A hospital IT staffer was ordered to deploy a dedicated “pleasure PC” for a senior doctor who repeatedly infected research lab systems with malware from adult websites, The Register reported. The machine, rescued from the e-waste pile, became the sole designated device for the doctor’s personal activities, a decision the tech support employee later learned was mandated by the CIO under threat of termination.
IT Contact Flagged Security Risks to Management
The doctor, a leading organ transplant researcher, was a known voracious consumer of adult content, a habit that resulted in frequent malware outbreaks across his lab machines. His IT support contact, a Regomized reader named Mason, repeatedly flagged the policy violations and security risks to management. Despite the doctor’s status and the clear breaches of hospital policy, no action was taken to curb his behavior. This permissive environment created a significant attack surface, ultimately leading to a catastrophic cyber-worm infection that originated directly from the doctor’s workstation. During the forensic cleanup, logs confirmed the doctor was engaged in his online hobby at the exact time of the breach.
The hospital’s response was not discipline. It was a compromise.
Management Created a Policy for Personal PC Use
Management brokered a deal with the doctor, baffling and infuriating his IT team. He would henceforth use a single, designated PC exclusively for his personal and “intimate” matters. All other office machines would be reserved for work. The machine selected for this dubious duty was not a new, secure device. It was a rescued PC from the hospital’s e-waste pile.
Mason’s boss delivered the order with chilling bluntness: “Get this thing going and deliver it to Doctor Pervert,” he recalled. When Mason escalated his concerns, citing professionalism, legal liability, and wasted resources, his boss delivered a stark ultimatum. “The CIO told me do this or get another job.” This directive, Mason told The Register, was a direct order from the Chief Information Officer, leaving him no room for professional objection.
Hospital Prioritized Researcher's Status over Security
A hospital knowingly created a malware honeypot to accommodate a senior researcher’s habits, prioritizing his status over network security.
Hospital Accepted Risk of Malware-Infected Machines
While the frequency of outbreaks dropped from multiple times a week to roughly once a year, the underlying vulnerability remained. The poor machine would become so overrun with malicious software that it would no longer function for its intended purpose, forcing IT to intervene and wipe it clean. This cycle continued for years, with the hospital tacitly accepting the risk and the associated IT overhead.
Lawsuit and Liability: The Cost of Complicity
The entire arrangement unraveled years later when the doctor’s graduate students filed a lawsuit against the hospital. The "fun-time computer," as Mason termed it, became important evidence. It demonstrated that the hospital was not merely aware of the doctor’s unprofessional behavior but had actively facilitated it.
