Blood donor data leak: HSA's vendor says information that went online was accessed illegally and possibly extracted
Read more at https://www.channelnewsasia.com/news/singapore/personal-data-of-800-000-blood-donors-accessed-illegally-hsa-ssg-11395364
30 Mar 2019 03:05PM (Updated: 30 Mar 2019 03:10PM)

Ricky Lim

Let us discuss the issue of accountability :-
Scenario 1:-
(1) A robber walk into the bank - and rob the bank of money, open fire and kill a person in the bank.
Accountability :-
(1) Is the robber that commit robbery accountable - yes (he should be jail or even face death penalty for the crime.
(2) Now some people argue - should the robber father and mother be held accountable as well?
(3) Some more far fetch argument - should all the family members of the robber be held accountable? 诛九族。
(4) Should the bank employees and bank manager be held accountable - for failing to put in security to prevent the robbery?
(5) Even more far fetch argument --- should the Law Minister be held accountable - and ask to resign - for failing to prevent people from becoming robber, for failling to put security instrument to prevent the robbers from staging a robbery and from succeeding in the robbery.

Public at large seems to be able to accept that - only the robber is held accountable for money crime.

Then we will discuss Scenario 2 - data crime (stealing of data).

Like · Reply · 1m · Edited

Ricky Lim

Scenario 2 (data crime):-
(1) A vendor staff is contracted to install an IT system - but instead he steal the data while installing the system (assume in the toilet using wireless login with the admin account - and the government official that supervise his work - cannot go into the toilet cubicle to see what he is doing).

Accountability :-
(1) Is the vendor staff turn hacker that commit the data crime accountable - yes (he should be trial in Court for stealing the data and posting it in the Internet - infringing OSA).
(2) Now some people argue - should the hacker father and mother be held accountable as well?
(3) Some more far fetch argument - should all the family members of the hacker be held accountable? 诛九族。
(4) Should the HSA employees and HSA manager be held accountable - for failing to put in security to prevent the hacking? (Ie. put CCTV in the toilet cubicle or use eyeball to peep what this vendor is doing in the toilet?)
(5) Even more far fetch argument --- should the Health Minister be held accountable - and ask to resign - for failing to prevent the vendor from becoming hacker, for failling to put security instrument to prevent the vendor from hacking and from putting the data in the Internet.

Some people seems to say that - the hacker is held accountable & further demanding HSA and Minister to be held accountable.

Is there differences in robbery and data crime -- in terms of assigning accountability?

Like · Reply · 1m

Ricky Lim

What is the World trend in data hacking? Can data hacking be prevented and totally cut off?

This is as good as asking can crime like robbery, stealing and other more serious crime be prevented?

Study shows that, with proliferation of Internet, mobile devices and more IT connected world --- hacking, data crime happen in every Country that are connected.

(1) US - has many highly secret, confidential data - whether in Government, Military, Business etc being stolen by hackers. Snowden (the NSA contractor) steal all the NSA data and fled overseas that started the wikileak.

(2) China - same

(3) Russia - same

plus almost every Countries that have internet connection.

As much as IT security are put in place to prevent hacking and data crime from happening -- it is almost impossible for data crime be totally eradicated.

Cyber security is always a chasing game --- and though we should strive to minimise data crime into minimum (it will be far fetch to say we can totally eradicate cyber crime - just like eradicating crime like robbery, scam, thief etc).

Strong punishment will be some sort of deterrent (in addition to beefing up cyber security and processes).

Like · Reply · 1m

Ricky Lim

Let us take the discussion into layman arena:-

(1) Both husband and wife go into a maid agency to employ a maid.
(2) The agency say that all the maid are trained and screen for good behavior.
(3) Husband and wife engage the maid.
(4) Assume the maid steal the money from the husband.
(5) Does he the husband expect his wife to monitor every moment what the maid do - including going to toilet and to bathe?
(6) In this case, is the maid accountable for stealing? Answer is yes.

(7) Under the argument in Scenario 2, do we expect the Husband to held his wife accoutable as well - for not monitoring the maid every moment?
Some bloggers here argue that the wife should also be held accountable - just like HSA staff should be held accountable for the data loss.

(8) Take one step further, should the husband also be held accountable - because the husband is the one that engage the maid.
Some bloggers here argue that the husband should also be held accountable - just like Health Minister should be held accountable for the data loss.

So it looks like - some bloggers are doing some sort of "witch hunt".

Like · Reply · 1m

TanChin

Ricky, you are ranting nonsense. Pp here don't blame for witch hunting as you alleged.

If robber rob bank & kill people. He is like hacker to be go after.

If bank has do all necessary security, with armed guards, CCTV, silent police alarm button activated, carry out SOP in handling robbery calmly to avoid casualty, ambulance save wounded timely, police come instantly to control situation(let robber runaway first with loud siren faraway), no one blame them but praise.

But if bank officers agitate robber against SOP to shoot, CCTV not working to capture robber face, no armed security or was away in toilet/lunch long time, shot customers were not sent to hospital timely because no ambulance, police arrived 3hrs late with excuse Little India traffic jam, and repeat every month same robbery, then we will haunt them, from bank-Cisco-CDF-Police-Sham.

Like · Reply · 2h

Ricky Lim

TanChin -
(1) Assume the bank implement all of what you say - and the robber still manage to rob the bank, kill a person and run away.
Then what will you say?

(2) Can you list a Country where no crime ever happen?

(3) Can you list a Country with internet connection - where no data crime ever succeed?

I am not finding excuse for the data breach that happen in the Country - where we need to continue to review ways how to minimise data breach to the minimal as far as possible.

But what I am trying to prevent "witch hunt" from happening.

Like · Reply · 1m · Edited