Falsifying Records Can Put Lives at Risk

Falsifying electronic records has been a problem ever since they entered our everyday business lives. Time after time, we’ve seen instances where individuals maliciously tamper with IP ownership documents, contracts, budget numbers and other forms of electronic evidence. While these are all undesirable scenarios that have serious financial, legal and regulatory consequences, tampering of these records rarely results in injury or death. Some electronic records, however, are actually used in highly regulated industries to ensure safety of everyday citizens. Dependent on industry, these records might log things like hours worked, compliance training and safety procedures – all things that impact job performance and on-the-job safety.

Unfortunately, when records of this nature are purposefully altered, the consequences can be grave. Take Gulfstream International Airlines for example. According to a recent Wall Street Journal article, current and former employees allege that the airline tampered with electronic flight logs and falsified flight hours in order to allow pilots to fly additional hours than the federal safety rules allow.

“Mary Hebig, who worked as a crew-scheduling supervisor at the carrier from March 2005 to July 2007, said in an interview that the flight-dispatch department frequently and retroactively changed flight hours in the computer system without conferring with pilots or with her department.

When an initial check of computerized schedules showed that certain pilots had run out of allowable flight hours, according to Ms. Hebig, ‘dispatch would call back and say, check them again.’ Often, it was apparent the numbers had been changed between calls and ‘suddenly, the crew had a rebirth; they were now legal to fly’ more trips, she alleged.”

And while Gulfstream did not operate the Feb. 12 Continental Connection Flight 3407 that killed 50 people, fatigue has been frequently reported as a cause of airline industry crashes, making the allegations against Gulfstream extremely troubling. The Federal Aviation Administration recently proposed a $1.3 million penalty against Gulfstream, accusing it of “scheduling crew members in excess of daily and weekly flight-time limitations.” David Hackett, chief executive of Gulfstream International Group Inc., argues that the airline never changed work records in an attempt to bypass the rules.

Putting aside the argument of who’s right or wrong, the mere idea that flight logs can be tampered with is a scary thought. Federal safety rules are in place for a reason, and the thought of someone violating them (for whatever reason) should stop us all in our tracks. Electronic records are in need of safekeeping from individuals who are tempted to alter them. Products such as Surety’s AbsoluteProof, could have played a major role in this particular case. AbsoluteProof’s digital timestamping technology would have legally and irrefutably proved whether or not the electronic flight logs had in fact been tampered with. Thus, the FAA’s investigation would be an open and shut case, proving Gulfstream’s guilt or innocence.

We’ll stay on top of this story and report back with the end result of this case. Regardless of its outcome, we hope this experience helped the airline (and the entire FAA, for that matter) realize the necessity for proper electronic document security measures. Failing to implement proper precautions could end up being a life or death scenario.

Information Security Risks Linked to Employees

Forget about blaming hackers and competitors for a security breach of your businesses’ information. According to a recent ComputerWeekly article, an organization’s own employees are often times the biggest threat to the security of your information

“The majority of major data breaches that have occurred over the past 18 months can be directly attributed to employee behavior, an inability to follow policies and procedures that has had catastrophic results; millions of personal records being compromised, a plethora of government investigations, heavy fines and sanctions, reputational damage and the media baying for blood.”

This is something we’ve talked about before but it remains a massive misperception among IT and business executives that the largest threats are those outside your own walls. So, what’s an organization to do?

First, every organization needs to make a commitment to information security. As an increasing number of an organization’s most valuable assets – from intellectual property records to contracts – are kept in electronic format, this often means making a commitment to ensuring those records are protected and that, if necessary, the organization can establish that these records haven’t been tampered. Investing in products such as Surety’s AbsoluteProof can help alleviate these worries of tampering by providing data integrity assurance with the technology of digital timestamping. Pinpointing the exact moment an electronic document is illegitimately altered, AbsoluteProof provides legally verifiable evidence of data authenticity, ensuring the protection of some of your most valuable assets.

The amount of time and effort invested in these types of technologies behind your security measures should equal to that of the energy you put toward educating and training employees about their respective IT responsibilities. Employees need to understand the procedures needed to take in order to effectively secure information. Compliance regulations and expectations must be communicated on a regular basis, keeping up with the ever-changing IT landscape.

In order to do this and manage “user accountability and awareness,” organizations should follow the guidelines listed below as described in the article. You’ll notice that automation plays a big role in the process – that’s because according to this article, automating key security processes has proven to increase user awareness of security risks by 30 percent within three months.

• Automate the policy creation process so that you can quickly create or modify policies already in place.
• Implement automatic targeting and scheduling technologies so that you can be sure you’re targeting all your users.
• Require a response from a user each time he/she breaks the code of conduct so that you can have proof of communication relating to the event.
• Automate surveys and risk assessments to challenge your employees’ knowledge and share an outline of your current IT security position.
• Implement products with skilled reporting capabilities so that you can better identify and prevent risks down the road.
• Implement automation so that you can establish a routine process, thus increasing your chances of reliable IT security.

So, do you agree or disagree with these recommendations? What is your organization doing to protect against internal security threats?

Surety, LLC Survey Exposes Concern About Data Tampering Risks in Collaborative IT Environments

2009 SharePoint Security Survey Proves Organizations with High-Value Electronic Records Need Additional Data Integrity Protection

Surety, LLC, the leading provider of data integrity solutions, has announced the results of its 2009 SharePoint Security Survey. The survey of more than 330 respondents spanned a broad spectrum of information technology job titles across markets, and the results revealed overwhelming concerns about the risks of data tampering in collaborative environments, particularly Microsoft® SharePoint®.

Alarmingly, nearly one-quarter of respondents lack confidence that their organizations’ electronic records or other digital content are protected when they are being shared within the SharePoint environment, and of the respondents whose organizations have suffered a data breach within their SharePoint system, 67 percent indicated that the tampering was at the hands of a person with access to SharePoint from inside the organization.

“This is not about SharePoint’s built-in protection controls, which are good in general, but instead it’s about protecting the integrity and authenticity of electronic records that can be shared across multiple parties in any document or records management system,” said Bob Flinton, Vice President of Marketing and Product Management of Surety, LLC. “With data security and integrity controls, like third-party digital timestamps, integrated into business process systems like SharePoint, organizations are able to deter electronic data tampering more effectively.”

The survey also revealed that a majority of organizations are using SharePoint to store and share their most vital electronic records, such as critical intellectual property (IP) records, to strategic corporate planning documents, company financials, employee records, electronic medical records (EMR) and personal health records (PHR). Forty six percent of respondents estimated that the data housed in their SharePoint systems was valued greater than $10 million dollars. Nearly 30 percent of survey respondents valued the electronic records housed in their SharePoint systems at more than $50 million dollars, with 9 percent indicating that their data was valued greater than $500 million dollars.

Other findings in Surety’s 2009 SharePoint Security Survey include:

• The ability to authenticate electronic records is essential in order to prove that these records have not been tampered with (for compliance, intellectual property protection or litigation readiness). Fifty eight percent of respondents indicated that electronic records authentication was either their most important or an important priority for their electronic records. Interestingly, 75 percent of respondents with C-level titles indicated that electronic records authentication is a top-of-mind concern.
• SharePoint users want additional security and document authentication capabilities in their collaborative environments. Nearly 60 percent of survey respondents believe that adding security and document authentication options to SharePoint would result in a “better and safer collaboration environment,” while only 5 percent viewed them negatively.
• The consequences of a SharePoint security breach extend beyond IT. According to survey respondents, the most significant consequences facing their organization include data loss (62 percent), reputation risk (41 percent), intellectual property compromise (35 percent), and non-compliance with regulations and legislation (31 percent).

To receive a full copy of the findings for Surety’s 2009 SharePoint Security Survey, contact surety@speakerboxpr.com.

Survey Methodology
The survey was conducted by eMedia USA on behalf of Surety during the Fall of 2008, and included 336 SharePoint, Network and Systems Administrators, Systems Architects, IT Directors, Security Analysts, Network Engineers, Chief Security Officers and Chief Technology Officers.

Surety Podcast Series: Informatics Trends Emerging in eR&D

This is part four of a four part podcast series.

Podcast Presenter: Michael Elliot of Atrium Research & Consulting.

Curious to know what sort of informatics trends are emerging in the electronic R&D space? And what about the success stories for ELNs? Listen in as Michael Elliot with Atrium Research & Consulting discusses both.

1. Tools and Technology Trends in eR&D
   SharePoint and other records management systems, combined with data integrity protection technologies, will play an increasingly growing role in how electronic records and other digital content are managed and secured. (Michael Elliot only)
   Register to download podcast segment. (6 MB)
2. eR&D Success Stories, A Real Life Analysis
   (Michael Elliot only)
   Register to download podcast segment (4 MB)

(Photo Credit: Ian-S)

Electronic Health Records – Calling for Security and Authentication

Electronic health information technology is transforming the delivery of healthcare. Nineteen billion dollars of the economic stimulus package has been set aside for the modernization of health records, and the federal government has set a goal of 2014 for the creation of an electronic health record (EHR) for all Americans . The move from paper records to EHRs —including electronic medical records (EMRs), personal health records (PHRs) and e-prescriptions –can solve a host of problems for medical organizations, allowing them to run more quickly, more accurately, and more efficiently. With complete and immediate access to patient records through EMRs, healthcare providers are able to provide better, faster and more personalized care, raising the level of both medical care and personal attention. As the number of patient charts is reduced, medical organizations are also dramatically reducing the costs associated with creating, storing and maintaining paper charts.

Beyond EMRs, the increasing use of electronic prescribing contributes to patient safety. A 2006 study by the Institute of Medicine reported that 1.5 million people in the United States are harmed each year – and 7,000 killed – by medication errors. E-prescriptions improve patient safety through more complete and accurate prescriptions, direct transmission of the prescription to a dispenser where fill status can be monitored, and elimination of the need for the dispenser to decipher and transcribe, often illegible, handwritten fax or paper prescriptions.

While the increased use of EHRs is integrally related to improving patient care and safety, their adoption introduces new security concerns, including the opportunity for data loss or destruction (both accidental and malicious data tampering), inappropriate corrections to medical records and e-prescription forgery. In order to address areas of potential risk and remain compliant with medical organizations must adopt policies and procedures that are compatible with EHR systems and compliance with regulations like the U.S. Health Insurance Portability and Accountability Act (HIPAA), which contains provisions for the protection of data stored electronically.

By not integrating proper security and authentication controls, the realization of electronic health records faces an uphill battle. As a Feb 16, 2009 Washington Post article reported, these challenges are real:

“Roadblocks include concerns over lack of universal protocols for collecting data as well as rules that establish how, with whom and under what circumstances the data can be shared. Many health-care providers — physician practices, testing facilities, hospitals and clinics — fear liability if private information gets into the wrong hands.

And the risk of tampering is real in healthcare as well. In the summer of 2008, when Esmin Green, a 49-year-old woman died in a Brooklyn psychiatric hospital’s waiting room, the video of her collapsing and lying on the floor for more than an hour until hospital staff responded, made front page headlines.

Among the many allegations leveled at the hospital and its staff after her death was one concerning the authenticity of the electronic records relating to Green’s care. The New York Civil Liberties Union states that hospital staff falsified Green’s records in an attempt to cover up the amount of time she was without assistance.

“Contrary to what was recorded from four different angles by the hospital’s video cameras, the patient’s medical records say that at 6 a.m., she got up and went to the bathroom, and at 6:20 a.m. she was ’sitting quietly in waiting room’ — more than 10 minutes since she last moved and 48 minutes after she fell to the floor.”

Considering the severity of the allegations and outrage over Green’s death and mistreatment, it is not difficult to comprehend the employee’s motivation for falsifying the times on Green’s records. In his blog BizTechTalk, document management analyst Dan Keldsen asked an important question every healthcare organization should ask themselves as they make the shift to electronic records:

“Do YOUR systems support verifiable, tamper-proof audit trails? Are you synchronizing the date/timestamps of related systems, such as in this case, video surveillance?”

Keldsen goes out to ask his readers scary but important questions such as “can people back-date contracts in your organizations? Invoices? E-mail messages? If you need to roll-back your entire systems to a certain point in time to see exactly what offers were made to who and when, could you do it?”

Green’s case, of course, is a dramatic example of the importance of digital time-stamping, but it highlights the ease with which electronic health records can be tampered. The instances where motivated insiders have found a way to manipulate electronic records are too numerous to mention here, but the results often make the headlines and lead to litigation and regulatory investigations.

The message is clear. Organizations must take proactive steps to guarantee the integrity of electronic health records. Healthcare professionals need the ability to irrefutably prove – without question – that patient records have not been tampered (maliciously or accidentally) since their creation.

We’ve developed AbsoluteProof in such a way that it can be integrated seamlessly at any point in the healthcare organization’s business process (including data capture, generation, management and archive), and is compatible with any data source, regardless or format. This gives healthcare IT professionals the ability to reliably and independently prove the integrity of their electronic records and prove that an electronic record existed at a specific point in time and has not been altered since.

If you’re a healthcare provider, what are you doing to ensure the authenticity of your electronic records? If you’re an EMR solutions provider, what are you doing to provide healthcare providers with this critical capability?

Surety Podcast Series: Electronic Content Management Silos, More of a Hindrance Than a Benefit

This is part three of a four part podcast series.

Podcast Presenters: Michael Elliot of Atrium Research & Consulting and Timothy Carroll, Partner at Loeb & Loeb, LLP.

When it comes to enterprise-wide data-level security controls in an ELN environment, why are organizations putting in more robust controls when it comes to regulation by the Federal Drug Administration than in areas and units that are solely focused on drug discovery? What are the risks in this particular scenario?

Learn this and more on why implementing robust controls in certain silos of an organization’s infrastructure may prove to be more of a hindrance than a benefit. What about organizations that are proactive versus reactive in electronic content management? What are the pros and cons of each strategy and which one will come out on top?

1. Risk of Enterprise-wide Disparate Data-level Security Controls: How Much is Good Enough?
   In this podcast, Elliot and Carroll talk through the motives of why organizations choose to use disparate data-level security controls. Just how much (security measures) is good enough?
   Register to download podcast segment. (6 MB)
2. Safeguarding eData Against Tampering, Theft & Misappropriation
   Find out from Elliot and Carroll how disparate record keeping programs and an organization’s lack of safeguarding its electronic records is grounds for data theft or intellectual property misappropriation.
   Register to download podcast segment. (4 MB)
3. Proactive vs. Reactive Electronic Content Management
   Proactive versus reactive security management of your electronic information, which strategy is best for electronic content management? Are there benefits to each? Where does your organization reside on the scale?
   Register to download podcast segment. (3 MB)

(Photo Credit: Leonid Mamchenkov)

Revisiting the Characteristics of a Good Data Integrity Mechanism

Last week, we read the New York Times article “A Tool to Verify Digital Records, Even as Technology Shifts” (free registration required) with great interest. The article discussed the University of Washington’s release of “the initial component of a public system to provide authentication for an archive of video interviews with the prosecutors and other members of the International Criminal Tribunal for the Rwandan genocide.” According to the article:

This system is intended to be available for future use in digitally preserving and authenticating first-hand accounts of war crimes, atrocities and genocide.

Such tools are of vital importance because it has become possible to alter digital text, video and audio in ways that are virtually undetectable to the unaided human eye and ear.

The researchers said history was filled with incidents of doctoring, deleting or denying written records. Now, they say, the authenticity of digital documents like videos, transcripts of personal accounts and court records can be indisputably proved for the first time.

On one hand, we were surprised to see the New York Times and John Markoff present authentication technology of this nature as a new thing, since Markoff himself wrote an article on our roots (free registration required) in the Bellcore research laboratories as “digital time-stamping service that relies on cryptographic techniques both to certify the time a document is submitted and to allow future users to verify that it has not been tampered with” in January, 1992.

On the other hand, the article on the University of Washington’s efforts to preserve important digital records across generations is an important one. Not only will the University’s efforts to create a publicly available cryptographic hash mark help secure digital records related to genocide, H.I.V. and AIDS, famine, deforestation and global warming, but the article presents an opportunity to revisit the characteristics of a good data integrity mechanism.

So what are they?

• Hashing alone doesn’t prove that the data has not been tampered with since you can always tamper with the data and recompute the hashes. Trusted timestamps solve this problem by securely binding a time value to the hash so it the hash is changed. Trusted timestamps allow you to prove that data existed at a particular point in time and hasn’t been altered since.
• This application illustrates a key requirement of a data integrity mechanism, namely that it be “independently provable” (i.e., there should be a process that a third party can follow that clearly demonstrates the authenticity of the data). One mechanism that meets this requirement, Surety’s AbsoluteProof timestamps, can be independently validated by computing a series of standard hashes and comparing the result to a reference value published in the New York Times. The fact that the result matches the published reference value proves that the document existed before the publication date and has not been altered since.
• Another key requirement of a data integrity mechanism that it can last at least as long as the life of the data. To be long lasting, the mechanism must not depend on things that can be compromised or that can expire (e.g., cryptographic keys or certificates). Another consideration when using secure hashing is the hashing technology itself has a limited lifetime. Surety’s AbsoluteProof timestamps also exemplify the long lasting requirement. Surety timestamps are based only on secure hashing and the concept of a “widely-witnessed value”. There are no secrets that can be compromised or certificates that can expire. To ensure that timestamps will outlive the hash algorithms initially used to create them, Surety timestamps can be “renewed” with more advanced hash algorithms when they become available. The key to this process is that once renewed, the original date on the timestamp can still be relied upon. Also, this process can be repeatedly applied over time as secure hashing technology advances, permitting data integrity protection that than truly last the lifetime of the data.
• A final requirement is portability. Since such an archive must last for and extremely long time, the proof of data integrity must not depend on the archiving system itself as this will be replaced over time. The advantage of a digital timestamp and integrity mechanism is that it can travel with the data as it is migrated from system to system. Hashes alone are not portable, because once they are exported from a system they can be altered and their association with a particular point in time can be lost.

Google Takes on the World of Email Archiving

Google’s latest trump – an expansion in e-mail archiving
Techno Talks, January 12, 2009

Google Message Discovery

Just when you think Google has thought of everything, think again. The corporate giant has recently developed an email archiving solution called “Google Message Discovery”. This service allows users to store and refer to emails for up to 10 years and simultaneously provides security software that is designed to protect without unnecessary blockage.

“In a nutshell the service efficiently provides an adequate interface for locating relevant messages. The more interesting staff is once the right content is found it can be viewed and accessed through regular email interfaces like Outlook Express or can be sent to output to a secure FTP server.”

The cost for this service? A mere $45 per user per year. Take a look at what is has to offer. If you’re currently using Google Message Discovery, take a minute and let us know your thoughts. We’re all interested in learning about solutions that make our lives easier.

Further reading: http://www.technotalks.com/reviews/googles-latest-trump-an-expansion-in-e-mail-archiving/

Investigators Turn to Electronic Records for Answers

Wall Street Crisis Forcing Closer Look At E-records
Network World, January 20, 2009

With Wall Street falling to its knees, it’s no surprise that people are now wondering who knew what and when in regard to the financial lending practices. One might think that electronic records would easily address these concerns, however it has since been made clear that retention regulations were only loosely followed before the market crashed. Thus, many questions will be forced to go unanswered.

Moving forward however, it’s a sure guess that electronic records will be taken more seriously and that regulations will be put forth with high expectations of compliance.

“Analysts warn that the fallout from the Wall Street meltdown will quickly lead to stricter enforcement of existing laws — including the Sarbanes-Oxley Act, the Electronic Signatures in Global and National Commerce Act, the U.S. Securities and Exchange Commission ’s Rule 17A-4, and the Gramm-Leach-Bliley Act — and perhaps some new ones targeting the financial services industry.”

Regardless if you agree with the increased supervision or disagree, as Bill Savarino, a partner at Cohen, Mohr LLP and an expert in e-mail retention and other regulatory issues, does, it is impossible to argue the importance of electronic records. Although they may seem mundane and irrelevant one minute, the next minute they might be the center of attention in a national investigation.

Further reading: http://www.networkworld.com/news/2009/012009-wall-street-crisis-forcing-closer.html

The Trouble with Metadata

E-discovery isn’t easy. On top of all that organizations are now expected to do in regard to preserving, producing and authenticating their electronic records, courts now expect companies to produce metadata associated with electronically stored information (ESI) as well. According to this article:

Guidance Software (NASDAQ: GUID) issued an alert today saying that in a recent court case (Aguilar v. Immigration & Customs Enforcement Div. of U.S. Dep’t of Homeland Sec.), a U.S. District Court ruled that metadata associated with e-mails and electronic files must be preserved, maintained and produced in the course of legal discovery, particularly when sought by the requesting party in its initial request.

The ruling opens up another area where companies could be hit with steep fines for failing to produce electronic documents in court cases — and could mean more business for e-discovery vendors.

The Aguilar decision and recent guidance from the Sedona Conference emphasize the importance of metadata preservation in the course of e-discovery, said Guidance Chief Strategy Officer John Patzakis, who said metadata can be used for authentication, search and analysis while also offering evidentiary value such as when the file was created or accessed.

Concerns about preserving and authenticating metadata aren’t new to us. The largest challenge organizations (and their legal counsel) face with respect to metadata preservation and authentication is that the metadata of every electronic record can be changed when a third-party opens the file. Whenever a native file, such as Microsoft Word, is opened, the metadata associated with that electronic record is changed to reflect the time that file was opened and by whom. Technically, the file was altered, and based on the Federal Rules of Evidence, may not be legally admissible.

Another problem emerges when considering long-term electronic records archiving. During its retention period and throughout its chain of custody, a native electronic record may be handled and managed by several people, and must withstand several technology upgrades to the electronic record archive system infrastructure in which it is retained. During this period, it is likely that a given record and/or its metadata were altered, either inadvertently or maliciously. Companies must be able to prove that throughout a record’s chain-of-custody, its intended content and metadata are pristine.

Manual metadata preservation is no easy feat. We’re working with an increasing number of companies that integrate Surety’s AbsoluteProof service into their overall electronic record management process to ensure that their native electronic files are “litigation-ready”. At any point in the future, when litigation holds arise, every record sealed by AbsoluteProof during the normal course of business operations can be authenticated by anyone, anywhere and at any time, without changing the metadata of the record itself.

What steps is your organization taking to preserve metadata and produce your native electronic files to third-parties during e-discovery without the fear of metadata alteration if and when the files are opened?

(Photo credit: About The Image)