8 ms·

I'm very surprised they gave out this information. I'm not talking about the mistake, I mean the actual request. In the UK I don't think you could even get a pr

I'm very surprised they gave out this information. I'm not talking about the mistake, I mean the actual request. In the UK I don't think you could even get a production order for this. Like, it's effectively getting Communications Data simultaneously against thousands of people not suspected of any crimes?? Like, do people know that by emailing their local government their email address is now free for scammers to request under FOI? Could I request this data myself, then start emailing them scam emails "I know you contacted us in June, could you call me on 555-1223 etc" This seems totally against the spirit of FOI

jacquesm 8y ago
Yes, you are as far as I can see correct. The request should have been rejected as overbroad and against data privacy laws (in so far as they exist), or the purpose of the request could have been verified and then they might have seen whether or not there was another way to let the requester do their work without giving them the data they requested (see another comment of mine for one suggestion).
- wegs2 8y ago
  That's not how FOIA works. It's a good thing too. Government employees almost always fight FOIA requests. There aren't many subjective tools (e.g. overbroad) and you're certainly not required to say why you're making the request. Data privacy laws in the US are unfortunately minimal. The bigger problem comes from imbalance -- if the government and corporations have lists of names, people need them to in order to be able to work together and organize. If you don't think this information should go out in FOIA requests, the tool to accomplish that is data destruction. Government could wipe old emails once no longer relevant.
  - sverhagen 8y ago
    Commercial organizations at least are known to implement maximum allowed retention strategies, such as having their staff not keep archived email beyond three months, presumably so it doesn't embarrassingly show up when it's legally unfavorable. Not quite the same, but along the same lines.
  - Spooky23 8y ago
    Email is really difficult because retention law and regulation is based on a topic. To meet federal requirements, information about procuring equipment with certain grants must be maintained for 10 years. Caseworker notes for a minor who is a ward of the state may be required to be kept for 20 years after the 18th birthday. If a record is deemed in scope and topical, an employee could be committing a crime by deleting that email. As a result, the easy answer is retain.
- danso 8y ago
  No, the Washington State law does not allow for agencies to reject requests on the basis of being overly broad or against data privacy laws. There are specific exemptions (e.g. library records), and for records that may contain personal info (like someone emailing the mayor and including their own credit card number), it is up to the agency to redact such info. However, the agency can charge the requester for that work. Moreover, the requester is not required to give a reason for the request. https://www.muckrock.com/place/united-states-of-america/washington/ https://www.muckrock.com/place/united-states-of-america/wash... https://www.rcfp.org/washington-open-government-guide/ii-exemptions-and-other-legal-limitations/exemptions-open-records-4 https://www.rcfp.org/washington-open-government-guide/ii-exe...
  - jacquesm 8y ago
    Ok, so in that case redaction would have been the way to go here. But the request as it is actually harms the privacy of large numbers of individuals which is not what the FOI laws are supposed to be used for. Also, of course Seattle could reject the request, they could simply say: "Without an explicit court order to release this information we will not do so", and that would be that. It would then be upon the petitioner to ask the courts to force the release of the information requested, if the petitioner felt his rights had been violated. In the present situation the city is opening itself up to liability because of the privacy of all the people they have exposed (and more so because of the mistake). FOI does not mean 'every piece of data the government has should be released to the requester', the goal is increased transparency of government, not privacy violation of citizens using the FOI requests as an end-run around any kind of privacy law. There is a tension between those two and typically the legal branch will determine where exactly the line is, when in doubt: go to court.
    - danso 8y ago
      But Seattle cannot summarily reject the request -- they have to follow the law, and the law does not require FOI requesters to get an explicit court order, e.g. a subpoena, for this information or for any other valid request. I mean, yes, the city of Seattle could try to reject the request, and the requester could sue and win in court after the judge finds that the city acted illegally. But that's like saying Seattle police "can" just arbitrarily arrest and imprison people, and fight the subsequent lawsuits. Because the FOI law exists, the city does not open itself to liability in releasing records, except when it accidentally releases records that are mandated to be private, which I'm not even sure is the situation here. Increased transparency is almost always a tradeoff with privacy. I don't disagree with you that the law may be abused for commercial or malicious intent, but it is up to the legislature to propose a bill that curbs FOI. Until then, the government cannot just deny valid requests because they don't approve of the requester or the requester's purported motives.
c3534l 8y ago
I have never assumed that an email address I gave the government would be protected. I would also not assume that the contents of any email I sent would be in any way protected either. The government is collectively owned. Your police record, where you live, who you're married to, and whether or not you voted last election are publicly available. I would rather all of that be protected in some way, but I think it's common knowledge that a lot about you is made public to anyone who wants to walk down to the courthouse. In fact, if you want to take a trip to Hawaii, you can drop in and see a copy of Obama's famously "missing" birth certificate. I am rather shocked that credit card numbers are being emailed about.
- rocqua 8y ago
  > I have never assumed that an email address I gave the government would be protected. I would also not assume that the contents of any email I sent would be in any way protected either. I have similar assumptions, but what about the less technically inclined citizens? Moreover, I wouldn't be surprised if the ploy described by the OP: > Could I request this data myself, then start emailing them scam emails "I know you contacted us in June, could you call me on 555-1223 etc" would work on me. Really, it would take me checking DKIM and/or SPF to notice such an email. And from this story it seems likely the city of Seattle doesn't actually implement DKIM or SPF.
  - wolco 8y ago
    DKIM and/or SPF can be a liability if you want to accept everyone's email. Only use if filtering is more important.
- tgsovlerkhgsel 8y ago
  > Your police record, where you live, who you're married to, and whether or not you voted last election are publicly available. This is highly country specific. For the marriage record, I checked the laws in Germany, and (except for your own records) you have to present a "legal interest", which seems to be stricter than a "legitimate interest" (i.e. probably you need the information to enforce your rights, not just because you want to do genealogy). I'm pretty sure the others would count as particularly sensitive personal data too.
rcw4256 8y ago
The Washington State Public Records Act, which this request was made under, states its spirit very unambiguously: The people of this state do not yield their sovereignty to the agencies that serve them. The people, in delegating authority, do not give their public servants the right to decide what is good for the people to know and what is not good for them to know. The people insist on remaining informed so that they may maintain control over the instruments that they have created. This chapter shall be liberally construed and its exemptions narrowly construed to promote this public policy and to assure that the public interest will be fully protected. In the event of conflict between the provisions of this chapter and any other act, the provisions of this chapter shall govern. http://app.leg.wa.gov/RCW/default.aspx?cite=42.56.030 http://app.leg.wa.gov/RCW/default.aspx?cite=42.56.030
- dclowd9901 8y ago
  Beautifully put. This information is _there_ whether we like it or not. I’d rather have as much access to it as a government employee than none at all.
  - deleted 8y ago
    [deleted]
ehsankia 8y ago
The part I found even more strange is that people are sending their credit card numbers and other personal information through e-mail...
- technion 8y ago
  People laugh at most DLP solutions. I know I used to. But then, I used to think the target was smart people trying to exfiltrate data. But then I implemented one on a busy mail system, and I started seeing credit card numbers very regularly. I mean, consistently. Even after people have been told why their emails are being bounced and no, I give an "ETA on when it will be fixed".
- jimnotgym 8y ago
  Are you really shocked by this? I guess you have never worked on a corporate email system! People do this all of the time. 1) They don't realise email is not secure 2) When you explain point 1, all of the other solutions seem like too much hassle so they email anyway. 3) You can tell your customers not to email you CC numbers, you can even refuse them, but they will keep sending them
  - wegs2 8y ago
    Or they think it's an acceptable risk... $50 liability limit.
    - jimnotgym 8y ago
      That's the thing with credit cards. The merchant always ends up paying.
  - tzs 8y ago
    ...and if you provide online chat with customer support or sales, people will send credit cards in that too. If you have customer accessible support ticket submission system, that will end up with credit cards too. The Payment Card Industry Data Security Standard (PCI DSS) that you have to agree to follow in order to be allowed to process credit cards requires secure storage of all the cards you store--not just the cards that you intended to store or just cards that come in through channels you intended for receiving cards. This is a serious issue to take into account when choosing your chat system, ticketing system, and email system because you can't just ignore those wayward credit cards. If you choose systems whose developers did not consider this and failed to provide good tools for finding and redacting unrequested, unwanted sensitive information you will end up having to hack such tools into the system yourself.
Spooky23 8y ago
The answer is that no, that request should not be filled, and certainly not in that way. From a FOI POV, email is tough because it straddles a line between “record”, deliberative material and conversation. Everyone hates sharing email because it is always trouble. In this case, they didn’t have a good process in place and nobody did a privilege or other review. The hint there is the police material — most police records are trivially made exempt from foi in most places. But to your point, there are many categories of communication with government where there is literally no expectation of privacy. If you email the zoning board something, you should fully expect to see the entire email in a public record somewhere.
coolboy93290 8y ago
Similar story. I worked at a polling company out of college owned by a Standford professor. My first task: After a poll is finished online, match that with voter records (using emails and addresses). My first question was: "Well, that is a cool idea, but, there is no way the government would release a huge database of every california voter and their party affiliation. Let alone, the users entering in online poll information would extend that database to include their actual vote. There is no way this is possible.... right?" Standford professor's response: "Do you want it in CSV?"
- danso 8y ago
  Voter registration is considered public information in many states. Some states even provide the entire database on their website to download. However, voter registration does not include who a person voted for in an election. You are free to augment the database with your own data, of course.
  - maxxxxx 8y ago
    I don't even understand why party affiliation is tracked by the state. What's that good for other than entrenching the two party state? Parties should have their own member lists.
    - Spooky23 8y ago
      Mostly for primary eligibility. It also allows for things like ensuring that poll watchers etc are available in a equitable way.
      - maxxxxx 8y ago
        Why is the state getting involved in primaries? That should be the parties' business. I think there should be no public record of party affiliation.
        danso 8y ago
btrettel 8y ago
I have filed both US and UK FIO requests. (But I am not a lawyer.) I think you are right in the UK. The US law is different and seems to allow this sort of broad request. I have been told before when filing in the US that others may request my contact information, and I have seen lists of FOIA requests received via the FOIA including contact information for requesters. In the UK, requests need to be fairly narrow as I recall. And the time frames in which the request will be processed also are narrow: 20 business days as I recall. If it would take longer than that you probably would be asked to narrow the request. This is good for me as I typically request individual documents, not huge swarths of data. I requested a classified UK technical report and received a redacted copy within a month as I recall. Much faster than in the US.
danso 8y ago
> Could I request this data myself, then start emailing them scam emails Yes, bad actors can find malicious uses for a dataset. Not sure what that has to do with FOI. Are you suggesting that people who email the government expect their email to remain private, even as that email may be forwarded to a number of agencies and employees?
- edoceo 8y ago
  Using FOIA data for marketing is not legal in USA. It is done but not legal and hard to prove.
  - danso 8y ago
    Some state laws do not restrict commercial usage [0] amd AFAIK, there is nothing in the federal FOIA law that prevents using information for marketing or other commercial purposes. That wasn't my point, though. The parent commenter talks about the potential danger of phishers using public data as being "against the spirit of FOI". Yes, I agree that using FOI to find info that facilitates a crime is not FOI's intended usecase. But the potential drawback has not been determined by legislators to outweigh all the potential benefits of transparency. [0] https://www.mcall.com/news/watchdog/mc-nws-open-records-business-requests-20180220-story.html https://www.mcall.com/news/watchdog/mc-nws-open-records-busi...
nandhp 8y ago
> do people know that by emailing their local government their email address is now free for scammers to request under FOI? Florida, which has fairly broad open records laws, at least makes this extremely clear: http://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0600-0699/0668/Sections/0668.6076.html http://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Displ... > Any agency, as defined in s. 119.011, or legislative entity that operates a website and uses electronic mail shall post the following statement in a conspicuous location on its website: > Under Florida law, e-mail addresses are public records. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing.
- lostlogin 8y ago
  Why is it like that? Do they give out your phone number or postal address if you contact them via those channels?
  - riquito 8y ago
    I suppose they treat e-mail addresses as street addresses. Public and not tied to anything else by default (you know it exists but not who is assigned to)

jacquesm 8y ago

Yes, you are as far as I can see correct. The request should have been rejected as overbroad and against data privacy laws (in so far as they exist), or the purpose of the request could have been verified and then they might have seen whether or not there was another way to let the requester do their work without giving them the data they requested (see another comment of mine for one suggestion).

wegs2 8y ago
That's not how FOIA works. It's a good thing too. Government employees almost always fight FOIA requests. There aren't many subjective tools (e.g. overbroad) and you're certainly not required to say why you're making the request. Data privacy laws in the US are unfortunately minimal. The bigger problem comes from imbalance -- if the government and corporations have lists of names, people need them to in order to be able to work together and organize. If you don't think this information should go out in FOIA requests, the tool to accomplish that is data destruction. Government could wipe old emails once no longer relevant.
- sverhagen 8y ago
  Commercial organizations at least are known to implement maximum allowed retention strategies, such as having their staff not keep archived email beyond three months, presumably so it doesn't embarrassingly show up when it's legally unfavorable. Not quite the same, but along the same lines.
- Spooky23 8y ago
  Email is really difficult because retention law and regulation is based on a topic. To meet federal requirements, information about procuring equipment with certain grants must be maintained for 10 years. Caseworker notes for a minor who is a ward of the state may be required to be kept for 20 years after the 18th birthday. If a record is deemed in scope and topical, an employee could be committing a crime by deleting that email. As a result, the easy answer is retain.
danso 8y ago
No, the Washington State law does not allow for agencies to reject requests on the basis of being overly broad or against data privacy laws. There are specific exemptions (e.g. library records), and for records that may contain personal info (like someone emailing the mayor and including their own credit card number), it is up to the agency to redact such info. However, the agency can charge the requester for that work. Moreover, the requester is not required to give a reason for the request. https://www.muckrock.com/place/united-states-of-america/washington/ https://www.muckrock.com/place/united-states-of-america/wash... https://www.rcfp.org/washington-open-government-guide/ii-exemptions-and-other-legal-limitations/exemptions-open-records-4 https://www.rcfp.org/washington-open-government-guide/ii-exe...
- jacquesm 8y ago
  Ok, so in that case redaction would have been the way to go here. But the request as it is actually harms the privacy of large numbers of individuals which is not what the FOI laws are supposed to be used for. Also, of course Seattle could reject the request, they could simply say: "Without an explicit court order to release this information we will not do so", and that would be that. It would then be upon the petitioner to ask the courts to force the release of the information requested, if the petitioner felt his rights had been violated. In the present situation the city is opening itself up to liability because of the privacy of all the people they have exposed (and more so because of the mistake). FOI does not mean 'every piece of data the government has should be released to the requester', the goal is increased transparency of government, not privacy violation of citizens using the FOI requests as an end-run around any kind of privacy law. There is a tension between those two and typically the legal branch will determine where exactly the line is, when in doubt: go to court.
  - danso 8y ago
    But Seattle cannot summarily reject the request -- they have to follow the law, and the law does not require FOI requesters to get an explicit court order, e.g. a subpoena, for this information or for any other valid request. I mean, yes, the city of Seattle could try to reject the request, and the requester could sue and win in court after the judge finds that the city acted illegally. But that's like saying Seattle police "can" just arbitrarily arrest and imprison people, and fight the subsequent lawsuits. Because the FOI law exists, the city does not open itself to liability in releasing records, except when it accidentally releases records that are mandated to be private, which I'm not even sure is the situation here. Increased transparency is almost always a tradeoff with privacy. I don't disagree with you that the law may be abused for commercial or malicious intent, but it is up to the legislature to propose a bill that curbs FOI. Until then, the government cannot just deny valid requests because they don't approve of the requester or the requester's purported motives.

c3534l 8y ago

I have never assumed that an email address I gave the government would be protected. I would also not assume that the contents of any email I sent would be in any way protected either. The government is collectively owned. Your police record, where you live, who you're married to, and whether or not you voted last election are publicly available. I would rather all of that be protected in some way, but I think it's common knowledge that a lot about you is made public to anyone who wants to walk down to the courthouse. In fact, if you want to take a trip to Hawaii, you can drop in and see a copy of Obama's famously "missing" birth certificate. I am rather shocked that credit card numbers are being emailed about.

rocqua 8y ago
> I have never assumed that an email address I gave the government would be protected. I would also not assume that the contents of any email I sent would be in any way protected either. I have similar assumptions, but what about the less technically inclined citizens? Moreover, I wouldn't be surprised if the ploy described by the OP: > Could I request this data myself, then start emailing them scam emails "I know you contacted us in June, could you call me on 555-1223 etc" would work on me. Really, it would take me checking DKIM and/or SPF to notice such an email. And from this story it seems likely the city of Seattle doesn't actually implement DKIM or SPF.
- wolco 8y ago
  DKIM and/or SPF can be a liability if you want to accept everyone's email. Only use if filtering is more important.
tgsovlerkhgsel 8y ago
> Your police record, where you live, who you're married to, and whether or not you voted last election are publicly available. This is highly country specific. For the marriage record, I checked the laws in Germany, and (except for your own records) you have to present a "legal interest", which seems to be stricter than a "legitimate interest" (i.e. probably you need the information to enforce your rights, not just because you want to do genealogy). I'm pretty sure the others would count as particularly sensitive personal data too.

rcw4256 8y ago

The Washington State Public Records Act, which this request was made under, states its spirit very unambiguously: The people of this state do not yield their sovereignty to the agencies that serve them. The people, in delegating authority, do not give their public servants the right to decide what is good for the people to know and what is not good for them to know. The people insist on remaining informed so that they may maintain control over the instruments that they have created. This chapter shall be liberally construed and its exemptions narrowly construed to promote this public policy and to assure that the public interest will be fully protected. In the event of conflict between the provisions of this chapter and any other act, the provisions of this chapter shall govern. http://app.leg.wa.gov/RCW/default.aspx?cite=42.56.030 http://app.leg.wa.gov/RCW/default.aspx?cite=42.56.030

dclowd9901 8y ago
Beautifully put. This information is _there_ whether we like it or not. I’d rather have as much access to it as a government employee than none at all.
- deleted 8y ago
  [deleted]

ehsankia 8y ago

The part I found even more strange is that people are sending their credit card numbers and other personal information through e-mail...

technion 8y ago
People laugh at most DLP solutions. I know I used to. But then, I used to think the target was smart people trying to exfiltrate data. But then I implemented one on a busy mail system, and I started seeing credit card numbers very regularly. I mean, consistently. Even after people have been told why their emails are being bounced and no, I give an "ETA on when it will be fixed".
jimnotgym 8y ago
Are you really shocked by this? I guess you have never worked on a corporate email system! People do this all of the time. 1) They don't realise email is not secure 2) When you explain point 1, all of the other solutions seem like too much hassle so they email anyway. 3) You can tell your customers not to email you CC numbers, you can even refuse them, but they will keep sending them
- wegs2 8y ago
  Or they think it's an acceptable risk... $50 liability limit.
  - jimnotgym 8y ago
    That's the thing with credit cards. The merchant always ends up paying.
- tzs 8y ago
  ...and if you provide online chat with customer support or sales, people will send credit cards in that too. If you have customer accessible support ticket submission system, that will end up with credit cards too. The Payment Card Industry Data Security Standard (PCI DSS) that you have to agree to follow in order to be allowed to process credit cards requires secure storage of all the cards you store--not just the cards that you intended to store or just cards that come in through channels you intended for receiving cards. This is a serious issue to take into account when choosing your chat system, ticketing system, and email system because you can't just ignore those wayward credit cards. If you choose systems whose developers did not consider this and failed to provide good tools for finding and redacting unrequested, unwanted sensitive information you will end up having to hack such tools into the system yourself.

Spooky23 8y ago

The answer is that no, that request should not be filled, and certainly not in that way. From a FOI POV, email is tough because it straddles a line between “record”, deliberative material and conversation. Everyone hates sharing email because it is always trouble. In this case, they didn’t have a good process in place and nobody did a privilege or other review. The hint there is the police material — most police records are trivially made exempt from foi in most places. But to your point, there are many categories of communication with government where there is literally no expectation of privacy. If you email the zoning board something, you should fully expect to see the entire email in a public record somewhere.

coolboy93290 8y ago

Similar story. I worked at a polling company out of college owned by a Standford professor. My first task: After a poll is finished online, match that with voter records (using emails and addresses). My first question was: "Well, that is a cool idea, but, there is no way the government would release a huge database of every california voter and their party affiliation. Let alone, the users entering in online poll information would extend that database to include their actual vote. There is no way this is possible.... right?" Standford professor's response: "Do you want it in CSV?"

danso 8y ago
Voter registration is considered public information in many states. Some states even provide the entire database on their website to download. However, voter registration does not include who a person voted for in an election. You are free to augment the database with your own data, of course.
- maxxxxx 8y ago
  I don't even understand why party affiliation is tracked by the state. What's that good for other than entrenching the two party state? Parties should have their own member lists.
  - Spooky23 8y ago
    Mostly for primary eligibility. It also allows for things like ensuring that poll watchers etc are available in a equitable way.
    - maxxxxx 8y ago
      Why is the state getting involved in primaries? That should be the parties' business. I think there should be no public record of party affiliation.
      - danso 8y ago

btrettel 8y ago

I have filed both US and UK FIO requests. (But I am not a lawyer.) I think you are right in the UK. The US law is different and seems to allow this sort of broad request. I have been told before when filing in the US that others may request my contact information, and I have seen lists of FOIA requests received via the FOIA including contact information for requesters. In the UK, requests need to be fairly narrow as I recall. And the time frames in which the request will be processed also are narrow: 20 business days as I recall. If it would take longer than that you probably would be asked to narrow the request. This is good for me as I typically request individual documents, not huge swarths of data. I requested a classified UK technical report and received a redacted copy within a month as I recall. Much faster than in the US.

danso 8y ago

> Could I request this data myself, then start emailing them scam emails Yes, bad actors can find malicious uses for a dataset. Not sure what that has to do with FOI. Are you suggesting that people who email the government expect their email to remain private, even as that email may be forwarded to a number of agencies and employees?

edoceo 8y ago
Using FOIA data for marketing is not legal in USA. It is done but not legal and hard to prove.
- danso 8y ago
  Some state laws do not restrict commercial usage [0] amd AFAIK, there is nothing in the federal FOIA law that prevents using information for marketing or other commercial purposes. That wasn't my point, though. The parent commenter talks about the potential danger of phishers using public data as being "against the spirit of FOI". Yes, I agree that using FOI to find info that facilitates a crime is not FOI's intended usecase. But the potential drawback has not been determined by legislators to outweigh all the potential benefits of transparency. [0] https://www.mcall.com/news/watchdog/mc-nws-open-records-business-requests-20180220-story.html https://www.mcall.com/news/watchdog/mc-nws-open-records-busi...

nandhp 8y ago

> do people know that by emailing their local government their email address is now free for scammers to request under FOI? Florida, which has fairly broad open records laws, at least makes this extremely clear: http://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0600-0699/0668/Sections/0668.6076.html http://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Displ... > Any agency, as defined in s. 119.011, or legislative entity that operates a website and uses electronic mail shall post the following statement in a conspicuous location on its website: > Under Florida law, e-mail addresses are public records. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing.

lostlogin 8y ago
Why is it like that? Do they give out your phone number or postal address if you contact them via those channels?
- riquito 8y ago
  I suppose they treat e-mail addresses as street addresses. Public and not tied to anything else by default (you know it exists but not who is assigned to)