Showing posts with label Privacy. Show all posts
Showing posts with label Privacy. Show all posts

Sunday, February 21, 2021

Are Messaging Apps Really Private? I Doubt It. Here's Why

I used to believe that WhatsApp, Signal and Telegram offered "private" messaging, particularly end-to-end encryption. I no longer belive that, in spite of what they all say. With all the recent flurry of controversy surrounding WhatsApp, I installed Signal and took another look at Telegram. I belong to a number of WhatsApp groups, and a few Telegram groups. Each WhatsApp chat states:
"Messages and calls are end-to-end encrypted. No one outside of this chat, not even WhatsApp, can read or listen to them. Tap to learn more."
I used to take this at face value, but I don't believe it any more.
The first problem is what do they mean by end-to-end encryption? One would assume that each phone would create a direct link to the other phone, similar to the way Skype used to work. But that isn't the case. You can send a message to someone whose phone is switched off. The message can wait for days, if not weeks, before the other phone is switched on and the message is delivered. So the encrypted message is queued somewhere, presumably on the messaging app's servers, because the receiving party can receive the message even if the sending party's phone is off.
The second problem is the message backups. WhatsApp does a regular backup to my Google Drive, and they don't claim that it is encrypted. Nor do they claim that the messages sitting on my phone are encrypted. Confiscate my phone or log in to my Google Drive, and you get a pretty good idea what I have been reading and writing. Signal can make encrypted backups to my phone, and I have to copy that backup off the phone to make sure I don't lose all that data if the phone goes up in smoke or gets confiscated. Telegram automatically backs up all my messages to its "cloud servers", whatever that means. These are not encrypted. "Secret chats" are encrypted and not backed up.
The most obvious problem is this: each of these apps has a version you can run on your PC. So how does the PC get to display all the chats in plain, unecrypted text? No obvious information passes from the phone to the PC. If the phone stores a private key, the PC never asks for it. That means that either the server keeps a copy and passes it to the PC, or there is no private key on the phone. Therefore the server has the means to read the stored messages.
WhatsApp displays a barcode on the PC screen that the phone needs to read when you visit https://web.whatsapp.com. No information is passed from the phone to the PC. It all comes from the server. I have confirmed this by watching the traffic leaving my phone after connecting using WhatsApp Web. On the PC I navigated to a group that posts a picture price list every day, and was able to go back to October 2020, when the group first started. Every picture that I had opened on the phone was available on the PC, without the phone uploading the data when I requested it on the PC. It complained if I put the phone into flight mode, but the PC was able to read the messages anyway and the data was transferred from the phone's unencrypted store to the WhatsApp Web server. Hopefully it was sent using https, but WhatsApp doesn't say.
Telegram and Signal both send a confirmation message to the phone when you setup the desktop app. But nothing appears to go in the other direction. They don't complain if the phone is in flight mode. So when any of these apps talk about "end-to-end" encryption they don't mean that your phone (or PC) is one end and the person you are talking to is the other end. Nope. The other end is their server.
The implications of this are serious: your chat is "secure" in the way your internet banking is "secure": it uses https between your PC and its servers. Anyone trying to intercept the traffic between the user and the server is going to have a hard time decrypting it. For practical purposes we will say it's impossible. Even for the NSA and other (Big Brother) nation state agencies. It's encrypted, but it isn't private. Big difference.
If the government wants to read my messages, all it needs to do is get a court order and instruct WhatsApp/Signal/Telegram to enable their PC application for my phone number, without sending the confirmation message or barcode to my phone. Presumably this would be in read-only mode so they don't give the game away by typing in something by mistake, or showing that the message has been received and read when I haven't done that yet. But there is nothing on my phone that they need to read my messages. If there was, the PC app would need it too. It doesn't. So either the servers have a copy of my private key, or they don't need a copy because they don't use public-private key pairs.
Whatever the reason, it's not private, even if it is encrypted. Leave a comment if you think I missed something obvious.

Update 25th February 2021: From the WhatsApp white paper:
Defining End-to-End Encryption
WhatsApp defines end-to-end encryption as communications that remain encrypted from a device controlled by the sender to one controlled by the recipient, where no third parties, not even WhatsApp or our parent company Facebook, can access the content in between. A third party in this context means any organization that is not the sender or recipient user directly participating in the conversation.
From their "privacy page":
End-to-end encryption
Conversations in end-to-end encrypted chats are clearly labeled with a gold message; these messages and calls stay between you, and no one else can read or listen to its content, not even WhatsApp.
Messages are stored on your device
Your messages belong to you. That's why your messages are stored on your phone, and we don't share them with advertisers.
The messages are not only stored on my device: they can be displayed on a PC. They are backed up to Google Drive. If "and no one else can read or listen to its content, not even WhatsApp" then how does web.whatsapp.com display my decrypted content when I ask it to? My phone didn't suddenly become a web server. Did it decrypt the content and then send it unencrypted to their web server? Did it send my private key to their server so it could decrypt my content from its backup copy and display it? They don't say.
From the Whitepaper:
Client Registration
At registration time, a WhatsApp client transmits its public Identity Key, public Signed Pre Key (with its signature), and a batch of public One-Time Pre Keys to the server. The WhatsApp server stores these public keys associated with the user’s identifier.
Great. Public keys are supposed to be public. But in order to decrypt my messages you either need my private key or the private key of the reciptient. Which one does their web server or PC app use? They don't say.

Update 26th February 2021: I did some more careful measurements with WhatsApp Web. There is a discussion group I am part of that has 34MB of picture and file data, according to the app. During the time I displayed most of these images, after having cleared my browser cache, my mobile data usage went from 665.31MB to 671.56MB, a difference of 6.25MB. So presumably this data was sent by the phone app to the WhatsApp Web server, so it could be displayed in my browser. So I have deleted some of my original statements in the light of the new evidence.

Friday, June 23, 2017

What part of "Do Not Call" is it that MTN doesn't understand?


These are the people at MTN who are personally and collectively responsible for the failure of the company to observe even the most basic adherence to the concept of privacy or an understanding of what "Do Not Call" (for marketing purposes) means. Their names are:
  • PF Nhleko;
  • P Hanratty;
  • S Miller;
  • AF van Biljon;
  • NL Sowazi;
  • A Harper;
  • KP Kalyan;
  • NP Mageza;
  • MLD Marole;
  • AT Mikati;
  • KC Ramon;
  • J van Rooyen; and
  • S Kheradpir
To give you an example of how bad it is, yesterday I had to send the following email:
Dear Rishen, Kaveen and Bridget
You seem to have missed the point. I am assuming deliberately but will give you the benefit of the doubt and put it down to sheer bloody-minded incompetence.
I have *ALWAYS* been on your Do Not Call list. I made it clear when I first obtained my MTN number, and have repeated it every time I have renewed my contract. I have also complained to MTN before about this matter. Many times.
  • July 2011: http://donnedwards.openaccess.co.za/2011/07/mtn8-competition-greed.html
  • May 2009: http://donnedwards.openaccess.co.za/2009/05/another-mtn-disaster.html
  • Nov 2007: http://donnedwards.openaccess.co.za/2007/11/mtns-marketing-incompetence-again.html
  • June 2007: http://donnedwards.openaccess.co.za/2007/06/mtn-direct-breaks-law-again.html
  • Oct 2006: http://donnedwards.openaccess.co.za/2006/10/mtns-marketing-incompetence.html
  • Aug 2006: http://donnedwards.openaccess.co.za/2006/08/mtn-sends-sms-spam-and-breaks-law.html
Since your company has known since 2006 that I do not wish to receive marketing communications, the fact that you supplied my name for marketing purposes to a third party is a clear violation of the ECT Act, plus the more recent privacy laws.
So what is it going to take to get MTN and its affiliates, subsidiaries and third party call centres to get the message? You clearly don’t seem to think that the bad publicity from my blog is motivation enough, so what is it going to be?
I also fail to understand why it is so desperately important for MTN to get me to renew my contract. You only offer 24 month contracts, not monthly or annual ones. I have my own phone and I will stick to my monthly renewal until I decide otherwise. I know this makes MTN nervous, and so you should be.
I await a suitable explanation. MTN’s marketing division clearly do not understand the concept of privacy or the desire not to be interrupted during a busy day with trivial and annoying marketing messages.
Looking forward to your reply,
Donn
It all started earlier this year when my 24 month MTN contract came up for renewal. I have a working phone, which I bought separately, and I decided to let the contract continue on a month-to-month basis. I told the person who called me that I had no interest in talking to them and they should not call again. I also blocked the number 083-123-7355 on my phone. So they tried calling on a different number 083-011-0100 and leaving voice messages. I called back and told them to take me off their autodial list. I made it very clear that I was not in the mood to be called by their marketing people.
But they persisted. They started calling my land line too. Yesterday they called twice. I found out that the company making these calls uses a bogus number 083-123-7355 for their call centre. You cannot call them on that number. This bunch
of crooksis called CCI SA and they have another call centre number 0861-262-241. When I called this number and complained about unsolicited calls the call centre agent was completely clueless and had no idea how to remove me from their list. Her supervisor, naturally, was "in a meeting".
I call them crooks because they made no attempt whatsoever to comply with the ECT Act, and they are not members of the Direct Marketing Association. That tells me that they are unscrupulous and dishonest and not to be trusted. They called me (twice!) today from 031-830-7200 to apologize and tell me that they have removed me from their call list. I pointed out that my details need to be blocked, so they aren't added again. So much for marketing ethics.
Yesterday I sent them the following email, cc'd to MTN:
Dear CCI
Please confirm that you have removed my contact numbers from your call centre databases and that you will no longer call me for any reason whatsoever on my cell phone number [redacted], or my land line number [redacted]
I should point out that my details have been on the DMASA Do Not Contact database for 12 years or so.
I am sick and tired of being contacted by yourselves on behalf of MTN, who should know better, and who have clearly violated the DMASA’s code of conduct by providing you with my details without my permission, and without informing you of my DMASA Do Not Call status.
Thanks in advance
Donn Edwards
Needless to say I have not had a reply from their email. But I did get a response from Bridget Bhengu, Senior Manager: Public Relations & Internal Communications. She referred the matter to Rishendren Damodaram, who roped in Kaveen Kalicharran, who "manages CCI". Rishen notified their Marketing Department and my name "has been removed from MTN Marketing", whatever that means. Probably not much. Hence my email at the top of this post.
It turns out that MTN are not members of the DMASA.
This would explain their unethical and illegal behaviour. Why am I not surprised?
Update Friday 23 June: I made a mistake in claiming that MTN are not a member of DMASA. They are listed on this page as "MOBILE TELEPHONE NETWORKS (PTY) LTD - SOUTH AFRICA". In spite of that they seem confused about how the Doc Not Call list works. And they seem to be blissfully unaware (or willfully ignorant) of the provisions of the ECT Act. Section 45 of the Electronic Communications and Transactions Act, no 25 of 2002. states the following:
45. (1) Any person who sends unsolicited commercial communications to consumers, must provide the consumer—­
(a) with the option to cancel his or her subscription to the mailing list of that person; and
(b) with the identifying particulars of the source from which that person obtained the consumer's personal information, on request of the consumer.
That implies that their call centre agents should be able to mark customers as "Do Not Call" by adding them to a do not call list maintained by the organisation. Clearly MTN doesn't know how to do this correctly. They should also be able to check their data against the DMA list before they hand over the data to third parties (it that is even legal any more). Clearly they failed to do this too. How convenient.
Update Friday 30 June: MTN called again, this time from 087-350-8555. They don't even have the ability to put my name on the do not call list, which is another clear violation of the ECT Act. Listen to the recording.
Update Thursday 10 August: My blocked call log shows that MTN called from 083-123-7355 again on 8th August and again today on the 10th August.

Wednesday, April 26, 2017

MTN Monitoring and Monetizing My Call Logs

This is part of a letter I have written to MTN (my mobile operator), following the events that happened after I made a call to my domestic worker's mobile phone. I recived a popup-style "alert SMS" message, followed by a standard spam SMS from the MTN short code 46163:
This morning I called my domestic worker from my MTN phone. Her phone is very basic. I can do SMS messages and not much more. She is illiterate, so she cannot read SMS messages.
When I had finished the call I got an annoying little popup message on my phone, followed by an SMS from 46163 claiming that my domestic’s phone number “just sent me a Caller Notify message.” [See screen shot above]
My first concern is that clearly my domestic does not have the capability to type out the message, let alone send it as an alert style SMS instead of a standard SMS message.
Secondly, she has no way of sending messages on behalf of 46163
Thirdly, 46163 is not a short code registered with WASPA.
But my biggest question is: who gave the operators of 46163 the network capability to monitor calls to and from my phone, and to and from her phone? I should also point out that I am the account holder of both phones and at no point do I recall permitting subscription services to be deducted from her phone, or have I given MTN permission to give calling metadata to anyone, and that it should only be used for the purposes of police investigations or billing.
So the privacy and compliance issues surrounding this “service” are of grave concern to me as a subscriber. Please would you explain what is going on?
Best wishes
Donn Edwards
I await their reply with interest, and will publish it as soon as it becomes available. I have called their call centre and discovered that the "service" deducts R2 per month R1 per day from the phone's account. Not much until you consider that she only gets R50 airtime a month. Then it's a big deal.
Update Friday 28 April: According to this tweet the call centre was lying. The cost for this "service" is R1 per day, or R5 per week. That's plain daylight robbery. My email has been passed from pillar to post at MTN, but still no one has actually replied. I guess I'll have to wait until Tuesday.

Friday, July 17, 2015

Discovery Health wants a photo of my backside. Seriously? (Not any more)

Update noon 22 July: common sense and decency has prevailed and "the committee" has decided that they really don't need to see a photo of my arse after all. See Dr Martin Young's take on the matter here.

Discovery Health is a medical "aid" with some weird ideas. Once of them is that they claim to practice "evidence based" claims processing. This has some weird side effects, such as their latest debacle: they want a photo of my injured backside. First, some background.
On Friday 26th June I noticed that a lump on my left buttocks was getting swollen and painful. On Saturday it got worse and eventually I decided to go to my GP for treatment. By then their offices were closed and I was directed to the Olivedale Hospital instead. Their emergency doctor identified a peri-anal abscess and used a local anesthetic while she made an incision to drain the pus. I was then given antibiotics, pain killers and a dressing and told to come back on Monday for a checkup.
It was still painful on Monday and my GP took one look at the wound and said I needed to see a specialist surgeon at Olivedale. On Tuesday I saw the specialist surgeon who examined me and said I needed surgery as soon as possible and antibiotics on a drip. I was to report back to the Olivedale Hospital later that evening and he would operate the following morning, Wednesday 1st July.
The necessary hospital pre-authorization was obtained from Discovery Health, and I took a printout of the authorization number 17263206 with me. Because the surgeon also wanted to do a follow-up colonoscopy, I had to make a "co-paymnent" of R2750 when I got to the hospital. The pre-authorization email ended with a curious statement:
You can receive the care you need at home with Discovery HomeCare

Discovery HomeCare is a unique healthcare service that offers our members quality home-based care in the comfort of their home. Certain treatments can be rendered in a home environment, making it possible for Discovery HomeCare to provide quality nursing and care worker support in your home rather than in in a medical facility or institution. For more information on Discovery HomeCare visit our website www.discovery.co.za.

If you are interested in this service, please discuss this with your treating doctor. If your doctor is in favour of you receiving care at home for your condition, please email or call us on 0860 99 88 77.

We hope this information helps you prepare for your hospital stay.
When you read that does it sound like you need to obtain pre-authorization for the HomeCare? Does it imply that the doctor has to send Discovery Health a motivation letter and photos before the care commences? It is sufficiently vague as to not even specify the email address to contact. Even the website address is very generic and non-specific. I have provided a link to the relevant page. But I digress.
I was admitted on Tuesday evening and after some confusion put in a ward and given a drip. This contained antibiotics and pain killers. The surgeon and the anesthetist came to see me and asked me various questions to establish my past medical history and so on. On the Wednesday I was given a general anesthetic at around 11am and when I woke up they had drained the pus completely and I had a large hole in my backside with gauze in it to prevent the wound from closing. I continued to receive antibiotics and pain killers via the drip for the rest of Wednesday and Thursday morning.
The following day the dressing was changed (quite painful) and I was allowed to go home on Thursday afternoon. The surgeon introduced me to a private nurse who would come round to my home on Friday and on the weekend to dress the wound and make sure the infection did not come back. There is a 20% chance of the abscess recurring. I was quite keen to avoid going through this process again.
I couldn't sit down properly on Friday or Saturday, so work was out of the question. I was advised to take at least 2 weeks off work. Since I am self-employed this wasn't difficult to arrange. Those first few dressing changes were painful, as the gauze went quite deep into the wound, where there are plenty of nerve endings. I was given stuff to put in the bath, and had to soak the would before the nurse arrived. By Monday I was able to walk outside and on Tuesday I decided to try going to the gym to see if I could manage any exercise. The sweat made the wound itch, but apart from that I managed fairly well.
I was also able to catch up on some admin work so I sent in the motivation letter provided by the private nurse, as well as the first invoice, which I had paid. Big mistake, according to Discovery Health. I shouldn't have sent the motivation letter along with the claim to claims@discovery.co.za, which seemed to me to be the logical thing to do. What I was supposed to have done, according to two different Discovery officials I spoke to today, is to have phoned Discovery when I got home, and requested permission to be treated by the nurse, even though the surgeon had already told me that he required it to be done. Then I was supposed to obtain a motivation letter from the nurse and the surgeon and send them to preauthorisations@discovery.co.za and wait for a response.
"If your preauthorisation request does not need additional input, we will get back to you in 2 – 3 working days. For requests that need additional review, we will give you feedback in 3 – 5 working days."
Never mind that the wound would probably have gone septic by then. But then Discovery Health doesn't provide health care: they are only accountants and insurance providers who try to avoid paying for it whenever they can. They have the audacity to call themselves a medical "aid". Perhaps "Medical Scheme" is more accurate, but it doesn't identify who does the scheming.
Treatment continued from 3rd July to 13th July, and I submitted claims as I paid the invoices. Each time I sent the motivation letter along with the invoice and receipt to claims@discovery.co.za. And each time I received an automated notification that my claim was being processed. No mention that the motivation letter was being sent to the "wrong" address. After all, they only process claims, and I am supposed to know how their system works. I'm the customer who pays, remember?
Today (Friday 17th) I noticed that my claim refunds were being deducted from my Medical Savings Account, and not being taken from the much-vaunted Hospital Benefits, even though the hospital, anesthetist and surgeon were all paid from the Hospital Benefit. So I called to find out. That's when things got a bit bizarre.
Firstly, I was told that the claims department doesn't decide which claims should come from Hospital Benefits, only the pre-authorisation committee can do that, and they were still busy with their decision. They promised to escalate the request, since it was now 10 days since I had sent the letter. At 16h22 on Friday they sent me the following letter:
Dear Mr Edwards

Request for Wound Care for Mr Donn Edwards

Thank you for your recent communication to Discovery Health.

We have received your request for Wound Care from Sr Bev Lawrence. In order for us to assist you with this request. We require the following information:-
  • A detailed Letter of Motivation from the requesting Doctor indicating the clinical information of the wound.
  • A quote with the relevant nappi codes.
  • A recent colour photograph of the wound with a ruler indicating the size of the wound, patient details and date. Photographs need to be submitted in a JPEG, PDF, PNG , GIF, DOC , DOCX format to be viewed in colour.
  • The exact treatment dates.
Please send the information to us by:-

Fax: 011 539 2192

Email: preauthorisations@discovery.co.za

I trust all of the above is clear and to your satisfaction; should you have any further questions in this regard, please do not hesitate to contact Discovery Health.

For any queries send an email to clinicalhelp@discovery.co.za or visit www.discovery.co.za

Regards
Orleans Ledile Sindane

Discovery Health (Pty) Ltd
On behalf of Discovery Health Medical Scheme
Both the surgeon and the nurse had warned me they might try a stunt like this, and absolutely and point blank refused to be associated with any photographs in any way. I have yet to figure out how to take a selfie of my own backside. The letter refers to National Pharmaceutical Product Index (NAPPI) codes. These are a unique identifier for a given ethical, surgical or consumable (pharmaceutical) product, not for treatment procedures. Treatment procedures are identified by ICD codes, K61.3 and Z48.0. So presumably when they say "we have received your request" it means that have only received it, but not actually read it.
I still can't believe they could actually send a letter like that. Especially the bit where I am supposed to fax them a colour photograph or my backside. Seriously? So I replied as follows:
Dear Orleans Ledile Sindane
I fail to understand your request, late as it is. Specifically:
a)   The wound has almost completely healed, a photo is a little bit late, don’t you think?
b)   The wound area is close to my anus. You have no right to request a photo of a private area such as this.
c)   The photo cannot be taken by either the doctor or the nurse without them being prosecuted for privacy violations, since the injury is in my anal area. You would know this if you had bothered to read and comprehend Sr Lawrence’s letter (attached)
d)   Sr Lawrence provided both the ICD 10 codes and a quote. See attached letter.
e)   Sr Lawrence provided measurement information of the size of the wound in her letter.
f)   Treatment commenced on the day after I was discharged from Olivedale Hospital (i.e. it began on 3rd July 2015) and concluded on 13th July 2015. You already have these dates because I have sent all the invoices from Sr Lawrence to claims@discovery.co.za. I have attached them again anyway for your easy reference.

So if I understand matters correctly, you require a motivation letter from the surgeon at Olivedale. Have you informed the surgeon, or do you expect me to waste more time going to see him to obtain such a letter?

Kindly advise
Donn Edwards
This raises a number of ethical concerns. Just who exactly gets to look at sensitive photos of my backside? The fact that they are happy for me to email them means that they have no concerns whatsoever about security or privacy, since emails of this nature can be forwarded to anyone they like, and their is no audit trail. Also, the emails are not secure, and we know for a fact that both the GCHQ in the UK and the NSA in the USA have copies of all emails sent in the last few years, including ones in South Africa. I may as well just post the photos on Twitter. Twitter messages are just as confidential as email, i.e. not at all.
What gives a bunch of accountants the right to request photos of my body? If they have already paid for the surgeon to operate under general anesthetic, they know that there will be a post-operation wound. Why do they need a letter from the surgeon and the nurse, as well as photos? Why not the anesthetist as well? Don't they believe the doctor and/or the nurse?
Update Saturday 18th July 2015: I have been assured by Jonny Broomberg via Twitter that only qualified health care professionals will see the information. I find this difficult to believe, given the nature of email. I find it more disturbing that a "health professional" would even request such a photo in the first place. What kind of perverts are they?

Then there is the question of the way the refunds are being financed. They are "borrowing" money from my Medical Savings Account for the purpose, i.e. it isn't covered by the Medical Scheme benefits. The money in the MSA is my money. It doesn't belong to Discovery. Nice of them to pay it back to me instead of paying it out of my hospital care benefits. This is the first time I have been to hospital since 1986, so its not like the funds are depleted or anything.
Even Mr Broomberg seems to think this is OK. He's a member of the Social and Ethics Committee and CEO of Discovery Health

He obviously thinks that "post-operation wound care" is an "out of hospital treatment". I disagree, but them I'm only the paying customer, so I must be wrong.
Update Monday 20th July: I called Discovery Health and spoke to someone at the pre-authorizations call centre. She confirmed that email confidentiality cannot be guaranteed by Discovery Health, nor that only qualified healthcare practitioners would see the photograph.
Since she was unable to help me resolve the issue, I was put through to Danette, since Orleans Ledile Sindane wasn't available. Danette explained that the photograph requirement is non-negotiable, but isn't written in the Member Rules, so there is no way that I would be able know about this in advance. He also accused me of being irresponsible for not phoning Discovery after being discharged from hospital. When I pointed out that her insistence on a photograph was effectively blackmail, she wouldn't back down. I asked her to repeat her insistence in writing. Here is her letter:
Dear Mr Edwards

Thank you for contacting us.

Request for conservative wound care

As per the communication sent to you on 17 July 2015 we informed you of the information we require in order to review the conservative wound care from the Hospital Benefit.

We received confirmation from you and Sr Bev Lawrence that you are not willing to send colour photos to Discovery Health for review. We are therefore unable to confirm funding from the Hospital Benefit. The claims will be funded from your available Day-to-Day Benefit as per your chosen plan type and the Discovery Health Scheme and billing rules.

We make consistent and fair funding decisions in the interest of all Scheme members

We recognise that treating provider is in the best position to make medical decisions about your condition and treatment. In reaching this decision we have not questioned the diagnosis or the treatment recommended by the treating provider. As a healthcare funder, we decide on funding treatment to make sure the Scheme can cover claims now and in the future.

Our role is to make sure members of the Scheme enjoy access to quality healthcare in a way that remains affordable and sustainable. Some of the ways we achieve this is in our plan and benefit design, the creation and application of funding policies and clinical protocols that are developed using a rigorous, evidence-based decision-making process. This process also helps us make decisions about which procedures and treatment to exclude from cover.

If you have any more questions, please call us on 0860 99 88 77, email clinicalhelp@discovery.co.za or visit www.discovery.co.za

Regards
Danette Gerber

Discovery Health (Pty) Ltd
On behalf of Discovery Health Medical Scheme
That's a nice way of blackmailing me: no photo, no benefit. The red emphasis is mine.

Also, on Friday I asked the Discovery CEO whether he would be prepared to take the photo of my backside. He's ducking and diving and won't reply. He knows it's illegal and doesn't want to run the risk of losing his license and landing up in jail.
I also tweeted that I thought Discovery was blackmailing me. Their replies show their hypocrisy and lack of understanding of the nature of reality:

I proposed a different solution: I would come in to their offices and show the photograph directly to a qualified healthcare professional. They can't do that because the "Benefits Committee" meets electronically. So they have to have an electronic copy. There is no secure upload facility on their web site, and they admit that a fax copy isn't in colour, so I have to send it via email. This is how seriously they take the confidentiality of their medical information.
The Twitter PR guy seems to think its OK for me to bring the photo to their walk-in centre.
Update Tuesday 21st July: Last night Jonathan Broomberg emailed me and asked if it was OK if Discovery's team could talk to my surgeon and the nurse. I said this would be most welcome and supplied him with their numbers. It seems like sanity and common sense may yet prevail. I hope so.
In the meantime, my friend Dr Martin Young has written an insightful article on the matter for his own blog.
Update Wednesday 22nd July: Three weeks after the operation, and 2 weeks after submitting my claim for post-op care, it has taken the personal intervention of the CEO to get "the committee" to decide that they don't need to blackmail clients and insist on a photo if it offends medical and social ethics. They just phoned me to confirm that they will indeed cover my post-op care from my hospital benefits and not out of my own pocket.
To the trolls on Twitter who claim I made this all up to defraud my medical aid: I am waiting for the day you get a very painful infection and have to hear your medical aid administrators tell you that they won't cover it. Then all of a sudden you'll think a little differently about what should be covered or not.
And in any case, I had to pay the money from my own account and then wait for a refund. I made nothing out of it financially. The nurse provided a medical service and didn't prolong the treatment for a day longer than necessary. She charged Medical Aid rates and didn't charge for the plasters and gauze, because it was already supplied by the hospital pharmacy.
The nature and position of the wound was such that I can't see it or treat it myself, not even with a mirror. And it was too painful to allow an amateur to touch it. That's why I had to have a general anesthetic for the initial operation. DUH!

Discovery's risk analysis people are clever enough to realize that providing post-op care by a professional is better and cheaper than (a) keeping the patient in hospital for 2 extra weeks and (b) forcing the patient to do the dressing himself (assuming he can actually reach the injured part) and running the risk of the wound going septic. There is in any case a 20% chance of the abscess returning. Halving those odds will reduce their hospital costs considerably. Prevention is better than cure in many ways.
When the smug Discovery PR person phoned to explain their procedures and pointed out that I should have known in advance that I was supposed to obtain pre-authorization or post-op care, I said to him that I thought he was exactly right, and that that made me feel much better about his company and I was most likely to recommend them to all my friends because they had proved that they were right and I was wrong. I don't think he got the sarcasm.
Neither their web site nor their emailed letter to me said anything about obtaining permission or authorization in advance. It still doesn't. It makes general hints and relies on the customer to call and find out. Why they can't be open and upfront in advance I don't know. Perhaps a paragraph like this would help:
We want you to get better after your operation, so before you leave the hospital you need to obtain permission from us to get better. In order for us to grant such permission, we'll need a quote from the nurse, and a motivation letter from the referring doctor, together with a detailed description of the wound, photos of the wound with an electronic date included and a ruler or tape measure blocking any private areas, a list of all the plasters, ointments, medication and pharmaceutical products to be consumed.

We'd prefer not to have to pay for this so if you can treat the wound yourself, tough luck and we hope you get better on your own. Remember that without prior approval for such treatment, which we don't see as in any way related to your recent stay in hospital, you will have to pay the bill yourself out of your own funds.

We think you are just using your hospital stay to milk us of all your monthly contributions and make a profit at our expense. Sorry, buster, we make the profit and keep 15% of your money no matter what else happens.

The problem is that companies and institutions set up systems with their own (evil) logic and rules. The people inside those organisations don't see how these rules clash with reality. They'll ask for a photo taken two weeks ago without even thinking about the laws of physics. They'll instruct a nurse to do something unethical for which she could go to jail, and then not understand why she refuses.
Most of us just capitulate because it's too much hassle to kick up a fuss. I kicked up this fuss because my butt was on the line. Hopefully now others will have a more compassionate experience. I'm just glad it wasn't my previous medical "aid". I left them in 1999.