Wow - so there is hidden functionality in the new router - reet OK - I really question how PN Techs don't seem to know that this is available - perhaps it's more feasible that they don't want you to know about it...
I have had a quick look at RDNS and I understand that it can sometimes be useful - would turning it off in any way effect me negatively, say, with running a mail or web server? It's like the blind leading the blind! So is this router capable of doing VPN connections then to take the weight off my Server? Is it any cop? For better or worse, misguided or not, this is my message to the networks team:
Many thanks, FAO Networks -
I really begrudge the fact that this has been given a 72 hour turn around time given that the issue has not been resolved properly the first time and after the fact that i've already waited once.
At sign up, your Sales Agents ask for a Username to be provided and do not make customers aware that this username will be linked to a customer's IP address. I gave you a username, having not been informed of how it would be used, that allows for me me to be searched online whenever anybody sees my IP address (it's the same as my Twitter handle). I would have given you an anonymous username had PN actually advised how my username would be used.
That username is then even used as the Email address you give to a customer. This is clearly a breach of the DPA and the Username is defined as "personal information" which is protection with additional safeguards under the DPA. It is reasonably foreseeable that, at the very least, the Sales Team should have warned me that the username provided to PN was too close to my real name but, ideally, it should not have been publicly broadcast in the first place:
Data Protection Act 1998 - Part 1 (1-2) "The Principles":
(1) ***Personal*** data shall be processed **fairly** and lawfully and, in particular, shall not be processed unless—
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
(2) ***Personal*** data shall be obtained only for one or more ***specified*** and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.
Personal data is defined by the ICO as:
" data which relate to a living individual who can be identified –
(a) from those data, or
(b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual." Source -
https://ico.org.uk/for-organisations/guide-to-data-protection/key-definitions/ . It is not necessary to assign a username to an IP in order to provide internet or to comply with any legislative requirements, no conditions in Sch or Sch3 are met. Given that the broadcast of the username is not, literally, technically necessary for your part of fulfilling the provision of ISP services (and crucially not literally technically necessary in the wider industry) and I did not give consent for the information to be broadcast, it is fundamentally unlawful for you to do this. There is also no technical gain in you doing so.
I have only became aware so late in the day about this happening because I was made aware of it by a user who I was talking to on IRC. Had it not been for me having a conversation about wider internet security, I would still be none the wiser.
I was DDOSd recently and so the Static IP address was changed. However, because my username is attached to the Static IP, my new Static IP address has also been exposed. It had been agreed that this would be turned off on the same morning as my Static IP had been changed. As the username has not been disassociated quickly, I am not going going to now need the username to be disassociated, but yet another IP address to be assigned after.
I look forward to hearing from you as the escalation ticket contents left a lot to be desired - particularly that:
1) The DDOS attack is not mentioned, the background to the issue is not mentioned, the fact that the matter was not resolved correctly the first time is not mentioned and the link between accounts has not even been vaguely supplied to you. For a ticket escalated from a technical department that I spent a significant amount of time with going over the background and the issues, this is bitterly disappointing.
2) Craig did not explain the reasons for why I "felt" that the DPA is being breached so the comment was not particularly helpful lacking further explanation.
In terms of action the order is particularly important-
Please would you ensure that my username is disassociated from my IP address ***first***
Please would you arrange for the Static IP address to be reassigned very quickly afterwards to prevent the vulnerabilities that I have been left with having had to wait yet again ***second***
Please take steps to ensure that Customer's currently affected are notified with the option of remedy and that new customers are not affected.***third***
Many thanks.
**If there is any confusion from other notes, past or future, this update should prevail.**
Thanks ever so much guys, it's been a horrible day
🙂
