Skip to main content

Information security, and how not to do it

On the 21st of this month, I received an email from a company*, advertising their upcoming online seminar, and various other online courses they ran, including ones on the Data Protection Act, and information security.
Since I wasn't interested in their courses, and didn't remember signing up to receive any marketing materials from this company,  I clicked on the unsubscribe link. However, when the unsubscribe page opened, the name and email fields were already completed...and none of the information was mine.
In fact, the email address was for a Junior School in Portsmouth (edited version below).


This is not great, in terms of information security...you know, that thing they're running online courses on?
So, I replied to them within an hour, pointing out that the information in those fields was not mine, and they might want to do something about that.
To date, I've not received an acknowledgement of my email, or any form of response.
I was also not alone in receiving this email, and finding someone elses information in the form when following the unsubscribe link.

However, in the days since, the form the link leads to has changed....well, to be specific, the information viewable in the form has changed. Yes, it's gone from being the contact details of the school in Portsmouth, to the address of a private school yesterday, and today, one for a university. The first two times, the emails were admin addresses, but the university address is the work email of an individual, with their proper name in it (instead of, as above "No" and "Thanks" being the name).

Now, mistakes happen, and making a link to a form that shows the details of the last person who's used it was probably an accident. But this is not how you deal with it.

What would I have done if this had been my mistake?

  • When I got the email pointing it out, I would have responded to the person contacting me, apologising for the issue, and thanking them for bringing it to my attention
  • I would have deactivated the link immediately
  • I would have got whatever glitch it is that's preserving the last page user information fixed
  • Once that was done, I would have emailed everyone that had received the previous email, apologising for the issue, and telling them that the unsubscribe link was now secure and anonymous
This company has done none of that. Allowing anyone to view names and email addresses of strangers is not as serious as sharing work or home addresses, or more sensitive personal information, but this is a company which is running a business specifically selling training on data protection, and information security. Hands up who'd feel confident about using their training, if this is how they put it into practice?

*I have not named the company here, but contact me directly if you would like to know who it is.
Labels:

Comments

Michael said…
I believe it's known as the "easy come, easy go" approach to data security.

It's commonly practiced by most high street banks I gather! ;-)
19 October 2012 at 16:44
Post a Comment

Popular posts from this blog

Careering along

When I look around at the activities of information professional groups, it seems that there’s a disparity. There’s quite often a lot of support and funding available for those who’re just starting out in the profession, but a desert of nothingness for those of us who’re “just getting on with it”. If you’re a new professional, you have lots of groups to support you as you progress in your early career, various prize funds available for essay and report writing, access to bursaries for conference attendance, eligibility for awards for being new and enthusiastic. But what do you get when you’re past that bright-eyed-and-bushy-tailed first 5 years (5 years seems to be the approximate cut-off point for becoming “established” and no longer new). What happens when you’ve already received a bursary from an organisation earlier in your career and so wouldn’t be eligible for one now, meaning you’re not able to attend events or training? When you’re heavily involved in a project but not at ...
16 comments
Read more

The mysteries of cataloguing

Cataloguing: an arcane art, where each piece of punctuation is significant, and commas and semi colons are all-powerful. Well, they are in "proper" libraries, where in-depth research of esoteric points goes on, and the precise spelling of Christian names, and information such as when a person lived and died can be crucial in pinpointing obscure facts. Here, we have our own catalogue system. It doesn't have a name, but if it did, it would probably be something along the lines of "I need this book NOW, no I don't care about the precise spelling of the authors middle name, or their date of birth." I know, I know, it's not snappy, but it's accurate. Cataloguing demands are different in a commercial law firm: we don't care about much more than what it's about, who wrote, when, and what jurisdiction it covers. And what we really, really care about is "where the hell is it". Law books are amazing: they have the power to move themselves f...
12 comments
Read more

Why do I do this?

By "this", I mean the whole librarian thaaaaang. Woodsiegirl recently blogged on why she became a librarian, and after conversations in the comments section, I thought I'd join in with my own blog post on the topic. As I said on Woodsiegirl's blog, I am one of those odd people who always wanted to be a librarian. My Mum and careers adviser both said it was a daft idea as 1) there'd be no jobs as computers would be doing everything by then (careers advisor) and 2) there's no money in it (Mums advice, herself a lifelong librarian). I actually was surrounded by librarians: Mum worked in libraries her whole career from the local branch library (when I say local, I mean local: 100 yards from my parents house) to the secondary school I went to (although years before I went there). My Aunt worked alongside my Mum for a while before emigrating, and has worked various shifts as cover in the local library since coming back home. So, I kinda grew up in libraries: I would...
4 comments
Read more