Search Mailing List Archives


Limit search to: Subject & Body Subject Author
Sort by: Reverse Sort
Limit to: All This Week Last Week This Month Last Month
Select Date Range     through    

[liberationtech] Buffoons stepping all over my privacy with muddy boots

The Dod unclezzzen at gmail.com
Sat Mar 3 03:39:49 PST 2012


On 03/03/2012 12:24 AM, John Graham-Cumming wrote:
> Given that the company in question is Amadeus and Amadeus is one of 
> the major reservation systems used by airlines I'd hazard to guess 
> that no 'sharing' of data happened here. I'd wager that the airline in 
> question uses Amadeus for its reservations and *all* they've done is 
> send you to a site that Amadeus runs so people can see their 
> reservations.
>
> John.
> --
> Sent from mobile device. Please excuse brevity and strange typos.
>

I resent the world "*all*". *What* they've done was illegal and 
*practically* dangerous to me.
Let's assume they do nothing else "behind the scene" (and why should I 
assume that? They've already done enough, and their so called "privacy 
policy" allows them to do practically anything). The situation *at the 
moment* is unbearable (even without script kiddies going fishing there 
in the shallow-entropy side of the pool).

A simple demonstration: 
https://twitter.com/SergiooPiza24/status/175635157720641536
Feel free to call Sergio in Bogota and tell him checkmytrip rats on him. 
You have the number there :)



> On 2 Mar 2012, at 16:45, Renee Lloyd <reneelloyd at me.com 
> <mailto:reneelloyd at me.com>> wrote:
>
>> So I read your post and thought this is pretty crummy.   While we all 
>> "know" that data is shared this scenario highlights the "OMG, they 
>> did what?" really well.   It is particularly cloying because you did 
>> not even sign up for this service the airline signed you up.  The 
>> airline who, in the context of booking a flight, needs the personal 
>> data that you shared.  But taking that information and sharing it 
>> with this company seemingly unrestricted without your notice and 
>> consent is stunning.
>>
>> To be honest, after reading what you wrote, I thought, for sure they 
>> would have some type of, "opt out and delete" function or procedure 
>> in their TOS or Privacy Policy.   I, perhaps foolishly, thought that 
>> they would also have a more limited use on information furnished by 
>> third parties or partners (airline).   Curiosity got the better of me 
>> and I actually looked at the site.  They don;t have a TOS but a 
>> fairly elaborate privacy policy and their policy says that they use 
>> the data:
>>
>> /"Personal data will be processed in accordance with applicable local 
>> law and regulations regarding data privacy.*Personal data will be 
>> processed, stored and disclosed only for business purposes as 
>> described below*. We may use your data for the following purposes: - 
>> *to provide you with the highest possible level of service and to 
>> help you to obtain the best service from our website*; - for other 
>> administrative purposes and for internal analysis; and - to 
>> participate as part of a survey or to get feedback. Non-personal data 
>> may be used to compile and analyze travel trends and/or other 
>> demographic information."/
>>
>> They can process store and *disclose* personal data for business 
>> purposes which includes just about anything (note how they insert 
>> 'only' before "business purpose" to give the illusion that this is 
>> some limited right).   In addition "purpose as described below" is 
>> not exclusive but rather reflective of some of the activities that 
>> would be considered use, disclosure, process for a business purpose. 
>>  In any event,  the 'purpose" is broad enough to do just about 
>> anything so there is little comfort that the policy will establish 
>> clear limits on what they do.   While I don't labor under a delusion 
>> that these policies are designed in any way to protect the individual 
>> whose information collection, use etc they control, I DO take issue 
>> with the sneaky drafting.  For example, as pointed out above, in the 
>> "how we use your data section"  it reads, "Personal data will be 
>> processed stored *and disclosed *only for business purposes*" * but 
>> in the section labeled "To whom may your data be disclosed?"   the 
>> policy reads as follows:
>>
>> / "If you are a travel and tourism customer, we will disclose your 
>> data to our partners for fulfillment of your booking request or other 
>> booking related requests. We will not disclose your data to any third 
>> parties except where necessary for the purposes of fulfilling any 
>> bookings, booking related requests, credit checks or fraud 
>> prevention, *or as otherwise described in this statement.* We may 
>> disclose your information if required by any applicable law, 
>> subpoena, or regulation. We may also disclose your data to third 
>> parties and professional advisors acting on our behalf who are 
>> obliged to keep that data confidential."/
>>
>> Something like this, to me is like a marketing document, they will be 
>> somewhat specific about the sharing that 'seems reasonable"  or 
>> better yet does not immediately raise a red flag (it may be  logical 
>> to share information for booking purposes) and rather than call out 
>> the*"red flag raising" *sharing of data*(the stuff we actually care 
>> about) w*hich legally they are required to disclose (in some form) 
>>  they i*nclude  the *"*or as otherwise described in this statement*" 
>> which technically complies.
>>
>> As I write this I am thinking 'this is madness"  you arrange a flight 
>> and the digital terms and policies of the airline and companies like 
>> this site seamlessly allow your information to be shared  which 
>> certainly benefits the airline and the site.  It may benefit you, if 
>> you were given the opportunity to understand and consent, but that is 
>> not how these things are designed.   Based on what I learned, there 
>> are a lot of concerns with their policy, at a minimum their 
>> collection, use, distribution, disclosure of 
>> *non-volunteered* information is outrageous.  The  site also directs 
>> individuals with concerns or questions about the privacy policy to 
>> send an email to: dataprotection at amadeus.com 
>> <mailto:dataprotection at amadeus.com>.     I intend to send an e-mail 
>> and hope others do as well.
>>
>>
>>
>>
>>
>> On 2012-03-02, at 9:43 AM, The Dod wrote:
>>
>>> I've just changed the date of a flight, and got an email from the 
>>> airline that also gave a link to my flight details at a site called 
>>> checkmytrip.com <http://checkmytrip.com>
>>> It's SSL, but that's where the cargo cult ends.
>>> This url doesn't seem to contain anything with entropy, and leads to 
>>> a page showing flight details, weather, and... my name, email 
>>> address and 2 phone numbers.
>>> OK. The airline leaked this someone without my consent, and even if 
>>> they have a privacy policy, too late for me to read it.
>>> But it gets better.
>>> They have a "share this" option. Mail/twitter/facebook. I tried mail 
>>> from/to trash mailboxes, and I get the exact same url I got.
>>> ZOMG. I could have twoten my identity all over the galaxy if I was a 
>>> wee bit less concentrated.
>>>
>>> What's the procedure in such cases? How do I make this info 
>>> disappear from that site without too much pain for me? Assuming they 
>>> do that, how big is the threat of this info leaking to whoever 
>>> checkmytrip are wheeling and dealing with?
>>> I mean, do I need to change my name and phone numbers? :)
>>> _______________________________________________
>>> liberationtech mailing list
>>> liberationtech at lists.stanford.edu 
>>> <mailto:liberationtech at lists.stanford.edu>
>>>
>>> Should you need to change your subscription options, please go to:
>>>
>>> https://mailman.stanford.edu/mailman/listinfo/liberationtech
>>>
>>> If you would like to receive a daily digest, click "yes" (once you 
>>> click above) next to "would you like to receive list mail batched in 
>>> a daily digest?"
>>>
>>> You will need the user name and password you receive from the list 
>>> moderator in monthly reminders.
>>>
>>> Should you need immediate assistance, please contact the list moderator.
>>>
>>> Please don't forget to follow us on 
>>> http://twitter.com/#!/Liberationtech 
>>> <http://twitter.com/#%21/Liberationtech>
>>
>> _______________________________________________
>> liberationtech mailing list
>> liberationtech at lists.stanford.edu 
>> <mailto:liberationtech at lists.stanford.edu>
>>
>> Should you need to change your subscription options, please go to:
>>
>> https://mailman.stanford.edu/mailman/listinfo/liberationtech
>>
>> If you would like to receive a daily digest, click "yes" (once you 
>> click above) next to "would you like to receive list mail batched in 
>> a daily digest?"
>>
>> You will need the user name and password you receive from the list 
>> moderator in monthly reminders.
>>
>> Should you need immediate assistance, please contact the list moderator.
>>
>> Please don't forget to follow us on 
>> http://twitter.com/#!/Liberationtech 
>> <http://twitter.com/#%21/Liberationtech>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.stanford.edu/pipermail/liberationtech/attachments/20120303/8bfa4c04/attachment.html>


More information about the liberationtech mailing list