In her 14-plus years of investigating and blogging about hacking and breaches, “Dissent” has been yelled at, threatened with lawsuits and accused of being a criminal. But now the self-described “older than dirt” retired New York psychologist, who publishes her work at DataBreaches.net, is enjoying a bit of fame.
Recently the HHS Office for Civil Rights (OCR) gave Dissent props for warning Athens Orthopedic Clinic PC in 2016 that patient information was online and for sale, an incident that predicated a $1.5 million financial penalty.[1] It wouldn’t be entirely accurate to say that, up until now, Dissent has been toiling in obscurity, but OCR’s mention prompted RPP to learn more about her and the insights she’s gleaned over the past 26,000 posts on DataBreaches.net and 19,000 on her other website, PogoWasRight.org.
In a wide-ranging Q&A, Dissent was by turns funny, self-effacing and humble, saying her work is simply “the right thing to do if you care about privacy,” and repeatedly claimed: “I am not a security professional.” A “ bad businesswoman” who doesn’t make money from the blog (she does do some consulting), Dissent is unsparing in her criticism of organizations’ dumb mistakes that let hackers in and is impatient with those who ignore her when she tries to notify them that their information is “leaking all over the internet.”
Much of the blog consists of timely postings of stories by others, but Dissent will often provide commentary—some undoubtedly unique given her psychology background and time spent talking to hackers, which few can claim. She also does a fair amount of original reporting, making the site a must-read for busy HIPAA compliance professionals.
Although never the victim of a HIPAA-related breach herself, Dissent’s interest grew from being harassed and stalked online and was spurred by a desire to share with others what she had learned about staying safe online. In 2006, Dissent launched PogoWasRight.org to report privacy news. Although it gets its name from the cartoon character who said, “We have met the enemy, and he is us,” it is not affiliated with the comic strip (which ended in 1975). She launched DataBreaches.net in 2009.
Unfortunately for Athens Orthopedic, the reason the world knows about Dissent’s tip is that the organization, according to OCR, had numerous HIPAA violations underlying the hack. Athens was just one in a trio of settlements totaling $10.65 million that had the common theme of “you were warned” (the FBI raised the alarm in other cases).
