Stolen laptop contains cancer research data(news.cnet.com)
news.cnet.com
Stolen laptop contains cancer research data
http://news.cnet.com/8301-17938_105-20028475-1.html?part=rss&tag=feed&subj=Crave
80 comments
I'm sick of this attitude of "Always be super nice and make sure you over mother your users" crap. You know what: If my car engine seizes because I haven't changed the oil, no one tells the car makers or the mechanics they didn't do thier job right. If I leave the oven on all night and get CO poisoning, no one blames the oven maker for it. If someone doesn't buy renter's insurance we don't blame the apartment owner for them losing their net-worth.
PCs have been almost ubiquitous for 20 years now. For my entire freaking life I have been hearing about how "you need to back up your data". We have consistently made better and better backup tools, like mozy, or backblaze. Yet somehow it is our fault some idiot decided "It won't happen to me!". At some point, we just have to have the users be a tiny little baby step of a bit responsible for their stuff too. Just like accounting makes people responsible for their inventory and expense reports. Just like HR makes people responsible for their own insurance stuff. Sure they help, but crap - people need to be a little grown up in their lives and actions.
Just because this person did not bother to find out about backups from her IT does not make it ITs problem. Hell, you don't even know if there was or wasn't the ability for backups in place. Most university IT shops have lots and lots of capacity and backup options in place -- and they are documented, they just don't force users to do it. You know why? Sanctimonious asshats come from the other direction then, complaining not about how IT must mother the employees, but instead must back off the draconian rules to make users feel more welcome.
tl; dr -- Users should be held to some standard of responsibility and IT is damned when they do and when they don't.
PCs have been almost ubiquitous for 20 years now. For my entire freaking life I have been hearing about how "you need to back up your data". We have consistently made better and better backup tools, like mozy, or backblaze. Yet somehow it is our fault some idiot decided "It won't happen to me!". At some point, we just have to have the users be a tiny little baby step of a bit responsible for their stuff too. Just like accounting makes people responsible for their inventory and expense reports. Just like HR makes people responsible for their own insurance stuff. Sure they help, but crap - people need to be a little grown up in their lives and actions.
Just because this person did not bother to find out about backups from her IT does not make it ITs problem. Hell, you don't even know if there was or wasn't the ability for backups in place. Most university IT shops have lots and lots of capacity and backup options in place -- and they are documented, they just don't force users to do it. You know why? Sanctimonious asshats come from the other direction then, complaining not about how IT must mother the employees, but instead must back off the draconian rules to make users feel more welcome.
tl; dr -- Users should be held to some standard of responsibility and IT is damned when they do and when they don't.
Emphasis on Mission critical. We're not talking about an arcane enterprise IT organization keeping you from going on Facebook (or HN for that matter) on your lunchbreak, or considering an upgrade to IE7 over the course of 2011.
We're talking about mission critical data. Data, without which the mission cannot succeed. It was not even backed up. That's not the users fault, it's a systemic failure of the organization, a failure it was/is ITs responsibility to fix.
We're talking about mission critical data. Data, without which the mission cannot succeed. It was not even backed up. That's not the users fault, it's a systemic failure of the organization, a failure it was/is ITs responsibility to fix.
The problem with those analogies is that they're due to physical properties which the designers of those cars, ovens, and apartments couldn't control.
Oil can't be regenerated. When gas burns, it emits CO. Catastrophes that might hit an apartment are usually out of the architect's control. There are protection schemes, but they're only protection, and they're often expensive.
In contrast, software authors are working in a world where they define the laws of the equivalent of physics. It's hard to define them so that nothing bad can happen, and they may be expensive in terms of memory or time, but there's still a big difference between problems in software and problems in the real world.
Oil can't be regenerated. When gas burns, it emits CO. Catastrophes that might hit an apartment are usually out of the architect's control. There are protection schemes, but they're only protection, and they're often expensive.
In contrast, software authors are working in a world where they define the laws of the equivalent of physics. It's hard to define them so that nothing bad can happen, and they may be expensive in terms of memory or time, but there's still a big difference between problems in software and problems in the real world.
Thought experiment time:
I create a new computer company, and put automatic backing up to my servers In said OS. It's part of the price when you purchase. It is fully encrypted, and strictly there to alleviate these problems -- you can always restore backups from our servers. You know what happens? It isn't heralded as a bright and sunny day where the evil programmers and computer wizard finally did something right. Instead it is the "Worst Thing Ever"(tm) and we are invading the privacy of millions. We must be trying to rape children and torture puppies. We will be branded as evil and Fox News will call for our assassinations.
Just because we make the rules of the software does not mean we make the rules of the society and people who use them.
I create a new computer company, and put automatic backing up to my servers In said OS. It's part of the price when you purchase. It is fully encrypted, and strictly there to alleviate these problems -- you can always restore backups from our servers. You know what happens? It isn't heralded as a bright and sunny day where the evil programmers and computer wizard finally did something right. Instead it is the "Worst Thing Ever"(tm) and we are invading the privacy of millions. We must be trying to rape children and torture puppies. We will be branded as evil and Fox News will call for our assassinations.
Just because we make the rules of the software does not mean we make the rules of the society and people who use them.
Flip that "entire freaking life" comment around, and ask yourself whether the current IT schemes and the current common IT approaches are working as well as might be desired.
Whether the current IT plans have survived contact with the end-users.
If IT assumptions and approaches and plans aren't working and if errors are repeating, then IT is left to continue to spend on and work on More Of The Same and on Just Try Harder solutions, or IT can look at different approaches and different solutions. At performing some Root Cause Analysis, or whatever that might be called, and at shifting strategies and tactics.
Computer hardware and software vendors have the same issues, too. Sooner or later, the "blaming the users" for a repeating failure modes isn't going to be a viable product strategy, and somebody (else) then ends up owning the problems and the costs, or your product ends up cast aside.
Look to ways the most serious of these repeating problems can be eliminated.
Backups? IT has to expect some users won't do backups. Something akin to Apple Time Capsule with Mac OS X Time Machine is an absolute killer feature for home users. Your data ends up archived with minimal end-user involvement.
Passwords? How long will we repeat the IT password mantras? IT has to expect some users will continue to pick passwords. So what to do about that?
With a large enough breach or a large enough data loss, IT can be forced start deploying its own CA chains and certificates, and moving to tokens or analogous. Or backups. Or whatever. Why not start ahead of that breach?
As for alternatives and depending on your local user requirements, look to add and to migrate to embedded and tablet devices and automatic backups; trump the problems where you can. At certificate chains and VPNs. At automated backups.
Look for, but don't repeat mistakes.
...Don't expect existing mistakes to fix themselves.
...Don't assume that longstanding approaches and solutions are still the best available solutions.
...And don't plan that end-users will grok IT. They know and think about cancer research, or whatever their job is. Not about IT.
Whether the current IT plans have survived contact with the end-users.
If IT assumptions and approaches and plans aren't working and if errors are repeating, then IT is left to continue to spend on and work on More Of The Same and on Just Try Harder solutions, or IT can look at different approaches and different solutions. At performing some Root Cause Analysis, or whatever that might be called, and at shifting strategies and tactics.
Computer hardware and software vendors have the same issues, too. Sooner or later, the "blaming the users" for a repeating failure modes isn't going to be a viable product strategy, and somebody (else) then ends up owning the problems and the costs, or your product ends up cast aside.
Look to ways the most serious of these repeating problems can be eliminated.
Backups? IT has to expect some users won't do backups. Something akin to Apple Time Capsule with Mac OS X Time Machine is an absolute killer feature for home users. Your data ends up archived with minimal end-user involvement.
Passwords? How long will we repeat the IT password mantras? IT has to expect some users will continue to pick passwords. So what to do about that?
With a large enough breach or a large enough data loss, IT can be forced start deploying its own CA chains and certificates, and moving to tokens or analogous. Or backups. Or whatever. Why not start ahead of that breach?
As for alternatives and depending on your local user requirements, look to add and to migrate to embedded and tablet devices and automatic backups; trump the problems where you can. At certificate chains and VPNs. At automated backups.
Look for, but don't repeat mistakes.
...Don't expect existing mistakes to fix themselves.
...Don't assume that longstanding approaches and solutions are still the best available solutions.
...And don't plan that end-users will grok IT. They know and think about cancer research, or whatever their job is. Not about IT.
You need a license to operate your car, not so with your PC.
{edit}
Some of your users might well be incompetent computer users and wont pass the "test".
I have often thought about why people dont do backups even when the new tools are easy for most to handle. I think the reason is psychological in nature.
Backup implies that you are at least cognizant of the impending disaster scenario. many people avoid even thinking about this, why think of bad news?. Engineers are accustomed to this way of thinking, its a different mental makeup, we shouldn't assume the general public shares this point of view, especially since most of the time they are led through their computing experiences by "wizards" and "guides" might as well be priests.
{edit}
Some of your users might well be incompetent computer users and wont pass the "test".
I have often thought about why people dont do backups even when the new tools are easy for most to handle. I think the reason is psychological in nature.
Backup implies that you are at least cognizant of the impending disaster scenario. many people avoid even thinking about this, why think of bad news?. Engineers are accustomed to this way of thinking, its a different mental makeup, we shouldn't assume the general public shares this point of view, especially since most of the time they are led through their computing experiences by "wizards" and "guides" might as well be priests.
> You need a license to operate your car, not so with your PC.
I own a car, pay insurance on it, but never in my life had a driver license. My wife drives it, working on my insurance bonus. But since it's my vehicle, am still responsible for all the stuff around maintenance, meeting requirements for road worthiness, etc.
I own a car, pay insurance on it, but never in my life had a driver license. My wife drives it, working on my insurance bonus. But since it's my vehicle, am still responsible for all the stuff around maintenance, meeting requirements for road worthiness, etc.
Really? Then how the heck to insurance companies stay afloat? How do home security companies profit?
Sorry, this doesn't pass the absurdity test.
Sorry, this doesn't pass the absurdity test.
Perhaps that is the point, you shell off the responsibility to somebody else, pay some money to some 3rd entity and you have insurance, and you pay premium the more lacking you are in responsibility.
Thats not to mention the case that some insurance policies are a legal requirement, case in point car insurance.
So, like companies such as mozy and backblaze, which I explicitly mention? Essentially they provide insurance in the form of backups. Trivial to use too. I'm not sure of your point anymore.
Just because this person did not bother to find out about backups from her IT does not make it ITs problem.
It was IT's problem before this person ever came along. That's the whole point.
A few quick questions:
1. Are you capable of implementing an IT infrastructure where it is impossible for a user to lose mission critical data? If not, then you're incompetent. Move along, please.
2. Are you willing to implement an IT infrastructure where it is impossible for a user to lose mission critical data? If not, then you're insubordinate. Move along, please.
3. Is it possible for a user to lose mission critical using an IT infrastructure that you have implemented and administer? If so, then you have a problem. Fix it.
Again, in an institutional environment, it is not the user's responsibility to safeguard mission critical data. By definition, this is one of the primary responsibilities of IT.
(Here's a hint: Mission critical data ever on a c: drive = IT failure)
I'm sick of this attitude of ...
And your customers are sick of your attitude. Thanks for demonstrating my point far more effectively that I could ever verbalize it.
It was IT's problem before this person ever came along. That's the whole point.
A few quick questions:
1. Are you capable of implementing an IT infrastructure where it is impossible for a user to lose mission critical data? If not, then you're incompetent. Move along, please.
2. Are you willing to implement an IT infrastructure where it is impossible for a user to lose mission critical data? If not, then you're insubordinate. Move along, please.
3. Is it possible for a user to lose mission critical using an IT infrastructure that you have implemented and administer? If so, then you have a problem. Fix it.
Again, in an institutional environment, it is not the user's responsibility to safeguard mission critical data. By definition, this is one of the primary responsibilities of IT.
(Here's a hint: Mission critical data ever on a c: drive = IT failure)
I'm sick of this attitude of ...
And your customers are sick of your attitude. Thanks for demonstrating my point far more effectively that I could ever verbalize it.
Bullshit. The vehicle fleet manager doesn't make it impossible to run out of gas. The accounting department doesn't make it impossible to max the corporate credit card you have. They provide infrastructure, you have responsibilities in it too.
Further, and I'm really really suggesting you read this slow, and look up words you don't understand in the dictionary, universities just don't work this way. There is no central authority that can force this sort of behavior in them. The researchers themselves push for it, and the people who pay IT then demand it be set up that way. No matter how nice it would be to force backups -- IT can't override the fucking dean. Researchers are to be given autonomy is the usual directive. This leaves IT to provide easy access infrastructure, but not go that last step, as they are forbidden.
Are you sure your customers love your "DO AS I SAY IT IS THE ONLY WAY DAMMIT" attitude? Having dealt with sanctimonious asshats like you many times, and further talked to the mormons and jehovia's witnesses at my door, I realize my words won't sink in, but I will make a futile attempt anyway: Give up the judgemental bullshit. Your way is not the one true way. Your smug little smirk makes lots of people fucking hate you, and you know what, you don't even realize they smile and agree with you just to get you to shut up and go away.
tl; dr- go jerk off to your authority some more, the rest of us have real worlds to live in.
Further, and I'm really really suggesting you read this slow, and look up words you don't understand in the dictionary, universities just don't work this way. There is no central authority that can force this sort of behavior in them. The researchers themselves push for it, and the people who pay IT then demand it be set up that way. No matter how nice it would be to force backups -- IT can't override the fucking dean. Researchers are to be given autonomy is the usual directive. This leaves IT to provide easy access infrastructure, but not go that last step, as they are forbidden.
Are you sure your customers love your "DO AS I SAY IT IS THE ONLY WAY DAMMIT" attitude? Having dealt with sanctimonious asshats like you many times, and further talked to the mormons and jehovia's witnesses at my door, I realize my words won't sink in, but I will make a futile attempt anyway: Give up the judgemental bullshit. Your way is not the one true way. Your smug little smirk makes lots of people fucking hate you, and you know what, you don't even realize they smile and agree with you just to get you to shut up and go away.
tl; dr- go jerk off to your authority some more, the rest of us have real worlds to live in.
It would be nice if you could channel that energy into something more constructive than personally insulting me. Others far more influential have tried and failed to do much with that.
I do care, however, how your behavior affects this community. Others smarter than either one of us have worked hard to keep it what it is. Please remember the guidelines:
http://ycombinator.com/newsguidelines.html
Peace.
I do care, however, how your behavior affects this community. Others smarter than either one of us have worked hard to keep it what it is. Please remember the guidelines:
http://ycombinator.com/newsguidelines.html
Peace.
1. This is how I talk. I call BS when I see it.
2. Follow the guidelines yourself, the condescending crap doesn't fly too well, and is no more or less insulting than anything I said. Further look at the insults you directed towards me. Do you really think your insults don't count but mine do? That act you are committing there, it's called hypocrisy.
3. It is sad you must fall back on pointing out the guidelines instead of addressing the parts about how authority doesn't work according to your claims. It is either an admission of ignorance of how things really work, or a diversionary tactic to avoid having to admit wrong. (PS -- continuing hte diversion about guidelines doesn't change this set of conclusions, no matter how you justify it, the deduction doesn't change).
4. I've been here about as long as you have. Feel free to peruse my comment history. I gladly contribute nicely to non-moralizing discussions, and I call people out when they act disingenuous or jerky. Your attempt to change your moralizing into some sort of "look at me I'm a pillar of the community" is at best an attempt to pull some dirty politics style trick. This loses you even more of the moral high ground you pretend to argue from.
2. Follow the guidelines yourself, the condescending crap doesn't fly too well, and is no more or less insulting than anything I said. Further look at the insults you directed towards me. Do you really think your insults don't count but mine do? That act you are committing there, it's called hypocrisy.
3. It is sad you must fall back on pointing out the guidelines instead of addressing the parts about how authority doesn't work according to your claims. It is either an admission of ignorance of how things really work, or a diversionary tactic to avoid having to admit wrong. (PS -- continuing hte diversion about guidelines doesn't change this set of conclusions, no matter how you justify it, the deduction doesn't change).
4. I've been here about as long as you have. Feel free to peruse my comment history. I gladly contribute nicely to non-moralizing discussions, and I call people out when they act disingenuous or jerky. Your attempt to change your moralizing into some sort of "look at me I'm a pillar of the community" is at best an attempt to pull some dirty politics style trick. This loses you even more of the moral high ground you pretend to argue from.
Any tools you use you should learn how to use first. That goes for a knife as well as a laptop. When I see people use stuff with sharp edges I invariably cringe as they point them at themselves and at others while putting force on them. Even passing the scissors from one hand to another comes with a protocol (sharp end towards the giver).
Laptops are powertools, use them well and they'll do you good, abuse them and they'll eat your research data.
Odds are the researcher messed up and uses the 'theft' as an excuse for something or other, otherwise that reward would have been a bit higher, $1,000, $500 of which is probably the second hand value of the laptop, that can't have been much data.
I agree with your basic premise that we collectively should help to make stuff like this impossible (dropbox is a nice step in the right direction making it easy to have multiple versions of your stuff) I just don't believe this particular case is a good example of what happens when 'we' fail. This user carries the blame and responsibility, not the IT staff there, nor the manufacturer of the gear.
Smart enough to use a laptop? -> Smart enough to burn a DVD once a week or so. Maximum loss is one week of data, and that's assuming you place those DVDs in a different physical location from the laptop.
Of course that's too much of an investment for such valuable data.
Laptops are powertools, use them well and they'll do you good, abuse them and they'll eat your research data.
Odds are the researcher messed up and uses the 'theft' as an excuse for something or other, otherwise that reward would have been a bit higher, $1,000, $500 of which is probably the second hand value of the laptop, that can't have been much data.
I agree with your basic premise that we collectively should help to make stuff like this impossible (dropbox is a nice step in the right direction making it easy to have multiple versions of your stuff) I just don't believe this particular case is a good example of what happens when 'we' fail. This user carries the blame and responsibility, not the IT staff there, nor the manufacturer of the gear.
Smart enough to use a laptop? -> Smart enough to burn a DVD once a week or so. Maximum loss is one week of data, and that's assuming you place those DVDs in a different physical location from the laptop.
Of course that's too much of an investment for such valuable data.
>. Are you willing to implement an IT infrastructure where it is impossible for a user to lose mission critical data? If not, then you're insubordinate. Move along, please
Bosses don't always let you stick truecrypt on everything, especially if they say, have macs.
Most companies aren't run by the IT guy, and no universities are. You don't get that authority most places.
Bosses don't always let you stick truecrypt on everything, especially if they say, have macs.
Most companies aren't run by the IT guy, and no universities are. You don't get that authority most places.
Are you capable of implementing an IT infrastructure where it is impossible for a user to lose mission critical data?
Impossible? Why is perfection the standard? At a minimum she could have bought a $50 external drive at Best Buy, used the back-up software included in the OS, and the probability of this outcome occurring drops substantially.
This is basic stuff that anyone doing cancer research should understand. The fact that she admits to feeling guilty is an indication that she knows better.
Blaming the IT department, in this instance, would be like not brushing your teeth and blaming your dentist when they start falling out.
Impossible? Why is perfection the standard? At a minimum she could have bought a $50 external drive at Best Buy, used the back-up software included in the OS, and the probability of this outcome occurring drops substantially.
This is basic stuff that anyone doing cancer research should understand. The fact that she admits to feeling guilty is an indication that she knows better.
Blaming the IT department, in this instance, would be like not brushing your teeth and blaming your dentist when they start falling out.
What you say makes perfect sense, but as an academic I have to say it is extremely unlikely that the policies and procedures you mention can be carried over from corporations to academia in a straightforward way.
Academics react extremely badly to being told to follow procedures as part of their daily workflow, especially ones they don't understand the importance of. In fact, a big part of the reason that they're in academia in the first place is that they're not able to handle the mundane requirements that are usually in place in the "real world."
For example, someone I work with complains incessantly about the fact that department IT forced him to upgrade from pine — pine, in 2010 — because it is no longer supported. If the IT folks tried to institute rigorous procedures, they would be instantly vilified (and ignored). Unlike in a company where there's a hierarchy, professors don't have anyone above giving them orders, and aren't used to the concept.
Of course, scientific protocols themselves often require lots of procedures, but this is very different because it comes from within and is well-motivated from the point of view of the scientist.
Let me clarify: I do think it is very important that what happened here doesn't happen again, but ensuring that is much harder than someone not familiar with the system might assume. It probably needs to be a mixture of carrots and sticks; I'd say a lot more carrots than sticks.
Academics react extremely badly to being told to follow procedures as part of their daily workflow, especially ones they don't understand the importance of. In fact, a big part of the reason that they're in academia in the first place is that they're not able to handle the mundane requirements that are usually in place in the "real world."
For example, someone I work with complains incessantly about the fact that department IT forced him to upgrade from pine — pine, in 2010 — because it is no longer supported. If the IT folks tried to institute rigorous procedures, they would be instantly vilified (and ignored). Unlike in a company where there's a hierarchy, professors don't have anyone above giving them orders, and aren't used to the concept.
Of course, scientific protocols themselves often require lots of procedures, but this is very different because it comes from within and is well-motivated from the point of view of the scientist.
Let me clarify: I do think it is very important that what happened here doesn't happen again, but ensuring that is much harder than someone not familiar with the system might assume. It probably needs to be a mixture of carrots and sticks; I'd say a lot more carrots than sticks.
There is nothing wrong with pine (well other than mutt is better) in 2011.
I use mutt (preferred pine) to email code patches. All those clicky-gooey email clients spindle and mutilate code patches. There are configuration work-arounds for some, but it is impossible to prevent Outlook from destroying a patch.
Hear Hear, true for nonprofits as well, in my mind perhaps even more so, as they exist for the public trust.
I got some fire and ire, restricting users software choices and tools, as it was a zoo before. It is too bad, I dont want to restrict anybody, but to maintain the integrity of the organization information, offer reliability and keep cost low, choices and policy have to be enforced.
Every desktop folder and user folder is synced to a server, restrictions on personal data stores are monitored, and enforced. critical data is copied to an onsite and offsite datastore. I am met with some dissatisfaction by more advanced users at times, but when their desktop/laptop gets fucked (3 year avg for laptop harddrive it seems) login on to a spare and having your desktop just the way you left it, is a huge relief for users.
and we are just a museum, we are not solving the worlds most dire problems.
I got some fire and ire, restricting users software choices and tools, as it was a zoo before. It is too bad, I dont want to restrict anybody, but to maintain the integrity of the organization information, offer reliability and keep cost low, choices and policy have to be enforced.
Every desktop folder and user folder is synced to a server, restrictions on personal data stores are monitored, and enforced. critical data is copied to an onsite and offsite datastore. I am met with some dissatisfaction by more advanced users at times, but when their desktop/laptop gets fucked (3 year avg for laptop harddrive it seems) login on to a spare and having your desktop just the way you left it, is a huge relief for users.
and we are just a museum, we are not solving the worlds most dire problems.
Agreed. If you're an IT guy and you haven't put a proper backup strategy in place for your users, you should be fired (and I am one).
[deleted]
The reward is only $1,000. While their research may have offered some interesting insights into cancer, they clearly didn't have an absolute cure (for prostate cancer, which is mentioned in the article). If they had a real cure, then around this moment Merk would step in and offer a $10,000,000 reward for the return of the laptop, in exchange for the right to commercialize the technology.
I've several friends who have pursued biology in universities. They could claim that their laptops have data offering possible cures for diabetes, high blood pressure and AIDS. This is the kind of thing they will talk about when we meet for lunch. I realize, of course, that they are not on the verge of a genuine cure. But occasionally their research offers an important new insight. I sense that these researchers, in the story, had info at that level.
Otherwise, the reward would be more than $1,000.
I do think the university should do more to help researchers manage their data.
I've several friends who have pursued biology in universities. They could claim that their laptops have data offering possible cures for diabetes, high blood pressure and AIDS. This is the kind of thing they will talk about when we meet for lunch. I realize, of course, that they are not on the verge of a genuine cure. But occasionally their research offers an important new insight. I sense that these researchers, in the story, had info at that level.
Otherwise, the reward would be more than $1,000.
I do think the university should do more to help researchers manage their data.
The idea that a "cure" for any type of cancer would only be on one laptop is absurd. It may work in a movie plot, but in real life, no way.
At best it would have info on how to possibly, vaguely minimise the suffering in some situations. Cancer is not something that one brilliant researcher can "cure" alone.
At best it would have info on how to possibly, vaguely minimise the suffering in some situations. Cancer is not something that one brilliant researcher can "cure" alone.
Besides, a researcher smart enough to cure cancer is smart enough to back up their computer.
How much time have you spent around cancer researchers? I can assure you that many of the most brilliant scientists I know are all almost entirely computer-illiterate.
If I had a dollar for every lab computer I've seen whose desktop is full of a few dozen Excel files ("data1.xls", "data2.xls", "new data.xls", "jim new data.xls"...), I would never need to apply for another grant as long as I live.
If I had a dollar for every lab computer I've seen whose desktop is full of a few dozen Excel files ("data1.xls", "data2.xls", "new data.xls", "jim new data.xls"...), I would never need to apply for another grant as long as I live.
Reading between the lines and with a healthy dose of cynicism and probability, what is "really" on this laptop is enough irreplaceable data that if not recovered, it will significantly impact and possibly even ruin this researcher's career. Odds are good there's at least one grant with now-unattainable expectations/deadlines. There is a small but finite chance that losing it might actually set a cure of one sort or another back, but, sadly, a much larger chance that it won't help a cure and never would have. Most cancer research doesn't advance the cure dramatically at one stroke, or it would be cured, after all.
(I'm not saying research is worthless. I'm saying that, on the whole, plink a random study and all the research behind done for it and the world won't be very different on the whole. The whole matters more than the parts.)
Still worth $1000 to get it back, for both the data and the career.
(I'm not saying research is worthless. I'm saying that, on the whole, plink a random study and all the research behind done for it and the world won't be very different on the whole. The whole matters more than the parts.)
Still worth $1000 to get it back, for both the data and the career.
That's grossly negligent behavior on her behalf.
Family pictures, unpublished novel and a gigabyte of emails? Fine. But research data that only exists on one consumer-level machine? Work that was financed by her employer and various other organizations? Holy shit.
Family pictures, unpublished novel and a gigabyte of emails? Fine. But research data that only exists on one consumer-level machine? Work that was financed by her employer and various other organizations? Holy shit.
Surely it's grossly negligent behaviour on her employer's behalf?
I voted you up, but I wanted to note that I (we?) have no idea how her department is run, and the negligence could rest as well in her hands as it could in her employer's hands. Another post here said "Blame the IT department for not establishing rigid policies." These sentiments are good, but...
What if the IT department clearly outlined policies for how to store and secure the data? What if the researcher is one of those "This is how I have always done it, and I am ignoring you" types? Given the kinds of data claimed to be on the laptop, it sounds like a personal laptop, not a locked-down IT-given laptop. What if that was the researcher's choice, the intentional ignoring of IT policies in the name of convenience or whatever?
Either way, the article's message is good: back up your important data. Whoever is to blame, the core message obviously bears repeating.
What if the IT department clearly outlined policies for how to store and secure the data? What if the researcher is one of those "This is how I have always done it, and I am ignoring you" types? Given the kinds of data claimed to be on the laptop, it sounds like a personal laptop, not a locked-down IT-given laptop. What if that was the researcher's choice, the intentional ignoring of IT policies in the name of convenience or whatever?
Either way, the article's message is good: back up your important data. Whoever is to blame, the core message obviously bears repeating.
I work in the physics department of a top university. The majority of work people in the department do involves a computer at some stage, from computational physics (likely involving supercomputers and months of compute time) at one end of the spectrum to using Excel as a data store at the other.
We do not have an IT department (we have one or two post-doctoral researchers who keep a couple of servers running for undergraduates).
We do not have IT policies, outside of university-wide intellectual property rules.
There are only personal laptops (in the sense that even though my machine was bought for me, I have full control of it and there is no oversight of how the machine is used).
To the best of my knowledge, this is true of the rest of the university (possibly even worse in other departments).
We do not have an IT department (we have one or two post-doctoral researchers who keep a couple of servers running for undergraduates).
We do not have IT policies, outside of university-wide intellectual property rules.
There are only personal laptops (in the sense that even though my machine was bought for me, I have full control of it and there is no oversight of how the machine is used).
To the best of my knowledge, this is true of the rest of the university (possibly even worse in other departments).
To add to the anecdotal evidence, I have contacts in the strong IT department of a top university near me. So it could indeed go either way.
I work for a University and I laugh so hard every time I hear this.
For the people that say this should be an IT policy issue let me explain to you how academic people work.
Professors and researchers are KINGS and QUEENS. You CANNOT tell them what to do, nor can you force ANYTHING on them.
The only exception are the engineering professors for obvious reasons they have their shit together. Other faculty are just plain morons and think they can do everything on their own.
Professors and researchers get to buy and chose their own laptops, and they can do whatever they want. Unless they fall under the administration side, IT cannot tell them what to put on or do with the laptop.
Just to get off my chess I'll tell you one of many stories. A faculty member brought in his school paid laptop, and he obviously used it for personal reasons. This is his main work laptop with all his data (again we can't force them to follow our policy since they are not administration), so he has no backups or any antivirus scans.
His laptop had over 5000 viruses when I ran a virus scan. This is no joke, I have the screen shot somewhere. I refuse to clean and told him I will rebuild it. Which I did and put all this files back. I explain to him exactly what I did in an email, what he would lose (software etc) and he was okay with it, remember I have this in email. Only when he agreed did I go ahead with the rebuild.
He comes back and writes an email to the department chair that I had broke his laptop and had to rebuild it. Then I lost his software which he paid for and wants the school to pay for it back.
I almost kicked him in he face even if it got me fired. Luckily my boss stepped in and took care of it.
For the people that say this should be an IT policy issue let me explain to you how academic people work.
Professors and researchers are KINGS and QUEENS. You CANNOT tell them what to do, nor can you force ANYTHING on them.
The only exception are the engineering professors for obvious reasons they have their shit together. Other faculty are just plain morons and think they can do everything on their own.
Professors and researchers get to buy and chose their own laptops, and they can do whatever they want. Unless they fall under the administration side, IT cannot tell them what to put on or do with the laptop.
Just to get off my chess I'll tell you one of many stories. A faculty member brought in his school paid laptop, and he obviously used it for personal reasons. This is his main work laptop with all his data (again we can't force them to follow our policy since they are not administration), so he has no backups or any antivirus scans.
His laptop had over 5000 viruses when I ran a virus scan. This is no joke, I have the screen shot somewhere. I refuse to clean and told him I will rebuild it. Which I did and put all this files back. I explain to him exactly what I did in an email, what he would lose (software etc) and he was okay with it, remember I have this in email. Only when he agreed did I go ahead with the rebuild.
He comes back and writes an email to the department chair that I had broke his laptop and had to rebuild it. Then I lost his software which he paid for and wants the school to pay for it back.
I almost kicked him in he face even if it got me fired. Luckily my boss stepped in and took care of it.
Just wanted to point out, in those situation keeping written records of communications like you did can save your ass.
(1) whatever happened to backups?
(2) the hardware could have failed just as easy as the laptop got stolen who would get the blame then?
(3) I don't buy the premise that there is 'cancer cure data' on this laptop to begin with until after it has been recovered they come out with a cure for cancer within measurable time.
(4) If the data is on the laptop it got on to the laptop somehow, either by doing experiments and recording the data or by copying it from some other medium, data does not exist in a vacuum as it's 'only copy'.
(5) $1,000 reward? really? that must be some crappy cure.
(6) What if the researcher 'lost' their laptop on purpose? That's a stretch, but with a claim this big I'd really like them to get to work on re-creating their miraculous results rather than cry over spilled milk, after all, recreating the results can't be nearly as much work as it was to do it all the first time. Assuming the experiments were real there should be a whole pile of knowledge that only needs to be verified rather than created from scratch so this is just a matter of time.
(7) I had a laptop with the design for a small and safe nuclear fusion reactor, unfortunately it got stolen...
What sickens me most about this whole thing is that the 'cure for cancer' gets trotted out again giving a whole pile of people hope that there is such a thing.
(2) the hardware could have failed just as easy as the laptop got stolen who would get the blame then?
(3) I don't buy the premise that there is 'cancer cure data' on this laptop to begin with until after it has been recovered they come out with a cure for cancer within measurable time.
(4) If the data is on the laptop it got on to the laptop somehow, either by doing experiments and recording the data or by copying it from some other medium, data does not exist in a vacuum as it's 'only copy'.
(5) $1,000 reward? really? that must be some crappy cure.
(6) What if the researcher 'lost' their laptop on purpose? That's a stretch, but with a claim this big I'd really like them to get to work on re-creating their miraculous results rather than cry over spilled milk, after all, recreating the results can't be nearly as much work as it was to do it all the first time. Assuming the experiments were real there should be a whole pile of knowledge that only needs to be verified rather than created from scratch so this is just a matter of time.
(7) I had a laptop with the design for a small and safe nuclear fusion reactor, unfortunately it got stolen...
What sickens me most about this whole thing is that the 'cure for cancer' gets trotted out again giving a whole pile of people hope that there is such a thing.
People need to learn the basics of working with a computer. I can't imagine working for years on an important project without any backup system whatsoever. Getting your computer stolen is only one of the tens of the possible scenarios of things that could happen.
> I can't imagine working for years on an important project without any backup system whatsoever.
I've "worked with computers" since I was a teenager, but for a long time I didn't make backups even though I knew it was something I should have been doing. It wasn't until I actually had a hard drive crash on me that I got backup religion.
I've "worked with computers" since I was a teenager, but for a long time I didn't make backups even though I knew it was something I should have been doing. It wasn't until I actually had a hard drive crash on me that I got backup religion.
I'm in the same boat (still am). I hardly ever back up my data.
My employer though, uses source control rigorously and makes deployment and usage of those tools dead easy. We also have folder redirection possible if you wanted to make your "My Documents" folder available (and backed up automatically) on the network. There's SharePoint too, but sometimes it's a PITA.
My hypothesis is this: Given OU Medicine's student computer requirements [1], I'm betting that these researchers just didn't have the patience or knowledge in integrating a Mac into their Windows-centric network.
[1] http://www.oumedicine.com/body.cfm?id=954
My employer though, uses source control rigorously and makes deployment and usage of those tools dead easy. We also have folder redirection possible if you wanted to make your "My Documents" folder available (and backed up automatically) on the network. There's SharePoint too, but sometimes it's a PITA.
My hypothesis is this: Given OU Medicine's student computer requirements [1], I'm betting that these researchers just didn't have the patience or knowledge in integrating a Mac into their Windows-centric network.
[1] http://www.oumedicine.com/body.cfm?id=954
> I'm in the same boat (still am). I hardly ever back up my data.
How much data are we talking about here? <10 Gigabytes? Solutions like Dropbox are just so simple for data in that range that you'd be crazy not to use them.
How much data are we talking about here? <10 Gigabytes? Solutions like Dropbox are just so simple for data in that range that you'd be crazy not to use them.
The only irreplaceable data I have is photos/videos of the family. It's getting to be about 10 GB - I've got two hard drives in my PC that I'm planning to mirror the data across. At the very least it'll save me from hard drive failure. Theft/acts of god are something I haven't planned for. I have thought about burning a bunch of DVDs (of just the photos) and storing them somewhere else (work/relatives/bank).
I use dropbox to sync passwords and some docs from work/home. I'd like to use dropbox (or something like carbonite) to back up the rest, but frankly I'm too cheap/lazy to go through with it.
I use dropbox to sync passwords and some docs from work/home. I'd like to use dropbox (or something like carbonite) to back up the rest, but frankly I'm too cheap/lazy to go through with it.
10 GB is also small and cheap enough to buy a USB drive for and back it up on. It's what, $10 for a 16 gig thumbdrive or so? Afaik, they also have less concern about bit-rot than DVDs or CDs, not to mention the ease of use.
When you are up against human nature, no amount of learning can help you.
Of course, she knew about backing up, but who has the time to do it? After all, who wants to figure it out, install stuff, port stuff or even choose a service! Who has the time...
Such things really aren't a result of ignorance, but laziness. Yet again are we any different?
Of course, she knew about backing up, but who has the time to do it? After all, who wants to figure it out, install stuff, port stuff or even choose a service! Who has the time...
Such things really aren't a result of ignorance, but laziness. Yet again are we any different?
I would have thought the value of a possible cure for prostate cancer would be far more than $1000.
Was thinking the same thing. Maybe they're hoping the thief doesn't read Hacker News (or CNET) and learn that little tidbit.
The more interesting question, to me at least, is whether or not the U of Oklahoma will be taking some kind of disciplinary action against her.
If she ends up losing the data permanently, that will severely hamper her ability to apply for future grants (which usually require preliminary data), and lose funding. This offense is definitely self-punishing.
That would be absurd.
Why? They are, after all, her employers-- and they've got quite a bit of time and money invested in her research. I have to assume that they have some kind of standards for the care of data, and I certainly hope that keeping exactly one copy of the dataset, without backups, on a laptop which frequently travels out of the lab, is in serious contravention of a number of their policies.
You're making way too many assumptions. You can't fire someone because a laptop is stolen or lost. The University should have provided a means of centralized backup for data.
I am making assumptions. So are you, of course.
I am assuming that the University did provide a means of centralized backup, and she failed to avail herself of it. This is based on the assumption that it is more likely that one researcher screwed up, than that the entire University is woefully incompetent.
Also, note that you assumed that I meant "firing" when I said "disciplinary action." I was thinking more along the lines of a note in her file, and a stern talking-to.
I am assuming that the University did provide a means of centralized backup, and she failed to avail herself of it. This is based on the assumption that it is more likely that one researcher screwed up, than that the entire University is woefully incompetent.
Also, note that you assumed that I meant "firing" when I said "disciplinary action." I was thinking more along the lines of a note in her file, and a stern talking-to.
I'm a student at OUHSC, and her husband, Dr. Janknecht, is one of my professors. Although failing to make a backup is obviously stupid, he is an extremely competent researcher (I don't know her). Clearly, calling the data "a cure" is a bit of hype, but that exaggeration might help in convincing the thief to bring the laptop back.
About computer knowledge in biological research, though -- the state of things is generally abysmal. The average biology Ph.D. can use Excel to find means, SDs, and do t-tests, and that's about it. Even my boss, who specializes in bioinformatics, still uses VB6+MSAccess shudder. Most probably don't know that hard drives CAN fail.
Yet, researchers are fiercely independent and would definitely resist any heavy-handed mandates from campus IT forcing specific OSes or regular backups.
About computer knowledge in biological research, though -- the state of things is generally abysmal. The average biology Ph.D. can use Excel to find means, SDs, and do t-tests, and that's about it. Even my boss, who specializes in bioinformatics, still uses VB6+MSAccess shudder. Most probably don't know that hard drives CAN fail.
Yet, researchers are fiercely independent and would definitely resist any heavy-handed mandates from campus IT forcing specific OSes or regular backups.
So _this_ is why cancer hasn't been cured yet. Gotcha.
Not really, but kind of... the person doing Cancer Research (or other work that is socially/culturally critical to the world) who did not back up their data should be held criminally responsible.
Not so interested in the punishment as the (possibly non-existant) deterrent effect such laws/prosecution would have. It's fucking ridiculous that in 2011 people are still not backing up their data.
Not so interested in the punishment as the (possibly non-existant) deterrent effect such laws/prosecution would have. It's fucking ridiculous that in 2011 people are still not backing up their data.
No idea why the parent got downvoted twice (i upvoted to counter one of them). If (and I sincerely doubt it to be the actual case, but the story suggests it is) the researcher is doing paid research and not backing it up at all, those involved in process design (or the researcher themself if there was adequate and clear process guidelines) should be held responsible for some kind of recklessness bordering on fraud. After all, they cannot prove that they have actually done any research right now and someone could similarly take millions and just "lose a laptop". It is comparable to not keeping proper financial records which is typically criminal.
Time Machine. It works.
I was really unimpressed with Apple's Time Machine. Did you know it only goes backwards?! Lame. (Humor aside, it's actually quite well engineered.)
Spideroak.com works too. It automatically backups your data to the cloud (securely encrypted!). It synchronizes your data across multiple machines (and multiple OS) and you can access all past versions of your files. It's free if you don't need more than one or two GB. It's the ideal backup tool for researchers that don't generate tons of data and want a simple backup solution.
..and, by the way, there's an automatic 50% discount for anyone with a .edu (or similar) email address. :)
This kind of thing makes me wonder... how long until backups are mandatory. I mean, in Windows 10 or OS 11 (aka: IOS 5), will it just come with 10 or 20gb of online storage that's automatically backed up, without the user's input (and is difficult to disable)?
We already have crazy easy backup solutions like mozy, carbonite, backblaze etc but the majority of people don't use them. What happens when the OS makers force you to back up?
And yes... it is totally the IT people's fault for not forcing backups on their users. Sorry but as an IT guy (I am one) it's your responsibility to make sure your users don't get into this kind of a situation!
We already have crazy easy backup solutions like mozy, carbonite, backblaze etc but the majority of people don't use them. What happens when the OS makers force you to back up?
And yes... it is totally the IT people's fault for not forcing backups on their users. Sorry but as an IT guy (I am one) it's your responsibility to make sure your users don't get into this kind of a situation!
I wouldn't be surprised if the owner _deliberately_ didn't create backups.
I used to work in academia. Some of the academics I knew were extremely paranoid about anybody (including SysAdmins) accessing their research. They would go to great lengths to to keep their work away from the "prying eyes of the university" (a phrase someone used once). This meant not allowing any access to their personal desktops, laptops, etc. Admins worked around the personal desktop issue by refusing to help them with the inevitable problems unless they got access. But laptops were a different story.
I used to work in academia. Some of the academics I knew were extremely paranoid about anybody (including SysAdmins) accessing their research. They would go to great lengths to to keep their work away from the "prying eyes of the university" (a phrase someone used once). This meant not allowing any access to their personal desktops, laptops, etc. Admins worked around the personal desktop issue by refusing to help them with the inevitable problems unless they got access. But laptops were a different story.
This is actually the plot of Johnny Mnemonic. I can't believe anything about that movie's plot turned out to be realistic.
It should be: "Stolen laptop may contain cancer cure data"
If you buy a car, it comes with seat belts. Safety is not optional - it's built in.
If you buy a computer, safety of your data is seen as a luxury add-on, like leather seats.
It's crazy when you think about it.
If you buy a computer, safety of your data is seen as a luxury add-on, like leather seats.
It's crazy when you think about it.
It was a Mac, which most likely came with Time Machine - all she had to do was connect a USB drive (as far as I remember, OS X even asks if you want to use the drive for backups) and she would have had automatic versioned backups.
To be honest, I think most people need backing data up scared into them (e.g., I nearly lost a college project due a HD failure, and now I have multiple redundant backups).
To be honest, I think most people need backing data up scared into them (e.g., I nearly lost a college project due a HD failure, and now I have multiple redundant backups).
But you still need to put the seat belt on! If you don't, your safety is compromised. So it's really up to the driver...
Both Windows and OSX come with built in backup software, but no one can force the user to use them.
Did they set up DynDNS by any chance? http://www.youtube.com/watch?v=U4oB28ksiIo
Doh! Now where did that cure for cancer I had lying around here go...
Step 1: Dropbox.
Mozy, anyone?
sounds like ouhsc.edu needs to go google!
I find it hard to believe that someone with the possible cure to cancer wouldn't bother backing it up. If this is legitimate, I think it's beyond irresponsible. Also, why such a minimal reward?
Probably because it was coming out of her own pocket, and researchers generally don't make that much (especially if she was a post-doc). I'm pretty sure that the NIH won't let you charge "stolen laptop reward" to your grant, and your university sure as heck isn't going to shell out for something like that.
Perhaps the "cancer cure data" claim is a huge exaggeration by Mrs Shin to help get her laptop back. You'd expect someone to value that at more than USD 1000.
We're blaming the user for our mistake. That's like blaming the cow for leaving the pasture because one of us forgot to lock the gate.
The simple fact is that this user should have never been able to be in a position for this to happen.
Where were the IT security policies and procedures? Why was mission critical data on someone's c: drive? When (if ever) was the last audit?
We curse enterprise IT departments because they are so slow at getting things done, but they are really, really good at putting in place the things that would never allow this to happen. I have customers with strict policies regarding the protection of mission critical data, and I bet that none of it is as important as what was routinely put onto this laptop and paraded around town.
Public companies are responsible to their shareholders and the SEC. Private companies are responsible to their investors and creditors. Why weren't the same protections put in place to the trustees and taxpayers in this case?
Every nanosecond this researcher has to worry about performing routine IT overhead is a nanosecond not spent on critical research. The technological solutions to problems like this have been around for years. Why weren't they in place?
It's about time for IT to stop blaming the user and fix the problem.