Probably should read this: http://www.huffingtonpost.com/entry/the-successful-hospital-...

A fundraising campaign was inconvenienced. Probably not as bad as torturing a little girl for months, leaving her unable to walk.

Horrific, inexplicable tragedies happen in hospitals and emergency rooms because in the normal chaos of medical emergencies and communication snafus, surgeons don't properly wash their hands or mark which limb is meant to be amputated [0]. But your experience with such institutions is that while they may fuck up the routine small things and kill patients, they are yet able to pivot like well-oiled military units when their information technology infrastructure is unexpectedly cut?

[0] http://www.newyorker.com/magazine/2007/12/10/the-checklist

If we can appreciate inexplicable medical tragedies - can't we appreciate a mans emotional response? If he was wrong was he yet not caught in a tragedy?

>their information technology infrastructure is unexpectedly cut

You are attributing offence of a kind which is far removed from his case - he never attacked the kind of critical systems which you indicate with the Newyorker article.

He pestered and temporarily disabled a medical company website to highlight the maltreatment of a patient, now he is facing many years in prison for the protest.

http://www.huffingtonpost.com/entry/why-i-knocked-boston-chi...

" I also knew from my career experience as a biotech professional that no patients should be harmed if Boston Children’s was knocked offline. There’s no such thing as an outage-proof network, so hospitals have to be able to function without the Internet. It’s required by federal law, and for accreditation. The only effects would be financial and on BCH’s reputation. "

> He pestered and temporarily disabled a medical company website to highlight the maltreatment of a patient, now he is facing many years in prison for the protest.

Uh, OK...

You'll have to pardon my skepticism that you actually read the New Yorker article when it appears you didn't even read the OP whom you defend. Here's one sentence you appear to have skipped over:

> Almost unbelievably, they kept their donation page on the same public network as the rest of their stuff. Rookie mistake. To take it down, I’d have to knock the whole hospital off the Internet.

Edit: clarification. The thing that I quote directly above is not in the OP, but in the link u/strainer provided as rebuttal, i.e. http://www.huffingtonpost.com/entry/why-i-knocked-boston-chi...

I did only scan the article which I linked to establish that he never attacked the kind of critical systems you indicated by your link. That was established and only somewhat distracted by your reaching caveat -that he knew his attack would take the whole hospitals websites temporarily offline.

You may think about admonishing u/danso for this - the hunger striker never did attack the kind of critical systems indicated by u/danso's comment and link.

My argument with you is that I don't think we should trust Mr. Gottesfeld's self-serving claim, at face value, that he knew that his attack wouldn't have unintended consequences. He was not an employee at BCH, he did not have inside knowledge about how their systems work, nor does he even appear to have read their incident plan. No one is arguing that a hospital folds over and dies when the Internet goes out; the argument is that a hospital operates suboptimally when under attack. I think it's a bit pretentious for an outsider to argue that crippling "non-critical" systems like appointment and prescription management is no big deal.

But the main reason why I think we should be skeptical of Gottesfeld's professed expertise is...well, the fact that we are discussing him at all. How was Mr. Gottesfeld caught so quickly? If you take Mr. Gottesfeld at his word, it's because the FBI poured thousands/millions into investigating the breach. According to the affidavit, though [0], the reasons for Mr. Gottesfeld capture were:

1. He allegedly posted a video calling for Anonymous to take action against BHC, and this video was posted on a YouTube account attached to Mr. Gottesfeld's identity.

2. He used a Twitter account attached to his name to DM other people about hacking the BHC.

3. He created a separate anonymous Twitter account to tweet about the attack, using an email address connected to his computer.

4. He bragged about the DDOS attack to his friend, who then told the FBI about it.

Since Mr. Gottesfeld, according to the FBI, initially denied his involvement -- and then was caught after he and his wife attempted to flee the country by boat but ended up being rescued, we can't make the argument that Mr. Gottesfeld was sloppy about his personal opsec because he wanted to get caught.

So Mr. Gottesfeld appears to be ignorant of how the Internet can inadvertently be linked to personal computer systems, even when such knowledge and awareness is critical to his immediate, personal well-being. But we're supposed to take his word that he can execute a hack with ninja-like precision on BCH because he happens to be an expert in BCH's systems and IT dependencies?

[0] https://www.scribd.com/doc/299575089/Gottesfeld-Martin-Affid...

[1] https://www.youtube.com/watch?v=CbnJyK_54Jo

You argument with me was that I don't adequately read sources and that I made an untrue statement, which was in fact not untrue, and was merely open to adjustment - which all summaries are.

My argument with you, was that you linked critical medical equipment to the accuseds website attack, which you should really be aware cannot be vulnerable to a website attack. Yet I am the one criticised for "not a lie" but "a major mistake ... made in rush to judgement"

I found neither your relevant or over-extended response to my criticism tenable. You appear to be in a rush to prosecute beyond fair assessment. Which is what years of hard prison for a temporary website protest attack that cannot threaten critical equipment presents.

> You argument with me was that I don't adequately read sources and that I made an untrue statement, which was in fact not untrue, and was merely open to adjustment - which all summaries are.

The statement in question:

> He pestered and temporarily disabled a medical company website to highlight the maltreatment of a patient, now he is facing many years in prison for the protest.

Mr. Gottesfeld's own statement:

> Almost unbelievably, they kept their donation page on the same public network as the rest of their stuff. Rookie mistake. To take it down, I’d have to knock the whole hospital off the Internet.

Christ, if that's "not untrue" in your judgment, then I won't hold out hope that you care enough about basic facts to see that even in the many words I've spent in this thread bickering about the topic, I've never stated that I support the prosecution or alleged mistreatment of Mr. Gottesfeld. My opinion has been: I am more ambivalent about this case than I was about what happened to Aaron Swartz [0]. Given how angry Swartz's case made me, me not feeling strongly about Mr. Gottesfeld by comparison does not equate to me supporting his prosecution.

But I'm not surprised you aren't able to see the distinction, if you don't see the difference between a website and the Internet.

[0] https://news.ycombinator.com/item?id=13306401

Either you are a master troll, or you need to draw a network diagram. You invoked "horrific, inexplicable tragedies" because "surgeons don't properly wash their hands or mark which limb is meant to be amputated". (Frankly I'm not sure the latter qualifies as "inexplicable".) Hand-washing and limb-marking don't require internet access. If hospitals require non-internet-enabled signs to inform surgeons of these risk factors, those are available at restaurant suppliers. (Well maybe not the limb-marking...)

Life support devices also don't require constant internet access. Diagnostic equipment also doesn't require constant internet access. Local medical procedures do not require internet access. Hospital medical records do not require constant internet access. In fact no life supporting activity requires constant internet access, because designing the system to rely on something that is unreliable would be stupid. Physicians are not stupid.

It is conceivable that telemedicine sessions might have been interrupted, but telemedicine is inappropriate when life is in jeopardy. We could imagine the future invention of remote robotic surgeries that would qualify, but if that were going on it would have been mentioned in the indictment, and also a dedicated and isolated network would have been created. In fact since every federal indictment written includes everything but the kitchen sink, and this indictment mentioned only the customary ridiculous inflated monetary damages, we know that this DDoS attack did not hurt anyone physically.

I don't think that we normal easygoing HN folks would really mind your conceptual mistakes, but the combination of those with the withering scorn you've exhibited here is probably what inspired us to keep this thread going long past the point of interest and utility. So, nice trolling!

Please don't imply that a commenter has not read an article, no matter how apparent it is to you or how obtuse you believe them to be. It does nothing to further the discussion constructively, but rather only increases animosity between participants. Simply pointing out what the article does say in contradiction is strong enough, and any ignorance or otherwise on behalf of the commenter should be apparent in and of itself.

I agree that we should err on the side of civility. But in this case, I think it's important to call out u/strainer for his mistake. Note that I said "mistake" and not "lie", because I do think it was an honest mistake, but a major one that was made in a rush to judgment.

No big deal. Me and u/strainer are just two people opining about things we read on the Internet on a late Monday night. But that's kind of the bigger picture, isn't it? If the allegations against Mr. Gottesfeld are materially true, but we assign the best of motives to him, then he himself is also just another guy who read something on the Internet. Except, instead of just opining about it, he allegedly tried to shut down an entire hospital's IT.

u/strainer wants to believe in the narrative that Mr. Gottesfeld is competent and knowledgeable enough to know how a hospital's IT is configured. I'm of the belief that maybe Mr. Gottesfeld is overconfident of what he knows about hospital IT. And perhaps he was overconfident of the issues regarding the plight of the girl and her family. Because it's easy to miss even the big details when reading things on the Internet.

Dude if anyone here "wants to believe in a narrative" it's got to be you. Gottesfeld's "narrative" is simple. He wanted to interrupt fundraising, so he interrupted fundraising. It's BCH and DoJ that have the complicated yarn to spin, about how torturing little girls is OK and all of their life support equipment relies on constant access to Instagram and the best response to your connection coming under DDoS is to just unhook the damn thing.

You aren't actually being civil, when you pretend that anyone whose argument you have misunderstood is some sort of moron.

I don't believe I ever used the word "moron" to describe someone who purportedly believes that the FBI, Boston Children's Hospital, and the state of Massachusetts conspired to torture a girl in public view. I'm still struggling with how Mr. Gottesfeld both denies that he was behind the attack while describing in extensive detail to the Huffington Post how he did in fact launch the alleged attack.

I guess I'll have to count myself among the simpletons who fail to comprehend Mr. Gottesfeld's simple narrative. I honestly don't feel too bad about that, though. Apparently the two people who care most about Justina, i.e. her parents, don't seem to understand his narrative, either.

Not true.

https://nakedsecurity.sophos.com/2016/10/24/anonymous-hacker...

Huffington post is the internet at it's worst. Pretends to be factual but isn't even close.

"Imprisoned human rights activist, journalist, and author Martin Gottesfeld "

I see no external evidence of this other than people can now just call themselves these and it's true?

There's a story here but the mess that's HP destroys that.

Did you see something at that link that contradicted anything at my link? Everyone seems to agree that BCH got DDoSed. Sophos adds a juvenile "hacks're bad, mm-kay?" gloss to it, apparently because all their readers are in elementary school, but that's all they have to offer. They don't mention any reasons why this hack was as bad as any other hack. If one recognizes, as all thinking people do, that some hacks as justified even though some other hacks are not, Sophos has no retort. This is a basic rhetorical failure; Sophos ought to be embarrassed.

One more thing: this was just a DDoS, yet, "The indictment states that BCH had to shut down its access to the internet and email servers to protect patient medical records." Come again? How on earth would a simple DDoS have that effect? Does the DB "fail open"? This is pure bullshit, yet DoJ and Sophos are happy to parrot it, because this is the sort of bullshit that pays their bills. Pathetic.

[EDIT:] He writes and he's in prison, so he mostly fits that description; do you have a particular reason to deny that he's concerned about "human rights"?

>> Did you see something at that link that contradicted anything at my link?

Didn't say it would, but that HP link was a total disgrace, in no way shape or form productive or balanced.

And my link directly contradicts your comment which was totally untrue -

> A fundraising campaign was inconvenienced.

Even in crappy HP the hacker directly says

"Almost unbelievably, they kept their donation page on the same public network as the rest of their stuff. Rookie mistake. To take it down, I’d have to knock the whole hospital off the Internet." [1]

If you think during DoSS companies (rightly or wrongly) don't shut down services, you need to look at more real world examples- This for instance also happened during the Australian census ddos [2] and has specifically caused data to leak during people trying to fix the issue which was maybe Sony?

[1] http://www.huffingtonpost.com/entry/why-i-knocked-boston-chi...

[2] http://www.news.com.au/technology/online/hacking/census-hack...

OK, if you insist, let's stipulate that the fundraiser wasn't actually inconvenienced.

Please reconsider the sentence from your own link that I helpfully repeated back to you. In a DoS context, "shutting down access to the internet and email servers" does nothing "to protect patient medical records". (In fairness, it might be the right response to a more targeted attack, which this was not.) DoSing doesn't give one access to protected DBs or delicate medical equipment. At any rate, if too much traffic is causing difficulties connecting outside the hospital, who on earth would "solve" that problem by severing the connection completely? Oh, right, this was in Boston, the official home of nose-cuttingly ill-considered overreactions like the Great Boston Mooninite Panic of '07. (I think they're coming out with a movie about a different yet similar episode...) One supposes that all the patients on ventilators were lucky they didn't just decide to cut all the power in the building. Note also that most of the alleged damages stem not from the DoS, but from the moronic shutdown. If one were cynical, one might suspect that the first step in the incident response handbook is "make the incident worse so it rises to indictable level and also we can get on the news".

I wish I was as optimistic about the modern workplace as you are, in which every single employee has the training and capacity to calmly and precisely diagnose why their computer programs aren't working. But in my experience, when the Internet goes down, the average non-IT person sees it as "the computer is broken". And instead of doing something rational -- like running `ping` -- they'll do things like restart the program, or even the computer, until an IT professional tells them that the fault is with their Internet connection.

Not too long ago I was at a very modern Palo Alto clinic getting some routine x-rays. My doctor warned me that things might be a bit slow because their office had just made the transition from XP to Windows 7 (because of XP's end-of-life, not because Windows 7 was new), and the clinic was having problems all week. I ended up waiting an extra half hour because they couldn't figure out how to get digital x-ray images taken from just a few rooms over onto my doctor's computer. And it wasn't some high school summer intern who was stumped, but the doctor, the radiologist, and a couple of nurses.

Sure, I'll admit, as an engineer, I can't help but think that this was an unnecessary shitfest. But, as an engineer, I also know that the "common sense" git-er-done solution -- such as just putting the files on a USB stick and moving them over -- might not apply in this situation. Sometimes, software is just hamstrung and shitty. Luckily, this was a routine checkup at a small, very-well equipped clinic in Silicon Valley, and not an entire fucking hospital in Boston, that, besides tending to children, also has to operate an emergency room and trauma center, in which a 10-minute tangle in IT can easily mean the difference between life and death.

I don't have a strong opinion on whether the perceived cruelty justifies criminal action by the OP. But I strongly disagree with his smug assertion ("I also knew from my career experience as a biotech professional that no patients should be harmed if Boston Children’s was knocked offline. ") that a hospital that he's never worked at can safely pivot when their entire Internet shuts down.

If no one was seriously afflicted by the outage -- and how the fuck would we even know that when modern healthcare can't even consistently diagnose causes of death on an average day? -- then that would have been pure luck, and not because the OP performed his attack with deliberate consideration of its possible effects.

I'm not sure you've modeled my thought process all that well; it's certainly a novel experience to be labeled "optimistic".

If a patient had actually died because her physician couldn't access WebMD for an hour during the fundraiser, that fact wouldn't have been omitted from the indictment. Actually it would have been a typical-bullshit element of a typical-bullshit homicide charge. Internet interruptions occur regularly, and they very rarely have fatal consequences even in hospitals. If they did, hospitals would have more redundancy. Lots of people seem eager to criticize Gottesfeld for not somehow foreseeing this unlikely thing that didn't actually happen except in their own imagination.

That's revealing. We expect private individuals to act with perfection, so that no unintended consequence, however unlikely, could ever be imagined. Yet giant wealthy firms with lots of lawyers can run roughshod over innocent children, being paid hundreds of thousands of dollars in the process, and they must simply be endured. How could the hospital know this handicapped girl wasn't simply imagining her symptoms? Actually lots of people at the hospital knew what was happening; nurses were quitting over it. Actually providing appropriate care for sick people is basically the reason that hospitals exist. Yet at every turn we give the giant abusive bureaucracy the benefit of the doubt.

In this case as in every case, DoJ stood ever ready to serve the interests of the wealthy, powerful, and well-connected. With gag orders, even complaining about abuse was grounds for more abuse! Policing a big urban hospital is not a good DoJ career move. Crushing little people who speak truth to power, even if only for an hour during a fundraiser: that's what really gets a federal prosecutor's juices flowing. We've seen enough from DoJ to expect this behavior, but don't imagine for a second it's justified by anything but their own craven self-interest.

[EDIT:] Rather pointless googling I'm afraid. It's not as though the interests of the wealthy and powerful are never found in opposition. By all means, though, keep trying to change the subject from your silly spurious movie-plot medical-procedures-dependent-on-constant-Facebook-access theory. I'm not sure that something as braindead as "CVS is just like this tortured handicapped girl" is any better though...

It's not terribly hard to find cases, even within just the Obama administration, of DOJ going after big hospitals.

A few months ago, the federal prosecutor in Georgia announced a $513 million settlement against the Tenet hospital chain for charges of bribery and fraud: https://www.justice.gov/opa/pr/hospital-chain-will-pay-over-...

The fed prosecutor in DC managed to extract $12.9M in settlements from the D.C. Children's Hospital based on a whistleblower complaint last year: https://www.justice.gov/opa/pr/childrens-hospital-pay-129-mi...

I admit, in casual Google searches, I didn't find any case in which Ortiz's office took on an area hospital. But I did find quite a few cases where her office hit pharmaceutical companies quite hard:

https://www.justice.gov/usao-ma/pr/cvs-pay-35-million-resolv...

https://www.justice.gov/usao-ma/pr/pharmaceutical-executives...

https://archives.fbi.gov/archives/boston/press-releases/2012...

https://www.justice.gov/usao-ma/pr/wyeth-and-pfizer-agree-pa...

https://www.fbi.gov/contact-us/field-offices/boston/news/pre...

Strange world in which Pfizer and CVS are "the little people who speak truth to power" only to be crushed by the DOJ.

Ah, so I see we're all for vigilantism now.

Good to know!

Now where did I put my pitchfork...