Trove of LA students’ mental health records posted to dark web after cyber hack | Hacker News Reader

Trove of LA students’ mental health records posted to dark web after cyber hack

the74million.org

71 pointsarkadiyt28 comments

(Off-topic) 'Clever' design shit like this just makes me reach for reader mode. If you want to do video, make a video. When I read an article, I do not want to scroll through the equivalent of a TV intro or game cutscene to get to the information. Normally this is just an aesthetic preference, but when you're reporting on a serious and complex legal situation, emotional theatrics actually undermine the journalistic mission.

I’m impressed as a software engineer that it worked as well as it did on my random phone screen.

Also, now I’m thinking about it more because I was annoyed.

I really don’t agree with you. I think it worked. It worked in a way that’s hard to describe; similar to how bad press will sometimes skyrocket a business into success and stardom.

There's some design inexperience going on. #FFF text on #000 background for starters [0]. Images of text used as a background for content text is an unusual choice. The #FF0000 red underlines for links look a lot like spellcheck highlighting. Storing still images as .gif can be a lack of experience thing, as in not knowing what default to select after drawing red squares over sensitive information, or not knowing to avoid image types that support layers.

[0] https://ironicsans.com/owmyeyes/

I agree. It looks like it was done well, but it was probably more fun to create than to read.

There is hopefully a special place in hell for people that do stuff like this. I can sort of see why people fall into computer-based crime, especially in developing nations (e.g., India), but this. It's despicable. Not only can it ruin lives, it can make people hesitate to get help when they need it, which can either lead to more suicides or just plain terrible life outcomes.

The anonymity of it all, and how they got away with it, is what makes it stand out for me. There aren’t many crimes this atrocious that are seen publicly without due repercussions for the criminals. I’m sure some homicide detectives see some real messed-up stuff, but I’m just a rando who didn’t sign up to be exposed to this kind of society underbelly.

I'm in agreement but, after all, no one pays a ransom if you tell them you are going to release mildly incriminating information. When you've elected to pursue ransom as a career path, you've already either decided or have been forced to live a despicable life.

Do the people who neglect to secure their IT systems get a place nearby?

You can always hack a computer if you work hard enough. Even the airgabbed Iranian nuclear control facilitices were hacked.

What we need to do is keep sensitive data in paper form only, and make people who hold it responsible for its security with no limits, or ability to hide behind corporate structures.

The end result is that so sensitive information as this is simply not kept, as it isn't worth the trouble.

That's everyone. The IT department is a conventient scapegoat for failing to do the impractical.

Someone decided to put sensitive records unencrypted on a computer connected to the internet. In the past they'd be on paper in a filing cabinet, only available to Watergate style attackers.

No it’s unlikely that they decided that. More likely that they didn’t realize that’s what they were doing, or didn’t understand the possible consequences.

Are there any civil or criminal consequences for the people who did the atrocious acts of collecting the PII?

Even though companies routinely neglect security until they are forced to address it through breaches, "Shadow IT" is often a thing and can bypass company security standards. I've worked with multiple corporations where the business side of the house had all but lost trust in the technical side of the house and just started getting what they needed implemented by 3d parties and consultants instead bypassing any existing corporate security standards and review.

You dont even know what the end user is going to do with the data and you are already condemning them.

Why do you think the state are the good guys when they dont even teach law in a concept understandable manner so kids can protect themselves from criminals from primary school age onwards?

Can you show me any other entity which is actively commissioning weapons and then using them on people en-masse, killing, maiming and psychological harming generations as we see with wars around the world?

The state gets to hide behind its own secrecy laws, no other entity has the scope or reach of the state in order to protect and hide its criminal activity. The state is hardly leading by example now is it?

> You don’t even know what the end user will do with the data

Posting private notes from psych evals to a darknet leak site is unambiguously morally wrong in a society that stigmatizes mental health conditions.

> Blah blah blah the state is bad

Yes. And?

Mental Health is just a cover for abuse the individual has suffered, the fact that you then state society stigmatises it, suggests society has a problem. Maybe its their laws, regulations, education and religion thats at fault!

> You dont even know what the end user is going to do with the data and you are already condemning them.

What do you think they're going to do with this data? Send them Christmas cards? Sign them up for fruit of the month club?

I think you'll find if you read the news, most of these hacker collectives are run/coerced/manipulated by the security services of various countries! Their incentive is to provide a more secure computing environment for their own state needs, but also to provide a robust defence should any crimes come before the courts, otherwise how can the defence prove the individual operating the computing devices carried out whatever crime?

"They’re instead covered by the Family Educational Rights and Privacy Act, the federal student privacy law known as FERPA. The law prohibits student records from being released publicly but, unlike HIPAA, does not require schools to disclose when such breaches occur."

...

"The federal privacy rules that apply to hospitals and schools “live in separate universes. If it’s maintained by the school, it’s FERPA. If it’s maintained by your doctor, the same information is HIPAA protected.” "

Sounds like one thing that should be fixed sooner rather than later is brining FERPA up to HIPAA level. Seems like something folks could realistically rally their lawmakers around?

Yeah. The question is do we change FERPA (add notification requirements and penalties) OR do we remove the exemption that places education-related medical records under FERPA (and let that info fall under HIPAA, where it should have been all along)? I think the latter makes sense - the school is acting as a medical provider, so HIPAA should apply. No get-out-of-jail card because they’re a school.

Of course, the problem with any meaningful penalties is what does that really accomplish? Crippling a school district (by yanking funding) doesn’t help anybody in the long run - it just makes education in that area worse.

Digitalization was/is such a hard push and it's obvious some decision makers were just blinded by it.

This also happened last month (the guy was caught).

We really need some serious laws/consequences in order to prevent situations like this. The last hack was a MySQL with admin/admin!?

That is just plain sick and twisted.

Despicable but that's one way to draw attention to cybersecurity for sure

Reply on news.ycombinator.com