<story><title>2.5M Medical Records Leaked by AI Company</title><url>https://securethoughts.com/medical-data-of-auto-accident-victims-exposed-online/</url></story><parent_chain><item><author>maybelsyrup</author><text>I&amp;#x27;m a medical researcher, and I&amp;#x27;ve worked with exactly this sort of data. The number of hoops I had to jump through to even be allowed on the project was insane. Background checks, legal forms of all kinds, trainings on how to keep the data secure. Fingerprint locked rooms. Access control. And most importantly: the data themselves were air-gapped.&lt;p&gt;If I fucked up on this scale, jail would be the least of my worries. I&amp;#x27;d never work again. I&amp;#x27;d be professionally shunned forever, with no hope of redemption once my name is attached to the incident in some Google search. No more grants, no more collaborations, no nothing. I&amp;#x27;d be ruined. Frankly I&amp;#x27;d be begging to be let into prison; where else am I gonna be able to eat?&lt;p&gt;Nothing will happen to these people.</text></item></parent_chain><comment><author>sillysaurusx</author><text>This is a wild exaggeration. First of all, everyone is insecure. Work as a pentester, and you&amp;#x27;ll see that the whole world is insecure. After the 30th project with an SQL injection vuln or misconfiguration, you&amp;#x27;ll never be phased again.&lt;p&gt;Secondly, this seems to be a straightforward database misconfiguration. The database was set to public with no restrictions. It likely wasn&amp;#x27;t accessible to anyone who wasn&amp;#x27;t explicitly looking for it, i.e. security researchers or black hats. Yes, this was horrible, but nothing bad happened here. The database was simply set to private.&lt;p&gt;Third, my friend, chillax a bit. Yes, it&amp;#x27;s extraordinarily important to protect people&amp;#x27;s medical data. But no, you&amp;#x27;re not personally liable if a fuckup happens. &lt;i&gt;Everyone&lt;/i&gt; fucks up. That&amp;#x27;s why the fuckups are covered by legal protections. You take your job seriously. Good! But you also take your job way too seriously. Bad. You&amp;#x27;re gonna burn yourself out within a decade with this mindset.&lt;p&gt;None of this is to say that what happened didn&amp;#x27;t matter. Of course it matters. But you are literally saying you&amp;#x27;d be begging to be let into prison. That&amp;#x27;s not proportionate, and feels like a reflection of the current social climate of retribution-as-forgiveness.</text></comment>
<story><title>2.5M Medical Records Leaked by AI Company</title><url>https://securethoughts.com/medical-data-of-auto-accident-victims-exposed-online/</url></story><parent_chain><item><author>maybelsyrup</author><text>I&amp;#x27;m a medical researcher, and I&amp;#x27;ve worked with exactly this sort of data. The number of hoops I had to jump through to even be allowed on the project was insane. Background checks, legal forms of all kinds, trainings on how to keep the data secure. Fingerprint locked rooms. Access control. And most importantly: the data themselves were air-gapped.&lt;p&gt;If I fucked up on this scale, jail would be the least of my worries. I&amp;#x27;d never work again. I&amp;#x27;d be professionally shunned forever, with no hope of redemption once my name is attached to the incident in some Google search. No more grants, no more collaborations, no nothing. I&amp;#x27;d be ruined. Frankly I&amp;#x27;d be begging to be let into prison; where else am I gonna be able to eat?&lt;p&gt;Nothing will happen to these people.</text></item></parent_chain><comment><author>g_p</author><text>In contrast here, this data likely came from an insurance company, which got access to the data from their claims. They don&amp;#x27;t inherently care about these people, because they&amp;#x27;re all seen as &amp;quot;costs&amp;quot; to the balance sheet profits for the year. Sending their data out for &amp;quot;AI&amp;quot; to try and learn how to predict which claims can be rejected is a rational thing to do, in their eyes, whatever the cost (to those concerned and their data), since it might help improve their bottom line by rejecting claims faster.&lt;p&gt;At least there&amp;#x27;s a cynical take on this. They have no inherent interest in protecting this data, absent external pressures or legislation that imposes penalties.&lt;p&gt;It strikes me the real issue is the lack of negative inventive for people and businesses who screw up with data. If you build something physical that falls down and hurts people, your investor money ends up paying compensation. In tech though, the goal seems to be to make the revenues without ever touching the responsibility.&lt;p&gt;The story over the weekend of Amazon trying to avoid being deemed liable as a seller for goods they ship, (often) deliver, warehouse, market, dispatch and receive seems to sum this up. A race to the bottom when it comes to protections - Amazon effectively is a shop selling goods from others, as it all happens on their terms. We see similar in physical retail where the manufacturer or reseller has a retention of title over goods in the store, and that doesn&amp;#x27;t affect the store being responsible. It seems like the &amp;quot;being responsible for what you build&amp;quot; is very much lacking in tech companies, due to lack of external regulation to achieve it. Same here in this case.</text></comment>