Hacker News Reader

I worked as a bioinformatician at a medical device company. We did genetic testing on cancer patients, and had huge amounts of private, personal information on the patients we were testing, because it was necessary to provide the correct clinical determination.

We also didn't have bossware. There were access controls on the data itself, audit trails on who accessed the data, but no software running locally on my personal dev machine looking at what I did at any particular moment.

HIPAA governs the storage, transport, and use of that health information, and we all knew we were criminally liable if the information got out.

Bossware in a HIPAA environment (or other environment where not having leaks in important) can be more of a liability than a boon, because it becomes yet another vector for attack or data leakage. You are in effect sharing all data a machine can access, with the maker of the bossware.

Something with the teeth of HIPAA but for other pieces of personal information could go a long way. It's amazing how differently executives behave when the consequences of data leaks change from "customers could be unhappy if they found out" to "I could personally go to prison".

> Aside: anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks.

Provision some isolated machines with access to production data, and let the data scientists login remotely. You'll be able to tell who is accessing the data and when, and won't need to install invasive bossware on their systems. It's a fairly straightforward solution. It's one thing to control access to sensitive data. Its another to use that to justify monitoring employees all day, even when they aren't accessing sensitive data.

Now you need to convince them to use this system. You also need to convince them to not use this system, where they're injecting arbitrary code into the sandbox remote machine, to download the data to their local machines where they can work in the way they understand and are comfortable with. Inevitably some person will react badly to the perceived lack of trust or object to what they see as making their job more difficult for no reason.

There are a lot of options for monitoring for that kind of thing. You monitor the remote machine, you monitor the network traffic between it and their local terminal... and the most valuable will be monitoring their local machine to associate with the rest of the access and usage information. Among other things, you need to be able to distinguish between someone using the data scientist's credentials and the data scientist using their own credentials.

Your idea is a wonderful approach! It improves security, privacy, traceability, and auditability. It may not be the same as removing the need for endpoint monitoring, unfortunately.

You can never perfect endpoint monitoring. At the very least, the engineer could see data, go to the bathroom, and write down what they saw on a scrap of paper. As long as eyeballs see data this is possible no mater what software you install on device, or even if you have an armed guard sitting in the office right behind the engineer.

I think there is certainly a place for audit trails etc, but it again comes back to how that data is used. An access log is an access log, but it's a difference if you analyze it to find people looking at data they have no reason to look at, or if you analyze it to track who spends how long on their toilet break. And a lot of what's offered by current "bossware" clearly falls in the latter category.

I agree. My goal here is to set out that there are important uses for monitoring. Uses important enough that it would be irresponsible to discard the notion entirely.

> It was the only way we could both protect the incredibly sensitive information about lots of people while allowing analysis work to proceed.

Meanwhile this data is getting leaked every other week by other companies. Didn't Equifax leak pretty much all sensitive information for the entire nation. What happened there?

I haven't formed a constructive thought out of all this yet, I'm just frustrated that we'll get surveillance software to allegedly protect data that's already been leaked by a hundred other companies.

Often this will be like the "think of the children" argument. Of course we should be concerned about security and make efforts to protect data, but many times the same people who push surveillance software in the name of security will later turn a blind eye to other security practices or concerns that might be an inconvenience to them. Their concern for security will extend only as far as it gives them power.

It's very often different companies and different systems. It's rarely the companies with mature and well-implemented security, privacy, and governance systems that do Equifax-style data spills.

To draw an imperfect comparison - improving the efficiency of electric car motors does little for those driving dino-juice-mobiles. That we as a society have the tools and ability to do better does not mean that every person and organization adopted them immediately and perfectly.

Yeah, do people really want no supervision on employees handling their PII or other sensitive info? I think I would be upset if I found out my info was not even being attempted to be protected while in an employees possession.

> anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks.

Joint distributions and generating functions trained against the production data to generate synthetic data, generally.