Hospital Let a Star Researcher Break IT Rules, Then Got Hit by a Worm

A story shared with The Register's On Call column shows how ignoring security policy for a high-status person can cost an organisation dearly. A reader called "Mason" says he worked in tech support for a hospital's research labs. One lab belonged to a leading organ transplant researcher, whose habit of visiting adult websites at work meant his PC and other lab machines often caught malware. Mason cleaned up the infections, sometimes several times in one week. The behaviour was widely known and breached several workplace policies, but management never intervened because of the doctor's standing.

Then a cyber-worm hit the hospital and caused a lot of damage. During the cleanup, colleagues found logs showing the doctor's PC was the source of the infection, and that he had been browsing those sites when the worm arrived. Mason expected disciplinary action. Instead, the doctor struck a deal with the IT department: he would use one designated PC for personal browsing and office PCs only for work. The team pulled a machine from the e-waste pile for the purpose.

Mason objected, arguing that the arrangement was unprofessional, risked lawsuits and wasted IT resources. His boss replied that the CIO had said to do it or find another job. After that, the designated PC needed cleaning about once a year, when it became so infected it was no longer useful. Mason eventually left the hospital, and the PC was still in place.