"At that time, my mobile phone was blown up, and it made me want to jump off the building": 10 times in 3 months, don't let the information leakage undermine the overall situation of epidemic prevention

  "At that time, my mobile phone was blown up, which made me want to jump off the building." "We are victims of the virus. We did not expect to be injured by the Internet again, and felt mentally collapsed."...The new crown pneumonia epidemic continues to arouse national attention At the same time, epidemiological investigations (hereinafter referred to as the flow control) report frequent leaks, causing secondary injuries to patients, directly causing the masses to question the safety and reliability of the flow control information, and affecting the overall situation of epidemic prevention and control.

  Experts believe that vigilance transforms anxiety about the epidemic into a tendency to attack individuals who are diagnosed. Any practice of "rejecting dissidents" will magnify the harm caused by the epidemic; frequent leaks of flow information expose the current data protection in my country There are many loopholes in the management, and relevant flow adjustment work plans and even laws and regulations need to be continuously improved and updated.

1 Circulation information has been leaked repeatedly, but infringement is seen without punishment

  The reporter of Banyue Tan found that since November last year, there have been at least 10 circulation leaks in Shijiazhuang, Chengdu, Shenyang, Hangzhou and other places, and there have even been ridiculous leaks of circulation reports of the "epidemic response drill".

In 2021 alone, three such incidents have been announced.

  In early January, a Shijiazhuang patient Ms. Zhou's flow information was leaked, and then Ms. Zhou received all kinds of abuse information; in early January, a township staff member in Lijiang, Yunnan sent an official letter to the WeChat group, which led to the information leakage; In the same January, Lin, a psychologist at a hospital in Hangzhou, forwarded a circulation report to the WeChat group, causing the information of an asymptomatic infected person to leak.

  Analyzing 10 cases, the flow of information leakage incident has three characteristics:

-Human flesh searches and online violence occur frequently, and female patients and their private lives are frequently targeted.

  Among the 10 cases, at least 5 clearly involved women. There were even online platforms that used information such as the names of the girlfriends of confirmed patients in Shanghai to create topics, and the number of readings exceeded one million at a time.

For example, some netizens attacked Zhao, a confirmed female patient in Chengdu, from entering and exiting bars to unproven "private life chaos" and wantonly disseminating photos of innocent people and screenshots of friends circle.

In December last year, the information of Yin Moumou, a female patient in Shenyang and her close associates, was leaked, and netizens dubbed it "Poison King" and Yin Moumou called it "mental breakdown."

  Under personal attack, he was enduring the torment of illness, but he still suffered mental damage.

In November last year, the private information of close contacts of asymptomatic infected persons in Tianjin was exposed overnight.

This close contact in Tianjin said that he had a mental breakdown in the isolation hospital several times. “At that time, the phone was blown out and I wanted to jump off the building”.

—— One-click forwarding on WeChat group, browsing Weibo and Moments of friends, and social networks help viral spread.

  The Banyuetan reporter combed through the case and found that the source-end communication of the flow information leaks all point to personal WeChat.

Some insiders were leaked after uploading to relatives and friends on WeChat, some were deliberately forwarded to multiple WeChat groups out of curiosity and eyeball psychology to cause rapid spread, and some believed that "whistle blowing" and "behavior justice" were disclosed according to official disclosures. The personal information clues of Weibo and WeChat actively spread after conducting human flesh searches on social networks such as Weibo and WeChat.

  Experts believe that some netizens have a mentality of "the law does not blame the public", and they hide behind the screen and are willing to be a keyboard man. One-click forwarding, accompanied by false speculations and cheering descriptions, "seeing the excitement is not too big a problem", and frequently "shows" Lower limit".

——Illegal acts are not severely punished, and local law enforcement is "thunder and rain are small."

  The Banyuetan reporter found that there were many cases of leaking information that were unclear, and the punishment results have not been disclosed so far.

For example, after Shenyang Yin's circulating information was leaked, the local public security agency said that it had been involved in the investigation, but the specific situation was inconvenient to disclose.

  A circulatory staff member in Tianjin said that in the face of illegal acts that clearly infringe on personal privacy, law enforcement agencies have not imposed strict and timely punishments. There is even a mentality of "the law is not responsible for the public". In some places, this is a negative public opinion. Covering the lid” not only fails to bring justice to justice, it causes more people to act recklessly, but also adversely affects the epidemic prevention trend.

"If the flow information is leaked, if you ask the patient to cooperate, they will not be willing to cooperate."

2 It is about epidemic prevention and control, where are loopholes in the circulation?

  According to experts, the circulation information mainly includes basic personal information, medical condition and health information, social relationship information, behavior trajectory information, etc.

Because a large amount of personal privacy is involved, the flow adjustment work needs to be kept confidential throughout.

So, where is the information disclosure vulnerability?

  First, non-professionals participate in the flow adjustment work.

The transfer work requires multiple parties to participate in the investigation. Due to the tight time, urgent tasks, wide range of investigations, and heavy workload during a major outbreak, it is necessary to mobilize multiple parties to complete it. Non-professionals and groups with weak legal awareness will also be exposed information.

In these 10 cases, the leak in Beijing was caused by an employee of an aviation security company who privately photographed the patient's preliminary flow report during work and sent it to the WeChat group.

  Secondly, instant communication tools such as WeChat are widely used in the dissemination of flow reports.

The intermediary staff who visited Tianjin, Shandong and many other places learned that due to timely convenience, intermediary personnel often use WeChat to communicate, verify, and report basic information of confirmed persons.

"There is almost no way to work without WeChat." An interviewer sighed.

  Finally, part of the flow adjustment process has achieved informatization, and there is still a gap between digitalization.

The Banyuetan reporter learned that some provincial CDCs in China are currently building their own epidemiological investigation system.

This is essentially a process-based information system for information collection, processing, analysis, reporting, and storage. There are many shortcomings in the digitization and cryptographic protection of personal privacy data confirmation, processing and application, knowledge, and flow.

Especially in on-site investigations, traditional paper forms are often used to conduct investigations. Due to the lack of digital investigation tools, the large number of participants, and the weak legal awareness, the risk of personal privacy data leakage is high.

3 Create a "impermeable" flow adjustment process

  Experts believe that as epidemic prevention and control become normal, government departments should not wait until the personal information protection law is promulgated before implementing it. Instead, they should learn from the painful lessons of patient information leakage in the past year and more, and formulate strong guidelines and constraints. The work plan is constantly improved and updated.

Both relevant departments and individuals must grasp the balance between the public's right to know and the right to personal privacy, and guard the security of citizens' personal information to avoid secondary harm.

  First, establish a standardized operation process. When collecting, collecting, summarizing, and disclosing personal information of relevant personnel, strict process management is required to prevent data leakage, loss, and abuse.

Even if information such as the whereabouts of relevant cases has to be announced for the needs of epidemic prevention and control, it is necessary to ensure that necessary "desensitization treatment" is carried out.

  Ma Liang, a researcher at the National Institute of Development and Strategy at Renmin University of China, said that it is necessary to clarify the management authority of personal information, and continue to strengthen the training and guidance of information management capabilities for epidemic prevention personnel, so that all aspects of personal information management can be seamlessly connected.

For example, it is necessary to clarify the main responsibility of the health department and the CDC in collecting personal information of confirmed patients, establish a cross-departmental and cross-level personal information transfer mechanism, and be responsible for the effective management of personal information.

  Second, strictly control the scope of information collection and the radius of dissemination.

Experts pointed out that the collection of personal information necessary for joint prevention and control should refer to national standards for personal information security and adhere to the principle of minimum scope.

Personal information collected for epidemic prevention and control and disease prevention and control shall not be used for other purposes.

  Liang Yumin, deputy director of the Jining Center for Disease Control and Prevention, said that there may be more departments involved in the current transfer work.

For example, if the flow report involves a student, it needs to be notified to the education department; if the situation of the recipient is decrypted, the local street office needs to be notified to cooperate with the work.

In the future flow adjustment work, it is necessary to minimize the exposure of non-essential personnel to relevant flow adjustment information and reduce the possibility of leakage while ensuring the normal operation of the work.

  Third, focusing on the special situation of epidemic prevention and control, local law enforcement agencies must punish violations of personal privacy in accordance with laws and regulations.

Chen Guanwen, a lawyer at the Shandong Japan-China Law Firm, believes that my country’s laws have limited binding force on the infringement of personal privacy information, and the success rate of individual rights protection and civil compensation is not large, and it is difficult to determine the amount of loss assessment, and those who want to disclose privacy It is very difficult to investigate the responsible person. The law enforcement agencies must take the initiative to strictly punish relevant behaviors and disclose them in time to form a deterrent effect.

  Fourth, further improve the construction of big data to ensure that it is the responsibility to pass it.

Zuo Xiaodong, vice president of the China Academy of Information Security, said that the responsibility system for data protection should be strictly enforced, and the powers and obligations of data protection should be further implemented to ensure that it is the responsibility to pass it. Everyone has the responsibility of data protection.

At the same time, the operation manual for data protection in specific scenarios was issued during the capture to let relevant personnel know "how to do" and "what to do", and to ensure the safety of data flow through system construction.

  Source: "Ban Yue Tan"

  Half a month to talk about reporters: Wang Yang and Wang Jinghuai