The MNHQ Moderation team

[BarrackerBarmer]

Dear MNHQ

I'm very grateful for the commitment to free speech you've publicly taken, and for Justine's courage this week.

A former disgruntled employee of MN is writing on Twitter about the 'transphobia' of MN staff, and calling you TERFs. She is showing a great deal of bias and intolerance towards women with feminist views, this may well be her honest opinion, which is no big deal I suppose, since she is no longer an employee.

At least, it isn't an issue until she calls a shout out to her
'friends who still work at MN' to report and take down posts by 'transphobic scum', by which she appears to be referring to any poster objecting to being called TERF by her friend.

Regardless of the personal views of the MNHQ staff, who should be as free to hold their own views as I am mine, I am disturbed that there may be a small contingent of employees who are invested in unfair moderation and will not be applying fair-handed principles, at least if the claims of this ex-employee are credible.

Can you please give posters some reassurance that the difficult job of fair-handed moderation isn't being abused by the 'friends' of ex-employees who are 'reporting it all' and taking down posts because any gender criticism means the poster is 'transphobic scum'?

Thank you.

I'll believe she's sorry when she says so on Twitter.

IMO it is fair enough for @JustineMumsnet to accept Emma's apology for the reputational damage Emma caused MN with those screenshots.

Is it even technically possible for Justine to accept an apology made to a third party?

Emma hasn’t even had the gumption to contact her directly.

Hi Justine, thank you for your responses and huge sympathies for this happening in what must already have been a hectic and difficult week. Also, thanks again for your courage in standing up for women's right to free speech. But..

I'm afraid that your response so far to this data breach does not seem consistent with your obligations under the DPA. Firstly, as PPs have said, IP addresses can be personal data. But, more importantly, you are not paying proper attention to the context of the breach. Emma has not accidentally shared some IP addresses in the course of a legitimate activity. She has stolen the data, apparently with the intention of using it maliciously. The consequences could be extremely serious for the data owners. You have a legal obligation to report the breach to the ICO as soon as you become aware of it and you must take steps to identify who else has been affected.

It seems unlikely in the extreme that the tweeted screenshots are the only data that Emma stole. You need to investigate what data she accessed during her internship and what she did with it, using someone with the appropriate forensic IT skills to follow the audit trail.

This isn't optional, I'm afraid.

FencingFightingTorture35

I seriously doubt you are the only one feeling this way.

I’m not so worried for myself, no children and I’m already very ‘out’ and vocal in RL.

I can completely see why women who have families, or careers that can be destroyed by rabid TRA’s would be petrified by this seemingly lax attitude to personal data being spread across the internet and no real guarantee that this person doesn’t have their data too.

How much information do interns have access to? This person has alluded that others with similar views are still employed at mumsnet. What data do they have access to?

What reassurances do users have that their data isn’t being privately collated by individuals who disagree with them?

I'll believe she's sorry when she apologises on here

Out of interest, are there instructions anywhere for users about how to deregister/delete an account?

You can do that in the MyAccount section. I saw the option earlier when I changed my password.

Does the fact that pretty much every user so far who's commented thinks that the data breach should be reported mean anything at all, MNHQ? It's their data that you're talking about, potentially.

"It's worth you knowing that Emma has apologised wholeheartedly to a member of our team for her actions and confirmed that the publishing of IPs was accidental and, though she did have access to user data for a time, I don't think there's any significant risk of a further breach. "

This sounds a bit vague...

@JustineMumsnet Have you, or a person with authority at MN (preferably someone in HR/Legal), actually spoken to Emma Healey?

Don't answer that, it wouldn't be appropriate, but I sincerely hope this is being properly escalated and investigated. It doesn't sound like it is so far based on your words.

*Merrymouse"

Bubble couldn't be sacked because she knew too much.

@JustineMumsnet

It's worth you knowing that Emma has apologised wholeheartedly to a member of our team for her actions and confirmed that the publishing of IPs was accidental

Yes I bet - she knows know that she has risked criminal prosecution.

How did she accidentally screenshot all that privileged access info?
How do you know what other info she has if there is no audit of records accessed or copy/paste logs?
How do you know where its been passed to or where its been stored outside the organisation?

IP is classified as PII and not only under GDPR but under other regulations, especially when in combination with other collected data about a user, accessible to your data thief.

You are not alone in being behind the curve on this six months ago especially as a medium sized enterprise. It isn't easy getting compliant if you have a long way to go.

But it beggars belief that "oops I'm sorry" is the end of the matter for her.
This was intentional theft of data for malicious purposes.

I'm more disappointed in that response than the inadequate protection policies which made it possible

MNHQ, I know you have problems with PBP and sockpuppets and multiple accounts, but what would be your policy on someone de-registering (where they had provided you with an easily identifiable email account, full name and surname) then re-registering with a more anonymous set of details? Would this be acceptable, or would we find ourselves filed as possible multiple account starters/sockies/whatever?

Emma Healey clearly intended the screenshots to demonstrate that she was a staffer at mumsnet. That was the whole point of her post; that she had inside knowledge to counter the times article.
She deliberately screenshotted pages demonstrating that she was staff, to lend weight to her claims. I dare say she didn't notice the IP addresses but that's frankly irrelevant!
All new members of staff in any organisation that handles personal data must have a data protection induction and sign up to abide by the policies. I'm in no doubt that MNHQ would have had such a procedure so she deliberately and knowingly breached the policy, even if she didn't realise to what extent.
If she was naive enough to screenshot that and then post it online she was certainly naive enough to screenshot more. And if she's stupid vindictive enough to post a blog about how hateful mumsnet is then she's vindictive enough to share more sensitive data with her TRA friends - probably not now that she realises how much trouble she's in but earlier today while she was basking in the ally cookies she certainly could have shared more.

Point being she has broken the law. And you are probably right when you say she won't post anything else but you can't ignore this issue.
Hopefully you can get further legal advice tomorrow because I think you have been badly advised.

I'll believe she's sorry when she apologises on here

I won't believe she's sorry no matter where she posts. Apart from being sorry that it's blown up in her face.

There was nothing accidental about this data breach.

Point being she has broken the law. And you are probably right when you say she won't post anything else but you can't ignore this issue.

Not least because there will be other TRAs keen to intern.

It could even be a coordinated effort.

You cannot claim to have women's back and let this crime go unreported.

I feel badly for Justine and MNHQ, they are victims of this as well and not to blame for someone else's criminal activity.

However I disagree with the non-reaction, it sends a clear message that anyone with a TRA agenda will not be held accountable for their criminal behaviour. And we are seeing this in practice more and more.

One thing that I am unsure of and MNHQ should look into is... if MN does not charge this person, could they themselves be sued if one of the poster's who's information has been leaked is physically harmed due to the leak? Does anyone know the laws regarding this?

Please protect yourselves MNHQ and your posters.

What makes you so sure that Emma isn't receiving information from people still at MNHQ @JustineMumsnet?

I don't think she's even a little bit sorry, I refuse to believe that any 24-year-old who has the ability to secure herself an internship with one of the most successful and influential UK-based websites (and let's be honest here, it is, and the only reason it's derided is because it has the vernacular 'Mum' in its name) has no idea what she's doing when she posts IP addresses on Twitter is laughable.

Please consider the strength of the message you send about who handles our personal information and what will happen if they abuse that privilege.

Agree. Justine has made it so clear recently that she believes in free speech and debate, but this is completely undermined if it isn’t backed up by the actions and culture of the rest of the organisation.

I posted, pages and pages back, that a data breach has to be reported within 24 hours of it coming to the attention of the company. I can't understand the reluctance to do that. Further information can be supplied later, but the breach has to be reported.

How can we be sure that Emma hasn't passed any of our details on to anyone else?

The only thing she's sorry about is the fact she was caught.

Well she was carving a career path in Comms & Campaigns, but she might have wounded herself in that regard

How many of these kind if jobs involve data bases and email addresses etc?

If she was seriously considering a job in this area, she should know this stuff. Its essential basic knowledge for this area of politics. Even if MN didn't teach it her, I don't know why she didn't know it anyway.

Barracker
Great post

"Again, I don't need admins to agree with my views. But they must have the minimum access possible to my data, and they must have an ironclad commitment to confidentiality, regardless of how they feel about my posts."

I so agree with this.

What IS clear, is that Emma has shown a shocking lack of integrity with regards the confidentiality of women's personal data. She is entitled to her views but she is not entitled to put people's safety and jobs at risk because of those views.

One thing that I am unsure of and MNHQ should look into is... if MN does not charge this person, could they themselves be sued if one of the poster's who's information has been leaked is physically harmed due to the leak? Does anyone know the laws regarding this?

Good point.

We won’t necessarily know for a while what damaging acts might result.