Healthcare Risks

This paragraph in the Atlantic September 2008 article called How American Health Care Killed My Father stood out to me:

About a week after my father’s death, The New Yorker ran an article by Atul Gawande profiling the efforts of Dr. Peter Pronovost to reduce the incidence of fatal hospital-borne infections. Pronovost’s solution? Hospitals implementing Pronovost’s checklist had enjoyed almost instantaneous success, reducing hospital-infection rates by two-thirds within the first three months of its adoption. But many physicians rejected the checklist as an unnecessary and belittling bureaucratic intrusion, and many hospital executives were reluctant to push it on them. The story chronicled Pronovost’s travels around the country as he struggled to persuade hospitals to embrace his reform.

Here again is a fine example of the issues around making a simple security choice even among highly educated professionals and presumably rational thinkers. Washing hands is resisted in spite of a well documented if not obvious potential to reduce risk. The rest of the article is a very thoughtful look at what the author calls “impersonal forces” that cause distortions to risk decisions, as well as suggestions on health-care reform.

RIP Fabio Casartelli

Last evening I heard two cyclists say “not tonight” when their friends asked why they did not have helmets. I’ve written at length already on helmets and risk intuition, but apparently they had not read my blog. This brought two things to mind:

First, the statistics on head trauma and bicycling are simple. Close to 90% of brain injuries sustained from bicycle accidents can be prevented by wearing a hard shell helmet. The National Highway Traffic Safety Administration (NHTSA) puts this into economic terms in their 2008 Legislative Facts document.

Every dollar spent on bicycle helmets saves society $30 in indirect medical costs and other costs.

They also note that while California was the first state to pass a mandatory helmet law in 1986 there are many states that still have no requirement at all:

Arkansas, Colorado, Idaho, Indiana, Iowa, Minnesota, Mississippi, Nebraska, North Dakota, South Dakota, South Carolina, Utah, Vermont, and Wyoming

Second, aside from all the data there are far too many empirical stories and examples that people should be aware of when they ride. One of the most known is the untimely death of Lance Armstrong’s team mate in the 1995 Tour de France.

Born on August 16, 1970 Casartelli probably would be one of the top riders in the world today. He had won an olympic gold medal in cycling at 22 years of age. Just three years later he was representing team Motorola in the Tour when he crashed on the Col de Portet d’Aspet in the Pyrenees and hit his head on the large square concrete blocks on the side of the road. The doctor who examined the injury said a helmet would have helped.

“There was a small but very violent impact to the top of the skull a few centimetres to the left of the central axis. Contrary to several reports, there were no facial injuries. The impact caused several fractures within the cranium, causing blood to emerge from the nose, ears and mouth.” Disteldorf added that had Casartelli been wearing a hard helmet “some injuries could have been avoided”.

One of the reasons to bring up the Casartelli story is also to note how the Tour’s senior doctor and the Motorola team doctor both asked that an autopsy of the injury not be performed. They then conjectured on cause of death without an examination. This lack of interest in safety and security data was echoed by the chairman of the International Cycling Union (UCI) who wanted to avoid helmet requirements at the time.

We have indicated the risk to the riders, but I believe that if you can’t apply certain rules on people it is better to drop them.

The question should not be whether we can find a person who will make a hasty conclusion or disobey a rule. Disobedience to rules without cause has what value? The question instead is whether someone will be able to make an informed and rational decision once they see and understand risks as a whole. An adult rider should think about their head’s vulnerability, the cost of prevention versus medical treatment or worse, and then examine the cost of countermeasures. This formula makes decisions easier and more accurate. It also brings forward arguments against helmets (cooling, fashion), which can then be addressed, proving that properly managed regulations are a way of stimulating innovation and market growth.

I would argue that simple common sense, backed by scientific study, has prevailed since the early 1990s and that is why helmets in races are now mandatory. I expect this to be documented by an improvement in the ratio of death and serious head injury among helmet-wearing riders to overall bicycle accidents. Although it is hard to account for threat variables (animals, other vehicles, terrain-type, etc. all differ greatly by region) the goal is to isolate and thus measure the change to a rider’s vulnerability. This is very similar to the process of assessing information security risks in organizations both large and small.

RIP Fabio Casartelli

Naked Nuns on Facebook

Ananova relays a story in Italy about a Nun upset about Facebook photos

The 31-year-old woman who lives in Turin said she was devastated when she saw the pictures, taken in summer 2006 during a holiday in Sicily, on the social networking site.

The man who said he wanted to stop her becoming a nun has refused to remove the pictures despite the woman’s requests.

Seems to me like a case of unauthorized use of personal images, violating her privacy, but also a situation that resembles blackmail. Italian privacy laws such as 675/96 and 196/03 will probably lead the Supervisory Authority (Garante) to dispense of this quickly on a personal level. The bigger question will be how Facebook handles the case and whether they will attract prosecutors based on the steps they take and when.

14 Bad IPs

Jose’s list of 2009 malicious links is a fun read. Here are the IPs:

8.12.206.126
60.173.8.0/21
64.34.228.126
66.220.17.154
67.29.139.153
68.169.70.134
78.108.0.0/14
94.75.207.219
121.11.0.0/16
195.2.253.240/30
209.84.29.126
209.205.196.16
216.240.157.91
218.149.84.0/25

One of the comments is a complaint — Jose did not put his list in htaccess format.

I find this comment quite odd.

I suppose some people think this should be setup for automation, but Jose’s blog is more about threat analysis and thinking than silent automation.

Moreover, it’s only 14 IPs and easy to convert. If you add “deny from” in front of the IPs, it’s the format for htaccess. Add the line, for example, “deny from 64.34.228.126″…

Examples of lists without any analysis can be found on many sites such as Country IP Blocks already formatted for quick inclusion. What they lack versus Jose’s list should be obvious. Ukraine (ua) has one of the largest blocks of bad agents of any country, with little or no explanation why.