Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
Security Crime Privacy The Courts

US Health Insurer Premera Blue Cross Accused of Destroying Evidence in Data Breach Lawsuit (zdnet.com) 72

Catalin Cimpanu, reporting for ZDNet: The plaintiffs of a class-action lawsuit against health insurance provider Premera Blue Cross are accusing the organization of "willfully destroying" evidence that was crucial for establishing accurate details in a security breach incident. In court documents filed last week obtained by ZDNet, plaintiffs claim that Premera intentionally destroyed a computer that was in a key position to reveal more details about the breach, but also software logs from a security product that may have shown evidence of data exfiltration. Establishing if hackers stole data from Premera's systems is crucial for the legal case. Breach victims part of the class-action will be to claim a right for monetary compensation, while Premera may argue that since hackers did not steal data from its servers, there is no tangible harm to victims. The class-action lawsuit is in connection to a March 2015 announcement. Back then, Premera announced that hackers breached its systems and gained access to computers holding the personal and medical data of over 11 million Americans.
This discussion has been archived. No new comments can be posted.

US Health Insurer Premera Blue Cross Accused of Destroying Evidence in Data Breach Lawsuit

Comments Filter:
  • by Anonymous Coward
    Insurance companies are leaches on society. Are you really surprised they'd engage in such behavior?
    • Insurance companies are major uniparty sponsors unaccountable to the public, a major source of problems from the Medical-Industrial-Congressional complex that hurts and bankrupts many Americians.
  • by AJWM ( 19027 ) on Monday September 03, 2018 @07:44PM (#57248178) Homepage

    If it can be shown that evidence was deliberately destroyed (and yeah, that's the hard part), then there's generally a legal presumption that the evidence showed the worst possible interpretation of the case for the party which destroyed (else why destroy it?).

    Of course when the evidence that they destroyed evidence has also been destroyed, and the evidence of that has been destroyed... well, you get the idea.

  • For nearly ten years before I retired BCBS was the insurance vendor for where I worked.
    After I retired I switched to their supplement plan. Four years later, even though my wife and I had made few claims, which they were very slow paying, if at all, we got a notice saying that our "group" was being canceled. So we contracted with another supplement vendor. Three months later BCBS sent us an ad telling about a new policy, which was exactly like the policy they dropped, except that it cost about 50% mor

  • Timeline:

    - 2014, the OPM warning
    - 2015, Premera announces breach
    - 2015, Lawsuits filed
    - 2016, One computer destroyed for end-of-life
    - 2018, Plaintiffs ask for all computers *** This motion makes all computers "evidence"
    - 2018, Premera gives all but destroyed

    I can destroy my desktop today. It can be crucial to a lawsuit tomorrow. Today it is not evidence. It isn't evidence tomorrow, either, because I destroyed it today.

    I am not compelled to preserve my desktop until served notice.

    Timing is everything.

    • Comment removed (Score:4, Informative)

      by account_deleted ( 4530225 ) on Monday September 03, 2018 @09:34PM (#57248532)
      Comment removed based on user account deletion
      • You wish it worked that way. You see, the computer wasn't destroyed until law suits were filld [sic].

        Hold up right there.

        If I receive notice of a lawsuit today, does that mean I can't replace my refrigerator?

        The original lawsuit, like most at that stage, was vague in scope and did not include a motion to preserve the destroyed computer.

        At no time prior to a motion to turn over all computers in 2018 were the computers sequestered by the court.

        Had that been the case, we'd be reading about the criminal charges filed for destroying evidence.

        Timing is everything.

        • If I receive notice of a lawsuit today, does that mean I can't replace my refrigerator?

          If the refrigerator contains or is evidence relevant to the lawsuit, yes, it means exactly that.

          • And, as you admit in your post, I'd have to know that the lawsuit existed and that the fridge was relevant to that lawsuit because the lawsuit defines scope.

            Does the presence of a lawsuit mean I can't sell my lawnmower?

        • Comment removed based on user account deletion
          • If a crime happened and your fridge was involved ...

            Stop.

            You did a two-step:

            1.) A crime happened

            2.) Fridge

            That's not what happened:

            1.) A computer was destroyed

            2.) A motion for computer was filed

            That's why timing is everything.

            • Comment removed based on user account deletion
              • Stop.

                The law is not based upon speculation prior to establishment of litigation.

                Any and all objects in the universe have the property that they could, individually or collectively, be evidence, and yet they are not all, at this point, evidence.

                In law, there's an order of operation:

                Evidence does not exist before probable cause.

                I have a magnifying glass on my desk.

                I could choke someone with it.

                If I should do that, it would become evidence.

                At this writing, I have not choked anyone with it, nor is there probabl

  • by ErichTheRed ( 39327 ) on Monday September 03, 2018 @10:11PM (#57248642)

    I've worked at places that use an insanely short email retention policy to get out of e-discovery in lawsuits. One place had a 30-day retention..anything older than that and, "la la la, we have no record of the email you are attempting to recover." And apparently that works, if you have a written policy stating that you don't keep email or backups for more than X days.

    But, couldn't any company just send all their computers to the metal shredder the second a lawsuit is filed using the same argument? Maybe that's how they're planning on hiding how bad their data breach was. Somehow I doubt that though...if there were no rules against destroying evidence, every computer would have a self-destruct circuit in it.

    Of course no one knows what actually happened, but this totally reads like some clueless CIO getting pressure from the board and CEO to just make the problem disappear.

    • by sjames ( 1099 ) on Monday September 03, 2018 @10:31PM (#57248694) Homepage Journal

      The short retention works for anything that happens BEFORE the lawsuit is filed. The written policy is just a way to show that anything destroyed more than 30 days before the lawsuit was just business as usual, not an attempt to destroy evidence. Once the suit is filed, the destruction must be suspended.

      • by TubeSteak ( 669689 ) on Tuesday September 04, 2018 @12:59AM (#57249022) Journal

        The spoliation inference is a negative evidentiary inference that a finder of fact can draw from a party's destruction of a document or thing that is relevant to an ongoing or reasonably foreseeable civil or criminal proceeding: the finder of fact can review all evidence uncovered in as strong a light as possible against the spoliator and in favor of the opposing party.

        E-mail/document retention policies are not a get out of jail free card.

        If the company can "reasonably foreseeable" the documents will be needed, they're obliged to preserved them, lawsuit or not.

        At the bare minimum, a judge will tell the jury to interpret destroyed evidence in the worst possible light for the destroyer.

        In a worst case scenario, depending on your jurisdiction, destroying evidence will spawn a separate civil lawsuit or a criminal prosecution (fines and jail time).

        Destroying evidence means you're stupid or hiding something much worse.

    • There are compliance regulations in many sectors, including finance (which includes insurance) and medical (which includes medical insurers) that say that everything has to be kept for a number of years. So on the whole in most of the civilised world, this sort of thing absolutely isn't going to fly.
  • by bjwest ( 14070 ) on Monday September 03, 2018 @10:38PM (#57248718)
    Until the entire board of directors and everyone with a C*O in their title goes to prison for shit like this, nothing will change in the corporate world. Pissy little fines that barley make a blip on the bottom line will do nothing, and that's probably all that will happen AGAIN.
  • A corparation can only be trusted to do whatever is in its best interest. Even If there are no psychopaths in its top management. The committee will always choose to do what is best for the company no matter what the law is. Its one of the reasons we need more regulation in this country. Several generations of US citizens have now been convinced that government regulation is bad. They have been convinced of this to preserve the bottom line of companies whose management closely resembles the communist p

Ummm, well, OK. The network's the network, the computer's the computer. Sorry for the confusion. -- Sun Microsystems

Working...