Google Drive Vulnerability

I just learned of a malware exploit that can permanently destroy files saved in a sync folder attached to Google Drive -- encrypting the files on the cloud with no backup.

Details:
A relative received a spear fishing email that induced him to open an attachment. The malware proceeded to encrypt files on his local drive, most of which were in his Google Drive sync folder. He soon realized the problem and shut down the computer, but not before it had encrypted many files. 

On logging into his Google Drive from a browser on another computer, we found that many files in the cloud were encrypted. When inspecting them for versions (within 24-36 hours of the attack) – there were no previous versions. There were no copies of the files in Trash on the Google Drive. We contacted Google, whose technician reported that there had been no files permanently deleted from Trash in the last 25 Days! Thus, the malware attacking the local sync folder had succeeded in not merely encrypting the local copy, but reached into the cloud and removed the cloud version of the unencrypted file in a way that did not allow its recovery. (Alternative interpretation might be that Google has a way of recognizing when you encrypt a file and removes the unencrypted version as a security feature – but does not log this event.)

The bigger issue is that Google has no way to restore the drive to a previous time point. Had these files been on an old fashioned network file server that was backed up to tape each night, an archived time point could have been restored. Apparently, this is not possible with the cloud as offered via Google. The problem has been escalated at Google to a second level and we hope to hear back in a couple of days. I’m not expecting much.

What can you do to avoid getting the flu?

Here I am talking with Ray Suarez on HITN listing the basic stuff -- we don't know how flu is transmitted, so if you want to reduce your chances 1) wash your hands frequently (and don't touch your face), 2) stay as far away from sick people as possible, and c) wear a respirator if you have to get near sick people. Also, keep the windows open or otherwise get as much dilution ventilation as possible (either outside air or HEPA filtered air unless you have very special UV lights).

Why EVERYONE who can should get the swine flu vaccine

Here are my thoughts, as expressed to Ray Suarez on Destination Casa Blanca, back in December. What you don't see here is that I was responding to comments by another panelist who argued that it is really just an individual decision -- I should take the shot only if it is good for ME. Good old American Me Me Me. No though of my children, my grandparents, much less my neighbor.

House Overwhelmingly Rejects Goldstone Report On Gaza War Crimes | Media Matters Action Network

House Overwhelmingly Rejects Goldstone Report On Gaza War Crimes | Media Matters Action Network

Posted using ShareThis

The Starr, Reich, Kuttner Debate on Health Care Reform

If these three cannot agree ... how can we expect Democrats in congress to sing from one score?

I tend to agree with Kuttner. The public option gets weaker with each day, increasingly more complex (and hard to understand or sell), and easier for insurance companies to game. We need to get some single payer skin in the game -- that could keep the public option honest.

I'm having to choose new insurance plans for Diane and myself in Maryland. I note they all have a "lifetime cap" -- so if either of us gets AML and needs a bone marrow transplant -- tough cookies. I'm not happy with my medical insurance options. I doubt any survey that says most people are.

Preventing AIDS in Iran is a crime

Besides the terrible news of recent HSPH grads being given years in prison, accused of being US agents because they are using proven public health measures to prevent the spread of HIV, this article is interesting for its note that WHO claims that Iran has the highest rate of heroin addiction in the world. I suppose living in a theocracy is tough -- many need an escape.

Swine flu -- What to do?

The CDC recommendations are very good. I have only a few things to add -- open the windows and if you are infected or could be infected, wear a surgical mask to protect your friends and family. Our research shows that surgical masks partially limit the shedding of virus into respiratory droplets. There is a lot of debate in the scientific community about whether influenza A viruses are transmitted by fine particle aerosols or just by large droplets and touching. It is time to be prudent -- consider aerosol transmission likely and take steps to limit it.

1. Open the windows at home.
2. Maximize dilution ventilation in mechanically ventilated buildings
3. Hold classes and religious services outdoors when possible.
4. If you have contacted someone with the flu, wear a surgical mask to limit spreading it to your family and friends.

Good sources of reliable information
For parents: http://www.cdc.gov/swineflu/parents.htm
In general on pandemic flu: http://www.pandemicflu.gov/

AIG Bonus for Failure

The idea that AIG cannot legally get out of contracts to pay bonuses argues strongly that it is high time that this company, already 80% owned by the US Govt, be forced into a govt supervised reorganization - bankruptcy. That will quicky solve the problem of bonus contracts.

The Profzi Scheme

Anyone with a guess what the pay lines will be on the new Recovery RC1 applications at NIH?

Health Care and Competitiveness

Greg Mankiw claims that transferring health care costs to a national program will have no effect on US corporate competitiveness (especially GM) in the long run because workers eventually pay the costs anyway. So, if they pay the cost by some alternative method, they then (in the long run) ask for more in wages. This argument misses a couple of important variables by assuming that employer provided private insurance and a national health insurance program are equivalent goods with similar costs and values.

1) The value to the worker of a given quality of health care is the same, whether it is purchased in efficiently through a private insurance scheme or efficiently through a national or regional (e.g. Canadian) system.
2) The value of health care coverage to the worker is greater if it not dependent on continued employment with a single employer.

Therefore, if workers get greater value by having health care coverage not linked to their employer and that greater value comes at a lower monetary cost -- their demands for additional compensation in the long run will be less than if they were getting inferior health care at a higher cost from the employer. Thus, Larry Summers is right and Mankiw and Elmendorf are missing the point.

Hawaii Island of Oahu Without Power

The power company rushed to give Obama an emergency generator to get him though the night. Doesn't this once again illustrate the need to bury our power lines? First New England, now Hawaii. Above ground power lines are a problem everywhere. Let's bury them as we dry to dig out of the financial crisis. Now that Obama has a recent personal taste of the issue, even if quickly ameliorated, maybe he will be motivated to add this to his stimulus package.

Ice Storms and Fiscal Stimulus

New England still has 100,000 homes without electricity a week after an ice storm. People are missing work and school and much time and money is going into putting the wires back on the poles. This happens every year, maybe not on this scale, but every year thousands lose power due to winter storms. Why are we not burying the wires?!

There's a job that could employ many now and improve economic efficiency in the future.

Here's what a good bike rack looks like

David Wegman, A Moment to Reflect Along the Way

Last night we honored David Wegman's many contributions to Occupational Health including especially his visionary application of the Nordic model to the United States, by creating a Department of Work Environment at the University of Massachusetts Lowell. It was a wonderful evening. With much humor and great stories. Central to it all were the roles played by David and Peggy's children in their presentations, and recognition of the central role Peggy Wegman played in all of this.

An ice storm canceled the afternoon session, so we were not able to formally present the many awards, including citations by the Governor, State Legislature, and even the U. S. Defense Department. But, my favorite story was about that DOD award, from an ergonomics grad of the program, who also sent a picture of he and his comrades waving from an ergonomically designed tank. To which Greg Wagner replied --"Tanks but no tanks."

Impact Factor

Thanks Greg Mankiw for this.

Conflicts of Interest and IRB Reviews

I'm reading the AAMC document referenced in a conference call yesterday about the case I discussed here a few days ago. The document clearly lays out the rationale for a rebuttable presumption against doing research where there is an individual or institutional COI. Appendix B gives helpful examples of how and when conflicts might be managed and the research allowed to proceed, and when the presumption should prevail. The document does deal with the early stage research issues I raised during the call.

Overall, the document is helpful -- but it only goes so far. I think it misses one of the most important conflicts of interest, the investigator's interest in publishing. This conflict is well known, is a major cause of misconduct in research, and has existed for a very long time.

Eventually, the COI process needs to grapple with the fact that researchers have vested interests in making findings and publishing their work. Publish or perish is well established. Thus, all researchers have a financial interest in making discoveries that they can publish to ensure their own job security. While job security issues apply most acutely to junior faculty, even tenured faculty have an interest in publishing so that they can get future grant funding and increase their social stature. Therefore, the logical extension of the COI recommendations is that there should be a rebuttable presumption against anyone doing any sort of research which they intend to publish. Only research done for purely personal enjoyment, by persons who are independently wealthy, should be allowed without prior approval of the institutional COIC.

Of War and Peace and GDP

Paul Krugman comments on an argument by Mark Thoma, Bob Hall and Susan Woodward, wherein Krugman asserts that the military spending resulted in a one-for-one effect on GDP during WWII because of rationing. But, Thoma et al., also look at the Koren War and see a similar effect. Now, I was born during the Koren War, so I have no direct memory of it. But, as far as I know, there was no rationing during that one. So, maybe there is more to this than Krugman allows.

Still the argument that infrastructure spending is equivalent to military spending seems a big stretch. I don't know of anyone who can use a tank or cluster bomb to increase productivity. Making stuff that is then only useful for destroying things and killing people somehow doesn't seem equivalent to building highways, mass transit, or electric power generation and distribution systems.

Conflicts of Interest and IRB Reviews

As an IRB Chair, I'm confronting how to deal with conflicts of interest (COI) on the part of a researcher proposing a human subjects study. The physical risks in this case are minimal. But, the population is vulnerable and the main risk is that bad science could be misleading, causing subjects to spend their money on useless products. The project could raise unfounded hopes, or make important discoveries.

The initial response of the IRB and the institutional committee on COI was to require disclosure. But, this does nothing to protect a desparate patient. Management of the COI is needed. Once that is done, what the subject needs to know is that after considering the management steps, that the IRB approves of the study. I've come across this helpful document on COI from the National Human Research Protections Advisory Committee (NHRPAC) -- a letter from the committee regarding how to deal with COI in human subjects research.

Particularly helpful are the following statements (emphasis added):

NHRPAC would advise that in a research protocol in which an actual conflict of interest has been identified in the financial disclosure process, subjects could be advised in the informed consent process (and/or in the form itself) of the possible conflict and the nature of that conflict, with the terms, conditions and extent of disclosure calibrated by the conflict of interest committee and the IRB to correspond to the level of risk that the possible conflict poses. Conflict management strategies should also be disclosed, so that research subjects have general knowledge of the conflict of interest identification and management processes, and how those apply to the study in which the subjects is considering her enrollment. Conflicts management strategies may include, for example, mandating independent monitoring of informed consent, outside evaluation of subjects’ eligibility for a trial, independent review of adverse events reports and research records, and peer review of data analysis and interpretation.

The NHRPAC gave an example of a disclosure:

Every research scientist and physician at Mercy Hospital, and Mercy Hospital itself, must disclose significant financial interests in private companies or entities that may be related to this research study. Our Hospital committees have reviewed this information and have concluded that there are some financial relationships between the researchers or Mercy itself on the one hand, and the company that is funding this research, on the other. [insert some degree of specific disclosure here, if warranted, as to the interests and the conflicts management strategies]. However, after considering this information, our Hospital committees believe that there are no conflicts of interest that [or no conflicts of interests that, when taken with the conflicts management strategies discussed above] will influence the way you will be treated in this study or the way in which this research study will be conducted. If you would like to have more information about Mercy Hospital’s review process in general, or in regard to this study, please ask the researchers or the research coordinator, and they will assist you. You may also ask Mercy Hospital’s patient advocate, who also can arrange for you to have this information. If, because of this information, you choose not to participate in this study, this will have no effect in your continued health care at Mercy. Participation in all research, including this study, is entirely voluntary, and you may withdraw from participating at any time.

... under NHRPAC’s approach, disclosure of troubling financial relationships or actual conflicts to research subjects is not the preferred methodology for protecting subjects, but is an adjunct method for allowing subjects to have access to information that some may find relevant to their choices to participate in research.

In summary, a majority of NHRPAC preferred the approach of financial disclosure, conflicts analysis, conflicts management, and carefully calibrated "specific" disclosure, or "generic" disclosure, with ready availability to subjects of more specific information upon their request. Under these recommendations, therefore, institutional and researcher disclosure and management of conflicts precedes research approval; and simple disclosure to research subjects is not substituted for the duty of an IRB, institution or researcher aggressively to identify and manage possible conflicts according to their established processes.

The tough part is deciding what is sufficient management of a particular COI.

Big Stimulus Programs by Big Debtor Countries Will End in Tears??

The argument that, "Keynes, in the 1930s, advocated that the US make up for the demand loss rather than expecting the US's overindebted European trade partners to continue overconsuming" does not hold water. See for example Brad DeLong's econ 161 course notes. Hjalmar H.G. Schacht, the first central banker and then finance minister under Hitler, pursued deficit spending in a way that no other government did -- including the New Deal. One could argue that Schacht was the only Keynesian finance minister of his time. Although, Germany in 1932 was saddled with extreme debt, the expansionary program was fabulously effective -- Germany's unemployment rate problem was quickly solved -- the only industrialized country to achieve that goal. It is ironic that the insightful financial master, who worked for the devil incarnate, had the middle name Horace Greeley because his parents so admired the 19th century Repubican and Abolitionist.

Ding Dong! GM's Congressional Godfather is Gone!

This is great news for the environment and for the future of energy efficient transportation. Dingell was a great advocate for universal health care and a bulldog on important issues for protection of consumers. But, he was an enabler of the (not so) big (anymore) three automakers addiction to gas guzzlers and intransigence when it came to doing anything progressive with their product.