Nearly 200K Medical Records of US Military Veterans Leaked

The only way to change that is massive fines, there is no chance that a technical system can control human behavior...ATM at least, like Plane-crashes technically it's always human error.

EDIT: Corrected Plan-crashes and told Mozilla to pay a 1 Million $ fine, because the auto-correct software did not work correctly ;)

You can have the best protocol in the world, but it's useless if nobody uses it.

These breaches aren't some amazing hacker. These breaches are outsourced, lowest bidder doing dumbshit stuff.

I would never allow any of my medical data to be digitized, but I have never been asked. I would never use an Internet-connected Windows PC to manage any critical machinery. I don't want my printer to order inks for itself. I would rather avoid modern libraries which add dozens megabytes of complexity to make trivial things look fancy.

Oftentimes the optimal solution is not to add something (like another layer of encryption and automation) but to remove and make things simpler.

We have plenty of mechanism to track and identify actors, but the legal framework to make that work is not there. The major obstacle to get those in place is the billions evaluated industries built on the exist frameworks, and the enormous political power they have on the political system. Getting laws in place so we can have a safe internet that does not get exploited for commercial gain will be a bigger challenge then people had fighting tobacco companies on health issues.

> hardware and software that allow careless or incompetent admins and users to leak sensitive data

We have hardware and software that take responsibility for sensitive data, but that responsibility cost money. There does not exist any feedback loop or incentives for contract negotiators to manage data leaks to the point where leaks will not occur. There is however direct incentives to reduce costs, so hardware and software that can keep the initial costs down by putting the responsibility onto the user get a competitive advantage during contract negotiation. The industry can not fix this unless someone find a new profit center in preventing leaks. Laws and regulations could fix it, but then established commercial actors who currently has a competitive advantage by providing cheap hardware and software will fight those laws and regulators.

As such, the challenge seems to be to either fight nail and tooth against money and power in order to get laws that solves the issue (like gdpr if it actually got enforced), or someone has to invent a profit center that happen to align with eliminating leaks and hacks.

Maybe after nations has tried the concept of a citizen score, had a few internal wars, genocides, and media storms to really demonstrate the harm of the current system we might end up with enough international pressure worldwide to both have all the tracking and recording needing to correctly identify bad actors, but also the laws and regulations that prevents harm to innocents and enabling the commercial exploration of fellow human beings.

There is only one way to keep utilities safe on a public network and that would be extreme simplicity and a fitting network configuration.

> We have an internet that has few mechanisms to identify bad actors and make them accountable

That isn't the problem here and the advantage from this far outweighs the risks.

> abuse the data from tens of thousands of these leaks and hacks.

The data people share voluntarily also far outweighs stolen info.

The reality is that nobody wants to spend anything on IT and that will bite you in the ass at a later time. It is not a technical problem alone.

edit:

Here are some sources to support my point:

NHS patient data breached at least 1,395 times in two years (https://www.bbc.co.uk/news/technology-44682369)

NHS data breach affects 150,000 patients in England (https://www.bbc.co.uk/news/technology-44682369)

Over 18K COVID-19 Patients’ Data Mistakenly Exposed by NHS Trust (https://www.tripwire.com/state-of-security/security-data-pro...)

I can assure you the data is safe due to being a total mess. Antiquated systems, archived data in different formats, cross institutions joined data based on intuition. Might get something but everything is so disjoint you would need a magician not a hacker for something sizeable.

EU countries at least some western ones I have worked with are OK but their implementation mirrors each country's bureaucracy.

The Irish health service is currently under a ransomware attack.

Also remember when the Berlin courts were 'hacked' because they were still using Windows 95? (It's been a couple of years already)

And in the end, securing systems will help, but this won't stop until the people doing this are held responsible.

I think the only saving grace at the moment is that the chance of any individual being taken advantage of is low simply because there are so many people.

I would be much more worried if I was important and more likely to be targetted.

Source: Worked in healthcare IT implementing electronic medical record exchanges.

I think I should run for Congress with a single policy... you screw up data storage, your company is "executed" (nationalized)

ID.me is basically a glorified coupon/advertisement delivery platform targeting veterans, which sells itself as identity protection with perks. Then, ID.me got hacked, and all of my info I'd given them to prove my identity got shared with the goat. I got this sweet apology letter though.

So moral? They don't give a fuck. No one is held responsible. The general feeling is that "this kinda stuff just happens" and it's not really their fault. I'd love to see large numbers of people go to jail over this...