Non-privacy of this person is currently sleeping data is very bad as well, for different reasons.

You know, now that I'm thinking about it, I'm beginning to wonder if poor data privacy could have some negative effects.

It sounds like there was "presence in room" data as well, which could be very bad

This is the easiest signal though, on basically any account. You can see the time that communication happens, and the times when it doesn't.

For example a while back I wanted to map out my sleep cycle and I found a tool that charts your browser history over a 24 hour period, and it mapped almost perfectly to my sleep / wake periods.

Unsecured fitness monitor data revealed military guard post (IIRC) activity a while back.

Yawp. T’was Strava. https://www.theguardian.com/world/2018/jan/28/fitness-tracki...

not because you knew how much someone worked out. But because it had GPS.

True.

But keep in mind that other less obvious data sources can often lead to similar issues. For example phone accelerometer data can be used to precisely locate someone driving in a car in a city by comparing it with a street map.

In the context of the military even just inferring a comprehensive map of which people are on which shift and when they change might be considered a threat.

People will be lining up to have their brainwaves harvested because it'll be mildly easier to send emails or something similarly inane.

Corporations will be lining up to require their employees have their brainwaves harvested, so they can fire employees who aren't alert enough.

Will someone invent the equivalent of a mouse jiggler to get around this?

Porn?

They'll update the required brain state to "alert but not enjoying yourself".

You could read the alertness level from an EEG, which could be helpful to a burglar. The device with slow-wave status seems ideal.

How useful could something like this be for research? I'm not a neuroscientist so I have no clue, but it seems like the only justification I can think of..

The general idea of an EEG system that posts data to a network?

Very, but there are already tons of them at lots of different price, quality, openness levels. A lot of manufacturers have their own protocols; there are also quasi/standards like Lab Streaming Layer for connecting to a hodgepodge of devices.

This particular data?

Probably not so useful. While it’s easy to get something out of an EEG set, it takes some work to get good quality data that’s not riddled with noise (mains hum, muscle artifacts, blinks, etc). Plus, brain waves on their own aren’t particularly interesting—-it’s seeing how they change in response to some external or internal event that tells us about the brain.

Not a neuroscientist either but I would imagine that raw data without personal information would not be useful for much. I can imagine that it would be quite valuable if accompanied with personal data plus user reports about how they slept each night, what they dreamed about if anything, whether it was positive dreams or nightmares etc. And I think quite a few people wouldn’t mind sharing all of that in the name of science, but in this case they don’t seem to have even tried to ask.

What if you gonna think about your social security number 30000 times in your dreams, and someone knows the pattern? See the danger? That's evil.

If they're taking patient data for research without permission, they are not ethical researchers.

Is it really “without permission” if it’s from a server for which the access credentials have been deliberately published to the entire internet?

From the perspective of research ethics: it is very much without permission in that situation

If it's without the patient's permission, then yes, it is without the only permission that matters for medical ethics.

I believe they use it for sleep tracking

I would presume data privacy laws already have good precedent for health data?

> I would presume data privacy laws already have good precedent for health data?

Google for a list of all the exceptions to HIPPA. There are a lot of things that _seem_ like they should be covered by HIPPA but are not...

Only for "covered entities" under HIPAA (at least in the US)

An MQTT Broker just mean server, that's MQTT terminology.

Dark humor is like food.

Not everybody gets it.

Here it's more Poe's law.

Maybe?

Poe's law is always described as being about parodies of extreme viewpoints, not about perceived misunderstandings of what is being commented on.

I don't think that the viewpoint that these people will sell your data in a heartbeat is extreme.