"Get this thing going and deliver it to Doctor Pervert," Mason's boss ordered, according to a reader's account published by The Register. What began as routine malware cleanup in a hospital research lab became a managerial decision that staff later said the institution wound up defending in a lawsuit.
Mason's role in the hospital research labs
Mason, the pseudonymous reader who reported the incident to On Call, was an IT support technician working in hospital research labs. He told On Call that "one of the labs was for a doctor who was one of the world's top organ transplant researchers." That doctor's repeated visits to explicit websites left his lab machines chronically infected with malware; Mason says he cleaned those infections, sometimes multiple times in a single week.
Mason reported each fresh outbreak to his boss and flagged the problem as a breach of workplace rules. The source material states the doctor's activity "violated several workplace policies," yet, Mason says, hospital management repeatedly declined to intervene.
The cyber‑worm, investigation logs, and the doctor's activity
The hospital was hit by a destructive cyber‑worm that did "a lot of damage," and the subsequent cleanup produced logs tying the infection back to the doctor's personal activity. Mason's team found logs showing the doctor's PC "was the source of the infection," and that he had been using that PC for his explicit online pastime when the worm arrived.
Mason expected that discovery to trigger accountability. Instead, the logs became evidence in a very different administrative bargain.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe compromise: a designated PC rescued from e‑waste
Rather than disciplinary action, the doctor negotiated a deal with IT: he would confine personal and "intimate" browsing to a designated, non‑work machine and use office PCs only for work. To fulfill that commitment the hospital's tech team "rescued a PC from its e‑waste pile" and prepared it for the doctor's exclusive personal use.
Mason says he pushed back. He told his boss that the arrangement was "unprofessional, likely exposed the hospital to lawsuits, wasted IT department resources, and was just wrong." Mason quotes his boss as replying, "What do you want to hear? The CIO told me do this or get another job." After prepping the salvaged PC, Mason reported he only needed to clean it "about once a year" — the machine would be so overrun with malware it no longer served the doctor's purposes.
Aftermath: yearly cleanup, Mason's exit, and a lawsuit
Mason left the hospital while the designated personal PC remained in service. He later learned that "years later the doctor's graduate students filed a lawsuit," and that the separate "fun‑time computer" was presented as evidence that the hospital not only knew about the doctor's proclivities but had facilitated them. In Mason's telling, what began as an accommodation became a concrete piece of litigation evidence.
What this means for technologists, hospital leadership, and graduate students
- Technologists and security teams: Mason's account highlights a recurring technical reality — machines used for banned personal activity attract malware repeatedly. The hospital's solution shifted the risk onto a single, repeatedly infected device that still required periodic remediation.
- Hospital leadership and legal teams: The decision to formalize a workaround instead of enforcing policies was later cited in litigation. Mason argued internally that the arrangement "likely exposed the hospital to lawsuits," and the later graduate‑student suit used the dedicated PC as evidence of institutional knowledge and facilitation.
- Graduate students and potential litigants: In this case the students’ later legal action relied on documentary evidence — the very computer and the fact of its existence became central to their claim that the institution was aware of and accommodated the doctor's behavior.
The story offers a compact, uncomfortable sequence: repeated rule‑breaking, managerial acquiescence, a makeshift technical fix sourced from the e‑waste bin, and ultimately a legal consequence that used the accommodation as proof of institutional complicity. Mason's account leaves a clear throughline — a senior researcher's habits generated repeated security incidents, those incidents were patched rather than punished, and the patchwork solution itself later turned into litigation evidence.
