Skip to main content

Information security, and how not to do it

On the 21st of this month, I received an email from a company*, advertising their upcoming online seminar, and various other online courses they ran, including ones on the Data Protection Act, and information security.
Since I wasn't interested in their courses, and didn't remember signing up to receive any marketing materials from this company,  I clicked on the unsubscribe link. However, when the unsubscribe page opened, the name and email fields were already completed...and none of the information was mine.
In fact, the email address was for a Junior School in Portsmouth (edited version below).


This is not great, in terms of information security...you know, that thing they're running online courses on?
So, I replied to them within an hour, pointing out that the information in those fields was not mine, and they might want to do something about that.
To date, I've not received an acknowledgement of my email, or any form of response.
I was also not alone in receiving this email, and finding someone elses information in the form when following the unsubscribe link.

However, in the days since, the form the link leads to has changed....well, to be specific, the information viewable in the form has changed. Yes, it's gone from being the contact details of the school in Portsmouth, to the address of a private school yesterday, and today, one for a university. The first two times, the emails were admin addresses, but the university address is the work email of an individual, with their proper name in it (instead of, as above "No" and "Thanks" being the name).

Now, mistakes happen, and making a link to a form that shows the details of the last person who's used it was probably an accident. But this is not how you deal with it.

What would I have done if this had been my mistake?

  • When I got the email pointing it out, I would have responded to the person contacting me, apologising for the issue, and thanking them for bringing it to my attention
  • I would have deactivated the link immediately
  • I would have got whatever glitch it is that's preserving the last page user information fixed
  • Once that was done, I would have emailed everyone that had received the previous email, apologising for the issue, and telling them that the unsubscribe link was now secure and anonymous
This company has done none of that. Allowing anyone to view names and email addresses of strangers is not as serious as sharing work or home addresses, or more sensitive personal information, but this is a company which is running a business specifically selling training on data protection, and information security. Hands up who'd feel confident about using their training, if this is how they put it into practice?

*I have not named the company here, but contact me directly if you would like to know who it is.

Comments

Michael said…
I believe it's known as the "easy come, easy go" approach to data security.

It's commonly practiced by most high street banks I gather! ;-)

Popular posts from this blog

What's in a name?

In the case of this blog, it's a name that had no particular thought or planning behind it - I had no idea whether I would actually want to keep it going, what I would blog about, or that anyone would ever read it. Well, it's almost 4 years later (17th June 2007 is blog birthday, if we're counting), and the blog's still here, so I think we can now safely assume that it's probably going to be sticking around. And the name's been getting on my nerves a bit...you have no idea the amount of people who have found this blog looking for ladies called Jennie Law or Jenny Law. Personally, I'm not actually called Jennie Law, so I'm no help to these poor searchers, although for the right fee I could maybe consider pretending to be... I also don't blog a huge amount about law: I'm not a lawyer, I just have the job of finding stuff for lawyers. Sometimes that process amuses me, sometimes it annoys me, and I blog about it. Sometimes I write about library is

The mysteries of cataloguing

Cataloguing: an arcane art, where each piece of punctuation is significant, and commas and semi colons are all-powerful. Well, they are in "proper" libraries, where in-depth research of esoteric points goes on, and the precise spelling of Christian names, and information such as when a person lived and died can be crucial in pinpointing obscure facts. Here, we have our own catalogue system. It doesn't have a name, but if it did, it would probably be something along the lines of "I need this book NOW, no I don't care about the precise spelling of the authors middle name, or their date of birth." I know, I know, it's not snappy, but it's accurate. Cataloguing demands are different in a commercial law firm: we don't care about much more than what it's about, who wrote, when, and what jurisdiction it covers. And what we really, really care about is "where the hell is it". Law books are amazing: they have the power to move themselves f

UK librarian blogs - the list so far

I’ve pulled the previous entries into one alphabetical list, with a few categories. Will be back later with more detailed discussion of what I’ve learned by doing this. And, as always, if you know of other librarian blogs, let me know and I’ll add them in! Institutional Library Blogs / Professional Group Blogs aRKive Appears to be the blog of the Reid Kerr College library, or someone related to the Library, but unable to confirm as it doesn’t have any ‘about’ section that I can find. Lots of posts about library topics, books, IT… Brit Lib Blogs Google Group There’s a Google Group for British librarian bloggers! Unfortunately it looks to be pretty much unused at the moment. CILIP Blogs CILIP has various blogs by either staff, or links to relevant blogs, available from the Communities section. Varying levels of activity on these blogs – the PTEG blog has one post from November 2007, while Lyndsay’s CILIP Blog has been going has been going for almost a year, with at le