Mumsnet Data Breach - Q&A

[JustineMumsnet]

As many of you already know, some screenshots of Mumsnet posts were recently uploaded to Twitter by a former Mumsnet intern – here’s a link to a previous thread discussing this in case you've not seen it.

Three of the screenshots showed an Admin’s view of the site and therefore contained the IP addresses of the posters concerned.

Understandably there have been loads of questions about the implications, about what data we hold and who has access to it so we've collated them here. Please do post any queries here or email [email protected] if you’ve any concerns or further questions.

Thanks and huge apologies if this has caused you any concern.

Thanks for explaining.

What data did interns have access to, and what is your basis for concluding that it does not constitute sensitive personal data within the meaning of the act?

Specifically, why leads you to believe that the combination of signup data including email addresses and (potentially names, dates of birth and postcodes), connected with postings and IP numbers, is not sensitive personal data?

What organisational and technical measures were in place to prevent personal data (as you saw it) or sensitive personal data (as I think it is clear it actually was) being inappropriately accessed, processed and exfiltrated by interns?

Slightly off-topic, but important in knowing who our information is shared with, you say...

The intern needed access to user information in order to carry out her work duties, which included contacting MNers to pass on press enquiries.

What type of press enquiries? Why would the press need to contact a Talk user? And how often does that happen to have it specifically written into the 'work duties' of a member of staff?

What else were her 'work duties'? Comprehensively, please...

That apology from the intern reported in the Guardian - I'm very unhappy about that final comment from her about MNners' 'mental health'. Just want to say that really.

Insult to injury, and all that.

thank you Justine

@CrochetBelle

Slightly off-topic, but important in knowing who our information is shared with, you say...

The intern needed access to user information in order to carry out her work duties, which included contacting MNers to pass on press enquiries.

What type of press enquiries? Why would the press need to contact a Talk user? And how often does that happen to have it specifically written into the 'work duties' of a member of staff?

What else were her 'work duties'? Comprehensively, please...

It was for media case studies and it doesn't happen very often - a few times a month. We reviewed our policies about who had access to user data during Emma's time at Mumsnet and she (along with some other staff members who only needed access intermittently) had their access removed. Obviously we wish we'd done this a bit sooner.

That is the same as the statement earlier but I imagine it's being said again as a direct statement from Justine?

I'm still happy with it.

Hi again Justine! Does your database allow audit trails? Can you see if she's accessed information for key vocal people (like Datun?)

Also on another note how are you doing? I hope there hasn't been too much personal nastiness after speaking up in the Times?

Repeating my question (also asked by other people) from the previous thread:

Are you conducting an investigation into Emma Healey's claims that she still has friends at MN who might make moderation decisions at her suggestion? Because we don't know what else they might do at her suggestion.

Could she access only the email address with which someone are currently registered? Or would previous email addresses also have been there?

(Ditto if you've changed name)

The recent twitter post by 'Ariel' (see other thread) is really worrying saying more data is to be released over the weekend. @JustineMumsnet can you offer any reassurances on its legitimacy?

@JustineMumsnet - thanks for the stance you are taking about protecting the space to debate. Thanks for updating us about this particular matter.

The MNHQ Moderation Team: Thread 2http://www.mumsnet.com/Talk/womens_rights/3226060-The-MNHQ-Moderation-Team-Thread-2#77245708

(Tweet Info Here)

From previous thread:

Why do you think EH posted screenshots from her work computer when the posts she put on twitter are visible on the MN website to anyone with an internet connection?

Why use screenshots from her work account after she left?

Justine has replied on that thread, merry

@Mogleflop

Hi again Justine! Does your database allow audit trails? Can you see if she's accessed information for key vocal people (like Datun?)

Also on another note how are you doing? I hope there hasn't been too much personal nastiness after speaking up in the Times?

No I don't believe we can do this from my initial conversations with Tech - I will explore further however. And I'm ok thanks - I'm staying off Twitter except to post pictures of gin...

I'd put less faith in anything "Ariel" had to say than a MNetter arguing a loo brush is sanitary.

@merrymouse

From previous thread:

Why do you think EH posted screenshots from her work computer when the posts she put on twitter are visible on the MN website to anyone with an internet connection?

Why use screenshots from her work account after she left?

I think she'd saved them/ previously sent them to someone. I think the piece in the Sunday Times prompted her to look them up and use them. But I'm speculating of course - I can't be 100% sure.

@ObiJuanKenobi

The recent twitter post by 'Ariel' (see other thread) is really worrying saying more data is to be released over the weekend. *@JustineMumsnet* can you offer any reassurances on its legitimacy?

I can't I'm afraid. But I'm sceptical for sure. I strongly suspect it's being done to inflame but can't confirm that.

The recent twitter post by 'Ariel' (see other thread) is really worrying saying more data is to be released over the weekend

Really? Missed that. A tad concerning.

@JustineMumsnet

1. What other investigation are you undertaking to assess the full extent of the stolen information ie IT forensics?

2. How are you impressing upon your staff the physical danger that leaked data can put members & their families in ie DV & family annihilation?

3. What other efforts are you making to get Emma to admit the full extent of her theft and proof of its deletion?

4. What investigations are you undertaking into the current staff team to ensure they don't also share Emma's authoritarian views?

5. What measures are you taking to ensure that only select, trusted staff can access username history?

Ariels twitter feed is a mess tbh.

I'd honestly not view it a a reliable source on anything.

The 'Ariel' post said 'more TERF names could be released'.

None have at all so not sure why 'more' would be a worry let alone the Tweet be reported to the Police.

Thanks for replying @JustineMumsnet I thought so too but it's so hard to know!

I think we all forget sometimes how easy it is to post so much about our lives, often things we don't even talk to people about in RL for one reason or another, yet here has always felt like a safe space to really share and get some genuinely great help, often at life's lowest moments - you don't stop to think something like this could potentially happen and your online safe space could suddenly become very threatening to your RL circumstances.

I hope EH understands the severity her actions could and still potentially will have on real peoples lives. We deserve a place like mumsnet, it's fab, but we also deserve to feel safe and have our data and identities protected.