Risk
7/31/2013
11:26 AM
Connect Directly
RSS
E-Mail
50%
50%

U.K. Online Dating Sites Catch Heat On Privacy

Government and BBC investigations raise alarms about the industry's personal data handling practices, social media identity theft.

In the same week the BBC claims to have uncovered the way unscrupulous U.K. online dating agencies "are preying on those looking for love," the country's privacy watchdog has separately warned four of the biggest local players to better police the way they handle client data.

In "Tainted Love: Secrets of the Dating Game," the state broadcaster's flagship current affairs program, Panorama, claimed to have uncovered a wide range of questionable practices by the online dating industry.

These include deliberate use of millions of photos and private details taken from social media sites without consent and reused to set up fake profiles of imaginary potential partners to, in the program's words, "tempt the lovelorn."

[ Want to learn more about data security? Read Record-Setting Data Breach Highlights Corporate Security Risks. ]

The documentary featured interviews with former online dating agency staffers who admitted on camera how they'd used such data to create fake profiles and adopt multiple personas to reel in those looking for love -- and to boost profits.

The report also claimed the sources of this illegally obtained personal material ranged from British celebrities, politicians and even children. On camera, one former employee said that other European countries (notably Spain) were the main target, with easy pickings apparently coming from platforms such as MySpace.

As part of the investigation, reporters posing as prospective dating agency business openers were able to buy 10,000 people's details, including birthdates and sexual preferences. That dataset included a member of the House of Lords, academics and BBC staff, all of whom told the BBC they had never signed up for such services.

At the same time, British privacy czar the Information Commissioner's Office (ICO) carried out its own investigation of dating sites. The ICO wrote to the U.K. branches of OKCupid, eHarmony, Match.com and Global Personals, plus the industry trade body, the Association of British Introduction Agencies, to alert it to similar concerns.

Letters have been sent warning the bodies that they could be in breach of the Data Protection Act over poor handling of personal details.

Specifically, the ICO is worried about poor visibility of terms and conditions about the use of personal information on these sites. They expressed concern that users must provide personal details to the companies before those terms and conditions are disclosed, as well as the companies' claims to take no responsibility about the loss of personal data. In addition, the regulator is unhappy about the fact that once signed up, daters seemingly have to agree to the sites having "perpetual" or "irrevocable" license to use their data.

Simon Entwisle, ICO director of operations, said, "The evidence we’re being presented with by the media suggests quite concerning business practices by some dating websites, and there are particular questions around how people’s information is being used that need to be answered. It’s concerning to see that there appear to be sites which, as a matter of course, are falling far short of the legal standards for ensuring information is accurate and up to date."

However, "the number of complaints we’re getting from the public is not very high. That could be because this is only an issue with a small minority of websites, or it could be because people are reluctant to come forward," the ICO conceded.

In any case, the body says it will now probe further to try and determine the scale of the issue. It has asked anyone concerned about possible misuse of their personal information to contact its investigators.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Elite Dating
50%
50%
Elite Dating,
User Rank: Apprentice
8/4/2013 | 12:21:41 AM
re: U.K. Online Dating Sites Catch Heat On Privacy
Very glad that things will be tightened up regarding online dating. Too much underhand tactics when dealing with one of the most important aspects of a persons life. www.elanlondon.co.uk
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7298
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

CVE-2014-8346
Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.