Whoops

Labour leak index

Labour accidentally left a server open for anyone to have a look around, and people looked. Using a website that checks what other sites are hosted on a specific web server, Cameron Slater (Whale Oil) says he found that Labour’s healthyhomeshealthykiwis.org.nz was hosted on the same server as lets-not.co.nz. Healthyhomeshealthykiwis.org.nz turned out to list the files and directories on the server. Drilling down, Cameron found that backups were on the server which contained records of donations and email addresses from Labour’s mailing lists. He explains further in a video on this post.

Stealing?

Comparisons to someone stealing something from an unlocked house (or in one comment I read, looting quaked houses in Christchurch) seem misguided. This is more like someone from Labour standing on the street and accidentally including email addresses and donation information in handouts.

Release of personal information

Cameron was going to, but now has said he won’t release the personal information of individuals obtained from the server, a decision which I support as there is no public interest in identifying the Average Joe donator or mailing list subscriber.

Labour leak site indexNational’s involvement

John Pagani (former senior adviser to Labour leader Phil Goff) was apparently given access to the logs (I’m not sure why it seemed like a good idea to Labour to further spread the access logs, complete with IP addresses) and says that the second IP address to access one of the backup files was 202.20.0.120 which resolves to mail.national.org.nz—a National party mail server. So if that’s true, National knew of the security hole in Labour’s website. In the perfect world, even though it’s not their job to, they would have informed Labour, but apparently chose not to. John continues that the logs prove that National tipped Cameron off about the gaping security hole as Cameron appears to be the next person to access this specific backup file. This is plausible, but isn’t proven by the logs. Neither of the above excuse the fact that the server should have been secure to begin with.

Credit card information

Labour says that “no credit card details were held on the site. All people whose privacy may have been compromised have been informed.”

Flo2Cash who handle Labour’s credit card payments say: “All donor credit card data is fully encrypted… the Flo2Cash system… is completely isolated from the Labour Party website… the recent Labour Party website breach has not resulted in any compromise of donor credit card data.”

Do you think National should have let Labour know about the security hole, or, if they did: tip Whale Oil off about it?

New Zealand Post’s Lifestyle Survey

New Zealand PostShop DevonportToday in the post we received New Zealand Post’s “lifestyle survey”, a controversial data collecting tool that’s recently been in the news because the information collected is used to market your address to other companies. The survey is sent to 800,000 households by post and 125,000 by email and asks 56 questions about various things, split into sections on your interests, vehicles, home, finances, shopping habits and travel. New Zealand Post sells names and addresses of respondents, “but not the information they provided in the survey”, for companies to use once. Information is also used to furnish New Zealand Post’s direct marketing tool named Genius which says it helps clients “gain deeper insights and understanding into your customers, particularly around wealth, life stage and lifestyle”.

2009 version

Reports ordered by the Privacy Commissioner concluded that the 2009 version breached privacy principles and violated marketing industry standards for not providing “adequate, non-misleading information about the survey’s (primary) nature and/or purpose” and asking respondents to answer questions about their partners”. Professor Malcolm Wright, head of communications, journalism and marketing at Massey University say that it shouldn’t be called a survey but “an opportunity to join a direct mail database”. Auckland University former marketing lecturer Linda Hollebeek says that a lot of people won’t be aware that New Zealand Post is shifting into a more commercial strategic direction including the compiling of databases for on-selling to marketers.

Wave around a chocolate bar (or $15k) to get what you want

Privacy Commissioner, Marie Shroff argues that people are often dazzled by competitions and giveaways and might foolishly give away personal information. I think this has been shown to be true by numerous research projects where people are happy to hand over their passwords for a chocolate bar, pen or for the chance to win a trip overseas. Close Up in conjunction with NetSafe offered a Moro bar up for grabs for anyone on Auckland’s Queen Street who was willing to answer a short survey, of which the first question was “what is your password?”. 59% of people gave their password (about half of people use the same password everywhere) and those conducting the survey said that the answers to other questions suggested the majority of passwords were legitimate. You can watch the full video here (apologies if it’s blocked in your country). The shorts for tonight’s episode of Fair Go (22nd June 2011) shows a man on the street asking people personal questions, which I’m guessing most people answered. If you’re interested in the New Zealand Post survey it will probably be interesting to watch.

New Zealand Post thinks they’re being clear

John Tulloch, New Zealand Post’s communication manager said the survey states numerous times that it’s optional and the information “could be used by other companies”. I call bullshit.

New Zealand Post Lifestyle Survey 2011 Cover

(I’ve uploaded the full version of the survey here (pdf).)

Spot where New Zealand Post states “numerous times” that the information could be used by other companies. Hint, about once.

The top paragraph states: “New Zealand Post wants to help you receive more relevant mail. We invite you to complete this voluntary survey and tell us about you and your household, so we can help tailor the messages that you receive. These messages will be from companies with products and services related to your interests” (emphasis is theirs).

I’m not counting this one because I don’t think this is clear that companies will actually be given your information. For example, Fly Buys forwards material on behalf of places you’ve shopped at, but the shops never see your personal information. Nor am I counting the text at the bottom of the page: “in addition to receiving selected offers addressed to you through the mail…” as this doesn’t state at all that those offers won’t be from New Zealand Post.

The one time I’m counting (and only other time in the whole form sharing of information is mentioned) is the fourth small print bullet point under “Here’s how it all works” which states:

Privacy: If you participate in The New Zealand Lifestyle Survey, your name, address and other information you supply (including your email and telephone numbers if you tick the boxes below), may be provided to companies and other organizations from New Zealand and overseas to enable them to provide you and/or your household with information about products and services relevant to your responses to this survey. New Zealand Post may also use that information for the same purpose.

Sure I’ll give them that they’ve made it clear that the survey is voluntary (mentioned about four times on the front page). But they only say that information may be provided to other companies, even though that’s the primary purpose of the survey. There is no mention of the information being sold in the whole form.

Blinded

So it’s still true that you need better eyesight to find out that your information is going to be shared than to learn of the cash, television sets and travel packages on offer for participants (if you happened to not be blinded by them, they’re shown in the massive images that take up a third of the first page).

Engaging in direct marketing services is part of New Zealand Post’s job according to the State Enterprises Act. Maybe we need a law change.

Would you fill out this survey? Do you care that New Zealand Post is selling names and addresses?

Image credit: Chatani