I. The Case
On Sept. 13, a group called Fancy Bear hacked the World Anti-Doping Agency’s database and released the private medical information of four U.S. Olympians. The group, possibly the same Russian hackers that penetrated the Democratic National Committee, published the private information of gymnast Simone Biles, basketball gold medalist Elena Delle Donne, and tennis stars Venus and Serena Williams. Since then, Fancy Bear has released the medical data of dozens of athletes in four more batches.
On their website, the Fancy Bears introduce themselves:
“Greetings citizens of the world,” the homepage reads. “Allow us to introduce ourselves…We are the Fancy Bears’ international hack team. We stand for fair play and clean sport. We announce the start of #OpOlympics. We are going to tell you how Olympic medals are won. We hacked the World Anti-Doping Agency databases and we were shocked. We will start with the U.S. team which has disgraced its name by tainted victories. We will also disclose exclusive information about other national Olympic teams later. Wait for sensational proof of famous athletes taking doping substances any time soon.”
The medical records that the group released on Sept. 13 revealed that Biles, Donne and the Williams sisters had received medical exemptions to use banned drugs and included drug testing results and documents called “Certificate[s] of Approval for Therapeutic Use.” Fancy Bear claimed that these certificates effectively allowed athletes to engage in state-sanctioned doping.
Therapeutic use exemptions, according to the World Anti-Doping Agency, allow athletes who have a medical need for medications on the banned substances list to take those substances. Athletes can have their doctors fill out forms to provide information on conditions including asthma, diabetes, and ADHD, and the athletes won’t be penalized for failing tests for drugs that they’ve reported they’re taking.
Athletes have responded to the leak by stating that they had followed all the rules to report their medical conditions and medication.
View this post on Instagram
Successful surgery today on my right thumb. Thanks for all the well wishes! 👍🏽 I'll be back on the court in no time 🏀🏀🏀 Side note: I'd like to thank the hackers for making the world aware that I legally take a prescription for a condition I've been diagnosed with, which WADA granted me an exemption for. Thanks, guys! ✌🏼🇺🇸
II. The Ethical Dilemma
Several ethical questions arise from this situation: Should the media report on the hack at all? Is it ethical to report on leaked medical records? Should they link to the Fancy Bear website or the leaked documents?
As far as I can tell, most media outlets chose to report on the hack. In this case, reporters would have had to weigh whether reporting the hack of an international organization was more important concerns about athletes’ privacy and giving the hacking group legitimacy.
Since medical records are private information, reporters would have had to decide whether to publish specifics about what certain athletes tested positive for and what medical conditions they reported to receive a therapeutic use exemption. Here, truth again conflicts with minimizing harm. How much exactly does the public need to know? Most media organizations reported solely on the hack and mentioned what athletes were effected, but didn’t go into specifics about athletes’ medical conditions or what drugs they were taking. Judging by the comments on organizations’ websites, this led to confusion and frustration in readers, who wanted to know more details.
Finally, media organizations had to weigh how much to report on the Fancy Bear group itself. Most articles mentioned the hacker organization, but various outlets treated the information differently. Several, including the New York Post, linked directly to the website where the private medical records were posted. Several included screen shots of the site or of leaked medical records.
This is a particularly difficult ethical equation to solve, since providing the public with more information means compromising the privacy of individual Olympians and giving legitimacy to a foreign hacker organization.
Questions to talk about in class:
- What ethical imperatives are in contention in this case?
- Should the media have reported on this hack at all? Is this something the public needs to know?
- How does this case compare to the hack of the Democratic National Committee? What are the ethical differences between reporting on the two cases?
- Should the Fancy Bears be given media attention? Does this encourage their illegal activities?
- How much attention should individual medical records be given?
- Should the media link to the Fancy Bear website or post screenshots of hacked medical records?
- What would ideal media coverage of this look like?