We hear a lot about open data these days. Organisations embrace it differently- Southampton University have a huge amount available in machine-readable formats, others think that posting a PDF is the way to go, despite the fact that it isn’t.

Anyway, you have to be careful what data is released: data protection laws mean that you shouldn’t release personal data.

Walsall MBC have fallen foul of this: if it’s not actually illegal (though this suggests it is), it’s not good to reveal the email addresses of everyone that signed a e-petition to all the other people that did. It’s a social engineer’s dream: a list of people with a common interest. I’m in there, but just guessing my email address is easy, but I now know several people’s email addresses I didn’t before and couldn’t have guessed.

Interestingly, I only noticed because the mail got trapped by Spamassassin, and I thought it was odd that anything from Walsall MBC would hit the filter- this made me look at it in detail.

Because the mail was badly formatted, it got scored like this:


pts rule name description
---- ---------------------- -------------------------
1.8 BAD_ENC_HEADER Message has bad MIME encoding in the header
0.2 SUBJECT_FUZZY_TION Attempt to obfuscate words in Subject:
0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
1.6 DEAR_SOMETHING BODY: Contains 'Dear (something)'
-0.2 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.2723]
0.0 HTML_MESSAGE BODY: HTML included in message
1.4 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS


Bad form, Walsall MBC. As for all of you people that signed the library petiton, watch out for phishing attempts.

[edit 22:34]
Just to clarify: In my opinion, this is a training or systems issue- the individual that sent the mail should have been shown/trained how to do this, or the system should do it correctly with no intervention. A proper mass-mailer would do so.