A team of Canadian medical researchers have inadvertently provided a very clear picture of the current state of the security risks posed by P2P networks. The authors intended to determine whether P2P clients were exposing personal health information, but their approach—downloading all files from a set of common document formats—provided them a clear picture of just what's being made available on Gnutella and eDonkey: personal identification, health, and medical information, and a healthy collection of trojans.
The motivation for the work is pretty simple. With the increasing digitization of health records, individual users are more likely to exchange e-mails and files with their doctors, insurers, and other health care officials. An obvious consequence is that personal health information (PHI) will end up on the users' hard drives, which creates a potential security hole. In the past, the research team has found that they could scrounge PHI from roughly 10 percent of the used hard drives available through second-hand computing vendors.
The researchers recognized that P2P clients can expose large collections of personal documents to the Internet at large. Although many clients allow fine-grained control over what files get sent out into the ether, there are plenty of opportunities for carelessness or error—like sharing an entire "downloads" folder simply because it contains a lot of music files—that could expose personal data.
To get a better sense for the scale of the problem, the researchers modified a client that worked with the Gnutella and eDonkey networks, and had it look for any files with extensions that indicated they were likely to be a document: Word documents, Outlook email files, PDF files, Access database files, and Excel spreadsheets. These were downloaded for several months, which allowed them to build collections from 1,651 IP addresses, equally divided between US and Canadian locations (files from outside these nations were discarded). With the collection in hand, the authors ran an antivirus scan, and then started manually examining the contents.
About 1.5 percent of the files they obtained contained viruses (one percent in Canada, double that in the US). So, the advice about approaching files obtained via P2P with caution appears to be pretty well grounded. Nearly 11 percent of the Canadian IP addresses yielded documents that could establish the personal identity of someone (7.1 percent in the US). This may not necessarily be the owner of the computer, given that the file didn't necessarily originate on its host system.
PHI, the original target of the study, wasn't a major feature of the downloaded files: only about half a percent of Canadian IP addresses, slightly less in the US. A lot of them were medical waivers for childhood activities or personal health assessments. But the scan also netted legal documentation about a US soldier's injuries, including their relevance to future deployments.
Banking records, including account numbers, passwords, and tax return and bankruptcy documents, also made appearances. These showed up on two percent of the Canadian IP addresses, and five percent of American ones.
Although the numbers aren't as bad as one might have feared, the authors place it in context by pointing out the excessive lengths that people will go to in order to avoid disclosing this sort of information. They cite extensive documentation of how people will actually refuse medical treatments in order to avoid having documentation of their conditions, either for insurance reasons or because of the social stigma associated with a diagnosis. There's also the issue of the number of computers that have P2P clients installed. That's estimated to be in the millions, which (if these percentages are right) could mean tens of thousands of users have this sort of information exposed.
The researchers also note that, as part of their work, they obtained a list of common search terms being used on the P2P networks they scanned, and discovered that terms common to either financial or medical documents were being used. This suggests that, however we may feel about exposing these documents, people out there are interested in obtaining them.
An aside on ethics and reproducibility
The paper's text is unusual in that the majority of it is devoted to considering the ethics of downloading this information in the first place. The paper includes an extensive consideration of whether the documents are in the public sphere, the ethics of surreptitious observations, and the practicality of notifying those whose documents turned up during the project.
In the end, the authors have stored the documents they obtained on an encrypted DVD that is being stored in a locked safe. After a year, the disk will be destroyed under the supervision of the hospital's institutional research ethics board.
It's an appropriate caution ethics-wise, but it means that the coding of document contents and statistical analysis of the paper won't be directly reproducible. Someone else could perform a similar analysis but, due to the constantly shifting world of P2P services, it would be unlikely to produce the same results.
JAMIA, 2010. DOI: 10.1136/jamia.2009.000232