Britain's Ministry of Defence fined £350K over Afghan interpreter BCC email blunder Britain's data watchdog has issued the Ministry of Defence with a financial penalty of £350,000 for the BCC email blunder that exposed names and contact data of Afghan interpreters locked in the Taliban-controlled country. The potentially life-or-death breach happened in autumn 2021 following the complete withdrawal of UK and …
I fail to see how using BCC is any more subject to human error than bulk email. It's when you're not using BCC and bunging everyone into SendTo that things are worse. That is what must have happened here. Instead of using BCC, they sent the mail out with addresses in the SendTo and probably got people killed. That fact will be on their conscience forever, fine or not.
And who are you going to fine for the brilliant decision of not bringing along those fine Afghan people who helped you and stood by you but didn't have the proper paperwork done in the madness of a hasty withdrawal ? You could have gotten them out and bothered with the paperwork later, when they were safe, but noooo. You don't have your paperwork ? We thank you for your service during all these years, and wish you good luck with the Taliban. Next !
Typically, in "BCC blunders", it is the failure of using BCC, and using the CC field instead, to copy-and-paste a bunch of email addresses into.
Using BCC is unsafe because it is very easy to click into the wrong field to paste the addresses into, and thereby facilitates human error.
A bulk email system typically does not even give you the chance to make such a mistake. That's why using BCC for mass emails is considered bad practice – for a long time actually.
Is the Ministry of Defence now hiring on special need people to perform security duties?
"Staff .. were not given specific guidance about the security risks of sending group emails when communicating sensitive information,"
You dumb fcüḳ, you don't send sensitive information by email, you dumb fcüḳ
"The email urged the interpreters, somewhat ironically, not to put themselves or their families in danger."
When will it finally sink in that email is not appropriate for sensitive communications. It does not inherently support end to end encryption (only some email clients might), so it is roughly the equivalent of sending a postcard written in pencil as it can be read and modified (as e.g. gmail does) in transit. So quite apart from the failure to use BCC, it was absolutely the wrong way to communicate this message to these people.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
