Delivering An Open Letter to BT

June 23, 2016

An open letter because BT continues with its custom of blatant dishonesty and obstruction of customer complaints. This letter was sent to Gavin Paterson, BT’s CEO, following a correspondence string which invariably received responses whose honesty was noticeable by its absence.

It appears that your staff are unable to check customer history correctly. Your complaints system should have comprehensive details of my previous complaints which state very clearly that, having been an extremely dissatisfied customer of BT, I was formally requiring that you did not pester me with junk sales communication via any channel.

It is unsatisfactory that your staff are pretending that the problem lies with another company. This is WRONG. I had enough unpleasant dealings with BT to be very sure of the name of the company causing the problem.

Your staff claim that the problem would not have existed were the number registered with TPS. Your staff should be capable of checking this before making such a stupid recommendation. They should also have the basic understanding that TPS registration is done directly, not through the service supplier. The number has in fact been registered with TPS for years, apart from a brief period when BT abused its position by instructing TPS to remove the number from its Do Not Call list. If your staff think that the TPS list is an effective way of preventing unwanted calls, then your processes should ensure that a check is made against TPS records BEFORE attempting to nuisance call people.

It is also clear from the reply below that your processes are unacceptably inadequate in dealing with the issue of nuisance calls. When BT is told that its nuisance calls are unwanted it has no excuse for failing to record that, whether or not the requirement comes from a BT customer. In this instance, your staff are wrong in claiming that there is no account to mark. There is the historic account, whose management left me disgusted with BT’s dishonesty. And, as I said in earlier correspondence, you are holding sufficient information to have my name associated with the number. Were you making the least attempt to comply with the Data Protection Act, this alone should have prevented your nuisance call.

It is very clear that BT is hiding behind company size and ignorant staff to try and block serious complaints. While this is not surprising given BT’s history, it is completely unacceptable.

Advertisements

Harassment – The Crime Committed By Nuisance Cold Callers and Similar Scammers

November 6, 2014

We’ve all had it, the persistent calls at ridiculous hours, with recorded or spoken scripts riddled with lies. The smarmy sleazy voices. They pretend to represent or be authorised by government departments. They pretend they know about a claim or right you have. They pretend you have to do something because of new legislation. They lie and lie and lie. They want your money for some dubious product, and people have been scammed out of thousands of pounds this way. They want your personal information, and giving them that is a large step on the way to the hell of ID theft and further fraud.

They got your data from somewhere illegally, and once one bunch of these crooks have your data it gets sold around. Try as you will, you can’t stop it. It’s not just data breaches. It’s not just small naïve organisations not being good enough with their data security. It’s not just all these marketing offers. Government departments have been publishing sensitive personal data for years, and two of the biggest are doing their damndest to start selling it on a large scale to all and sundry – step forward HMRC and the NHS. We have in the space of a few short years been forced into dealing with constant harassment within our homes.

I’m actually surprised that telecoms companies aren’t protesting about this. There’s been a lot of recent publicity about people giving up on landlines for the simple reason that the bulk of calls come from fraudsters autodialling or using illegally obtained information. At least with a mobile you can cut the call off. When it comes to the primitive technology of landlines, the caller has control and can block your line.
With elections coming up we’re getting mealy mouthed platitudes from politicians about doing something to stop this. Why haven’t they done it before? The legislation already exists. These calls easily fall within harassment legislation and it is a criminal offence.
• It certainly distresses people to be constantly interrupted
• Frequently numbers are withheld, which is intrinsically threatening since the caller appears to be untraceable
• Many of these calls are silent, which is particularly threatening.
• A frequent tactic is to pretend that there is legislation which means the called person must do something
• The callers refuse to say where they obtained the personal information they so clearly have, which is a tactic of intimidation – ‘we know about you, we won’t say how’
• Buying or selling or passing on illegally obtained information is certainly harassment since it perpetuates and escalates the distress being caused.

The CPS provides the following definition of harassment:
‘the term harassment is used to cover the ‘causing alarm or distress’ offences under section 2 of the Protection from Harassment Act 1997…. The term can also include harassment by two or more defendants against an individual or harassment against more than one victim.
Although harassment is not specifically defined in section 7(2) of the PHA, it can include repeated attempts to impose unwanted communications and contact upon a victim in a manner that could be expected to cause distress or fear in any reasonable person.
A prosecution under section 2 or 4 requires proof of harassment. In addition, there must be evidence to prove the conduct was targeted at an individual, was calculated to alarm or cause him/her distress, and was oppressive and unreasonable.
Closely connected groups may also be subjected to ‘collective’ harassment. The primary intention of this type of harassment is not generally directed at an individual but rather at members of a group. This could include: members of the same family; residents of a particular neighbourhood; groups of a specific identity including ethnicity or sexuality, for example, the racial harassment of the users of a specific ethnic community centre; harassment of a group of disabled people; harassment of gay clubs; or of those engaged in a specific trade or profession.

Well, distress is being caused on a large scale. There are very clearly repeated attempts to impose unwanted communication, and there is no realistic opt out – the so called opt out option on automated calls has long been recognised as being used as confirmation that the person called is gullible so a good target for further harassment.

As to evidence, since these scammers are being allowed by telecoms providers to withhold numbers or display numbers, there’s not a lot the victim can do. But the information is flowing through the telecoms companies. They make money from these calls. In effect they are abetting fraud and harassment by doing this. Let’s see them forced to take some responsibility.

Are individuals being targeted on the basis of ‘protected characteristics’? Look at the age profiles. Ask people who have hit 50 or 60 or 70. Ask people who have started getting a state pension. Age is a recognised trigger for increasing volumes of scam calls. The fraudsters assume that older people are easier to intimidate into parting with information and money, and sometimes they are right. It may be the targeting of people who grew up in more innocent times and who, by retiring, are predictably likely to be at home at times to suit scammers. It may be people who are vulnerable through bereavement, particularly if the late spouse took responsibility for financial matters. It is more common for elderly people to be confused, through dementia or medication, so less resistive to scams. It sure as hell means that these scammers are targeting people on the basis of the protected characteristic of age.

Of course the people doing all this cannot help but be fully aware that they are following a course of conduct which amounts to harassment. It takes little intelligent thought to recognise the conduct as unreasonable. In fact it takes a highly determined effort at self-deception to find even the flimsiest framework which shows the conduct as anything other than deceptive, dishonest, unreasonable, and intimidating.

They know all of this when they buy data without checking it has been legally obtained so the defence of legitimate trade does not apply. They know it when they sell the data on illegitimately. They know it when they autodial. They know it when they phone TPS registered numbers. They know it when they write and approve scripts full of lies. They know it when they train their staff.

They? The Board of Directors, obviously, and also those in senior management who promote and collude with harassing behaviour. That covers operational management and strategic decision making. It covers HR when they set targets which depend on harassment producing results. It covers those who accept financial reports based on results obtained by harassment. It covers auditors who turn a blind eye to the way a company generates its profits. It covers those businesses which provide outsourced outbound calling services and pretend that they have no responsibility for the legitimacy of the data they use for calling. They are all executing or colluding with institutionalised practices of harassment.

There is of course Data Protection legislation, but that is too weak to be useful, more so since it relies on civil prosecution by the victim, and the harassment is executed in a way which prevents the victim from getting access to the necessary proof.

Under Protection From Harassment legislation, a perpetrator can be imprisoned for up to 6 months and fined up to £5000. The legislation for punishment exists. The cases exist to prosecute. The data is available to prosecute. Yet there has yet to be a prosecution. Not a single politician has risen from their backside to ask why there have been no prosecutions.

The DeliveryDemon, like a lot of people, is pretty quick to recognise scammers and tell them where to go. They are still a bloody nuisance and their calls are still harassment. She would dearly love to hear just one actual or prospective MP actually stand up and ask – loudly – for action to be taken using the ample legislation which is already in place.

Yes, let’s see the Action Fraud database being used to collect details of these harassers. And Data Protection reports. And Ofcom reports. And TPS reports. All the data collection mechanisms exist. Let’s see a campaign encouraging the victims to report their harassers. Let’s see some pressure on the telecoms companies to take responsibility for ensuring that their networks are not used for harassment. And let’s see the data being used for prosecutions.

We have seen a few prosecutions in other sectors for blatant criminal activity. Doing the same to the decision makers in nuisance cold calling organisations just might prompt an improvement in their behaviour.


Delivering Libellous Content

March 17, 2014

The DeliveryDemon had to chuckle at this article http://www.pressgazette.co.uk/content/dont-let-internet-linked-stories-land-you-libel-writ

The law has certainly been working hard to catch up with technology, and the impact of this sort of libel is very real to those who are libelled. But the legal profession is missing a trick here. Behind the scenes, there is technology which looks for keywords and tries to interpret them. By and large this software is still remarkably primitive. It has yet to get to grips with the ability to interpret the context. Basically it lacks ‘intelligence’. It is designed to provide an answer at the expense of providing a sensible answer.

Google predictive text gives some good examples of what can happen http://www.telegraph.co.uk/technology/google/6161567/The-20-funniest-suggestions-from-Google-Suggest.html and various mobile phone predictive text engines can be even funnier. The automated parsers used by recruiters cannot distinguish between Coral the bookmaker and Coral the programming language. Amazon’s ‘you might like’ suggestions suggest you buy an identical item to a recent purchase, with a different brand name.

To some extent, many of these tools are designed to depend on data which is not quality-controlled in any effective way. Certainly an Amazon vendor will enter the keywords likely to maximise search hits. that can mean the entry of keywords with little relation to the product being sold.

Google is one of the more sophisticated players since its product depends on understanding what a searcher is likely to want, but the Telegraph article shows how primitive the logic is. Asking users to log in and relating searches to their search history has the potential to improve search result quality, but people are becoming increasingly sensitive to the amount of their data held by large corporations, and legislators are starting to respond to those concerns, so relying on users logging in may not be the most fruitful development path for this type of tool.

The examples in libel article certainly have merit. Either the tool is not fit for purpose, or it is being used unintelligently. A fairly obvious solution would be for the news website to flag articles as being either positive or adverse, provided the tool refrains from coming up with links to ‘similar’ articles unless they were also flagged as adverse. If the tool can do this, the web publisher is at fault. If the tool can’t do it, then there are two potential breaches. The tool may be inadequate for the purpose for which it is being sold. Or the web publisher may be making inappropriate use of the tool. Of course, when a payment model is based on click throughs, the incentives tend not to favour anything which limits the number of links displayed.

A fruitful approach for legislators would be to look beyond individual libels and examine the capabilities of current tools, and the processes which web publishers use to to mitigate the risks arising from tool limitations.


Banks that don’t deliver

August 7, 2012

The DeliveryDemon prefers to avoid dealing with financial institutions, primarily because of the enormous effort required to overcome their incompetence. The validity of this prejudice was confirmed recently during an attempt to open a very simple bank account https://deliverydemon.wordpress.com/2012/06/20/delivering-complexity-at-the-expense-of-security/

But the saga didn’t end there. Despite the DeliveryDemon having previously entered her details online – and she knows how to spell her own name – when she went to a branch to complete the tedious and primitive process, the bank person (teller? salesman?) managed to introduce an incorrect spelling. When the DeliveryDemon pointed this out, and expressed the wish to have cards and cheque book showing the name she normally uses, the bank person claimed to have corrected it. This was followed by the staggering assertion that, having introduced the error, the bank would send me documentation in the incorrect name as well as correct documentation.

So what actually happened?

  • A chequebook arrived with the incorrect name
  • A paying in book arrived with the incorrect name
  • TWO cards arrived in the SAME envelope, one with the incorrect name and one with the correct name, with the covering letter referring to BOTH cards
  • Two separate envelopes arrived in the same post as the cards, with PINs for each card – not particularly good security.

Today the DeliveryDemon spent nearly half an hour on the phone to their hell centre to try and sort the mess out.  The first clueless idiot, who couldn’t even read what was on the screen in front of her, just bleated that she wasn’t capable of changing details. Rather than waste time, the DeliveryDemon asked to talk to the supervisor. This person waffled on about stuff having gone missing – in fact he was referring to the cards etc that I had received with the incorrect name on them. Eventually he stopped waffling for long enough to arrange for corrected chequebook and paying in book to be sent, but the card problem was handled elsewhere.

When the DeliveryDemon got through to the bunch who deal with cards, their first suggestion was that they would send new cards to the branch to be picked up – a round journey of 80 miles, not to mention the time wasted and the tedious hanging around in the branch –  suggesting incorrectly and without checking the facts that cards had been sent which the DeliveryDemon had not received.

Eventually it transpired that nothing had gone missing but the bank had generated an incorrect card and a correct card and had chosen to send out BOTH cards in the same envelope. There is clearly a complete lack of intelligence in the system to pick up the fact that two cards were being sent for a single signatory account. Even if it had been a multiple signatory account, sending two cards in the same envelope is poor security, and the fact that this can happen indicates that, if the card sticking and envelope stuffing gets out of sequence, there’s nothing in the process to stop cards going to the wrong person.

This is the same bank which wants the customer to come up with EIGHT so-called authentication factors, considering it a form of security to ask a customer for information which is in the public domain. It hasn’t registered the fact that anything which makes a number memorable also makes it easier to guess. And it’s far too stupid to realise that, even if someone is sufficiently media-led to have a favourite sleb, that is hardly the sort of stable information that makes for a decent authentication factor – just how many people are going to contact their bank every few weeks to announce that they have gone off Lady Gaga recently and much prefer Metallica?

Clearly this bank has no concept of the basics of security. Like so many institutions it has confused security with making it difficult for customers to access their own money. And to confirm that staggering absence of commitment to customer service, it expects customers to go out of their way to sort out mistakes whcih arise purely from the bank’s incompetence.


Delivering Complexity at the Expense of Security

June 20, 2012

The DeliveryDemon is frequently flabbergasted by the sheer stupidity demonstrated by so many financial institutions when it comes to security. They obstinately pretend that imposing complexity on account access equates to security, in the face of all evidence to the contrary. At the same time they refuse to acknowledge that their own processes are often staggeringly insecure.

Some time ago after a trip abroad, the DeliveryDemon had a phone message claiming her credit card had been compromised, and asking her to ring the issuer on an unidentifiable number. It clearly sounded like a scam which needed to be reported to the issuer. So the DeliveryDemon phoned the switchboard and asked to be put through to the person who had left the message. She was unsurprised when the switchboard had never heard of this person, and asked to be put through to the security and fraud department – where she found herself talking to the person who had left the suspect message.

So how many security mistakes was that?

  • Leaving a message about a card compromise on a landline answering machine without knowing who might pick it up
  • Asking the cardholder to ring a number which could belong to any scammer
  • Creating a situation designed to justify a request for secure information, using a process riddled with fundamental security flaws
  • Preventing a customer from carrying out basic security checks by using a name not recognised by the switchboard.

But the biggest mistake of all was the fact that some time afterwards the DeliveryDemon had to deal with the identical flawed process. Needless to say, the DeliveryDemon had complained to the card issuer on the first occasion, yet the organisatioj had taken no notice of the complaint and had continued knowingly to operate processes which were fundamentally insecure.

This type of stupidity is remarkably common in the financial services sector, and a couple of very similar examples are described in an earlier post .

https://deliverydemon.wordpress.com/2012/04/02/delivering-poor-banking-security/

The other side of this refusal to operate secure processes is a determined effort to create barriers to prevent a customer from accessing their own funds. This goes hand in hand with lengthy and inequitable Ts and Cs which attempt to absolve banks from any responsibility whatsoever. The DeliveryDemon recently encountered this while opening a very basic bank account. This ‘simple’ account required no less than EIGHT authentication factors, including providing answers to some remarkably stupid questions.

  • A memorable number? Seriously? Numbers are not intrinsically memorable. Those which are memorable usually relate to public domain information, which is hardly secure.
  • Details of various third parties? Public domain again. It is also questionable in data protection terms whether a bank should be asking for information about third parties who have nothing to do with the account.
  • Favourite TV programs, newspapers, historical person, sleb, town? Get a life! This sort of preference is transient and likely to be forgotten months or years down the line when it is eventually needed in order to deal with some call centre drone who is not empowered to think beyond the mindless detail on the screen in front of them.

This sort of pseudo security is not just stupid in its own right, it is creating a situation where complexity makes life difficult for the customer, while being used as an excuse for financial institutions to try to avoid their own responsibilities.

Put these so-called security processes in the context of today’s digital native. Basic security advice is not to use the same details in multiple places, since compromise of one account can lead to compromise elsewhere. Typically, an account asks for 4 pieces of information, even when no financial transactions are involved. Try counting them up. Even without an intricate lifestyle the following range of accounts is pretty commonplace.

  • Mortgage
  • Mortgage-related insurance
  • Life insurance
  • Health insurance
  • Current account
  • Savings account
  • Debit card
  • Credit card
  • ISA
  • Pension
  • E-mail account
  • Work e-mail account
  • Mobile account
  • Landline / broadband account
  • Car insurance
  • Car radio code
  • Electricity account
  • Gas account
  • Water account
  • Council tax account
  • Supermarket account
  • Amazon account
  • i-Tunes account
  • Comparison site accounts – up to half a dozen
  • Social media accounts – another half a dozen
  • Technology support arrangements – say 3
  • Travel accounts for commuters – another couple
  • Online information sources such as newspapers, news sites and the like – say 3.

All of these want a login ID and a password, plus several additional pieces of information for ‘security’ should you be unable to log in. Security guidance suggest that unique information should be used for each situation, and that the information should not be written down in a recognisable format, even when months or years may elapse between accesses to the account.

Put this into the context of the real world. Current security guidance expects the individual to memorise in excess of 172 unique pieces of information, and to relate each piece of information to one of 43 or more situations. Current practice is for Ts and Cs to forbid keeping written records of passwords in any useful format. This is complete nonsense, not security.

So what’s the answer? There are organisations which can be used to store multiple passwords, but these then become a single point of failure should the access password be compromised or the organisation’s own security be breached. It’s not clear whether this sort of password storage is acceptable under access Ts and Cs either.  Even if banks start to give some form of approval to these organisations, it could be withdrawn, leaving the customer with the option of dealing with multiple password holders or changing to a new one. If a security breach underlies the reason for change, that would mean working through every single account to change access details. In some circumstances that may mean the delay of going through the account provider to replace codes which they do not allow the customer to change.

The current security situation is clearly unsatisfactory, ineffective,  and unfair to the customer. The DeliveryDemon thinks it is time that organisations which are responsible for security got together with both security and usability experts to come up with a solution which is designed to protect the customer’s interests, not a solution based on allowing financial institutions to avoid responsibility.


Delivering Demands for Blind Acquiescence

June 13, 2012

The DeliveryDemon is becoming increasingly fed up with growing expectations of blind acquiescence. It may make it easier for an organisation to use ill-trained operatives and unintelligent processes if customers mindlessly comply with demands for vast amounts of sensitive personal information despite the absence of justification for the request. After all, if everyone provides every piece of information which might be required for every conceivable circumstance, the admin drone can just tick a load of boxes and the organisation doesn’t have to bother making the effort of deciding which information is actually required. And the DeliveryDemon is fully aware that many such demands for information are purely box ticking exercises, with no intelligent use being made of the information gathered. She is also fully aware that, when no thought is applied to deciding which information is needed, it is highly likely that an equal lack of intelligence and diligence is applied to the storage and management of information collected.

This rant was provoked by the need to go through a ‘proof of ID’ process, where the conversation with the call centre went something like this:

DD – You don’t need my marriage certificate since I never changed my name – why do you need my divorce documentation?

CC – It’s the regulations

DD – Which regulations?

CC – HMRC regulations

DD – Which HMRC regulations?

CC – I’ll check with my supervisor

CC calls back – It’s our own rules

DD – Why do you need it?

CC – It’s our rules

DD – If you need it you have a duty to explain why it’s needed

CC – I’ll get someone to call you back

CC2 calls back – We might be able to accept copies with a letter

DD – That wasn’t my question. You have already said you don’t need my marriage documentation since I have never changed my name. Why do you need my divorce documentation?

CC2 – We don’t need it.

Unfortunately, this sort of conversation is, in the DeliveryDemon’s experience, all too common. Far too many organisations feel entitled to pressurising customers into providing information well in excess of the organisation’s real need. Let’s look at what actually happened here.

  • First there was a request for information without an adequate explanation of why it was required.
  • Second there was the assumption that a reference to some unspecified regulations would make a customer stop asking questions.
  • Third there was an assumption that a reference to HMRC would stop a persistent customer from asking questions.
  • Fourth, there was an admission that it wasn’t valid to blame the law or the taxman, that this was an internal blocker.
  • Fifth there was an attempt to avoid the issue by offering an alternative (certificate copies), in the hope that the customer would be fed up enough to comply.
  • Sixth was the admission that the information was not required.

This was not an isolated incident. The DeliveryDemon frequently encounters organisations which behave as though Data Protection legislation didn’t apply to them. If there is a genuine need for a piece of information in one specific instance, they embed the requirement in their general process. They try to blame the law, or various bureaucratic bodies. Call centre operatives are trained to give woolly and misleading responses to questions about the need for information. They expect the customer to be acquiescent and unquestioning, in the interests of lazy process.

It is simply not good enough. The DeliveryDemon is familiar with data protection provisions, and has a good understanding of how a wide range of businesses operate. This puts her in a good position to challenge demands for excessive information. Not everyone is so lucky.

It’s not a matter of being awkward. Our personal data has value, and the cost to the individual of identity theft is massive. Both the law and business ethics demand that organisations only collect the data they need, and on the basis of explicit customer agreement and understanding. It is shocking how many organisations are prepared to ignore both the law and ethical considerations. Unfortunately, the UK’s enforcement of data protection legislation is weakly and tardily applied – enforced would be too strong a word. It’s down to the customer to resist the tsunami of demands. The DeliveryDemon recommends the following questions:

  • Why do you need it?
  • Which legislation requires it?
  • No, I need to know exactly which legislation so I can check the requirement.
  • Who will have access to it?
  • How will it be kept secure?
  • How long will it be held?