5 ms·

The writer has fessed up to reading a lot of the emails. As evidenced by summarizing the content (e.g. cheating spouses, zabbix etc.). Wouldn't the responsible

The writer has fessed up to reading a lot of the emails. As evidenced by summarizing the content (e.g. cheating spouses, zabbix etc.). Wouldn't the responsible thing to do be stop reading the emails once you realise what is going on?

0xfffff 8y ago
I had the same thought - he seems to have indulged in the data quite a bit to come up with such a thourough analysis.
- JoeSmithson 8y ago
  I would love to hear his explanation for why he thought reading through them all was necessary. I'm not surprised the city requested 3rd party proof he had deleted them, he clearly demonstrated a fascination with their contents
- danso 8y ago
  What was thorough about his analysis? He mentions a few things that could easily be detected with grep within a corpus of millions of messages.
bpchaps 8y ago
I probably only spent 30 minutes looking at it and used a few regular expressions to look for anything interesting. The point there was to understand the extent of the leak so that I could raise it in the intent of being taken seriously. A search for "(Fuck|Shit|Bitch)" can go a long way. For what it's worth, I used to work at an investment bank spending 30hr/week diving through logs with unix tools, so finding interesting information quickly is something I've learned to do quickly.
- jacquesm 8y ago
  FWIW I think you should not have done that, though I understand the temptation. At the first indication that the data was not what you requested and contained more than you - or they - bargained for you should have stopped looking at it and alerted both the sender and the relevant data protection authorities in so far as those are a functioning entity where you live to tell them they have an 'accidental disclosure' on their hands. Essentially your blog post documents something that is pretty strong proof you are not able to deal with confidential information properly.
  - Aeolun 8y ago
    If all that information is available in plaintext to the relevant IT department, does it really matter that one other person is party to it? I guess if all that is in those records I’m going to commend the Seattle IT department for their ethics at least. It’s amazing what people think they can put in emails/messages and have stay secure...
    - jacquesm 8y ago
      There is a huge difference between releasing the information to the public and having IT workers under NDA with the ability to access it. And depending on their set-up that could be a lot harder than it might seem from the outside. Though, in truth I doubt it was set up properly, but absent evidence we can't make assumptions either way. One citizens communications with the city should not automatically result in disclosure of the fact that that person communicated with the city to other citizens. The fact that a communication took place in itself is information, and correlated with things like timestamps and who in the city was contacted a large amount of sensitive information will leak out.
  - bpchaps 8y ago
    Fair. Though, in my defense, the last time I tried to report a similarly large leak (completely different circumstances), it wasn't until I was very explicit in what I found that the report was taken seriously and sent to the appropriate place. Otherwise, I think reports like this are just added to a pile of other complaints. In this case, it took about a week for them to take it seriously. Like last time, it wasn't until I was explicit that they took it seriously.
  - sverhagen 8y ago
    Just curious, are there established guidelines that are broadly accepted and that lay out how to proceed? Or is it really just down to the "I think you should" on Hacker News? (No snark intended here.)
    - jacquesm 8y ago
      Accidental disclosure is a gray area, and once you are aware of it being an accidental disclosure you will want to make sure that you do not make things worse through your actions. There are a number of moving parts here: - The disclosure was clearly not the intended result - The recipient could - and in fact did - realize this - The recipient was in contact with the sender - The recipient had some easy means to redress the situation Given all of the above, if you then dig in and start looking at the data I think you are crossing a line. At a minimum a legal professional should have been consulted before further examination of the data, once it became obvious something was wrong. In the end it would have been down to a judge to decide whether that crosses the line in a criminal sense but I would be loathe to find out the hard way. Pick your battles and all that.

0xfffff 8y ago

I had the same thought - he seems to have indulged in the data quite a bit to come up with such a thourough analysis.

JoeSmithson 8y ago
I would love to hear his explanation for why he thought reading through them all was necessary. I'm not surprised the city requested 3rd party proof he had deleted them, he clearly demonstrated a fascination with their contents
danso 8y ago
What was thorough about his analysis? He mentions a few things that could easily be detected with grep within a corpus of millions of messages.

bpchaps 8y ago

I probably only spent 30 minutes looking at it and used a few regular expressions to look for anything interesting. The point there was to understand the extent of the leak so that I could raise it in the intent of being taken seriously. A search for "(Fuck|Shit|Bitch)" can go a long way. For what it's worth, I used to work at an investment bank spending 30hr/week diving through logs with unix tools, so finding interesting information quickly is something I've learned to do quickly.

jacquesm 8y ago
FWIW I think you should not have done that, though I understand the temptation. At the first indication that the data was not what you requested and contained more than you - or they - bargained for you should have stopped looking at it and alerted both the sender and the relevant data protection authorities in so far as those are a functioning entity where you live to tell them they have an 'accidental disclosure' on their hands. Essentially your blog post documents something that is pretty strong proof you are not able to deal with confidential information properly.
- Aeolun 8y ago
  If all that information is available in plaintext to the relevant IT department, does it really matter that one other person is party to it? I guess if all that is in those records I’m going to commend the Seattle IT department for their ethics at least. It’s amazing what people think they can put in emails/messages and have stay secure...
  - jacquesm 8y ago
    There is a huge difference between releasing the information to the public and having IT workers under NDA with the ability to access it. And depending on their set-up that could be a lot harder than it might seem from the outside. Though, in truth I doubt it was set up properly, but absent evidence we can't make assumptions either way. One citizens communications with the city should not automatically result in disclosure of the fact that that person communicated with the city to other citizens. The fact that a communication took place in itself is information, and correlated with things like timestamps and who in the city was contacted a large amount of sensitive information will leak out.
- bpchaps 8y ago
  Fair. Though, in my defense, the last time I tried to report a similarly large leak (completely different circumstances), it wasn't until I was very explicit in what I found that the report was taken seriously and sent to the appropriate place. Otherwise, I think reports like this are just added to a pile of other complaints. In this case, it took about a week for them to take it seriously. Like last time, it wasn't until I was explicit that they took it seriously.
- sverhagen 8y ago
  Just curious, are there established guidelines that are broadly accepted and that lay out how to proceed? Or is it really just down to the "I think you should" on Hacker News? (No snark intended here.)
  - jacquesm 8y ago
    Accidental disclosure is a gray area, and once you are aware of it being an accidental disclosure you will want to make sure that you do not make things worse through your actions. There are a number of moving parts here: - The disclosure was clearly not the intended result - The recipient could - and in fact did - realize this - The recipient was in contact with the sender - The recipient had some easy means to redress the situation Given all of the above, if you then dig in and start looking at the data I think you are crossing a line. At a minimum a legal professional should have been consulted before further examination of the data, once it became obvious something was wrong. In the end it would have been down to a judge to decide whether that crosses the line in a criminal sense but I would be loathe to find out the hard way. Pick your battles and all that.