Eyeglass security: well-intentioned, but...

I shared in a teachable security experience moment at home the other day. Ms. Context had recently had an eye exam and needed a copy of her prescription to get a new pair of glasses. She called the doctor’s office; no problem, they said: we can email it to you.  This seemed quick and convenient. The “fun” started with a subsequent message in her inbox bearing an unexpected and, er, cryptic and concise title something like “encrypt”.  Recognizing the from address as corresponding to the doctor’s office (rather than a malware sender who might have sought to tempt with the same title), we continued. We registered an account with the proffered email encryption service provider, creating a password that will probably never have an occasion to be reused, also answering familiar life questions. After a few minutes, we successfully obtained and extracted the prescription-bearing PDF, free to email to an optician.

Ms. Context found these hoops frustrating; other patients might just have given up and waited for postal mail. As a security technologist, I could understand the rationale for encrypting the email; we’re dealing with a patient’s medical data here, after all, where privacy is fundamental and HIPAA regulations speak loudly to healthcare providers.  I’ve also had a hand in supporting the concept of Internet email encryption since the pre-Web era, as via this RFC. Nonetheless, it was hard to see that the balance of cost and inconvenient processing vs. tangible benefit clearly added up in this particular case.  What’s the actual threat?  It doesn’t seem likely that an attacker would find much value in intercepting email to become able to obtain a pair of glasses that probably wouldn’t match their own eyes.  There might be cases where people wouldn’t want specifics of their vision revealed (maybe if they’re approaching the limits of visual acuity required for a driver’s license?); while conceivable, these also seem fairly unusual.  I don’t know if or how the decryption service’s design might or might not expose protected data to insiders there, but that could become another threat to evaluate in the overall picture that wouldn’t arise if the service weren’t involved.

Security policies are normally and appropriately conservative, and medical offices should certainly be careful when storing and sending patient data.  (I’ll also recommend dialing carefully when using fax machines, but that’s another topic.)  For this example, though, many or most patients might not consider this piece of their data as particularly sensitive (vs., e.g., prescribed medications they may be taking). Security methods should be effective and also convenient to use, but instead seemed burdensome in this case. I wish (and continue to believe that) the technology could become easier to apply, so users’ data could be protected as usual practice.  Where we stand, though, it can often be much easier to see and resent the tangible annoyances that security methods impose than to value the more amorphous benefits that they’re meant to offer.