I recently blogged about the Judge Rotenberg Center and a few employee’s and ex-employee’s came to offer their opinions that it was OK to inflict pain on people until they did what you want.
Like most quacks, they failed to show any evidence that their way was any better then a non-pain inducing methodology so one was left with the conclusion that they used pain as a tool because it appealed to their natures as people.
Anyway, I’ve been taking a long hard look at the JRC website and received a bit of information which led to what I believe is a breach of US law governing personal data and data protection issues.
I’m going to have to talk broadly here as I don’t think it would be ethical for me to show you exactly what steps I took to stumble across this data. However, not only are the full names of all current staff members on public display, there are documents I’ve found which contain a full listing of all current students, represented by initials, together with details about which schools/units they’ve attended prior to JRC. There are also documents which mention at least 4 students full names, together with photographs of these students.
Let’s also be clear that the method I utilised to get to the data under discussion did not in any way reflect any hacking, cracking, injecting or otherwise any unethical practices. It came from a chance mouse click and some really dreadful .NET coding on behalf of the JRC’s web developer(s).
In the US it is the Dept of Health and Human Services which have governance over the regulations that dictate what is legally acceptable and what’s not under HIPAA.
From the HIPAA site:
Generally, what does the HIPAA Privacy Rule require the average provider or health plan to do?
For the average health care provider or health plan, the Privacy Rule requires activities, such as:..[]…Securing patient records containing individually identifiable health information so that they are not readily available to those who do not need them.
It seems pretty clear to me (but remember I’m not a US citizen or overly familiar with the intricacies of US law) that the posting of student personal data on an insecure web server where it can be accessed by a chance mouse click is a clear contravention of the above legal guideline.
I posted what Id found to an American friend I trusted and this person was able to replicate what I’d done and was also presented with the same confidential data. As an American citizen my friend is free to make a complaint following the process outlined here and in fact I understand this process is underway. The official complaint contains full details of how the data was discovered and exactly which data it was that was found.
Upon checking the source code of a few pages (the source code is the code that a web page is written in) I was shocked to find the following statement:
<!--#include virtual = "connectDB.asp"-->
I have altered the path and file name referred to but essentially this file is used to declare a connection to an online database. I now knew the exact path to the .asp file that contained the database server name, username and password which means that it would not have been to difficult, if I was so inclined, to connect to the JRC online database. I was _not_ so inclined and so I have no real idea what’s in the database but I would imagine it would be pretty important stuff. It’s also further illustration of the woeful state of the security on the JRC website.
Student safety is paramount and so if any JRC staff are reading this, please email me and establish exactly who you are (no anonymity allowed) and I will tell you exactly how this confidential data was accessed. I’ll even make a few suggestions as to the nature of the coding error and how you might fix it.
I don’t suppose this breech will result in JRC getting shut down but I think it will ensure the close attention of data protection specialists and probably ensure a hefty fine. Here’s hoping. I’ll keep this blog up to date with how the complaint goes.
Left Brain Right Brain 
ouch.
Shows the sort of ‘care’ they take with things…
Use of GED *in wet conditions* – despite the safety hazards involved in that…
… and now *this*.
Pathetic place.
I e-mailed the NY Board of Regents about the Web Security June 22. Mr. Phillips responded and said he would take care of things. I will send you all of the contact information via e-mail.
Also, you might want to forward this information with the real path to each of the members of the out of state placement committee. I will send you this as well.
The other thing that one of your contacts in the US should do is put the Board of Directors on notice. This will put them personally in the liability link.
What is the JRC to do about this? I think they might have their .NET developers wear one of those backpacks that give shocks (can’t remember what they are called). Surely that should motivate them to write more secure code.
Good job finding that out, Kev.
There called GEDs.
I’m sure they wouldn’t after all the technical staff are REAL people with actual fellings.
A member the Board of Regents and two of the members of the Board of Directors have been directed to this site.
JRC’s sites should be shut down immediately, pending a complete, independent, review of security. I have told them of the problems I found. And even if Kev tells them of the problem he found, I there are not guarantees there are not others.
There is a fundamental flaw: The secure site can be accessed from any computer on the INTERNET and there is no meaningful security. I am sure it would have taken less time for Kev to hack in than it took him to find the flaws he describes here.
Best is, Jackie… Kev didn’t even need to hack the site to discover how shitty the security is there! The site is just *that* insecure…..
Will the private information that was on the site be available in web archives?
Possible but not likely.
The web archive is basically a web spider/robot and these scripts require links to go fetch content.
The area in question on the website is in a frameset and is further a scripted environment meaning there’s no _direct_ access to those pages. There would need to be a user involved 🙂
Lest I be criticized for remaining silent on this one too:
Good work, Kev.
It looks to me like the site is still wide open. I guess the techies are not available on weekends, or maybe Matthew Israel is in Paris with a girlfriend. He needs his rewards, too. He’s such a hard worker. (ick)
Hey, maybe the techie is on the spectrum and left it wide open as a way of exposing uncle Matty. Maybe the techie is not answering the phone now.
Al Capone was brought down not for gambling, bootlegging, prostitution, or murder, but for tax evasion.
Wouldn’t it be ironic if the coup de grâce in this case was delivered not as a result of electric shocks and other sickening activities, but due to failure to protect confidential information?
If you check the job postings on the JRC web site, you’ll see they are looking for a Director of Information Technology. Based on what Kev has found, the job has been vacant too long.
I’m very familiar with HIPAA rules and their application in IT. The HIPAA rules typically don’t apply to schools, but I’m sure the JRC meets the definition of a Health Care Provider. Their mistakes on their website are ridiculous and make their developers look very ameteurish. They’ve comprimised the privacy of their clients. That’s a pretty big deal in the IT world.
I’ll leave others to comment on the rest of their staff.
Ian,
It’d be very ironic indeed if that aspect of the JRC’s whole set of piss-poor excuses for existing brought them down. Personally, I want to see the whole shit-bucket fall upon them 🙂
Kev: The schools/units in the document you found have an interest in correcting this problem. Maybe they should get the e-mail.
Does the document provide enough information to fully identify the institutions?
Microsoft has standards for security in .NET – security is a main selling point. It is inconceivable that anyone who took the time to learn enough .NET to put together the site would have done the things the JRC programmers have done.
Since JRC publicly published all of the user names, when they fix the site they must assign all new names and passwords in order to make the site secure.
Does anyone disagree?
There are difficult HIPAA issues at JRC.
The philosophy of HIPAA is that if you don’t need to know, you aren’t entitled to know.
JRC has 250 students in over 40 residences and hundreds of staff. Most places I have seen, staff stays with a small subset of the student population, so most staff only has access to maybe 30 student records.
At JRC, staff/student relationships are actively discouraged and staff is moved from group to group frequently. On any given day, staff member may end up interacting with any of the 250 students. This means that most staff member must be given permission access to every student’s records.
And all of the records are on the computer system…
While HIPAA doesn’t directly apply to schools, FERPA (Family Educational Rights and Privacy Act) does, and what Kev’s found appear to be flagrant violations of it.
What such frequent switching of staff and students does is to prevent the formation of any kind of relationship. It prevents staff members from gaining a personal understanding of a student, thus being able to individualize attention and build trust. There are only so many individuals a person can become familiar with in their “village” (sociologically speaking), and seeing any of 250 students for a few days at a time doesn’t provide that opportunity. Such a system keeps the students as interchangeable, generic units.* History has too many examples showing that when people are not individuals whom you know personally and see regularly, it is hard to develop empathy and they are more easily used and abused.
This system also prevents staff from being able to gain a sense of a student’s change over time, physically and psychosocially. It’s much more difficult for staff to be cognisant of a student’s particular needs as someone who is bipolar, autistic, suffers from PTSD or depression, is hard of hearing et cetera. Having records in a datafile somewhere may make the information available to lots of people, but that’s not the same thing as individual staff members being able to be familiar with the information for all the students under their care. Data and information are not equal things. Charted scores on offences observed and punished, and the resulting graphs of data are no substitute for seeing a person regularly and gaining a qualitative understanding of who they are and how they function. Minimal time spent with a student also means minimal information on a such charts, because extra information may not be recorded if someone hasn’t been following a case well enough to know to observe for anything beyond the required data.
This system also depersonalises the members of the staff, and deprives the students of appropriate role models and of mentoring. Instead they get rote lessons on computers, a system constantly focused on what they do rather than why, and the stifling attentions of Big Brother. We want our children to become thoughtful adults, meaning able to act appropriately to the situation, to be considerate of others and able to think independently. This kind of situation doesn’t allow that. http://qw88nb88.wordpress.com/2006/07/02/making-sense-of-rules/
andrea
* Little flashbacks of, “We are the Borg. Resistance is futile.”
Every student is a patient at JRC. HIPAA does apply.
The site is still wide open. No rush to create some security or privacy there. I guess.
Andrea,
I agree, this is a way of depersonisling the kids so the GEDs can be delivered swiftly.
Shows how much they care about “helping” the kids. Most therapies a relentant on the affect of patient to teacher/therpist relationship.
That relationship does not exist here. The Kids/teens will change only to avoid punishment not to gain apprasial from a respected figure (something that is a much greater motivater than pain).
You can’t just use pain as encouragement IT NEVER WORKS thats why americans can’t preform peace keeping. Negatvive reinforcement just models negative behaviour.
These guys/girls are going to grow up into trumatised and spiteful adults.
P.s. Hey Kev do you thing the ND movment could get dispatches (channel 4) to investgate the unethicality of autism treatment?
“Hey Kev do you thing the ND movment could get dispatches (channel 4) to investgate the unethicality of autism treatment?”
Now *that* would be a massive coup if we could do that. Any idea if it’s at all possible?
I filed a report to the Office for Civil Rights (Dept. of Health and Human Services) regarding the open content of the JRC website and HIPAA violation. Feel free to do the same.
http://www.hhs.gov/ocr/hipaa/
http://www.hhs.gov/ocr/privacyhowtofile.htm
Well i was talking about it with my friends ever since i first learned of the centre.
If everone just sent one E-mail each requesting an investigation then they sould respond if they believe it is an area of hot interest.
If we could get an experianced journalist (NOT KIRBY!) to agree to do the show then they might just do it.
Kev you would need to provide alot of the information as you always seem to be “first of the bat” with this stuff.
I do think that if enough people got involed we could get channel four to do it.
The site appears to be offline. Or more accurately, for those into the technical details, the domain records for judgerc.org and judgerc.com appear to have been removed from the designated name servers.
I don’t think ‘Dispatches’ would be interested as its a UK program and JRC is US based. I don’t know what US based investigative shows are around.
The website looks like it has, for me, it’s still got that glitch (methodology edited by Kev ;o) ). I don’t know if the list of all employees is still available…
Ms Clark: I don’t think kev is talking about the public site. They did remove both lobbying files from the public site last week.
I had that nightmare again last night.
A small, autistic boy cowers with terror when his father picks up the car remote…
Nathzn: “Negative reinforcement just models negative behaviour.”
Not quite.
Negative reinforcement isn’t punishment, and what you would seem to mean (based on my training as a psychologist) is that’ *punishment* just models negative behaviour’ … which would be entirely true.
The difference between negative reinforcement and punishment is that, in negative reinforcement, the noxious stimulus is removed when the desired behaviour is engaged in; whereas, in punishment, the noxious stimulus is applied upon engagement in an non-desired behaviour.
An example of negative reinforcement would be the withholding of a university degree until a graduand’s debts to the university had all been paid. An example of punishment would be the rescinding of one’s university degree upon engagement in behaviour which brings disrepute to the university which awarded it (as can indeed happen; the UK’s Open University has powers to do this).
I wonder if JRC has Disney’s OK to publicly use its “Mickey Mouse” for marketing of their house of horrors.
http://www.judgerc.org/Photo_Tours/mickeyrm.html
I will send them an e-mail.
Social Policy on the use of Aversive Interventions: Empirical, Ethical, and Legal Considerations.
Peter Gerhardt, David L. Holmes and Michael Alessandri, Michele Goodman
Journal of Autism and Developmental Disorders Vol 21, No. 3, 1991
Everyone should read the Ethical, and Legal Considerations
Pages 270 – 274
(Pages 111-115 of the PDF document)
Click to access 14_papers.pdf
These documents are published by JRC to support its use of aversives.
I find they condemn JRC.
In response to Kev’s question about US investigative shows, one of America’s most well-known TV investigative journalists, Geraldo Rivera, recently filmed a segment about the JRC controversy and had this to say:
To me, this is like the collars we put on dogs to keep them on the property. The dog wanders; it gets shocked. And that is the issue: treating kids the way we treat dogs or cats. It’s only a pinch they say. But it’s a pinch, just like the one used by the Dog Whisperer. In my opinion, the NYS Board of Regents was absolutely right to restrict these treatments.
http://www.geraldo.com/index.php?/archives/113_Assisted_Suicide.html
Jackie: Disney has a reputation for being extremely tough on anyone who uses its intellectual property without permission. Good call.
While I agree with Geraldo’s statement – it does remind that the next time I see him I must ask if he ever did find Al Capone.
When reading
Click to access 14_papers.pdf
remember ‘BRI’ is the old name of ‘JRC’.
You should also read the comments after the article as well.
Here is another document on JRC’s site which raise questions:
Click to access GuidelinesforEffectiveBehavioralTreatment.pdf
JRC is monitoring this site. The file was removed within 20 minutes.
(I got the document by using the advance search in Google for pdf files on ‘judgerc.org’. When you see a file ‘Unnamed.PDF†you know it is worth a click.)
The Document is a resolution from APA Division 33.
“Guidelines for Effective Behavioral Treatment for Persons with Mental Retardation and Developmental Disabilities”
Their home page is
http://www.apa.org/about/division/div33.html
I will say, that since they removed the file, it made me take a close look. It puts forth exactly when and under what conditions the APA might find the use of aversives acceptable.
This is the most damning thing I have seen.
http://www.apa.org/divisions/div33/effectivetreatment.html
If anyone is a member of the APA they should direct Division 33 to this site.
You don’t have to be a member of APA to report unethical behavior on the part of a psychologist/psychiatrist, at least that’s how I remember it.
Thanks for fixing my overdetailed description of the glitch on JRC. I havent’ checked it lately. Is it still wide open?
This will be my final entry.
JRC, Board of Regents, Out of State Placement Committee, APA Division 33, JRC Board of Directors, and Reporters are all monitoring this site.
And I will start with what I said on Mike’s blog – and Kev picked up on his first JRC blog – and is detailed by the NYSED report:
‘However, the worst punishment is when food is withheld from a child for bad behavior. Every child’s behavior deteriorates when food is withheld so JRC becomes directly responsible for the behavior for which the child is being punished.’
Withholding food is not an aversive under “Guidelines on Effective Behavioral Treatment for Persons with Mental Retardation and Developmental Disabilities”. Let me go through it requirement by requirement.
“1.Determination on the basis of the professional and scientific literature of the probability that a specific technique will be appropriate for this particular behavior and individual.”
There is no scientific studies on how withholding food improves someone’s behavior.
“2.Determination on the basis of behavioral assessment of the probability that a specific technique will be appropriate for this particular behavior and individual.”
Does anyone think this can be done with withholding food?
“3.Determination on the basis of peer and human rights review procedures and guardian approval of the appropriateness of the specific techniques for the particular behavior and individual. Participation of the client will be secured in accordance with the Standards for Providers of Psychological Services.”
Can anyone argue that withholding food does not violate ‘human rights’. Has there been any peer review?
“4.Determination on the basis of continued monitoring of whether the intervention should be continued, modified, discontinued, or supplanted by a different intervention. Such determination shall be rendered on a periodic basis as determined appropriate by the practitioner or required by programmatic policies or consent obtained or agreements during the course of due process.”
There are lots of graphs about the GED effectiveness but not one about the effectiveness of withholding food.
“5.Determination of the success of a treatment procedure shall be rendered with regard to an array of criteria.”
Data?
To conclude: No need to argue the contrivertial GED’s when starvation is held out to be theropy.
It’s past time to shut that place down. Isn’t there a Geneva convention or something that comes into play here? It would be good if the authorities would put uncle Mattie on a starvation diet in solitary confinement somewhere. GED devices might be helpful in training him to like starvation.
All – it doesn’t matter if the source PDF’s are missing. Try either Google’s cache and if that doesn’t work click the ‘convert to HTML’ link – that will work most of the time.
Mom sues over electric shock
Thanks for the link, Anne…
Sadly… I don’t hold out much hope. The JRC has too many friends in high places. That Flammia guy seems a callous and heartless bastard, too. He’s more of a spin merchant than lawyer.
From another story on the same site:
“The GED device was developed and patented by Israel, who earned a doctorate in psychology from Harvard University. Israel doesn’t market the device outside Rotenberg, he said, because he wants to ensure it’s used properly.” (quoting Matthew Israel)
So, the proper use of the GED includes the use of an electrical device in situations involving water, then?
This just added to You Tube two days ago, put out by AutTV:
Human Rights Abuses at the Judge Rotenburg Center:
instead of judging that school…there are better things to debate….like the poison chemicals that they are using in our foods…everytime you turn around there something new and improve this or that….soon we will have computer implants inside our body to do simple things like talk on the phone…the society as a whole is going downhill and no one is noticing we are getting immune and wonder why there are so many cancers,obesity or new health diseases…..people are working more and spending more money on nothing…family values and family time are dissappearing in the human socialization and interaction….well now even our pets are coming up with all kinds of human disease it is the food ….and false advertising to make the rich richer and poor poorer…they dont care about the truth only the $$$$$ matters….while we are slowly dying…i hate it like artificial sweetners small doses proven to cause cancer in lab animals…well we got artificial in everything which of course can add up to large doses overtime,,,but no we are blind to think we are eating healthier by choosing sugarfree, low sugar etc……../if the parents sign to let their child attend the school then it is their choice mind your own business….find another important issue to debate….people always think that they know it all untill you are in their shoes and walking not on the outside looking in keep your 2cents to yourself and stop spreading or repeating things that you dont understand or know first hands….they have camera everywhere and justify every GED…they dont just GED to be GED….they have to account for every action….other places uses people to change their behavior that may seem inhuman but if it works it works….nursing homes..neglect,hospital are the biggest killing people poor get poorer and rich gets richer…why is it that they charge like 50hr for a visit that last less than 15 minutes of a dr. time and like a 2hours wait time……..why do auto mechanic charge like $75 hr for labor and the part is like$20……..why are teachers paid so low? and are motivating the future investment…..find a better mature issue to debate leave that school alone……just like a a parent wish to raise their own child with a certain type of discipline let them so long it is not hospitalized abuse………..people complain about child spanking and always ignore the long term everlasting verbal emotional or neglectful abuse that a child can face that is much more harmful than a spanking……..complain about the rental cost for a tiny old dilapated apt buildings that charges the cheapest for a 1bdr rental is like 800 a month not including utilities….only single people can do this and they are living paycheck to paycheck to do this….or it takes two incomes working two jobs if you have kids to raise…..why are people paying more than 30% of their income on rent………poor gets poorer and rich gets richer….same deal with state taxes…..why are there so many potholes still messing up people cars and then it’s a cycle of paying money for car, cause you got to use it to go to work to pay your rent,living food expense etc and you have to pay your hospital bill even the dentist,eye dr…everything is sky high….can goods use to be like 4 for $1….now we are brainwashed and immune to believe that 10 for $10 is a good sale on can goods and then the coupons are now like buy 10 get one free….every 3months dunkin keep changing their prices…oh its only a few cents increase but it adds up. coffee use to be like 50 a cup hot dogs like 50cents a doughnut 25….if the inflation of things go up then the salary and wages should also too…..how on earth can anyone live on minium wage…then we wonder why there is a crime problem or drug problems…poor people get poorer and rich gets richer…..
then there is the digital divide….the have and have nots….which usually translate if you are not white your chances of being discriminated against in getting a good job or anything in life is diminished because of racism…..people think people from a certain background are good or bad…..people should stop being scared judging and flapping their tongue that is how we got the holocoust,and other mass human genocide and unfair equal treatment…you think today racism doesnt exist ha ha ….acording to who…
everyone has loop holes that you can have errors and get data…stop it. no one is perfect. stop trying to find something if you do that will only make them better so then thanks for your help…you negative bitter person thinik of something important to btch about…….katrina relief if it was rich people guess how much help they would have gotten…….for real 2006….poor get poorer and rich gets richer….stupid people stop spreading their opinion sometime people hear an untruth so much that they believe it and take it for a fact…look at some of the rumor, sterotyope and false belief their are abouot people who are different from you tht you dont understand that you believe. and label and judge….stop it think of something more important……we are all dying the government coverup and media influence….think for yourself. dont just repeat others fears…..thanks
The above lucid and fascinating comment came from someone in Framingham MA – within spitting distance of the JRC.
Uh, yeah. I don’t think anyone could have confused her with the other Amanda 😉
A blogger called Ann has been posting this question
ann Says:
August 4th, 2006 at 2:50 pm
I had one more thought that I keep forgetting to mention when I post in these blogs.
For the people that are so vehemently opposed to skin-shock, do you also believe that police should not be allowed to use tazers?
Just curious what your opinions are on that thought.
My reply follows;
Ann Your thought about the TAZER is interesting. Are you implying thet the GED is equal in power to the TAZER (which death has resulted in after its use) and can also cause skin burns? If that is true then how can you use a device that was created to controll exrtemly violent crminals or drug addicts, change it’s look and call it a GED and say it is OK. Also how can you compare the actions of the mentally ill to exrtemly violent crminals or drug addicts. To have this point of view and work in the field of handicapped children is very scary.