Council in UK's City of York outs hundreds of disabled residents with a single email blunder

A City of York Council email mishap exposed the email addresses of hundreds of Blue Badge holders in the ancient Viking capital, inadvertently revealing their status as disabled residents and triggering a data breach investigation. The council confirmed to The Register that it’s investigating what it described as a "personal …

[adrianww]

Mass email using BCC

I know that people do this, but what the actual f-f-f-f-… are they thinking?

Leaving aside the potential for cock-ups (cocks-up?) like this one, if they’re sending an email to hundreds of people, why the hell aren’t they using some kind of proper mailing list management system or third-party mail manager service or whatever to do it? Oh no - let’s just stuff a Bcc: field with hundreds of bloody email addresses instead!

If I had a tenner for every time I’ve seen some numpty do this (both public and private sector offenders) I’d be considerably better off.

Good grief…

[JimmyPage]

Re: Mass email using BCC

It's not as if they don't pay $$$$$$$$$$$$$$$$ for their systems.

[Giles C]

Re: Mass email using BCC

I run a small club and we don’t send that many emails but when we do we use Mailchimp on a free tariff to stop this kind of problem.

Yes I know people will hate Mailchimp but for what we need it works and is free

[heyrick]

Re: Mass email using BCC

Ah, but you're literally handing a third party a list of valid email addresses. Do you have informed (as in you've clearly said you'll be doing this) consent?

[adrianww]

Re: Mass email using BCC

Usually yes, because most mailing list tools understand this and have implemented systems to ensure you have consent when you add addresses (e.g. automated opt-in confirmation or double opt-in systems, proper handling of unsubscribe requests, etc.)

Doing the whole thing by having somebody copy loads of email addresses into an email program doesn’t absolve you of the consent requirements just because you already happen to have those addresses in your own system. It just makes it more difficult to monitor and confirm that you do have appropriate consent. I suppose you might be able to make an argument about it being transactional email so consent might not apply, but I wouldn’t want to rely on that. And that’s before you even introduce the possibility of screwing it up entirely as in this example.

Sure, use Bcc: to include a few people on a project email or something specific between a limited group of recipients but using it for general mass emails to dozens (or hundreds) of people is, at best, unprofessional and, at worst, just bloody stupid.

[chris street]

Re: Mass email using BCC

If your 3rd party mailer is asking for permission it's already too late. The number of times this happens to me is infuriating - if I give someone an email address it is for them to use - no one else. Mailchimps servers are in the USA - that means all the data, all the comms, everything is going out to the USA. Have you explicit permission for that? I see far far too many times someone saying we are not going to share data in the privacy statement - and then all the emails come from Mailchimp. Great way to end up on the wrong end of a SAR.....

[Giles C]

Re: Mass email using BCC

Yes because there is a tick box to allow us to do this on the application forms, and on the renewal forms the same applies if someone does not wish to receive messages then we accept that and they can unsubscribe from any of the messages that get sent out.

Fully GDPR compliant even though we only have 60 members.

[tiggity]

Re: Mass email using BCC

@Giles C

"if someone does not wish to receive messages"

Though, if the reason they do not want to receive them is due to privacy reasons (i.e. they do not trust MailChimp) then it might mean a disgruntled member i.e. a member who would actually like email - if the mails were not sent via MailChimp.

That's why, for club mails I do, although I have variety of email addresses (including some throwaway ones with US companies such as Google & Yahoo) I use a UK based email server (though with so many recipients using US company email addresses I do wonder if its a bit of an exercise in futility - still its all good practice making sure you have set up your mail server such that it passes SPF / DKIM tests by the "big boys" who love to reject mail from outside their cosy cartel using spurious security reasons)

[Giles C]

Re: Mass email using BCC

Considering that most of the members are gloved to Facebook or WhatsApp they can still find out and we send out a monthly newsletter as well.

[Ian Johnston]

Re: Mass email using BCC

And of course, you have no idea how many servers the email will pass through en route. Permission should be sought for every single one or goodness knows what will happen as your email bounces around the world. Your soul will probably be stolen, for a start, followed by one of your kidneys.

[AndrueC]

Re: Mass email using BCC

And of course, you have no idea how many servers the email will pass through en route.

That's not how email works, or hasn't done for many years if not decades now. That only ever happened in the past because of network fragmentation meaning that packets from the sender's server had no route to the recipient's and had to be relayed by other servers.

These days it would be very unusual for a mail server of all things to have only partial access to the internet address space. It wouldn't even be done for security reasons since you're actually making security worse. And very, very few mail servers act as relays these days. Spam killed off that feature. Mail servers these days are only ever responsible for their specific domain(s). You try asking my mail server to relay mail somewhere and it'll tell you to get lost in short order.

I would guess that at least 99.9% of emails are transferred directly between the sender's server and the recipient's. They will of course pass through any number of network routers along the way but that's a separate issue.

[Ian Johnston]

Re: Mass email using BCC

When somebody sends me an email it goes through, at the very least, their SMTP server and my provider's POP3 server (other protocols are available) on its way from their device to mine. That's two places which have my email address given to them, not to mention all the switches and routers in between them. Bugger it. There goes my soul.

[steviebuk]

Re: Mass email using BCC

Alot of people abuse it so some places will block anything from mailchimp. We were for a while.

[tiggity]

Re: Mass email using BCC

I do the mailouts for a small club.

I avoid any cc / bcc issues completely.

I have written my own basic mail app*, that is used exclusively for the club.

I can select from "mailing lists" I have added.

Crucially, what my code does is process the mailing list and send out to each recipient as an individual mail.

No chance of cc / bcc errors.

I am not giving the mailing lists to third parties to handle, so I'm fully in control of the data (which is important to me as I am the data controller of the club)

* Trivial using a high level language as most have good libraries for mail functionality** (though TBF my day job is coding & have had to write email code in the past)

** I'm sure it's even more trivial these days as you can get "AI" to spit out the core code for such functionality & then fixing the "AI" errors is still probably faster than coding from scratch as it is a basic sort of task. Though a bit more hassle if you use email from some of the "big boys" as you will need to jump through the OAuth hoops (whereas if you run your own email server you can use the easier solution of basic authentication )

[wolfetone]

Re: Mass email using BCC

In a previous life I had to build something similar for a "volunteer" organisation, made up of people who think they know better.

Had so many run ins with people who refused to use it. I'd have parents complain to me that it's happened, and I'd go and tell the branch owner about the complaint and they couldn't give two shits about it. "It's just an email" was the usual reply. Absolutely no idea or understanding about it, and worse still absolutely no inclination to understand the problem either.

[David Hicklin]

Re: Mass email using BCC

I also help to run a club and recently we had need to do a mass mailing, LibreOffice did the work quite nicely and kept everything safely in our own hands

[doublelayer]

Re: Mass email using BCC

Generally because either the person tasked with doing this isn't aware that there are better tools and how to use them or they don't have the access necessary to add one. Using a mail client to either BCC people or mail merge into separate messages is relatively easy, making it an acceptable solution enough of the time that some organizations don't have anything else and don't let individuals change that.

[ComicalEngineer]

Re: Mass email using BCC

I am a member of a small model making club, about 100 people. The club administrator is an elderly bloke who simply doesn't get the idea of using BCC and therefore I have a list of the entire membership email addresses.

One member of the group insists on hitting "reply all" and therefore the entire group receives messages like "great I'll be there on Saturday" etc.

After several attempts at education I gave up and have therefore set up a separate email address just for this group.

[david 12]

Re: Mass email using BCC

Oh no - let’s just stuff a Bcc: field with hundreds of bloody email addresses instead!

If they are using a private, local, email server, then it's only allowing that because it was out of support 10 or 20 years ago. Even the mail servers I've touched no longer allow hundreds of email addresses in the CC field without special configuration.

[JimmyPage]

Luckily they won't have to compensate anyone

so that's all good.

[An_Old_Dog]

Attempting to Idiot-Proof Computers, Attempt 606437

Let's disable the "CC:" function from business- and government- owned computers' email software, and force thrm to use "BCC:" instead.

[RSW]

Re: Attempting to Idiot-Proof Computers, Attempt 606437

Thats no good either as here they try to stuff them all in the TO field

[steviebuk]

Re: Attempting to Idiot-Proof Computers, Attempt 606437

Exactly. Exactly what they'll do. Whatever they find easiest.

[that one in the corner]

Re: Attempting to Idiot-Proof Computers, Attempt 606437

ONLY for outgoing emails to the public!

Otherwise email conversations are going to get even worse!

The Project Manager can't see your new estimates were also sent to the rest of the correct team members[1]. The recipient of a ticking off can't see that HR have been sent the "put them on final warning" order.

The person who insisted on ordering the boiled egg sandwich can't see that all the desks around him have been warned... actually, no, keep that as a BCC, give them a chance to arm themselves without tipping him off.

[1] "just set up mailing lists" - for every permutation of subgroups, kept up to date as people are assigned tickets from different parts of the project, or across projects...

[MiguelC]

Re: Attempting to Idiot-Proof Computers, Attempt 606437

I was once BCC'd in an email from my boss' PA to my boss that included an Excel file with all team members' pay packages.

If I was a betting man, I'd wager my boss never got wind of the blunder!

[that one in the corner]

Re: Attempting to Idiot-Proof Computers, Attempt 606437

Yeah, but that was all internal to the business - the CFO just has to add a line item to cover "ffs why do we let him near computers" and that is everything taken care of.

[Azamino]

My privacy...

Crap by the council and a warning to anyone interested in flaws in their operating procedures and patterns of behaviour. If they cock-up something this straightforward what else are they doing?

I am mystified as to how one poor person thought that "most people in her life were unaware she held a Blue Badge" though. The first clue is the disability, the second the bright blue badge with your photograph and hologram sitting on your vehicle's dashboard. Are the people not very observant or do they all park like idiots and assume that everyone does the same?

[John Robson]

Re: My privacy...

The badge doesn't have to live in the windscreen, it can usually be stored in the glove box.

And the requirements for a blue badge aren't always obvious to others, not all disabilities are visible.

[Anonymous Coward]

Re: My privacy...

"... not all disabilities are visible"

This is the most critical point.

When you are ranting at someone parking in a Disabled parking spot, remember when they 'walk' away and seem to be not 'Disabled' that not all disabilities are obvious !!!

This happens a lot ... you know you are guilty 'sometimes' ... in the Supermarket, when fighting for a parking spot. !!! :=)

:)

[Phil O'Sophical]

Re: My privacy...

True, as long as they have a blue badge on display. It's people parked in disabled spaces without such a badge on display that deserve the complaints.

[Ian Johnston]

Re: My privacy...

The blue badge system is poorly thought out. It gives priority parking to people without mobility issues and doesn't apply to people with severe but short-term issues.

[John Robson]

Re: My privacy...

I agree that we should have a short term badge available.

But to assert that someone with a BB doesn't have mobility issues is deliberately disingenuous.

[Richard 12]

Re: My privacy...

The photo and name are on the back, they are never on display.

Aside from that, the only people aware of the blue badge are those who actually see it being used. There's a big difference between walking past a badge holder getting into or out of a parked car and telling a few thousand people the email address (and thus name) of a few thousand blue badge holders.

[Anonymous Coward]

One affected resident told local media

> that the disclosure had left her upset because most people in her life were unaware she held a Blue Badge.

For all the sympathy we have for those affected by this breach, is anyone going to tell her that it is only after she told the media that all those people in her life are going to figure it out now?

And isn't it appalling that we all expect this information to leak, even though everybody who has it is a member of the affected group; nobody believes in group solidarity. People! The lot of 'em!

[Azamino]

Re: One affected resident told local media

That is a very good point. I know that in much of the country provision has not matched the increase in the number of blue badges issues. There are already over three million in total and that number will only grow until the mental health crisis in this country is properly addressed.

[heyrick]

Re: One affected resident told local media

Mental health crisis? What mental health crisis? Everything is fine, nothing to see here. Put the kettle on and calm down.

[Anonymous Coward]

Re: One affected resident told local media

At risk of being downvoted to hell & back ...

The real crisis is the misuse of 'Mental health' as an excuse for EVERTHING.

Every criminal who is caught and is 100% guilty because they were caught 'doing the crime' will make up a plea of some 'Mental Health' problem.

This is a 'standard' defence argument before they are sentenced.

People with real mental health issues are being out-numbered by the scam merchants using it as an excuse, to avoid the consequences of their actions.

People faking mental health issues should be made to pay ... most of the time the 'Mental Heath plea' is not backed up with any real diagnosis as people 'self-dianose' when it suits !!!

:)

[parrot]

Re: One affected resident told local media

Some reasons I think we have more awareness of difficulties with mental health:

- in the past people didn’t talk about it

- in the past people felt they had to “keep calm and carry on” and pretend they were ok for everyone else’s benefit

- we understand a lot better what it is

- we know it can have a real effect on the quality of a person’s life, eg. A simple task that would take you 5 mins might take a very long time for someone who has OCD.

I am sure you are correct that what you’ve described can happen. But if you believe the process of diagnosis in the case of such a claim is not robust, because you care about objectivity, can you say that your statement is also objective? How closely have you examined the prosecution process? How did you quantify scam artists and genuine cases?

I try to make the time to talk to people and make sure they know when I say, “how are you” I really am asking. Subjectively, in other words from my experience, people who struggle with mental health are everywhere. I don’t believe they are outnumbered by people “faking” it. They are just too numerous, and if they could just snap out of it they would.

And consider, if we accept this is as widespread as I believe it is, wouldn’t some crimes be inevitably committed as a direct consequence? When people can’t cope they can’t conform. By the way, I know people who have done prison time because of destructive behaviour which was definitely caused by their state of mind. They did not get let off lightly.

Like you I want to see fairness in society. But there’s a difference between perceived unfairness and actual, demonstrable inequity. On balance I believe the healthiest conversation about mental health is the one that helps people to feel they can talk about it and be supported.

[Anonymous Coward]

Re: One affected resident told local media

1. I am not making a judgement randomly ... the mental health plea is reported BUT usually is never backed up with any evidence from a medical practitioner which is usually reported as well.

2. Look at news stories (Trivial to Headlines) reported everyday and you will see many many statements of 'Mental Health' usually to excuse behaviour, never is this backed up with a reference to a doctor/clinic etc

3. I do appreciate that 'Mental Health' is an issue but it is being trivialised by people using it as a general excuse including defence lawyers etc.

4. I want people who need help to get it by eliminating the people who are gaming the system. They are preventing real needs from being met.

5. This over-reporting also explains why people have such problems getting help when the few doctors we have are being abused by people gaming the system.

6. I too know people who really need help who are waiting far too long for appointments to start their treatment.

[Calum Morrison]

Not all disabilities are visible

Until some idiot spaffs them to a mailing list.

[Bebu sa Ware]

The Gift that just keeps on giving

Just not sure whether it is idiots or it is email lists — probably both.

Cc, Bcc and Reply-to seem to be beyond the horizon of comprehension of a significant fraction of the population.

The number of sizable lists stored in spreadsheet columns and copy/pasted into the To: or Cc: fields of the email client even when the client could actually use local (file of addresses) lists, I have encountered would undermine anyone's faith in human intelligence.

Having managed the local mail services (MTA etc) sendmail (later postfix) for many years, lists weren't really a problem - user agent brain·dead auto·responders were a bigger problem.

Why didn't they ask Evans might be rephrased why didn't the developer read the RFCs.

[doublelayer]

Re: The Gift that just keeps on giving

What RFC were developers supposed to have read but did not? RFCs don't fix things if an internal list of addresses would have been a good idea but either the server admin didn't set one up or the service they're running their mail through doesn't choose to expose that feature. They certainly don't help if one of those things did happen but the user doesn't know or understand that and thinks pasting a list of addresses is the only way of doing it.

[AMBxx]

Re: The Gift that just keeps on giving

Outlook now hide BCC by default. First you have to find the option hidden in the riband.

[elsergiovolador]

Routine

This has been happening in every organisation for ever.

People don't get the difference between CC and BCC no matter how many times you explain it and in how many ways.

At best they get it other way round, like CC is opaque and BCC "broadcasts" the recipient list.

[Gavsky]

Re: Routine

No, BCC broadcasts programmes on the telly...

Damn this anorexia, er - dyslexia.

[Ken Shabby]

Re: Routine

Nah, it’s CBC, Cipher Block Chainig, secure innit

[Anonymous Coward]

Not funny but

Ours was worse. Our local leisure centre was supported by us (until it went out to trust), and wasn't run by the brightest sparks and one could say the director was bent as fuck (prompting the woman he was having an affair with to director when they went to trust. Despite the fact she should have been fired years back when she got access to another staff members email, by lying. The staff member had a grievances on going against her). The same leisure centre that had the user name and password for the account they used at the gym reception, stuck onto the monitor. In full view of members. Anyway.

One day they sent an all members email out but, as you guessed, didn't BBC. Then they sent out an all members email to apologise. But, did the same in the apology. Oops. No worries, try again. Nope, did the same in the 2nd apology about the first apology about the original fuck up. Oh well, forth time will def be right. Nope, did it again the forth time.

Someone somewhere must of then chopped the hands off the staff member as they finally stopped apologising and just kept quiet. We couldn't stop laughing in our office as we saw them come in (no idea why IT were included).

[David 132]

Re: Not funny but

Was the staff member's name Gordon Brittas by chance?

"Marvellous."

[Anonymous Coward]

Re: Not funny but

Or Frank Spencer !!!

:)

[Gavsky]

Jesus, is this STILL a thing?! We really need AI Clippy: "Hey! It looks like you're sending an email to a lot of people who don't know each other - are you sure you want to send it 'CC'? I thought 'BCC' might be an idea?" [Ya fecking moron]

[Anonymous Coward]

Nah. We need sensible MUAs: "Hey, you're trying to cc/bcc a small army. That's wrong and beyond stupid. I'll never let you send an email to so many recipients - or anyone for that matter. Don't come back until you get some email clue."

[Winkypop]

“Didn’t know how many individuals were affected”

Really?

Any of the recipient’s certainly could.

Just count the exposed email addresses.

[Anonymous Coward]

Re: “Didn’t know how many individuals were affected”

But there could be several individuals who have multiple email addresses that've all been exposed. They can't immediately see how many individuals are affected because it's not necessarily a 1-to-1 relationship between email address and individual.

(Or they ran out of fingers to count on)

[Anonymous Coward]

Cowboy builder

We were victims to a builder who took a small deposit but never did the work.

He emailed all his victims with some sob story. Luckily for us, he CC’d instead of BCC’d all his victims.

We were then able to organise, document and take him to consumer rights and won.

He’s now subject to an arrest warrant.

[Anonymous Coward]

Re: Cowboy builder

Off Topic: Needed to ask.

Is 'Cowboy Builders' a problem that is strictly in the UK or do other countires suffer the same problem ?

[I never seem to read about these issues eleswhere !!!]

:)

[Anonymous Coward]

Re: Cowboy builder

France certainly had its share of them when I lived there, les 'constructeurs "cowboy"' :)

[Anonymous Coward]

Re: Cowboy builder

Probably the same UK Cowboy Builders on holiday, making a few 'quid' to cover the cost of the holiday :=))

:)

[an.other_tech]

The council should indeed be reporting themselves to the ICO for a data breach.

Regardless of the content, it's still active email addresses.

Back in the old days, before people were forced to use electronic communications, you were generally limited to a wrong house address. Granted the letter contents could be much more personal, but then you had the choice to return to sender, not open the letter if it wasn't for you, or bin it.

These days, you open an email, and the contents are there, in plain text.

Unless it's encrypted with say d.o.b, as our insurance company does.

So how do we prevent our details being sent out in C.C as in this case, or by bad actors gaining access to databases, or m.i.t.m (man in the middle) ?

Which then nicely leads onto Cloud flare...who seem to be at most sites gateways, including El Reg.

Who is watching the gatekeepers?