The person most likely to go to jail is the person who swore that the company's disaster recovery plan has been tested and that they can recover in under 48 hours.

For something like a major insurance company, they should be assuming that they will be hit by nation-state actors and that they need to have a plan B, plan C, and probably a plan D for when it fails. It doesn't seem like they were prepared.

Or it is all lost and DHHS finds that it was negligence of the C suite that allowed the breach to happen and people go to jail and someone has to rebuild it with security and not HITRUST in mind.

These companies are either covered by HIPAA or sign a Business Associates Agreement (BAA) agreeing to be covered by HIPAA and subject to the penalties of HIPAA (maximum fine of $50,000 per users data disclosed in a breach and up to 10 years in jail if the cause of the breach is determined to be negligence).

The problem is that it is an industry ruled by certifications and checklists more than knowledge and ability.

There are people working at fixing the individual flaws in HITRUST but not in the flaw of thinking that you can just follow a third party checklist and magically be secure. Cyber insurance companies give favorable rates for ISO27001 and HITRUST compliance so the industry generally follows them. I'm not entirely sure how to get the industry to focus more on proper risk reduction by doing things like reducing attack surfaces and realistic risk assessments.

An example is a requirement that you do an annual pentest. You can spend anywhere from $600 to $120,000 for a pentest. If you want a pentest that says your systems are great you hire someone to do a $600 pentest. If you actually want to know what is wrong with your systems you spend for the $120,000 pentest. Most people don't want to know what is wrong, they just want the certificate that says "We didn't find anything after we ran a few scans with some open-source tools."

I can give you about a 99.9% confident answer that everything was encrypted in transit and at rest.

There is a huge HITRUST framework that insurance companies try and get their vendors to follow. It is about 70% good ideas, 29% meaningless, and 1% bad ideas that will undermine security. HITRUST makes the mistake of thinking that human beings are reliable if they are not malicious and it is very fond of error prone manual processes over reliable automated processes.

There is a law, and there is a detailed spec that the insurance company has drawn up and thousands of people are mindlessly following it.

Are we talking about the ransomware gang, the Health Insurance companies, or both?

We already know where the Health Insurance C suite executives live.

In this case, they are going to be facing questions from HHS (department of Health and Human Services) and if HHS doesn't like the answers they receive they can refer them to the Justice Department for prosecution under HIPAA for negligence with a maximum jail term of 10 years.

Their defense will be "We followed HITRUST and are certified as HITRUST compliant". Never mind that HITRUST is a severely flawed security standard that has many requirements that weaken security.

It is the worst thing about working in the healthcare industry. The security policies are more about proving that you are doing something and can blame someone else and not really about having the defense in depth and keeping security and the business goals in sync. Just randomly quoting HITRUST or ISO27001 or some other standard to mindlessly 99% follow with "a few exceptions" that make everything else meaningless. I saw a company that said "Developers cannot access production" that also had over 10,000 one-time exceptions of developers accessing production. You can create tools so developers don't need to access production, but in healthcare, it is by decree and no budget.

No, it means Itso will take over despite being a subpar solution. There are many companies running hundreds or thousands of clusters. (or maybe even envoy as a service mesh)

If it is true that Chat GPT wouldn't be used, I suspect that it is because there are much better AIs to use for drug development than ChatGPT.

The covid-19 vaccine https://www.ncbi.nlm.nih.gov/p...

And the person who is profiting the most off of one of those ETFs says that Bitcoin is worthless (Jamie Dimon - CEO of J.P Morgan Chase)

Those rights are only with the original purchaser of the coin. (at least in countries like the US and England)

If the seller of the rights reneges and a purchaser in the secondary market sues the seller will simply demur claiming that there is no contract between the seller and the owner of the coin and that therefore the owner of the coin has no standing to sue. This is covered in This video on the problems with NFTs

Hmm, just thinking about this, AI could do some investigative reporting.

Feed an AI bot much of the video feeds of London and have it describe anomalies.

I don't know what percentage of London's surveillance state cameras have their feed accessible, but it could probably report car accidents and street crimes. It might even be able to do public interest stories about new food trucks and businesses.

It would be interesting to see if it could verify quarterly reports of publicly traded companies. An AI could probably do a lot of the summarization of anomalies of quarterly filings at the minimum and also generate the vapid fluff that the financial press puts out about how the market is reacting to an earnings report.

Based on how Ronald Reagan announced Baseball games an AI could probably do the same in real time from the stat sheet as he was announcing the games from just what was coming over the wire service, which was mostly just the stats.

Unfortunately, the spammers slowly realized that dmoz was an excellent place to place spam.