NHS Fined After Computer Holding Patient Records Found On eBay 186
judgecorp writes "NHS Surrey, part of Britain's health service, has been fined £200,000 when a computer holding more than 3000 patient records was found for sale on eBay. The system was retired, and given to a contractor who promised to dispose of it securely for free, in exchange for any salvage value... but clearly just put the whole system up for sale."
How does... (Score:3, Insightful)
The government fine itself?
Re: (Score:2)
Ever heard of separation of powers?
Re: (Score:2)
Yup, I have heard of that BS excuse to not need to impose jail time for people in government. It clearly doesn't work and needs to be rethought for that purpose.
Frankly, government corruption and incompetence is the only category of crime I support the death penalty for. Even a serial killer can only have so many victims. Maybe we can learn something from them over time...but... government employees? No, their org keeps on going, examples need to be made of them, they can hurt hundreds of thousands of peopl
Re: (Score:2)
Yup, I have heard of that BS excuse to not need to impose jail time for people in government. It clearly doesn't work and needs to be rethought for that purpose.
Frankly, government corruption and incompetence is the only category of crime I support the death penalty for. Even a serial killer can only have so many victims. Maybe we can learn something from them over time...but... government employees? No, their org keeps on going, examples need to be made of them, they can hurt hundreds of thousands of people with a simple missstep like this. They need to be held to a higher standard than anyone else.
If a few people swung when this sort of fuckup came about so many people are put in harms way, I have no problem with publicly hanging the people involved.
It would set a perfect precedent for once people realize what damage other polices have done.
That would make it pretty hard to hire people with skills.
A: Because it breaks the flow of a message (Score:5, Insightful)
Re:How does... (Score:5, Insightful)
They shouldn't be fining themselves, they should be jailing the person responsible for handing them to the "unnamed contractor" (who was probably a friend).
Comment removed (Score:5, Insightful)
Re: (Score:3)
How hard can it be for a government to make a CD stick which you insert in a PC which boots up and wipes the hard drive?
They could insert one in every PC before they remove it from the person's desk. It would take about ten minutes. If they're doing a roomful of PCs (as they mostly do) then by the time you got around to putting the CD in the last machine, the first one would be finished.
Re: How does... (Score:2)
10 mins? Really. The last disk I decommissioned took 24 hours to shred (4 passes, the longest time being for the 2 random writes). OK that was a failing Seagate 2TiB drive but for sensitive data, more passes is standard.
Re: (Score:3)
Ok, let's agree it more than 10 minutes. Now can you address the actual point...?
(I should have known better than to put an actual number on slashdot...)
Re: (Score:3)
... for sensitive data, more passes is standard.
Somebody needs to question that standard. There's no credible evidence that data can be recovered after writing a single pass of random data.
Even if there was any evidence (and let's be clear, there isn't...), if anybody wants to spend that much money trying to recover data from machines bought randomly on eBay they should be encouraged to do so. The sooner they go bankrupt, the better.
Re: (Score:2)
For that matter, simple zeroing is quite sufficient for data that is merely confidential (though government standards may insist on more). Nobody is going to buy a machine off of ebay and scan the disk platters with a force microscope.
Most of the concerns are based on outdated information relevant to much older MFM drives where the recording density was much lower and tracking errors much larger.
Re: (Score:3)
Re: (Score:2)
I have to deal with this a great deal with systems being passed from company to company or releasing hardware between departments inside a company.
The "scrub" utility, built into most Linux distributions and available on the Knoppix CD and DVD images, works very well. The time taken really depends on the level of scrubbing. The "nnsa" and "dod" standard scrub options do take many hours, because they use patterns like all zeros, all ones, 10101010, 01010101, and then randomized data of various sorts. That's
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
http://killdisk.com/downloadfree.htm [killdisk.com]
unbelievably easy
Re: (Score:2)
There is commercial software available and certified by the government for destruction of sensitive data and "confidential" classified data.
The use of free software is not an approved method of data destruction for bulk personal data in the UK, and its use could technically lead to legal problems. In practice, if it was used correctly, then no one would ever know.
The problem is that the legal onus is on the person in possession of the data to provide documentary proof that the data has been destroyed in an
Re: (Score:2)
Yup, exactly, and that is exactly why my own company has a specific policy on the decommissioning of....hard drives. We don't toss servers out whole, we pull the damned drives, then who gives a fuck what you do with the chassis? I mean, of course we have a policy on how that is handled too, but its the hard drive one that matters.
For that matter.... should so many medical records have been on an unencrypted volume? Shit, store the encryption key backups centrally and put the key on a USB stick. Separate sti
Re: (Score:2)
Secure data destruction involves a very large shredder which just turns the disks in to scrap metal. There's even video of it being done to the HDDs that were holding the ID card database before it was scrapped.
Re: (Score:2)
But as pointed out this is unnecessary and those PCs/disks could benefit a lot of needy people. Securely re-imaging a hard disk isn't difficult.
Re: (Score:2)
http://www.dban.org/ [dban.org]
Such a project already exists.
Re: (Score:2)
Sigh.
OK, let's agree it more than 10 minutes.
Now can you address the actual point, which was: "It's not difficult to wipe hard drives in a time frame which is consistent with upgrading a room full of PCs."
For some reason, I'm thinking of Dumbo. (Score:3)
Coat [at least] one side with glue.
Re: (Score:2)
Actually as a PC repair guy who often does this very thing I say they should throw the contractor in jail, he is making us all look bad.
Making you look bad is not a criminal offense. You'd need to take it up in a civil court, and they don't throw people in jail.
Re: (Score:2)
No, but it is a motive for him to want to see criminal offenses prosecuted.
Re: (Score:3)
No, but it is a motive for him to want to see criminal offenses prosecuted.
But as nobody has suggested a criminal offence of which the contractor may be guilty, it hardly seems relevant.
Re:How does... (Score:5, Insightful)
Agreed. I used to do the same, take in free donated systems and wipe them with dban or other zero writing software. It was easy and ensured the buyer got a clean system. The main reason why people destroy perfectly good machines out instead of giving them to someone like me (or charity) is fear of the type of behavior shown.
And for god sakes, you do not need to DESTROY the hard drive. Zero writing is fine for anything not containing national security level secrets.
Re: (Score:2)
Even for that it should be fine. There is no proof that there is any way to read drives that are overwritten.
Risk/reward. If failure to destroy a $15 hard drive (its value after years of use) could cause a $5B fighter plane to be useless, it is probably worth the $15 just to be sure (especially since wiping isn't exactly free in terms of labor either).
When risk tolerance is low the burden of proof is really on those who want to promote the risky behavior. There is no proof that it is impossible to read a zeroed drive (and it is unlikely there every will be until we reach the point where the uncertainty principle
Re: (Score:3)
Afaict there are basically two real problems with overwriting.
1: drives remap sectors that are detected as troublesome (often before they go completely unreadable). This makes it very hard to ensure that you really hit every sector with your overwrite pass. Some drives have a built in secure erase feature that should solve this but then you are relying on the drive vendor to have implemented it correctly.
2: Even if you have decided that the risk from remapped sectors is tolerable you have to be EXTREMELY ca
Re: (Score:2)
While I agree it is the contractors fault. However when you deal with a contractor you better be sure your contract has him to do what they say they will do. The contractor will probably do more what is in the contract however if failure to not do more that is in the contract could have a negative effect it should be protected.
Such as delete your drives beforehand, or make sure the contract has him do this work, and perhaps a measure stating he will do what he says he does.
Is Xzibit a law professor now? (Score:2)
The contract should include a clause stating that the contractor must abide by the contract? Should it perhaps include another clause stating that the contractor must abide by the clause stating that the contractor must abide by the contract?
Re: (Score:2)
Actually as a PC repair guy who often does this very thing I say they should throw the contractor in jail, he is making us all look bad.
I've done plenty of work for the city in the past and they know any donations they give to me will be wiped clean so they have no problem handing me desktops and laptops that are being replaced. Is there any records on them? probably but I wouldn't know as the first thing they get is a boot 'n nuke from me, the ONLY thing I don't wipe is the factory restore partition if it has one, everything else? Wiped before I ever mess with the system.
So I'm all for throwing this asshole in jail because its jerks like this that end up causing systems to be disposed of via shotgun. In a dead economy there is plenty of folks hurting out there and these off-lease systems can be used to make sure anybody can have a PC, hell thanks to donations from the city I have a complete desktop system for $50 at the shop. Sure its not the fastest thing in the world but it surfs, burns DVDs, and when somebody needs a PC so their kid can look up info for school reports and they can look for a second job? A system like that can really make a difference. This is why I fricking HATE when assholes like this do dumb shit like just throwing it on eBay, he could have boot n' nuked and been done in no time, throw the lazy ass in jail.
And if you work in a position that has getting rid of older systems as part of your duties? Don't dispose of via shotgun, talk to the local shop guys, talk to the local churches, there is usually a guy like me that is happy to refurb 'em for the poor folks and unlike this douchebag we're happy to do secure wiping on anything you hand us. There is nothing like the feeling of making a difference, just last week I donated a couple of systems to one of the local churches so they could expand their computer classes, they do a lot of work with abused women and teaching them basic computer and office skills helps them get a job and not be dependent on some wife beating scumbag. I wouldn't have been able to hand those systems over if they hadn't been donated to me, so ask around, those old P4s and Athlons may be junkers to you but it could make a difference to somebody else.
It depends. It's easy enough to blame the contractor but there are factors that have to be taken into account.
Is there a written security policy that states that the drives have to be wiped (and with what method or methods)?
Was the contractor presented with said policy and asked to sign each page to indicate that they've seen it?
Was it written into the contract with the contractor that they read and will follow said security policy?
Yes the contractor (if there was one - I didn't read TFA) fucked up but th
Re: (Score:2)
Indeed, even if the hard drive contains state secrets could they just keep the hard drive but give you everything else? The donor can decide if to destroy or how they want the data erased (hopefully they can be convinced to just scrub it a whole lot and then give it to you anyway).
Much less wastage that way, eBay has 80GB velociraptors going for $20-30 bucks (yes I know this is overkill), will increase the price of your $50 PC to $80 but I think that's still reasonable.
As a side note to all of this, wouldn'
Re: (Score:2)
They shouldn't be fining themselves, they should be jailing the person responsible for handing them to the "unnamed contractor"
They should be firing the idiots that aren't encrypting their drives.
I'm amazed no one is addressing the obvious. The simple solution is encrypted drives. Encryption eliminates this issue along with protecting against a whole host of other problems.
Re: How does... (Score:5, Informative)
Because there was no actual "contract" requiring him to destroy them.
That's the real problem in this case - no contract. It's all all in TFA (if you can be bothered with such trivia).
Re: (Score:2)
That's the real problem in this case - no contract. It's all all in TFA (if you can be bothered with such trivia).
Of course there's a contract: there's one described in the summary above. The contractor agreed to wipe the machines in exchange for getting them for free. There, that's a contract. Now, it may be difficult to sue him for breach on the basis that there doesn't appear to have been a *written* contract, but that's an entirely different matter from there being no contract at all.
Re: (Score:2)
Re: (Score:2)
If he was told to wipe them, he should have wiped them. End of discussion.
Re: (Score:2)
In a previous case where a certifed contractor was hired to destroy the data, but sold theequipment on ebay, the NHS hospital was fined, not the contractor. The reason given by the information commissioner's office, was that the NHS staff should have supervised the contractor and independently verified the destruction.
It was left for the NHS hospital to sue the contractor for breach of contract.
Re: (Score:3)
Garbage. Is every air passenger expected to be an aeronautical engineer and supervise the construction of the plane so that the wings don't fall off?
Re: (Score:2)
Raises taxes?
Re: (Score:2)
Re:How does... (Score:4, Informative)
Simple, there are a bunch of ministries, departments, and divisions and other units all with a degree of autonomy, their own budgets, and other stuff.
When you ask nearly any government employee of where do they work. They will not say I work for the Government. They will say I work in the Department of whatever...
So if you fine a government agency the money leaves their budget and goes away from their department and to an other area. Leaving that department with less money budgeted towards what they need to do. As well it would effect their influence of getting additional funding for the next year.
Re: (Score:2)
So if you fine a government agency the money leaves their budget and goes away from their department and to an other area. Leaving that department with less money budgeted towards what they need to do. As well it would effect their influence of getting additional funding for the next year.
Great, so the NHS has less money to spend on making patients healthier, and so patient health suffers.
Trust me - the money won't come out of office furnishings or donuts for the doctors.
If money is being misspent the solution is to correctly spend it - not just to cut off the supply. When people make bad decisions you need to punish the people, not the organization.
Re: (Score:3, Informative)
First, the Information Commissioner's Office is an independent body, subject to supervision by the courts, not any ministry. It cannot and does not care (modulo human error) whether the responsible entity was a public or private body, except where the law distinguishes between them.
Second, an NHS trust (which NHS Surrey is) is technically not part of the government, but a public sector corporation with separate auditing requirements and separate liability. Another example is that NHS trusts are also vicario
Re: (Score:2)
Re: (Score:2)
Of course, in this case the net result is that the public has been fined £200,000 worth of health care.
I'm sure there has to be a better way of penalising government institutions.
Maybe they should consider firing the person who made the decision to pass on confidential data to an uncertificated contractor without performing any due diligence, or is that perhaps a little too radical?
No encryption (Score:2)
Re: (Score:2)
Bear in mind that most NHS places barely fund an IT department, let alone one that'll support the costs of encryption to every disk on every machine in a trust.
General policy is usually that you don't save patient identifiable information to a non-server disk. And when you hire a contractor to do a job, you expect it to be done. The fault here isn't with the NHS, it's with a contractor who's supposed to be vetted as secure, offering a service, and then doing something completely stupid.
Would be great if e
Re: (Score:2)
Having been involved in these sorts of contracts (in the USA) I can tell you that your excuse is bullshit. I've pointed out some rather glaring evidence that contractors were likely not fulfilling their end of the contracts in the past... for example, per a contract data was supposed to be encrypted at rest. However, I could connect to it via ODBC and download plain text passwords. If your passwords are stored in plain text, it's hard to believe any of the rest of the data is protected any better.
Anyway, re
I wonder (Score:5, Funny)
Re: (Score:2)
It is possible that they might, but since the data they process is Top Secret, the hard drives will be destroyed, and probably the ram as well.
Re: (Score:2)
It is possible that they might, but since the data they process is Top Secret, the hard drives will be destroyed, and probably the ram as well.
well sure, if their contractors aren't cheapening out...
or if anyone knows what the box going to the dumpster is.
Re: (Score:2)
For systems that have held Top Secret data the media won't be sold, it will be destroyed. The consequences of possible loss are considered too severe. I believe I've read that they have facilities for destruction themselves. It looks like one of the ways they do it is the use of High Security Disentegrators which reduce everything to no more then 3/32" size. Examples here [semshred.com].
I suppose it is possible that they might outsource it, but there would obviously have to be tight controls in place to assure destru
Re: (Score:2)
Unless it's not. I'm afraid I've been handed several systems by military software developers that were never scrubbed before they were loaned to me for software projects. I did try to arrange a quiet talk with their IT personnel about their security practices, and on one occasion felt compelled to write a registered letter, with copies to their and our legal staff, to warn about the dangers. (There were poorly protect system passwords stored in plaintext on the system.)
Re: (Score:2)
http://www.youtube.com/watch?v=yd_O7-rqcHc [youtube.com]
Re: (Score:2)
Formatting works perfectly well for data destruction.
(cue line of geeks with theories about why it isn't despite the fact that they can't come up with a single example of data recovery after formatting...)
Re: (Score:2)
Hope you don't work in data security! Every decent file recovery tool (Recuva, PhotoRec, etc.) can restore files from a formatted drive. Secure wiping (as with DBAN) is a different matter.
Re: (Score:2)
Some data recovery can be done even off multiply-overwritten tracks but it takes serious engineering of the sort only police forensics and national security can afford in terms of cash and time. Even then there is no certainty of success.
The head positioning system in a disk drive is not 100% accurate pass to pass and remnant magnetic data can persist on the edge of the main track after an overwrite or two on some sectors. That data can be read using scanning electron microscopes, SQUIDs and other exotica a
Re: (Score:2)
Re: (Score:2)
One (public) example where this has been carried out is where someone wiped their collection of child porn but the prosecution were able to prove the disk contained a few illegal images, enough to secure a conviction.
If this really has happened, you should be able to point to the details of the particular case. Common wisdom is that this simply does not happen any more (as the likelihood of being able to recover enough information to achieve a conviction has become much, much lower with modern disks that are much more accurate in head positioning than older disks), so I'd really like to see actual documentation of cases where such a technique has been successfully used in, say, the last 10 years.
Re: (Score:2)
That's funny. Can I be the first one with with a real example?
My brother in law "accidentally" formatted the hard drive of one of their old computers that had all of their family pictures on it.
I restored the entire drive. Basically all I didn't get were file names. Which, trust me, was annoying. I had duplicate photos all over the place. But I got everything back and was able to copy every photo off the drive. I believe I used Norton and it was a free download.
If you were to write all 0's to the drive (and
Re: (Score:2)
In Canada the military thermally destroys the drive and PCB to a molten state. In the days of large mainframe hard drives I was told the CIA would first open the drive platter case. separate each platter and mount the platters on a lathe and mill them down to bare aluminium, which was melted.
I would anticipate the NSA/CSA/FBI would perform a similar level of destruction, the IRS, I have heard of them selling systems with only the directory wiped, so ant expert person could read the scattered data files and
Re: (Score:2)
> separate each platter and mount the platters on a lathe and mill them down to bare aluminium
Given the prevalence of aluminum platters with iron oxide coatings, this seems extraordinarily dangerous. Although, thinking about the possible thermite reaction this could trigger, I think that _would_ destroy the data.
Contract not signed (Score:2)
It does not matter if a contract was not signed, there was still an agreement. All that signing a contract means is that the agreement is provable and, hopefully, responsibilities clearly defined. Here: there does not seem to be a dispute as to who should have deleted the data (destroyed the disks), it is the contractor they should pay every penny of the fine.
All of the above written without knowing exactly what was agreed!
Re: (Score:2)
... mostly depending on the exact terms of the contract.
You know how I know you didn't read the article?
Outsourcing (Score:2)
FTFA:
We should not have to tell organisations to think twice, before outsourcing vital services to companies who offer to work for free.
Relevant Dilbert [dilbert.com]
salvage value.. (Score:2)
well duh, obviously this was the highest salvage value they could arrange.
Fines.. (Score:5, Insightful)
Fining the NHS is pointless, it only harms the NHS itself... Those responsible don't care because its not their money.
They should fine the contractor instead, as it was his laziness/incompetence that caused this.
Re:Fines.. (Score:4, Insightful)
While there was negligence on both parts, I definitely agree that the contractor should be penalized for failure to perform the promised service.
Re: (Score:2)
If you read TFA you'll see there's no contract. The word "contractor" implies it but really they were just handed to a guy who crossed his heart and promised to do it before putting them on eBay.
OTOH, you're right that the NHS shouldn't be fined. The person who handed over the computers (presumably to a friend of his) needs jailing.
Re: (Score:2)
Fining any public body tends to be at best pointless, at worst counter productive. (Another common example of this kind of daftness is fining police forces when prosecution of police officers would be more appropriate.)
Those responsible don't care because its not their money. They should fine the contractor instead, as it was his laziness/incompetence that caused this.
The most obvious thing to do would be for NHS Surrey to sue the contractor
Re: (Score:2)
Re:Fines.. (Score:4, Informative)
Look up Vicarious Liability, it's a tenet of Common Law.
Too many MBAs believe that when you outsource, you are offloading responsibility. 'It was the contractor's fault, your honour' will not wash in any court of law.
Re: (Score:2)
If the idea is to punish someone to try to correct the behavior, then fining the NHS is a fat fucking waste of time. Fining whoever hired the contractor personally might help. Fining the contractor should be mandatory when one is involved.
Re: (Score:2)
Agreed that the contractor is primarily responsible, and should be punished.
However the NHS has a secondary (vicarious) liability and should also be punished for inadequate supervision of its contractors.
FWIW I used to work for an NHS IT dept. The destruction/wiping of hard disks was tasked to the in-house team. Unlike contractors they're not motivated to take shortcuts for financial gain.
Re: (Score:2)
However the NHS has a secondary (vicarious) liability and should also be punished for inadequate supervision of its contractors.
Just how do you "punish" an organization? The only reason the org has money is to accomplish some public service. Taking that money away just makes it less effective at whatever purpose it was created for. If it doesn't need the money, then the money should be taken away regardless of behavior.
Punish the people who made the decisions, not the organization.
Re: (Score:2)
Re: (Score:2)
Hmm
They should punish all involved in NHS Surrey. Hit them where it hurts, final warnings, no pay rises, no promotions, no pension contribution for the year.
Re: (Score:2)
Fining the NHS is pointless .... Those responsible don't care because its not their money.
They should fine the contractor instead, as it was his laziness/incompetence that caused this.
Wrong, I think you would find those responsible DO care and are feeling very embarrased about this. Nevertheless, the episode shows that they were incompetent and should simply be sacked. There are too many incapable people holding jobs they are not up to, and too many capable people unemployed.
Apart from that, there is no way that the NHS should have been letting PC's off the premises with data on the drives, contract or no contract. If they had to employ a contractor, the work should have been done
Re: (Score:2)
They should fine the contractor instead
Suing the contractor is hopefully NHS's next step.
Should be fining the contractor, not the client (Score:5, Insightful)
I don't really get this. The NHS contracts out the disposal of the machines to a private contractor, who then royally screws up, and it's the fault of the NHS?
Surely the responsibility lies with the contractor?
FTA:
This seems to me an argument that the NHS cannot outsource or subcontract anything.
What is NHS Surrey supposed to do in this scenario? Use in-house people to analyse the machines to make sure there is no data remaining before disposing of them?
Or just keep data-disposal services in-house? Personally, I think this would be a great idea, but it goes against the dogmatic 'privatise absolutely everything possible' trend in the UK.
Except they didn't work for free: they worked for the salvage value. I can't really see how the low value of the contract proves fault.
Re: (Score:2)
nhs shouldn't be giving them away out of their control in uncleaned condition. that much is simple.
nhs can try to sue the contractor on contract breach still though. but if getting rid of responsibility was that easy there would be none.
Re: (Score:2)
Not really. You can't discharge responsibility just by contracting someone else to do something; the principal is responsible for the actions of their contractor.
Of course, the NHS could sue the contractor, assuming they had a contract that mentioned secure disposal.
Re: (Score:2)
The ICO doesn't need to prosecute anyone.
They did need to some years ago, but today they can simply march in, investigate and levy a fine. You disagree with the fine? It's down to you to appeal the fine at a tribunal.
Re: (Score:2)
Except amongst your quotes from TFA you omitted one:
The NHS body didn’t sign a contract with the provider and failed to determine whether the hard drives have been wiped, the ICO said.
Thanks, I must have glossed over the fact that they can't prove that they instructed the contractor to destroy the data.
But still the issue remains that verifying that the data has been destroyed is more work than destroying the data, so is the ICO really saying that responsibility for data security cannot be subcontracted?
Personally, I hope so. But like I say, it flies in the face of privatisation dogma.
So? (Score:2)
How hard (Score:2)
No data on devices (Score:2)
Re: (Score:2)
dd if=/dev/zero of=/dev/hda bs=1M
Or something equivalent. It's not hard to blank out a hard drive, just time consuming.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Even better. Use /dev/random instead of /dev/zero. Good luck to anyone trying to recover that data.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
In theory, the auction site should blank the machines
At least here in the UK, there is no law that would require them to do so as far as I am aware. The only obligation to destroy the data rests with the data controller, who in your scenario is not even the cloud provider. The cloud provider may have undertaken to do so on behalf of the data controller, but I am uncertain if such an obligation would survive the company being declared insolvent: at such a time, recovering the maximum possible revenue for the company's creditors becomes the highest legal prio
Re: (Score:2)
This also only works "in theory". The list of drives with hopelessly broken "SATA secure erase" implementations is a long one.
Re: (Score:2)
Re: (Score:2)