Security Update: Isolated Document Incident

link

There have been a handful of posts today on blogs about this situation - and I know it will surprise some of you who know that there is tension between AAG and EF (which for the record happened waaaaay before I got here, so I do not fully know the details, thanks) - but I found AAG's post today link to be most illumniating and balanced. I personally appreciate that she took the time to write in such detail and cared to give clarity to the situation. Even more admirable is her willingness to attach herself to it. I know for some of you, her opinion holds a lot of sway and I give her credit for being so diplomatic. Thank you.

Hi, In The Pink,

Welcome to your new role and I, for one, look forward to working with you!

AAG's post was pretty fair and balanced (Fox News she ain't!) In all honesty, from how she explained this happening, it was a complete fluke. Somebody who wasn't aware of the document security (potentially anybody who wasn't her) clicked on a link and the scary Interweb, as it is want to do sometimes, recorded a link back. It sounds like it was a genuine accident.

I'm not sure if my information was there or not, but personally I think it's worth remembering that nothing we're doing here is illegal and the person(s) the document was 'leaked' to almost certainly are affiliated with EF in the first place (hence how they linked back through their webstats and how the leak became public knowledge so quickly.)

Compared to George Bush recording our phone calls and keeping track of our library withdrawals, I think a fellow EF member having a momentary glance at a document with our real names on is hopefully a non-issue. I like to think we're all part of a like minded, responsible community here.

In this day and age, there IS no privacy. Especially not for bloggers. We might not want to advertise our affiliation with EF to our friends and families, but the price of being part of a sex-positive community is that the chance exists that other people will find out about it.

Thank you so much - what an awesome response!

Does anyone have any idea when the url from the documented became live?

What I want to know is how long it was live before it was reported? When did the spreadsheet receive it's first click that turned it into an available document?

And was it reported to EF, or just on someone's blog?

My information was on that spreadsheet, and the entire issue concerns me. However, I think some facts are missing....

Betty,

To answer your question there is no way to tell when the document became "live" and no single employee, who had access, knowingly did this including myself. It became known to us over the evening hours when offices were closed. We addressed the issue as soon as possible and shut down the document as soon as possible. We appreciate everyones comments, concerns and I can be reached directly at drewg@webmerchantsinc. com to discuss any issues that might arise. This was under no way as AAG put it "nefarious" but simply an accident. I blame myself completely and offer my sincerest apology to our entire community. Please I implore anyone with future concerns to email me. drewg@webmerchantsinc. com

Hey, Urban Gypsy. I totally agree with you about the blogging thing, but as you said: "The risk we take is having our real names attached to our blog identities."

I think anybody - ANYBODY - who writes a blog, even attempting to keep it anonymous, has to ultimately take their own responsibility for it.

I've had several 'blog friends' who have had the rude interjection of 'real life' onto their blissfully anonymous blog.

One or two by a boyfriend or lover they'd shared their 'secret' blog with and later broken up with, or by giving away too much personal information in their blog (one was victim to a rather scary Internet stalker who 'exposed' her blog by working out her true identity based on the information she'd posted.)

If you have a blog, even an anonymous one, it's clear you want other people to read it. The risk of that self-publicity is that your 'real life' will one day cross over with that blog and people you would be embarassed to know about it might find out and read it.

So while I can understand people being upset with the security 'lapse' at EF over their anonymous blogs - and not to trivialize it - if the thought of your anonymous blog being exposed fills you with that much dread, I think the question is more about whether or not you should really have it in the first place.

Hopefully people will decide to, since there are some GREAT blogs I've found through EF.

But even given my personal information being leaked, I'm ultimately happy with the feedback I've got from EF regarding this and the steps they've taken to correct it. I'm now more interested in who the person who found this document was and why, if they were never affiliated with Eden, their blog would be linked to by an EF internal document.

People have accused facts being missing from EF's account of events, but the more I hear about this leak, the more questions I'd like to ask the person who exposed it in the first place. You say "this document was open to the world at large" and I'd love to know the details of that, rather than just take everybody's word for it. Where? How? Who?

Hi Urban Gypsy,

I've just read a bunch of blogs from people writing about this breach of privacy and I think the following is clear:

1: The person who discovered this breach was at least connected enough to EF to have been in email communication with their staff and have their details on a database. That makes me less concerned because I like to think the EF community is pretty responsible and understands and shares concerns for their fellow EF member's privacy as well as their own (although they kind of contradict this later.)

2: The person who discovered it found it through a link in their webstats, which was a glaring fault and error by EF, but not exactly 'open to the world at large.' Only bloggers with webstats who'd been clicked on via that google document would have been able to access this document.

3: One or more of the bloggers affected understandably made their fellow bloggers aware of the leach in privacy when they found it - from my understanding SENDING THEM THE LINK so they could check it themselves to see if they were affected. So thanks to these bloggers spreading that link around, far more people had the chance to see my private information than they would have done if they hadn't shared that link.

I can understand the upset, but I'm just as offended at wounded bloggers swapping this personal data between themselves than EF losing it in the first place.

Are you a blogger? Was your name on that spreadsheet?

This is how I understand it.....the bloggers involved in the outside review program were on that spreadsheet...right? Not affiliates.....

When I say facts are missing, I am referencing the source of the initial link....

Some of us have positions in real life that would be compromised if we were exposed as a sex blogger. I stand to lose my job. Not because what we are doing is wrong.....simply because ignorance prevails.

I do not think this is any small thing....really I don't. I would love to know how it happened, why it happened, and was it done on purpose (which is the overall tone from the blogging community)

The problem right now is that this situation is now very public, and we are adding more fuel to an already outrageous fire.....
'
edenfantasys has a responsibility to gather as many facts regarding this breech as possible, and relay those facts to those affected....we need to let them do that

As far as losing reviewers, I would hate to see so many jump off a sinking ship when the crew has just gotten their sea legs....

I am just as confused and disheartened as everyone else, but right now I want to see what happens now........

Thanks, Betty, for the clear-headed response! I'm so glad expressed your sentiments. This has a tough first week for me and like I said to my boss today, it's been "baptism by fire"... we're not just giving lip-service today, this is being taken very seriously. Thanks again.

Even I, who have no love for Eden, do not believe this was anything but a dumb mistake nor do I think that the blogging community at large believes this was done on purpose.

The source of the initial link was a hit on StatCounter coming from a google document.

Hi Betty,

I am a blogger, and although I don't know if my name was on that list, I'm presuming it was - so I reserve the right to be as upset as anybody.

But, personally, I've been forced to take a lot of the accusations some bloggers have made with a huge grain of salt.

Instead, I agree with your excellent suggestion to cool our heels and see what the facts of the situation are. 'Well intentioned' blogger hysteria has already made this situation worse. Let's deal with it maturely. I'm a big fan of EF and have a lot of confidence in them.

I'm not sure what to think at this point.....

I am a relatively new blogger, who keeps to herself a lot of the time, contributing when I can and reading the super bloggers. So, I wasn't privy to this important information until reading it here.

And my name was on that spreadsheet. I would never have known if I hadn't asked EF to let me know.

I have spent the majority of my morning reading blog posts and comments....and this has developed my concern that this was malice and not accidental.........

I just hope whoever discovered this contacted edenfantasys before they blogged about it. It seems to have become meat for the beast....and I for one do not view it that way.

My only desire is to know exactly what of my information was available on that form, and I will never know.

Nor will I ever know how long it was live, and how many people were forwarded the link. Bloggers forwarded the link amongst each other (at least that is how I understand it) without any regard for the other people on it...........that was a violation of privacy in itself.

This entire situation is a huge let down. The more immersed in it I become, the more let down I am.

Email the project manager and ask him if you were on it......

My personal information was on that spreadsheet, and the person who first discovered that it had been inadvertently made public was not affiliated with EF. And if she could access it, anyone could have - I for one, will be cutting off all affiliations with EF. I do not think that they have adequately dealt with the situation, as I know of several bloggers who have sent emails complaining of this very incident and have not heard anything in the way of responses.
To me, this is just another incident in a long line of events that makes me distrust EF.

Already done - and I REALLY appreciate what you wrote here:

"I just hope whoever discovered this contacted edenfantasys before they blogged about it. It seems to have become meat for the beast....and I for one do not view it that way."

What makes it very difficult for me to be on the side of the angry bloggers is that they jumped on sending the link around without ANY regard to the people on it, making an uncomfortable, but manageable situation far worse. As I said, my general impression of the EF community is that we're a responsible lot, but some of the bloggers have been VERY selfish, irresponsible and immensely disrespectful towards other bloggers who might have been on that list by spreading it about amongst themselves and others.

EF have legal and business responsibilities they have to live up to. The bloggers don't, so they continue fanning the flames even though it's directing the heat on people like you and I.

As far as I'm concerned, Eden Fantasies has done all they can to correct this mistake AND owned up to it. I hope the angry blogging community quickly cools down and realizes that when it comes to other people's personal information, THEY have a responsibility to act accordingly too (which some of them have failed to do in a spectacular fashion.)

Red, I'd be interested in finding out where you're getting your information. I have seen no evidence of bloggers passing out the list that contained the personal information among the community. Instead, I have seen bloggers passing on the information that the list had been released - which is, I think, very important since EF seems determined to sweep it under the rug.

I am the person who found the document in my stats and you are totally incorrect when you state I was connected to EF. This was the first email I have ever received from any employee of EF and as far as I know none of my information is in any data base of theirs. Or at least it should not be.

From what I saw on that spreadsheet in regard to myself I was what you would refer to as a "cold call" when I was contacted. Only my blog URL and email was on it along with a note of the date they contacted me. With that being the case we have no idea how many blogs EF accessed through this document that left the link in the stats of blogs or how long this had been going on.

This spreadsheet was "open to the world at large" because it was a live document being left out on the internet as EF clicked on blogs.

The tone of your response is to blame the victim here. These bloggers acted in good faith when then entered into an agreement with EF and trusted EF to protect their identities. EF failed to do that and you now are blaming bloggers for "swapping personal data" between themselves.

You state that this document was passed around by bloggers. Where are you getting this information from? Did someone send you this document? Did you read it on one of these bloggers sites?

There is only one person who should be held responsible for this and that is EF. It was EF who put personal blogger information out on the internet. Yes, I know we all take the risk of being found out when we blog, but we should not have to look to someone in our own community as a risk for outing us.

Hi DD!

Remember, my identity is ALSO one entrusted to EF, so please respect my right to be concerned.

Although I think if you're 'ground zero' a lot of people will be VERY reassured to see you and get your side of the story. I know I am. I had to take a deep breath to reread your blog post a couple of times to make sure I got the story straight, since you print out an entire email between you and EF instead of 'cutting to the chase.'

Betty Rocket and my CONCERN was that when this 'leak' was discovered (by you, apparently) that you might have made other bloggers aware of it, making the 'hole' larger by making more people visit the private document. If that's not the case, than Betty and I are clearly VERY reassured.

You contacted EF first and told them about the leak, so they could close it, that's AWESOME. After that, I think it's absolutely fair to make other bloggers and EF people aware of the leak because it could possibly have affected them.

We were just worried that you might have highlighted the problem to fellow bloggers, who then followed the same 'back route' themselves and accessed personal information they wouldn't have known about if you hadn't made them aware of it to begin with.

Since you say that didn't happen, I'm very reassured. I think I got my knickers in a twist when possibly I didn't need to, but I was upset at the reaction on the blogosphere and had assumed the worst.

Not to trivialize this leak, but if it extends no further than you than I feel my personal information is probably safe and this experience will make sure EF are stringent in making sure mistakes of this nature aren't repeated.

As this situation becomes clearer, I think eden needs to contact those affected and do some serious damage control........silence would not be wise at this point.

Sounds to me like someone at eden was using the spreadsheet, and instead of accessing the blogs through the address bar or a search engine, they were clicking the hyperlinks in the spreadsheet, therefore making the document viewable by the general public

Sound right?

If this is indeed the case eden needs to do this:

1.Contact every single person on the spreadsheet and notify them of what has occured.
2. Determine who did this, as there should only be certain persons that access the spreadsheet, and determine when it was done, which should be easy once they determine who did this. The responsible party is no doubt reading these posts, however continues to hide....we are OWED an explanation at the very least.
3. Be prepared to reap what you have sown. This utter irresponsibility with the private information of the people you depend on to sell your products is HORRIFIC.

As the events become clearer, I myself must discontinue my dealings with this company. I thought about this for the better part of the day, and I can see no other alternative.


However, I just did a 850 word piece for this company that is supposed to be paid at .15 cent a word. I do not expect to see a dime of this, but I wanted to put this in a public forum so I do not suffer the same fate as AAG and not get compensated for my hard work.

And I'm sorry for assuming you were affiliated with EF, but it was a very long and involved blog post about them, so in my fluster, you can possibly understand me making that assumption!

I'm with you. I'm sorry, but I'm going to have to resign, as well.

Excuse me, but to clarify, Red Roulette, are you a blogger as well or do you work (meaning receive compensation other than free toys) for Eden?

It seems your replies are all in the CYA mode and that makes me wonder.

Maybe I'm perceiving this incorrectly but the security issue seems to fall in the line of it not being password protected. If that file had a password shared between the more important of staff members then we wouldn't be in this situation. Eden has done all they can do on their end, they didn't create the file but they're the ones left cleaning it up because the person that created the original file left it as is--- Someone who openly admitted in their blog to not being skilled in computer security. Am I understanding all this correctly? I love her, I think she's fantastic, but for something on such a big scale you can't just hold the company responsible, there were individuals involved that personally made mistakes.

I can't fault Eden seeing as soon as this question was asked they got right on it. They had planned meetings it sounds like on how to broach this in the best possible way. I would be very disturbed to know my home address was given out or my real name, but then again I advertise myself on myspace- people can also view my avatar and see the same picture on personal websites. I do not feel slighted by this egregious error but what more can they do? They got rid of the file (which seems that only limited people had access to.)

If any of what I've said is wrong please correct me, I'm still trying to grasp the situation at large. I don't want to ruffle feathers and I'm not mad at any individual or the company as a whole

I had to google 'CYA'! Cover Your Ass! Nice one.

No, I don't work for Eden fantasies. I do write reviews for them and get the toys - my personal data might have been affected. I just happen to have very strong opinions about this particular topic.

What can I say? Part of it is sympathy. I live in the real world. I've been on the receiving end of corporate crap when I have to deal with somebody else's screw up. I don't get the impression that EF is taking this REMOTELY lightly and it strikes me that they're doing everything they promised. I'm not sure what people expect. Maybe just to rant. It's making me feel better.

But I'm not just being devil's advocate. I reckon my opinion is valid - I get on a high horse about privacy and blogging and personal responsibility. For example, I don't want my mother to know I get sex toys from Eden Fantasies, but if it REALLY was THAT important to me that nobody EVER found out, the only way to CYA (see, I'm using your phrase) would be NOT to have signed on with them in the first place.

WE ARE A COMMUNITY. If we are part of EF we can certainly be upset at this breach but we should also CLOSE RANKS and act like a community and stop jumping ship and blogging about how terrible EF are. They've been good to me so far and, hell, I want my free toys!

I don't want to find out that because of this leak and the angry blog reaction, as of next month the reviewer program has ended. I gave EF my personal information to get free sex toys. Nobody made me. I think that's worth bearing in mind.

Hell, before I knew EF existed, I bought $60 of sex toys off a company and never saw them months after they'd billed my credit card, so I think NOBODY HERE has the right to say they didn't take a risk sending their info into a company that sells adult products.

The fact that we DID proves that EF IS "the sex-toy company we trust."

The way they've acted - emailing those affected by this leak, taking responsibility for their screw up, not getting bitchy despite our angry attacks - is pretty reassuring.

I am upset this happened, but I'm more upset at the thought of me losing out on my free sex toy every month, the forum, the community blog and everything else I've become a part of since joining the review program.

When I signed up they said they already had enough reviewers, so I wasn't given any free toys for months. In the end I bought my own and reviewed them here myself to EVENTUALLY earn the respect to get the upgrade.

That means I WORKED at becoming part of EF because it MEANS something to me and I'm EXCITED to be a part of it and I'm worried that people's overreaction will destroy that.

I'm not trivializing it, but since my personal data might be/is affected I think I'm just as qualified as anybody else to have an opinion about this situation. The fact that you don't agree with it doesn't make it any less valid.