The Marshall Gramm Case: What HISA Said and What HISA Can Show
Professor Justin Cappos said a system that lets a user view other people's confidential records simply by changing a number in the URL reflects negligence by the organization that built it, not the person who found the flaw. "It's not the user who goes into the URL bar and types in a different number. It's not their fault," he said. "Anyone who so poorly protects their systems is just leaving the front door open."
