Live data from Hacker News

FBI raids dental software researcher who discovered patient data on FTP server

dailydot.com

91–100 of 171 posts

Re: FBI raids dental software researcher who discovered patient data on FTP server

#91

About a month or so a go i found a open public mongo database with about 12GB of records regarding peoples retirement founds of what i assume was hundreds of thousands of people, account numbers, how much money was in the accounts when they had moved them to various founds and so on. Thought long and hard about what to do but decided to not do anything, dont feel like risking my entire life just to help someone. This…

You could search PGP keyservers for email addresses/domains of the local media where that retirement fund is located and take it from there, using your own judgment about the reporter and outlet, and how much you'd want to mask that communication.

> You could search PGP keyservers for email addresses/domains of the local media where that retirement fund is located

Best case among the likely outcomes of that is: "Can you re-send that e-mail? It's all garbled or something."

Re: FBI raids dental software researcher who discovered patient data on FTP server

#92
The FBI seems to have lost it's way (Same with most of the other 3-letter governmental entities and other law enforcement). How do we change the system so that they are held accountable for these sort of things?

This is getting ridiculous. I can't predict the general public's opinions on things like this but it seems so clearly "wrong".

I have hope for a peaceful fix but I am skeptical that we aren't well on our way to a much more traditional violent revolution.

Everything I've read on the subject suggests that the early signs of revolution are a sufficiently large disparity between the rich and the poor such that the poor can no longer provide for themselves. It seems like this is well on its way and likely speeding up.

I'd love to see some statistics on situations like the 2014 Ferguson Missouri situation. I'm curious if there's a rise in situations where the government sufficiently crosses the line that the public backlash manifests violently. I expect that we're still in a stage where these situations are still largely centered around poor minorities [1] but situations like this suggest that incidents are starting to expand into demographics that might get the "middle class" [2] to finally pay attention.

I hope we can find a way to unite as a single voice to change things. I hope it doesn't end up being violent. The following things encourage me.

* Decreased relevance of the "mass media". This is a double edged sword. On one hand it allows for news that might be ignored by a major network to still be disseminated widely. On the other hand, the "public" has a really poor track record of consuming news that isn't also entertainment and many of these issues seem to fall entirely outside of people's interests.

* The ability to aggregate these sort of events to establish a clear pattern of behavior. It's getting harder to hide things.

Also these disclaimers:

1. I say poor minorities because based on my knowledge of the law enforcement overstepping it's typically in situations involving people who are poor and black.

2. The "middle class" is used here to reference a predominantly "white" demographic that most mass media caters to. I've struggled to find the appropriate language here, fearing I'll be labeled racists somehow. Hoping that my message reads as intended.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#93
post #7

Earlier quoted context omitted.

Yea.. but a site on the internet is more akin to a store than someone's home. It's completely normal to walk into someone's store.

An ftp server is clearly more akin to a spooky abandoned building.

I think that's a gopher server

Re: FBI raids dental software researcher who discovered patient data on FTP server

#94

Earlier quoted context omitted.

I had a similar thing happen to me. In high school our user names were first letter of first name and last four of last name. The passwords were the last four digits of our phone numbers. I figured out that the teachers had the same schema for their accounts. They also published a directory with all the names and phone numbers of the students and teachers. So basically I tried accounts until I got a teacher who didn'…

I don't think that's really similar at all. You circumvented password protection and used it to play games. I don't agree with the punishment, but you clearly broke the rules. I also don't see that as having anything whatsoever to do with standardized learning, just you wanting to play games at school.

It does fit with the trend of crazy overreactions to "computer hacking" though. If some kids figure out where you keep the keys to the gym and you catch them playing basketball after hours when it's supposed to be closed, you give them some detention, you don't prohibit them from ever entering the gym thereby causing them to miss school assemblies and fail classes. But do the equivalent thing on a computer and they assume you need the Hannibal Lecter treatment or else you'll whistle into a phone and bring forth Armageddon.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#95
post #37

This reminds me of something that happened to me in high school back in 1999. I found an Excel doc in a public network drive that contained every single student's SSN, DOB, whether they had free/reduced lunch, address, phone, etc. I was admittedly snooping around, but this was all public stuff every student and teacher had full access to. When I found it, I told one of the teachers that I trusted and she insisted tha…

A similar thing happened to me at my university. This new website came out called TheFacebook.com and it seemed hip to add artificial friends like famous actors, super heroes, etc. I had the bright idea to add the school president as a friend by creating a fake account like the thousands of other fake accounts on TheFacebook. I needed a university email address, but luckily, my school allowed you to create a personalized email alias. What should I change my personalized email address to...? How about @mail.myschool.edu? That would be funny - and I'd just revert it back after creating the stupid FB account.

There was some problem with the alias. I couldn't receive the FB confirmation email. So I gave up and went to sleep. The next morning I received a call from the campus police - they wanted to talk to me. I don't remember all the details, but I just remember a long process of being interrogated by campus police and later school administrators who were certain that I had hacked the president's email account. I mistakenly thought simply telling them "I wanted to add the school president as a friend on TheFacebook" was innocent and harmless enough. Some time later I received a letter with a list of 20 or so charges including things like Identity Theft and the possibility that I may be expelled.

I only found out at the end of this whole process that due to a bug in the mail system it allowed me to register a duplicate email alias and all of the school president's emails were being bounced and they assumed I was receiving them. I was able to knock it down writing an apology and community service.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#96
post #84

Earlier quoted context omitted.

That's sounds like quite an interesting story if what you are saying is taken as true and at face value. Have you tried contacting press, or lawyers in the US who would want to take on your case?

Honestly, going after the FBI for lying to the Finnish police would probably be a pretty hard case to win. Especially considering how blatantly unreasonable the behaviour of the .fi authorities has been. It's possible that I could win. But that wouldn't really achieve anything, it wouldn't make the .fi authorities stop. The best option I have available is to keep fighting my charges in Finland, as no matter whether I…

If your story is true, then you were, as it appears, wrongfully and unlawfully imprisoned. I think you should at least try contacting press and some lawyers -- if what you are saying is a true story.

It sounds pretty interesting to me -- I imagine someone in the press would pick it up.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#97
post #55
post #37

This reminds me of something that happened to me in high school back in 1999. I found an Excel doc in a public network drive that contained every single student's SSN, DOB, whether they had free/reduced lunch, address, phone, etc. I was admittedly snooping around, but this was all public stuff every student and teacher had full access to. When I found it, I told one of the teachers that I trusted and she insisted tha…

> I was nearly expelled for "hacking". They placed me on "academic probation" This reaction makes me very, very angry. I would love to push it back on them: it's unclear under what laws/regulations this would fall, but if you (as the student who found it) can get in trouble for finding this info, they can most certainly get in trouble for posting it in a location it can be found in. Further, because you were actually…

Remember clock Ahmed the clock kid? I had a situation almost exactly like his, except I made a working FM radio, could change stations and listen to local news and weather, I thought it was the coolest thing ever.

The school did not, and the district superintendent agreed with them. Who knew that an FM Radio made out of a La Gloria Cubana cigar box-with labelling removed so as not to run afoul of any "tobacco paraphernalia" questions constituted a "bomb".

Parents sued to have me reinstated, but the social stigma lasted well throughout high school. Kids nicknamed me "bomberman" and there was this whole narrative that I had to be removed from the school, handcuffed by the FBI and put into the back of a box truck and hauled away. When in reality, my dad picked me up in his Honda (which would later become my Honda) and we drove home.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#98
post #90

As a separate issue: why the "shock and awe" response to what is (even allegedly) a non-violent crime? Why the assault rifles? Why could he not have been arrested by just a couple agents walking upto the door, knocking, serving the search warrant, and then maybe having the techs step in to conduct the search and seizure? Why does US Law Enforcement so dramatically escalate every contact with a citizen? Everytime they…

Requiring the warrant to specify the level of force could be interesting. Are there good reasons why this could not be done?

Re: FBI raids dental software researcher who discovered patient data on FTP server

#99
post #97
post #55

Earlier quoted context omitted.

> I was nearly expelled for "hacking". They placed me on "academic probation" This reaction makes me very, very angry. I would love to push it back on them: it's unclear under what laws/regulations this would fall, but if you (as the student who found it) can get in trouble for finding this info, they can most certainly get in trouble for posting it in a location it can be found in. Further, because you were actually…

Remember clock Ahmed the clock kid? I had a situation almost exactly like his, except I made a working FM radio, could change stations and listen to local news and weather, I thought it was the coolest thing ever. The school did not, and the district superintendent agreed with them. Who knew that an FM Radio made out of a La Gloria Cubana cigar box-with labelling removed so as not to run afoul of any "tobacco paraphe…

It sounds like you weren't sufficiently brown to get media attention? "Public school bureaucracy run by bureaucrats" doesn't have the right mass appeal.

Re: FBI raids dental software researcher who discovered patient data on FTP server

#100
post #90

As a separate issue: why the "shock and awe" response to what is (even allegedly) a non-violent crime? Why the assault rifles? Why could he not have been arrested by just a couple agents walking upto the door, knocking, serving the search warrant, and then maybe having the techs step in to conduct the search and seizure? Why does US Law Enforcement so dramatically escalate every contact with a citizen? Everytime they…

Two reasons perhaps. Publicity and safety of the officers. How do they know how this person is going to react (or anyone else in the house)? And the publicity is much greater with a greater show of force (hence a deterrent) as well with a shock and awe response.
Post reply on HN