Did you see something at that link that contradicted anything at my link? Everyone seems to agree that BCH got DDoSed. Sophos adds a juvenile "hacks're bad, mm-kay?" gloss to it, apparently because all their readers are in elementary school, but that's all they have to offer. They don't mention any reasons why this hack was as bad as any other hack. If one recognizes, as all thinking people do, that some hacks as justified even though some other hacks are not, Sophos has no retort. This is a basic rhetorical failure; Sophos ought to be embarrassed.

One more thing: this was just a DDoS, yet, "The indictment states that BCH had to shut down its access to the internet and email servers to protect patient medical records." Come again? How on earth would a simple DDoS have that effect? Does the DB "fail open"? This is pure bullshit, yet DoJ and Sophos are happy to parrot it, because this is the sort of bullshit that pays their bills. Pathetic.

[EDIT:] He writes and he's in prison, so he mostly fits that description; do you have a particular reason to deny that he's concerned about "human rights"?

>> Did you see something at that link that contradicted anything at my link?

Didn't say it would, but that HP link was a total disgrace, in no way shape or form productive or balanced.

And my link directly contradicts your comment which was totally untrue -

> A fundraising campaign was inconvenienced.

Even in crappy HP the hacker directly says

"Almost unbelievably, they kept their donation page on the same public network as the rest of their stuff. Rookie mistake. To take it down, I’d have to knock the whole hospital off the Internet." [1]

If you think during DoSS companies (rightly or wrongly) don't shut down services, you need to look at more real world examples- This for instance also happened during the Australian census ddos [2] and has specifically caused data to leak during people trying to fix the issue which was maybe Sony?

[1] http://www.huffingtonpost.com/entry/why-i-knocked-boston-chi...

[2] http://www.news.com.au/technology/online/hacking/census-hack...

OK, if you insist, let's stipulate that the fundraiser wasn't actually inconvenienced.

Please reconsider the sentence from your own link that I helpfully repeated back to you. In a DoS context, "shutting down access to the internet and email servers" does nothing "to protect patient medical records". (In fairness, it might be the right response to a more targeted attack, which this was not.) DoSing doesn't give one access to protected DBs or delicate medical equipment. At any rate, if too much traffic is causing difficulties connecting outside the hospital, who on earth would "solve" that problem by severing the connection completely? Oh, right, this was in Boston, the official home of nose-cuttingly ill-considered overreactions like the Great Boston Mooninite Panic of '07. (I think they're coming out with a movie about a different yet similar episode...) One supposes that all the patients on ventilators were lucky they didn't just decide to cut all the power in the building. Note also that most of the alleged damages stem not from the DoS, but from the moronic shutdown. If one were cynical, one might suspect that the first step in the incident response handbook is "make the incident worse so it rises to indictable level and also we can get on the news".

I wish I was as optimistic about the modern workplace as you are, in which every single employee has the training and capacity to calmly and precisely diagnose why their computer programs aren't working. But in my experience, when the Internet goes down, the average non-IT person sees it as "the computer is broken". And instead of doing something rational -- like running `ping` -- they'll do things like restart the program, or even the computer, until an IT professional tells them that the fault is with their Internet connection.

Not too long ago I was at a very modern Palo Alto clinic getting some routine x-rays. My doctor warned me that things might be a bit slow because their office had just made the transition from XP to Windows 7 (because of XP's end-of-life, not because Windows 7 was new), and the clinic was having problems all week. I ended up waiting an extra half hour because they couldn't figure out how to get digital x-ray images taken from just a few rooms over onto my doctor's computer. And it wasn't some high school summer intern who was stumped, but the doctor, the radiologist, and a couple of nurses.

Sure, I'll admit, as an engineer, I can't help but think that this was an unnecessary shitfest. But, as an engineer, I also know that the "common sense" git-er-done solution -- such as just putting the files on a USB stick and moving them over -- might not apply in this situation. Sometimes, software is just hamstrung and shitty. Luckily, this was a routine checkup at a small, very-well equipped clinic in Silicon Valley, and not an entire fucking hospital in Boston, that, besides tending to children, also has to operate an emergency room and trauma center, in which a 10-minute tangle in IT can easily mean the difference between life and death.

I don't have a strong opinion on whether the perceived cruelty justifies criminal action by the OP. But I strongly disagree with his smug assertion ("I also knew from my career experience as a biotech professional that no patients should be harmed if Boston Children’s was knocked offline. ") that a hospital that he's never worked at can safely pivot when their entire Internet shuts down.

If no one was seriously afflicted by the outage -- and how the fuck would we even know that when modern healthcare can't even consistently diagnose causes of death on an average day? -- then that would have been pure luck, and not because the OP performed his attack with deliberate consideration of its possible effects.

I'm not sure you've modeled my thought process all that well; it's certainly a novel experience to be labeled "optimistic".

If a patient had actually died because her physician couldn't access WebMD for an hour during the fundraiser, that fact wouldn't have been omitted from the indictment. Actually it would have been a typical-bullshit element of a typical-bullshit homicide charge. Internet interruptions occur regularly, and they very rarely have fatal consequences even in hospitals. If they did, hospitals would have more redundancy. Lots of people seem eager to criticize Gottesfeld for not somehow foreseeing this unlikely thing that didn't actually happen except in their own imagination.

That's revealing. We expect private individuals to act with perfection, so that no unintended consequence, however unlikely, could ever be imagined. Yet giant wealthy firms with lots of lawyers can run roughshod over innocent children, being paid hundreds of thousands of dollars in the process, and they must simply be endured. How could the hospital know this handicapped girl wasn't simply imagining her symptoms? Actually lots of people at the hospital knew what was happening; nurses were quitting over it. Actually providing appropriate care for sick people is basically the reason that hospitals exist. Yet at every turn we give the giant abusive bureaucracy the benefit of the doubt.

In this case as in every case, DoJ stood ever ready to serve the interests of the wealthy, powerful, and well-connected. With gag orders, even complaining about abuse was grounds for more abuse! Policing a big urban hospital is not a good DoJ career move. Crushing little people who speak truth to power, even if only for an hour during a fundraiser: that's what really gets a federal prosecutor's juices flowing. We've seen enough from DoJ to expect this behavior, but don't imagine for a second it's justified by anything but their own craven self-interest.

[EDIT:] Rather pointless googling I'm afraid. It's not as though the interests of the wealthy and powerful are never found in opposition. By all means, though, keep trying to change the subject from your silly spurious movie-plot medical-procedures-dependent-on-constant-Facebook-access theory. I'm not sure that something as braindead as "CVS is just like this tortured handicapped girl" is any better though...

It's not terribly hard to find cases, even within just the Obama administration, of DOJ going after big hospitals.

A few months ago, the federal prosecutor in Georgia announced a $513 million settlement against the Tenet hospital chain for charges of bribery and fraud: https://www.justice.gov/opa/pr/hospital-chain-will-pay-over-...

The fed prosecutor in DC managed to extract $12.9M in settlements from the D.C. Children's Hospital based on a whistleblower complaint last year: https://www.justice.gov/opa/pr/childrens-hospital-pay-129-mi...

I admit, in casual Google searches, I didn't find any case in which Ortiz's office took on an area hospital. But I did find quite a few cases where her office hit pharmaceutical companies quite hard:

https://www.justice.gov/usao-ma/pr/cvs-pay-35-million-resolv...

https://www.justice.gov/usao-ma/pr/pharmaceutical-executives...

https://archives.fbi.gov/archives/boston/press-releases/2012...

https://www.justice.gov/usao-ma/pr/wyeth-and-pfizer-agree-pa...

https://www.fbi.gov/contact-us/field-offices/boston/news/pre...

Strange world in which Pfizer and CVS are "the little people who speak truth to power" only to be crushed by the DOJ.