclosed. In fact the point of a patent is to protect the patent holder from someone finding a cheaper or faster means of reproducing it.

The invention is just the claims of a particular patent.

The patent description must include enough information so the invention as recited in the claims could be replicated. Patent descriptions do not have to disclose details about the supporting/surrounding components of the whole system or platform.

E.g., a patent claiming a method for selecting 5G channels does not need to describe how to build out a 5G network.

From Wikipedia:

A patent is a form of intellectual property that gives its owner the legal right to exclude others from making, using, or selling an invention for a limited period of years in exchange for publishing an enabling public disclosure of the invention.

So, yes, an _enabling_ public disclosure is exactly the purpose of a patent.

Public disclosure of the thing being patented, not all aspects of how you plan to produce and distribute it. In fact, those details are open for additional patents.

>We grant these companies patents so they can be open about their tech.

We also have EU wide law that protects these companies from lawsuits for side effects, instead the company, a governments gets sued.

We have the same in the U.S. https://www.hrsa.gov/vaccine-compensation/index.html

Research data that could help others fight the pandemic should not be secret.

But personal data should be. And data about business processes have no reason to be accessible. Work data can be misleading too.

Imagine you are working on a software project, there is a massive bug in your code, you know it is there and you intend to work on it before release. Now, imagine a competitor, trying to do the same and trying to get some advance, he steals your code, but he doesn't know about the bug and releases his own software based on it. You don't want that to happen with a vaccine...

>Imagine you are working on a software project, there is a massive bug in your code, you know it is there and you intend to work on it before release.

If only we could design a method to openly share the source data, perhaps even with a way to track those bugs. Alas, it's totally impossible for humans to collaborate like that.

Yes, I know about GitHub and the like.

But working in collaboration is always a hassle, you spend a lot of energy in reporting and getting people to agree. So what you usually do it to do your work locally, maybe have your own TODO list, and when you are done, you clean up your work and make a nice commit. Sometimes you can't even do that, you have to send it to an integrator who then assigns your work to a reviewer and write a test, and... lots of stuff.

What you see on GitHub tends to lag significantly behind what is actually being worked on. In fact, a lot of developers tend to dislike messy histories. They take great care of squashing and rebasing so that the history looks like a nice, linear, well documented process. This is not reality, reality is "forgot to add file", "removed debug trace", "fixed merge didn't compile".

Now back to the spying. Imagine you are working on an open source project, with a bug tracker, continuous integration, and all the bells and whistles of a modern collaborative platform. Because you don't want to show others the ugly truth of actual development work, if can take a few days before the thing you are working with appears on the platform, if not weeks.

Now imagine a rogue actor who doesn't like to collaborate and really wants to get an edge. Instead of getting the nice, clean version from the main repository, he goes to the main developer computer and copies his workspace, and then rush to release something before the next nice commit hits the mainline.

That's the idea behind such hacks: try to copy a work in progress, not understanding what went behind it, and, by limiting collaborative effort and testing, try to get something out as fast as possible.

That seems unreasonable in a world where not all countries respect US patents. Secrecy is a protection from having to compete with generic products made "illegally" in those countries. You can block imports of the generic into the US - but that gets harder to control in the rest of the world. And people can still import the generic for personal use as I understand it.

This is an argument for trying to keep something secret instead of filing for a patent, not what to do given the existence of a patent.

Parents are hardly an idealized system working properly. I don't see why you can't do both. Defense in depth.

The OP's argument is a theoretical argument that's only good in an idealized world that doesn't exist.

>I don't see why you can't do both.

Because we shouldn't allow people to have their pie and eat it too, at our expense.

Sure, I'll take Pfizer's meds and keep my money. Defense in depth.

Except the US didn't "grant" Pfizer anything, nor made any arrangement in regards to IP. Trump only made a deal for some of the first couple batches and that's it.

What should have happened, is what you are saying. But that's not how it went down and it seems, not how this world works.

Patents are already open information.

What you argue is that there should be no trade secretes.

I think what they are arguing is that you should only get one or the other -- that there should be no trade secrets required to put a patent into practice after it expires.

But that's what you get.

After patent is granted, it becomes public knowledge and stays public knowledge (not when it expires).

Patent's are just the top of the iceberg. Lots of research and methods related to covid-19 is not patented.

Lots of research and methods related to covid-19 is not patented.

That's the problem. Patents aren't useful to the public because they don't describe enough to make a useful product when combined with public knowledge. The monopoly granted is supposed to be in exchange for expanding the public knowledge after expiry, but if most of the knowledge is kept secret, then the patent system isn't striking the bargain it was meant to strike.

You say that as though having a patent in Country X protects you from IP theft by country Y. When the bad actors and the good-faith actors participate in the same market, and regulations protect good-faith actors only in a submarket, ... uh... of course there's secret data.

I think this is a much more complicated topic than many are making it out to be. And this complication is why patents are weird.

Like let's look at it. The argument here is that it was funded with public money so the data should be public. As a big OSS person I really like this idea. But who should the data be open to (and what data)? Germany?[0] (the funder) The EU? {North Korea,South Korea,Iran,Vietnam,China,Russia}?(the accused) The world? Public usually refers to the citizens of the country but can also colloquially mean "human."

Then we have to consider money (or resources, capital, whatever you want to call it. Time and effort was spent doing this and there was a loss of resources by some party). Is it fair for company A/Country A to spend a year or research time and money and Company B/Country B to steal that and make a profit through it because they can sell it for cheaper (i.e. B stole resources from A, that A spent time producing)? Do we know about how it is being produced? Are they vetted? There's all kinds of complications here that not only include resource recuperation (i.e. ignoring the capitalism component, which we can't because you can't just burn resources (capital) indefinitely) but there are also safety concerns.

Lots of companies decline to issue patents because they don't often protect their production rights. Often what happens is that the company produces a patent and 1) another company uses that knowledge to create something similar but distinct enough or 2) produces the same product in a country that does not respect the former country's patents. 1) is basically that student that copied your homework but made things unique enough that they technically weren't plagiarizing (but did they cheat?) and 2) is someone who copy pasted your assignment and turned it into a different professor. I don't think people feel great about either of these, but slightly better with 1. But you can also see a situation where the cheater turns in the assignment first and you get accused of cheating. The whole process is a mess!

Patents are difficult enough when you're operating in one country but get way more complex when you introduce other countries into the situation. I do think there needs to be major patent reform and personally I'd love to live in a world where all scientific advancements are available to anyone, but I'm not sure such a situation can exist until we advance to a post scarcity world. We're all familiar with OSS here and you'll always see people saying things like "Facebook is using that person's code, they should be a good guy and kick back a few grand for the free work." That's because we don't live in a post scarcity world. But in the mean time (until we get there) let's not trivialize the situation and try to view things from the situation we're in and how to advance things towards the dream situation.

[0] https://www.bloomberg.com/news/articles/2020-11-09/pfizer-va...

Data which no doubt is the result of research and engineering funded with public money.

Thus, it should be in the public domain and unencumbered with patents in the first place.

And in many cases will be bought as a developed product with public funds.

No, these companies are not funded with public money.

No?

> BioNTech to Receive up to €375M in Funding from German Federal Ministry of Education and Research to Support COVID-19 Vaccine Program BNT162

https://www.wallstreet-online.de/nachricht/12930907-biontech...

> US government and Pfizer reach $1.95 billion deal to produce millions of Covid-19 vaccine doses

https://edition.cnn.com/2020/07/22/health/pfizer-covid-19-va...

> to Support COVID-19 Vaccine Program BNT162

Emphasis on support

That doesn't mean the sum is equivalent to the full R&D cost or that the company actually agreed to give the IP developed.

Most likely they could have developed even without public funding but not on the expedited timeline.

Do you have any actual evidence for this? BioNTech has about 1k employees strong and got about 375 million Euros. Even if everyone would exclusively work on the vaccine for the whole time, which obviously didn't happen, that amounts to over 700k€ per seat for half a year. In an industry that isn't exactly capital intensive, i.e. the biggest part of expenses will be salaries.

Please read your own articles before posting. Your article it states clearly what the funding was for:

> The goal of the initiative is the expansion of vaccine development and manufacturing capabilities in Germany, as well as the expansion of the number of participants in late-stage clinical trials.

What you quoted is the shortend version of the goals of the funding program, here is a more complete description: https://www.bmbf.de/foerderungen/bekanntmachung-3035.html

The program is funding clinical trials 1 to 3, having bigger cohorts for trials 2 and 3, and scaling up production while trials are still in progress. In short: Everything that makes vaccine development expensive. Finding the actual vaccine candidates is the cheap part.

> Finding the actual vaccine candidates is the cheap part.

Do you have any sources on that?

See here: https://www.thelancet.com/journals/langlo/article/PIIS2214-1...

Going from zero to preclinical is about 1/3 of the costs of going from preclinical to phase 2. Phase 3 is not part of this study, neither is parallel production.

That is a study of existing vaccines based on existing practices (which result in astrazeneca's 70% effective vaccine)

BioNTech is a different vaccine type, hence effectiveness and fact that both moderna and pfizer license it.

The fact that Germany subsidised the last stages to speed it up doesnt mean technology should be public access. That's for the government and company to negotiate.

The German funding is funding.

The Pfizer funding is just a pre-purchase agreement.

According to the German article, they were already in phase 3 and they had not received any of that grant money. Seems to me, it is more about vaccine production at this point.

Biontech's research definitely was funded with public money, over 300€ million, in fact: https://investors.biontech.de/de/news-releases/news-release-...

According to the article, they were already in phase 3 and they had not received any of that grant money. Seems to me, it is more about vaccine production at this point.

Correct, though keep mind that this was explicitly demanded for this program: https://www.bmbf.de/foerderungen/bekanntmachung-3035.html chapter 4, second bullet point. That doesn't mean they don't get reinbursed for phases 1-3. Of course I don't know for certain, I do have past experience with federal funding in Germany, though.

Considering that the company has a history of funding from this source ("BioNTech is already an old friend in our research funding. We - the BMBF - have been promoting this company since it was founded in 2007") https://www.bmbf.de/de/deutschland-kann-innovation-13125.htm... my interpretation is that this was a calculated advance payment.

They got €300 million but that doesn’t mean the project cost €300 million.

This is a pretty normal arrangement where government induces companies to do something by paying at least up to half the cost while the company gets to reap the rewards. I’ve seen it happen in tech but I’m sure it happens in different fields.

Of course its a mutually beneficial arrangement, otherwise that would be pretty dumb for a government to do, right?

I can guarantee if there are any government funding instruments in place in the respective countries of operation, one way or another it will be gouged by the big corps.

Example from my home country: the government heavily subsidized the biggest telco’s new cyber security center a couple years back, because it was an ”technological innovation” that would ”bring jobs”. The services provided through this are of course private (as are gains.)

The talent and resources of big corp will usually outwit government policy.

That's a radical proposal. Instead the countries mass buying these vaccines should have a condition of annulling the patents upon purchase. The EU buys 300 million doses, they pay 300 million x unit plus a 1 time cost for the patents. As a result all the patents developed as part of the development of this vaccine are voided.

Company becomes richer than it already is, humanity gets richer with this new, public knowledge.

I love how HN is against software patents yet my much more lenient pharma proposal is downvoted :-))

HN isn't anything. Some users are against software patents, some are not. A downvote comes from some unknown person with some unknown opinion on the subject.

True, but that's assuming that there isn't a local culture that develops wherever people congregate, even online.

HN, as designed, definitely leans towards entrepreneurs, risk takers, people who rebel against authority, etc. Nothing wrong with that, we just have to acknowledge it :-)

By that logic if a tech start-up takes a business grant from the local govt of say $500k, but later raises $10M from private investors, the entire company and all of its technology should be public domain?

Really? A drop of public funding means the entire company is public domain?

These aren't startups. They are multi-billion pharma corporations.

What precisely is the structural, legal, moral, or other practical difference?

And that changes things because...?

Just replace “raised $10M from investors” with “put in $100M of their own money”.

Point still stands, no?

Military secrets are funded with public money. Should them be too public domain?

If by "public domain" you mean "public knowledge", then it should indirectly be public knowledge through elected officials.

Do you have any reason to believe that the military should be treated equally to healthcare funded by the public?

I mean, is this meant to be some sort of 'gotcha'?

yes

Setec Astronomy.

> Military secrets are funded with public money. Should them be too public domain?

Yes.

That's a false equivalence. This type of data doesn't represent a security threat.

Pfizer didn't take public money for development of this vaccine --- Moderna did.

And by public, I mean from the US taxpayer. No American company got funding from the Russian government.

FYI, they did take German money[0]. But there's still the question of what does "public" mean here.

[0]https://www.bloomberg.com/news/articles/2020-11-09/pfizer-va...

They're getting public money to fund public benefits like opening up businesses. If the vaccine single-handedly revitalizes the economy, they don't get paid for that either.

Stolen or copied as in a leak? Was the original copy removed?

Oh HN, please never change.

It was my first thought at well. The real question being "does this impede vaccination efforts?"

This discussion thread is pretty much garbage, IMO. The first thread is one guy arguing about patents and public domain (with participants having extremist absolutist views of how the world must be), and now some being pedantic about a word...

Incompetence breeds this type of bickering. Oh, that and extremist views, which stem from another form of the former...

If anything the extremist view is that publishing secret details about a vaccine should be a crime. The only one who benefits from not publishing them is the vaccine company in expense of everyone else.

Regarding "extremist absolutist views", would you consider entities like the FSF, GNU, and wikileaks to be extremist and absolutist?

As for "being pedantic about a word", I would say that it is not just penancy but rather a complaint about the presentation by the Reuters, in the style of "the evil russian hackers stole vaccine secrets" vs "the heroic security experts published vaccine secrets to the world".

If you have an issue with what these users posted, wouldn't it be better to directly respond to them as to why you disagree rather than dismiss them as extremist lunatics?

The terminology used is perfectly fine, consensus is that you can steal intellectual property -- and you can do so without making it inaccessible for the owner.

> consensus is that you can steal intellectual property

There isn't even consensus around the legitimacy of the notion of intellectual property (I'm happy to represent the position that it is not legitimate), let alone the notion that it's proper to use the same word that we use for larceny of physical objects to describe copying it.

In any case, this isn't an intellectual property issue, but a privacy issue. The question is whether this data was properly being kept private, or whether it belongs in the public domain in the first place. There doesn't appear to have been any announcement of what data was accessed, so it doesn't seem to be something we can know at this time.

> There isn't even consensus around the legitimacy of the notion of intellectual property.

There is, though. That's why the vast majority of nations have laws protecting intellectual property.

A different position held by a minuscule minority does not make it less of a consensus.

> In any case, this isn't an intellectual property issue, but a privacy issue.

Articles states:

> U.S. drugmaker Pfizer and its German partner BioNTech said on Wednesday that documents related to development of their COVID-19 vaccine had been “unlawfully accessed” in a cyberattack on Europe’s medicines regulator.

And if it is related to the development of their vaccine -- and something for the European Medicines Agency to review, no less --, I'd argue it's nearly impossible that it isn't intellectual property of Pfizer/BioNTech.

> That's why the vast majority of nations have laws protecting intellectual property.

Let's be clear on this one: the vast majority of nations have these laws because the US forced them via trade agreements, and the US has them because the entertainment corporations lobbied the hell out of them. Individuals almost never benefit from these laws.

Individuals consistently benefit from these laws - how do you think so many 'tech millionaires' exist? They had an idea, claimed it as theirs, and profited from it. Individuals don't benefit when these laws are taken away, because there is no incentive to create and all incentive to steal (re: China).

Yes, there is a consensus. Throughout history and every subject of study, ideas have been attributed to one or a small number of individuals. This is what intellectual property is.

Eastern minds don't believe in it because they don't believe in individual accomplishment or identity. That's why "dissenters" are locked in prison camps or disappeared.

No, it isn't. There is a very important difference here, they are not equal, and the editors have conflated the two problems. An an example, losing your digital photos and losing control of your digital photos are not the same problem for one to have. The article even states that the data was unlawfully accessed, and I think "stolen" in the title is a failure by the editors.

To "steal" has many definitions. When it comes to data that can be copied, there is another.

This action may well deprive the owner of said information of income/deals in the future.

But I completely follow your argument re: copyright infringement.

Stolen in the same sense someone would steal your credit card number

Except a credit card number is a piece of information that protects your real money that the word "steal" could definitely be used in relation to. It's like copying a key to a safe. This one however?

Pharma IP is both zero sum and way more valuable than your real money.

Pharma IP is literally the textbook definition of non-zero-sum. You think Fleming's refusal (or inability, or whatever) to patent penicillin resulted in the discovery being zero-sum? It's hard to imagine an example of anything more positive-sum than pharmaceutical knowledge.

A molecule will generally only be approved for a given indication once (until it goes generic). If one company releases it, the second one to discover it can’t.

In stories like this it's important to consider that returns on R&D for these large pharma companies have recently been getting quite low, 1.8% in 2019 according to [0].

[0] https://www.reuters.com/article/us-pharmaceuticals-r-d/pharm...

Those numbers are somewhat financial fiction to garner sympathy for big pharma, lobby for reduced regulations, and for “AI” startups to pitch their products.

Can you substantiate this?

Substantiate? No, you'll have to wait for the next Panama Papers for that.

But the process is similar to https://en.wikipedia.org/wiki/Hollywood_accounting : there's so many levels of suppliers/customers/expenses that may or may not belong to the same conglomerate, it's very easy to make the numbers of any individual organization reflect what you want it to reflect.

If you torture the data, it will speak.

Why should I, a person who is not a large pharma company, care about this?

Put another way, I care as much about pharma company profits as pharma companies care about my personal health.

Because this means for you as a person suffering from anything that isn’t extremely common, life threatening or severely disabling, pharma companies have no financially viable path to develop new treatments for you.

When kids say “I wanna grow up to develop a cure for cancer” the default answer shouldn’t be “That’s stupid? Even if you found a cure it would be to expensive to get to market. Why not do something that will actually benefit society like getting a law degree?”

I know it’s hip to hate on pharma companies, but at some point you have to realize that all those kids grew up to become scientists that are now working in these pharma companies trying to find drugs that will help people 20 years from now. But the fact is that the scope of research is limited by the financial reality that these companies face. If the net ROI on R&D goes negative that just means that companies stop investing in R&D and the first thing to happen is that scientists working on potential high impact low chance of success get fired. So out goes cancer treatment, while the team of people trying to figure out which color packaging for aspiring tablets maximizes chance of customer retention gets doubled.

Whatever happened to Anonymous? Pfizer have been involved in enough scandal and near-criminal activity in the past that I would have imagined governments championing them now as the new medical saviour is as big a cause as anything Anonymous has pursued.

The big people got caught, everyone else is killing time in chans.

Totally infiltrated by the alphabet agencies

A not-insignificant portion of them turned out to be crackpots that you don't really want to associate with

The title should more accurately reflect that the regulators were the data custodians that were compromised.

'The European Medicines Agency (EMA), which assesses medicines and vaccines for the European Union, said hours earlier it had been targeted in a cyberattack. It gave no further details.

The two companies said they had been informed by the EMA “that the agency has been subject to a cyber attack and that some documents relating to the regulatory submission for Pfizer and BioNTech’s COVID-19 vaccine candidate” had been viewed.'

I wonder what the purpose of this is. It would be quite disruptive for a bad actor to start leaking data to discredit the efficacy of the vaccine or to highlight side effects.

Cyber attack you say? Will an ex-military cyborg dolphin be sharing the data in a worldwide broadcast next?

Can anyone more familiar with this area explain what it says about the IP. What sort of things are shared with the regulatory bodies that could be extremely valuable to other companies developing vaccines?

When a new car engine is developed you don't need to share exactly how you make the parts or how it works (of course knowing how it works for a vaccine is probably important), it just has to meet certain standards regarding efficiency and emissions to be approved by regulators.

Probably a document like this https://www.fda.gov/media/144246/download

There is sometimes specific information about the actual manufacturing process or synthesis that companies provide. Given that this is an entirely new vaccine technology that has never been used before, there was probably quite a bit of confidential manufacturing content supplied as supplemental material to satisfy regulators.

You are correct that the regulators are generally concerned with safety and efficacy of the final product, not the sausage making. But if the sausage making is super complex and/or novel that could potentially have an impact on safety and efficacy. So the company may have been asked to give some amount of detail there. For example: given this vaccine requires cold temperatures or it breaks down, how are they guaranteeing the cold chain in the manufacturing process? (I'm just using this as an illustration of the flavor of question someone on the committee might have)

Given how new this vaccine tech is, there are probably quite a few manufacturing-related efficiencies and techniques that Pfizer does not want competitors getting access to. Not because they're going to copy this specific vaccine, but because it allows them accelerate efforts in this area for other vaccines.

> but because it allows them accelerate efforts in this area for other vaccines.

And ultimately make the world a better place? I fail to see any downsides here.

I would argue what makes the world a better place is ensuring companies have to innovate on their own. That’s what leads to breakthroughs and new things. Constraints often breed innovation. What is the incentive to sink billions into R&D if someone can sit on the sidelines and just take what you have developed? Look at the situation right now: we have multiple vaccine candidates from multiple companies because they all had significant incentive to develop them not because they were necessarily going to make a lot of money off this particular vaccine, but because they could accelerate R&D on tech they can use for other therapies. Some of these vaccine candidates appear to be mediocre at best. If we didn’t have a competitive marketplace we wouldn’t have gotten the best vaccine possible in the shortest timeframe possible.

Any guesses regarding the hackers? Russia? China? North Korea? Someone else?

Russia only holds 4.3% of global hack attacks, whereas USA and China are the biggest ones. North Korea is not even in top 10.

I think China already haa a license to make that vaccine.

Right, although they might be interested in how to make it at scale. I haven't heard anything about their plans to produce it.

I'm fairly certain they just got the license as a contingency in case their domestic/allied vaccines didn't pan out. I don't even know that they will decide to produce it at scale.

That could be, but it is different enough that if they didn't make strong efforts to produce it in quantity they wouldn't be able to exercise that contingency. Thus I expect someplace in China is a factory that can make it. It might or not have all the machines set in place, but it would be close enough that they can start them in a month (including the entire supply chain). China is pretty good at manufacturing, so I don't think they would screw this up.

Ah, I don't think at this point there is much of a risk anymore.

> some documents relating to the regulatory submission for Pfizer and BioNTech’s COVID-19 vaccine candidate

Hold it. Wouldn't these documents be publicly available already?

> confidential information about the vaccine and its mechanism of action, its efficiency, its risks & known possible side effects and any unique aspects such as handling guidelines

Why is this confidential? Isn't this information exactly what they're supposed to be shouting as loudly as possible to the scientific community and the general public?

If Pfizer's keeping confidential information about the side effects and risks, doesn't that completely undermine the narrative that the vaccine is safe and effective, and citizens oughtn't be concerned about it?

I'm not an anti-vaxxer. But this article definitely raises some doubts in my mind about the Pfizer vaccine, where there were none before.

Good. Hopefully this data will be open sourced.

Not entirely.

As someone in a sibling thread pointed out, by necessity these research labs get access to patients' medical history, and releasing all of that all of a sudden seems like a net negative to society, especially when we don't have good policies everyone agrees upon for where e.g. you might be justified to turn someone down for a job because they have fragile bones, among other random reasons.

(Though as another sibling thread points out, it sounds like patient data isn't breached, so...who knows.)

In clinical trials companies only get access to patients' medical history by looking at it wherever it's stored (hospital, doctor's office). It can not be "taken home" or downloaded or whatever, for confidentially reasons. Similarly, if you work in a trial you can not have any direct contact with patients.

A trial involves administering a substance and then recording its efficacy by examining certain parameters (lab results, images, a questionnaire etc). Someone from the pharma company has to look at these results and then check the patient medical data to make sure there's no unrelated conditions that could have influenced that data (this was my job for a few years).

The company will have lab results with numbers instead of names and in a blind study, the treatment they received will be unknown to the company until it's "unblinded" at the end of the trial, which is usually done by an external company.

Wow, regulators and government entities are terrible custodians of personal data, I'm shocked...

Good.

Yes, once they found the recipe for the vaccine, it should have become public right away unless someone wants to profit from this pandemic.

Why is it bad to want to profit from the pandemic? What's the alternative? No profit, no vaccine?

Or do you think that people should invest tens of millions out of their own pocket just for a good cause?

Or do you think that the government will magically conjure a vaccine without the support from the industry?

It is bad to encourage profit from a disaster because it creates a perverse incentive where you hope for more disaster. If you can profit from a disaster it is fine up until greed begins to interfere with solving the disaster.

Right, so.

There are people out there who we can simply call profit-haters. They are of course not quite so foolish as to imagine that people with money should commit millions and billions to pay talented scientists salaries up front, with the hope of doing no more of breaking even. Instead, they envision an alternative where the private sector is simply gone, a thing of the past, and instead some government bureaucracy is placed in charge of directing all of society's resources where they see fit.

Of course this gleefully ignores all economics concepts like "incentives", "accountability", the entire body of public choice theory, the principal-agent problem, numerous real world experiences of corruption, waste, and inefficiency in real-world planned economies, and the whole imposition-on-liberty thing.

These all have real world effects. As a strictly topical matter, the public sector in the US was in charge of the early COVID testing approach, and its months-long delays cost the nation very dearly. Some coverage from the Grey Lady (a well-known public-sector sympathizer, at that) --

https://www.nytimes.com/2020/03/28/us/testing-coronavirus-pa...

When someone advances arguments like the grandparent post has done, he generally doesn't want this mode of resource allocation to be expanded -- he wants it to be the only thing that exists in the world. It is likely that such persons cannot be dissuaded from this goal, because it is accepted as a hallowed ideological truth: profit is evil. If someone were to save society a billion dollars, and made a million dollars in profit, they would still deem it evil, and would rather see society continue to suffer. They would also be happy for society to pay steep prices in terms of lives, or in terms of freedom. So in the end, one generally can't meaningfully argue with these assertions. All you can do is just point out to others how extremist and foolish the position is.

A dead post adjacent laments people profiting from disaster, suggesting this encourages disasters. This is thinking about the incentives, but it is also, unfortunately, somewhat insane in the current context.

right, so, we're allowed to profit by releasing a new clone of candy crush but not by saving humanity from a global pandemic...

> we're allowed to profit by releasing a new clone of candy crush but not by saving humanity from a global pandemic...

Pretty much, yes.

We also shouldn't be allowed to profit from saving the humanity from crime (by running private prisons), for the same reasons.

I expect China to soon announce their own new vaccine candidate with similar effectiveness as Pfizer+BioNTech.

China has rights to produce the BioNTech/Pfizer vaccine, so that wouldn't be a surprise.

China national here.

BioNTech's vaccine is already bought and to be manufactured in China [0]. Implying it's China behind this incident is a little too late, don't you think?

[0]: https://www.fiercebiotech.com/biotech/fosun-follows-biontech...

Just China checking their already 100% working vaccine from months ago is still better /s

Why is this kind of data on servers connected to the internet?

Because everyone is working from home?

Reply on news.ycombinator.com