\documentstyle[doublespace]{article}

\author{David Golombek}
\title{Blue Cross and Blue Shield Admit Possible Security Breach}
\date{June 1, 1998}
\begin{document}
\maketitle

{\bf(WASHINGTON)} --- In a press conference held late last night, the
Blue Cross and Blue Shield Association (BCBSA) \footnote{BCBSA is a
real organization.  This paper uses them to provide a realistic
background, but is otherwise entirely fictional} admitted that the
security of their internal medical databases may have been
compromised.  Michael Roberts, the new president of BCBSA, stressed
that although computer experts within the company confirmed that there
was a security hole that could possibly have been used by an outside
individual to access private information, there was no confirmation
that such access had been used.

This press conference comes eighteen hours after the group calling itself
the ``Phuture Phreaks'' held a media event in which they claimed to
possess a copy of the full Blue Cross and Blue Shield medical records,
which are comprised of the records from all 56 independent Blue Cross
and Blue Shield companies.  BCBSA member companies provide health care
to 68.6 million Americans, and all records are kept in the central
databases to ease transfer of information between member companies.

``We have always been committed to providing the best medical coverage
to everyone under our plans, and part of that coverage is the proper
privacy people expect and deserve of their medical records.  We have
also been centralizing our information, to ease communications among
our associated companies and between doctors.  Towards these ends, we
have building a database of all patient profiles and medical records,
and protecting that database with the best security that was available
to us,'' said Roberts during the press conference.  ``We believe we
took every reasonable precaution to protect the privacy of our
customers, and we believe that privacy is still secure.''

Little is known about the group calling itself the Phuture Phreaks.
Yesterday afternoon, they sent identical videos to all major TV
stations in the Washington DC area which detailed the claims of the
group.  Although the pictures and voices of the group members had been
digitally altered, all were obviously young, ranging from lower teens
to mid-twenties, and all were extremely nervous.  They showed pictures
and screen shots of various medical records, including those of
several celebrities and public figures to verify their claims.
Surprisingly, the tape held little in the way of demands or threats.
Discussion ranges from expectations of a followup tape full of
demands, to an announcement of a destruction of the data and a warning
of the danger of hackers.  

BCBSA had been using Internet Security Systems' (ISS) \footnote{ISS is
a real company.  This paper uses them to provide a realistic
background, but is otherwise entirely fictional} SAFEsuite$^{TM}$
Adaptive Security Environment, including their Internet Scanning
Toolset and System Security Scanner.  These tools are near industry
standards for security among similar organizations, and are typically
considered adequate protection for highly secure data that must
nonetheless remain accessible over a network.  BCBSA computer
administrators claim to have properly installed these products,
followed proper procedures for maintaining security, and performed
frequent security audits.

Following the announcement by the Phuture Phreaks, BCBSA computer
administrators brought in a tiger team, a group of independent
networking experts who attempted to break into BCBSA databases.  BCBSA
revealed at the press conference this evening that the tiger team had
indeed managed to breach security.  They were quick to claim ``that
although this team of top notch computer experts was able to penetrate
our security, it is by no means verification that others were able to
do so.  We are certain that the claims made by the Phuture Phreaks are
unfounded and that the records and medical history of our customers
remains private.''

Other groups and individuals are not so certain of these claims.  Mike
Miller of the CERT/CC group at Carnegie Mellon University, an
independent computer vulnerability research group, indicated that the
security hole was very likely to have been exploited.  ``Whenver a
target as tempting as BCBSA goes online, a lot of hacker groups want
to try their luck at breaking into it.  There are a lot of hackers out
there, and they have a lot of time and tools on their hands.  Whatever
it is that the tiger team found, it's very likely that someone else
found too,'' commented Mr. Miller.  ``This obviously wasn't an a
simple or stupid mistake by Blue Cross and Blue Shield's computer
administrators, because only one group has claimed to have found the
bug, but on any system as complex as theirs, perfect security is
impossible.''

The first public group to release a statement in reaction to BCBSA's
announcement was the National AIDS Coalition.  ``We find it
inexcusable that a group which has access to such crucial and private
information could allow that data to be disclosed to unauthorized
individuals.  AIDS patients have a right to keep the details and the
existence of their illness to themselves to avoid any of the
unfortunate hostility that still exists within our society.''  Other
groups are beginning to make similar announcements, but the general
reaction seems to be one of astonishment, as people begin to see the
implications of mass availability their medical records.

Further public reaction is expected over the next several days, as
well as a followup announcement by the Phuture Phreaks.  Further proof
of their claim is needed before they are taken seriously by more
people, but BCBSA's press conference today served to confirm the claim
in many people's eyes.  For now, people appear to be content to wait
and let events develop at their own rate.

\end{document}

