Ethical Sensitive Data Handling

 

March 11, 2015

Ethical Sensitive Data Handling

Current events with regard to public and private officials handling sensitive data have given rise to the larger question, beyond legal requirements, what is the right thing to do when it comes to handling sensitive data?  Indeed, data handlers in both the public and private sectors have a responsibility to handle that data with integrity and keeping in mind who they are serving while handling the data.  We’ll explore some of the different considerations here:

Sensitive Data Handling in the Private Sector

There’s no doubt that data security and the threats posed from both internal and external data breach perpetrators has become a very hot topic in recent months.  External hacking attacks upon the systems at eBay, Home Depot, Staples, Google and Anthem are just a few of the high-profile examples of the external threats that exist with regard to data security.  But what ethical obligation do those companies have with regard to handling your sensitive data?  I would suggest that the base-level of ethical responsibility is the same across the board, no matter the industry.  Whether the company is handling your credit card number or your healthcare records, they all have a basic ethical responsibility to treat the trust their customers place in them with the highest regard.  As consumers, we all have a choice of who earns and keeps our business.  The waters get a little muddier when the data handler is an employer-sponsored insurance company, but the fact remains that you still have a choice.  Fortunately, it appears that most companies do understand this ethical obligation, even if only after a breach has occurred and when “prosecuted” in the court of public opinion.

Beyond credit card numbers, email address & other personal information, certain industries have an even higher ethical responsibility to handle your data securely.  The obvious recent example is the data breach at Anthem, an extremely large health insurance company which warehouses the healthcare information for millions of customers.  There are several reasons why the doctor-patient legal privilege exists, not the least of which is the sensitivity of the information shared between patients and their healthcare providers.  Regulations and laws such as HIPAA are in place to try and force healthcare providers and their associated industries (i.e., insurance companies) to do the right things insofar as patient privacy, but we still see outdated, insecure practices like pen-and-paper sign-in clipboards in doctor’s offices and examining room doors being left open while awaiting treatment or while under treatment.  These violations are minor in comparison to a large data breach, but they signal a larger systemic problem in healthcare data security, HIPAA compliance and patient privacy – the oneness for patient confidentiality is ultimately on the healthcare provider and carelessness or complacency is no excuse to sacrifice patient information security.   

However, we as the “consumers” of health care need to also educate ourselves to the best practices of patient privacy and hold our healthcare providers to those standards.

It bears noting that healthcare is only one example of this ethical responsibility.  Other industries that bear an ethical and often times legal responsibility for client information security are legal practitioners, financial institutions and the government.

Ethical Data Handling in the Public Sector

The “pink elephant in the room” example with this particular subject is the recent story of Hillary Clinton and her handling (or rather mishandling) of potentially vital emails through use of a personal email address for official U.S. State Department business.  While the media pundits and critics from both sides of the political spectrum will debate her actions as legal or illegal, the more poignant question is, was it ethical?  I submit the answer is a resounding “NO!”

Political ideology aside, let’s explore the common-sense side of data storage that is potentially vital to our national security on a private email server.  The first consideration is accountability.  It was reported today that Clinton may have “deleted” upwards of 30,000 emails from this personal server, and by her own admission used the personal email for official business, but it was legal because there’s no law against it.  This would seem to be an obvious example of an instance where the law has not yet caught up with technology, which is a repeated theme in the legislature and court decisions.  Public officials are placed in positions of public trust.  The higher the position, the more the public has implied trust in the person holding that position.  But trust is backed up by verification, or in this case, transparency.  Unfortunately, transparency is out the window because Clinton allegedly deleted half of the emails lying on the server.  Does that mean our trust should be out the window too?

The other notable area with regard to ethical data handling by public officials is the security of that data.  The Federal Government has regulations, standards & practices in place for secure data handling.  If a public official handles his or her data privately, they are not necessarily subject to those standards, presenting a very convenient loophole.  Even if they are subject to data security standards, the government may have trouble compelling an employee to turn over personal data, even when mixed with official communications.  However, those data security standards are in place because there are other nations that would be very interested in any and all data from the public sector they can get their hands upon to exploit.  I recently saw a tweet from an information security professional that read: “Maybe the American People didn’t know Hillary had a private email server, but the enemies of our State sure did!”  No truer words have been spoken.  If Clinton was handling official business on a private email server, as she has admitted, what security measures were in place to handle the data?  What server logging, monitoring, incident response or data encryption was in place?  If we take Clinton at her word, she used one email and one device “for convenience”.  Is it possible none of these security measures were put in place because of the same convenience mindset?

Was anyone really over her shoulder looking? (Picture credit: ABC News)

 While Hillary Clinton’s mishandling of sensitive data has provided a great example here, the responsibility for ethical data handling is not limited to the Federal Government or officials in high-ranking positions.  Federal, State & Local officials at every level bear the same responsibility.  Local and State Departments of Social Services not only warehouse client information, but may also have healthcare-related and highly sensitive and confidential information about their clients.  Local and State public safety agencies warehouse data for every ambulance call, police report, traffic stop and personal encounter with virtually everyone they come into contact with, including those involved in a personal health crisis.  While these incidents may be exempt from HIPAA, that doesn’t mean the data any less sensitive.  These examples are just two of many that illustrate the need and responsibility for ethical data handling at all levels of the government.

Conclusions

High-profile cases have certainly created an increased awareness of data security, but the practice and implementation of real data security measures is still reactionary at best.  To be sure, virtually everyone in every industry (including digital forensic consultants & bloggers) is responsible for some sort of sensitive data and bears responsibility for ethical data handling that goes beyond simple legal requirements.  The Golden Rule applies across the board, no matter your industry and can be applied to data handling as well – Handle other’s data as you would handle your own.

In the end, ethics and integrity go hand-in-hand.  Integrity means doing the right thing, even if no one is watching.  So let’s all start taking the proactive measures required to handle sensitive data not just to the legal standard, but to high ethical standards worthy of the trust of our clients, customers and the public at-large.

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com

Twitter: ProDigital4n6

Digital Forensics & Mental Health

February 20, 2015

Digital Forensics & Mental Health

As a former law enforcement officer, tactical team member and child exploitation investigator, I’ve certainly seen my fair share of gruesome car accidents, injuries, violence and child victimization.  And while the police generally get quite a bit of attention with regard to the concerns of Post-Traumatic Stress Disorder, seldom (if ever) are the civilian counterparts in digital forensics afforded the same considerations.  I’d like to user this forum to start changing that mindset, if even a just a little.

Background

Soldiers, medics and front-line combat personnel certainly see some of the worst man has to offer.  From wounded comrades to children being used as homicide bombers, the horrors of combat have been well documented throughout history.  One of my personal role-models is Lt. Col. Dave Grossman, whose written works “On Killing” and “On Combat” break down the stigma typically associated with the “John Wayne” and Hollywood imagery of combat and tell the truth about how traumatic combat really is.  From men displaying acts of pure cowardess to defecating themselves, these actions are real, physiological symptoms of operating in a high-stress environment, such as combat.  In civilian law enforcement, it’s often reported that a very high percentage of officers involved in combat situations in which they had to kill or seriously wound another person don’t work in the field much more than a couple of years after the incident.  The very fact that police officers, firefighters & combat soldiers receive hazardous duty benefits means society has deemed their positions not only of higher value than other public servants, but that they also have a high propensity for danger.  This is why I would cringe whenever another police officer would tell me to “stay safe.”  There’s nothing safe about these positions.  If you want safe, go work in a library.

The almost inevitable fallout from working these positions is some sort of psychological damage, most commonly referred to as Post-Traumatic Stress Disorder or PTSD.  While it’s often the butt of jokes from people who have never worked in dangerous situations, it’s also a real phenomenon.  For example, I have two friends & former co-workers who responded to a domestic dispute that turned violent.  The aggressor in the situation grabbed his pistol and began shooting his family members, then at my friends as they arrived at the house in response to frantic 911 calls from the shooter’s family.  One of my friends had to shoot and kill the man who was about to shoot and kill him.  The other friend shot at the man from a distance, but they both delivered deadly force.  This incident occurred over 4 years ago.  One of my friends is still in law enforcement, the other is not, but they bond over the incident and speak to each other yearly as a reminder of how fortunate they are to be alive after that day.

The stress of combat isn’t the only environment where a public safety practitioner can fall victim to the psychological effects of trauma.  As a child sexual exploitation investigator, I would routinely work in an undercover capacity chatting online with grotesque, sick men (yes, they were all men) who consistently talked about doing horrible, vile things to a person they thought was a young girl (age 13) - from rape to incest & marriage to pregnancy.  In addition to those cases, I would routinely attempt to identify and arrest people involved in the trading of child pornography images on the internet.  These images are not of 17 year-old girls, they are of small children, sometimes infants, being bound, drugged, raped, molested and violated in acts you can’t even imagine.  These acts are recorded then traded and shared amongst people with similar interests.  Initially, I would investigate these cases, view only what I had to in order to make the case, then submit the evidence to someone else for digital forensic examination.  As time went on, I became responsible for not only the investigation, but the computer forensics portion of the cases as well.  This meant my exposure increased from a moderate percentage to almost 100% in every case.

Forensic Examiners in the Weeds

In many ways, the forensic examiner has it worse than the investigator.  In order to get a complete picture of the evidence for court, it must ALL be examined, not just the parts that are good enough to make a case.  I recall one case (referenced here: http://prodigital4n6.blogspot.com/2015/01/case-study-commonwealth-v-emanuele.html) where there were not only mountains of child pornography images, but terabytes of adult pornography and bestiality images too.  As the forensic examiner in these cases, once the images are viewed, you can’t un-see them.  Some of them are so vile and disgusting, they make you gag.  These images get emblazoned in your memory for a time and the best thing you can do is take a break from the work and try to let the memory fade.  The repeated exposure to these types of images had an effect on my marriage, my relationships with co-workers, my overall attitude and my desire to keep working.  The argument could be made, much like officers involved in deadly force incidents, that the PTSD effect from repeated exposure to images like this led to my eventual departure from law enforcement.  If that isn’t textbook PTSD, I don’t know what is.  Over the years, I attempted to talk about my haunts with a couple of different counselors, but it’s hard to relay the horror of things to people who don’t even want to know these evils exist.

If you are a digital forensic practitioner and you’re reading this, you may be thinking, that’s what we have hash sets of known child pornography for – so we don’t have to view all of the images.  While this point is very well taken, many cases still require those involved in the process to view and verify the images, regardless if they belong to hash sets of known child victims.  This is also why we show images to judges & juries at trial.  An alpha-numeric string doesn’t adequately relay what the image contains.  Not even close.

Agencies like the FBI do have measures in place to ensure the mental well-being of their agents, especially those involved in child exploitation investigations.  I do not know, however, if the same considerations are offered for civilian forensic examiners employed by the FBI who are unquestionably exposed to more of these images than the agents themselves.  Examiners have to look at it all, that’s the only way we can know what really happened.  I worked at a smaller rural agency who not only didn’t give any consideration to the stress the repeated exposure had on mental health, but denied several attempts for us to join forces with the FBI task force, which would have offered us the opportunity for yearly psychological evaluations and access to counseling.  I’m forced to wonder if this phenomenon is present for other child exploitation task force officers employed by smaller, local and/or rural agencies.  With all the political and monetary capital being fed into national child exploitation investigations and state task forces, how much is being set-aside to ensure appropriate mental health of the investigators AND the forensic examiners, whether they be civilian or sworn?

Conclusion

There is a trend afoot in the world of digital forensics in law enforcement.  The movement is progressing in many areas to transition the role of a digital forensic examiner away from sworn law enforcement officers and move toward an all-civilian digital forensic work force.  Why, you may ask?  To save money.  But what is the cost in terms of human capital when examiners get burned-out, stressed-out, over-worked and perhaps even sloppy because they are exposed to things that most people should never see?  It can be very hard for some people to remain consistently objective under those circumstances.

Perhaps it’s time to consider adding civilian digital forensic examiners to the statutory list of public servants who are afforded certain considerations because of the hazards their job exposes them to.  Do civilian examiners have to kick open doors and handcuff people? No.  But their job on the back-end of an investigation is just as important as the investigator and they are often exposed to much more psychological trauma than investigators.  

The job of a digital forensic examiner isn’t glamorous (despite the new CSI: Cyber series).  It is interesting, challenging, ever-evolving, fascinating and valuable.  I love it no matter who my “client” may be because I get to pursue the truth in every case.  But maybe it’s time for administrators to stop counting beans and start caring about the people doing the work. 

As a close friend of mine who is a retired Trooper once wisely said, the command simply doesn’t exist without the rank-and-file.

Author:

Patrick J. Siewert, SCERS, BCERT, LCE

Principal Consultant

Professional Digital Forensic Consulting, LLC

Based in Richmond, Virginia

Available Globally

Email:  ProDigitalConsulting@gmail.com

Web: www.ProDigital4n6.com
Twitter: @ProDigital4n6