Skating on Stilts

9/11 Commission gingerly embraces "direct action" against hackers

I've long been an advocate for fewer restraints on how the private sector responds to hacking attacks. If the government can't stop and can't punish such attacks, in my view the least it could do is not threaten the victims with felony prosecution for taking reasonable measures in self-defense.  I debated the topic with co-blogger Orin Kerr here.  I'm pleased to note that my side of the debate continues to attract support, at least from those not steeped in the "leave this to the professionals" orthodoxy of the US Justice Department.

The members of the 9/11 Commission, who surely define bipartisan respectability on questions of national security, have issued a tenth anniversary update to the Commission's influential report.  The update repeats some of the Commission's earlier recommendations that have not been implemented.  But it also points to new threats, most notably the risk of attacks on the nation's computer networks.  No surprise there, but I was heartened to see the commissioners' tentative endorsement of private sector "direct action" as a response to attacks on private networks:

Congress should also consider granting private companies legal authority to take direct action in response to attacks on their networks.

This "should consider" formulation avoids a full embrace of particular measures, and in that respect it parallels another establishment endorsement of counterhacking.  The Commission on Theft of American Intellectual Property, said in its 2013 report:

Finally, new laws might be considered for corporations and individuals to protect themselves in an environment where law enforcement is very limited. Statutes should be formulated that protect companies seeking to deter entry into their networks and prevent exploitation of their own network information while properly empowered law-enforcement authorities are mobilized in a timely way
against attackers. Informed deliberations over whether corporations and individuals should be legally able to conduct threat-based deterrence operations against network intrusion, without doing undue harm to an attacker or to innocent third parties, ought to be undertaken.

If repeated tentative embraces are the way new policy ideas become respectable, "direct action" is well on its way.  The 9/11 commission deserves credit, not just for moving the debate but for contributing a label that gives counterhacking a kind of anarcho-lefty frisson.

A privacy law's "unintended" but remarkably convenient results

HIPAA is an arguably well-intentioned privacy law that seems to yield nothing but "unintended" consequences. I put "unintended" in quotes because the consequences are often remarkably convenient, at least for those with power. I'm not sure you can call something that convenient "unintended."

The problem has gotten so bad that even National Public Radio and the Pro Publica organization -- hotbeds of bien pensant liberalism -- have started to notice. This story, for example, could be mined for a host of Privy nominations for Dubious Achievements in Privacy Law:

In the name of patient privacy, a security guard at a hospital in Springfield, Mo., threatened a mother with jail for trying to take a photograph of her own son.

In the name of patient privacy, a Daytona Beach, Fla., nursing home said it couldn't cooperate with police investigating allegations of a possible rape against one of its residents.

In the name of patient privacy, the U.S. Department of Veterans Affairs allegedly threatened or retaliated against employees who were trying to blow the whistle on agency wrongdoing.

When the federal Health Insurance Portability and Accountability Act passed in 1996, its laudable provisions included preventing patients' medical information from being shared without their consent and other important privacy assurances.

But as a litany of recent examples show, HIPAA, as the law is commonly known, is open to misinterpretation — and sometimes provides cover for health institutions that are protecting their own interests, not patients'.

"Sometimes it's really hard to tell whether people are just genuinely confused or misinformed, or whether they're intentionally obfuscating," said Deven McGraw, partner in the healthcare practice of Manatt, Phelps & Phillips and former director of the Health Privacy Project at the Center for Democracy & Technology.

At this point, we've seen a boatload of stories in which HIPAA produces stupid or bad results.  The real question is whether there are any stories in which HIPAA has produced unequivocally good results -- things that wouldn't have happened without the law.  Otherwise, we're looking at a law passed to prevent nonexistent abuses that has become a source of abuse itself.  In my view, that's a recipe for repeal -- and pretty much the story of most privacy law.

And who's protected by taxpayer privacy laws? Hint: not taxpayers

When you're in the business of pointing out how often privacy law ends up protecting power and privilege, you never run out of material.

Everyone remembers Lois Lerner, the IRS official who pleaded the fifth amendment and refused to testify about her role in the agency's scrutiny of Tea Party nonprofits. And everyone remembers her mysterious computer crash making years of emails unavailable in 2011.

Could the messages be recovered with advanced forensics? We'll never know, because the IRS so systematically nuked Lerner's drives that no one could ever recover anything from them.

Why? According to The Hill, "the agency said in court filings Friday that the hard drive was destroyed in 2011 to protect confidential taxpayer information."

I'm sure the taxpayers will find a way to show their gratitude.

Who is protected by patient privacy laws? Hint: not patients.

It's time once again to point out that privacy laws, with their vague standards and selective enforcement, are more likely to serve privilege than to protect privacy.  The latest to learn that lesson are patients mistreated by the Veterans Administration and the whistleblowers who sought to help them.  According to the Washington Post:

Citing patient privacy, managers have threatened VA employees or retaliated against those who complain about agency misconduct, according to a key congressman and the union that represents most of the department’s employees.

“VA routinely uses HIPAA as an excuse to punish into submission employees who dare to speak out,” said Rep. Jeff Miller (R-Fla.), chairman of the House Committee on Veterans’ Affairs. He is leading a probe into the coverup of long wait times for VA patients.

David Borer, the American Federation of Government Employees’ top lawyer, listed a number of cases involving a VA claim of patient privacy used to stifle whistleblowers in a June letter to the department.

The Office of Special Counsel (OSC), which investigates whistleblower retaliation cases, is “very concerned about the misuse of HIPAA,” said Eric Bachman, an OSC deputy special counsel. “The potential chilling effect of even a small number of these HIPAA retaliation cases is a serious issue and one that should be addressed by the VA in short order.”...

Valerie Riviello is one VA employee who felt the lash of the department’s culture of retaliation.

A registered nurse at the Albany Stratton VA Medical Center in Upstate New York, Riviello said she was threatened with suspension and stripped of managerial duties after she complained last November about how a veteran was treated.

 Riviello said the vet was unnecessarily restrained, with an arm and leg strapped to bedposts.

“They scared the hell out of me,” Riviello said with worry clear in her voice. “They sent me a letter saying I could go to jail.”

That threat came in the form of an e-mail to Riviello’s lawyer, Cheri L. Cannon, a partner with the Tully Rinckey law firm. The VA e-mail said that information Riviello provided Cannon “unlawfully includes medical records of a VA patient” and noted that violating HIPAA “is a felony offense subject to imprisonment and a fine of up to $250,000.”

Misuse of privacy law is now so common that I've begun issuing annual awards for the worst offenders -- the Privies.  The Veterans Administration has officially earned a nomination for a 2015 Privy under the category "We All Got To Serve Someone:  Worst Use of Privacy Law to Serve Power and Privilege."  The Department is in good company; here are the 2014 nominees.