Thread by @allthecitizens

🚨NEW:

The Labour Party are still refusing - nearly eight months on - to answer Subject Access Requests from party members about what information was lost during a massive data breach back in October last year. 🧵
@allthecitizens / @TheEyeballsEN / @BylineTimes

Following news of a data breach affecting the Labour party, in which a ‘significant quantity of party data’ was rendered ‘inaccessible’, @allthecitizens can confirm that members still haven’t had their requests for information answered by the party.

In a press release following the attack, Labour announced that the data affected included ‘information provided to the Party by its members, registered and affiliated supporters, and other individuals who have provided their information’
labour.org.uk/about-your-dat…

The event affected a third party, Tangent, which handles Labour’s membership data, who fell victim to an attack by an unknown ransomware group.

They locked Tangent out of the database, holding the info hostage until the company agreed to pay...
techcrunch.com/2021/11/04/lab…

Tangent refused, so the data was corrupted, rendering it inaccessible.

Labour engaged the National Crime Agency, National Cyber Security Centre, and Information Commissioner’s Office, but it didn't inform affected members until 5 days after the breach.
publictechnology.net/articles/news/…

In response, @allthecitizens and @TheEyeballsEN, both formed in the wake of #CambridgeAnalytica, collaborated in Nov to develop a Subject Access Request generator, to help people file automated requests to uncover what specific user data was compromised:

https://twitter.com/allthecitizens/status/1460300643147649028?s=20&t=X52dyBGxHq_nIDAodQz-hA

The tool was launched in late November 2021, and included an initial set of over 90 applicants.

Respondents were then asked, after Labour had failed to respond initially, to send a further prompt to the party in January, and once again in mid-April.

Of the 25 applicants who saw the process through to the end, so far not one has recorded receiving a response from Labour.

What’s more, in the months since the breach, they've failed to communicate what specific data was accessed, or a full breakdown of info it holds on people.

Shockingly, many of those affected by the breach had left the party years earlier, some had never even joined, instead having made one-off payments to affiliates, or signing up for mailing lists.

Some had left the party as late ago as 2014…
inews.co.uk/news/politics/…

Speaking to @allthecitizens, one ex-member said that ‘I left the Labour Party in 2016, after they waved through the Investigatory Powers Act - so that’s five years between my leaving and the data breach!’

Others voiced similar concerns and frustrations with the lack of response:

Labour claims its own systems have not been affected, although its membership webpage has been down since it happened. As a result, the party reportedly doesn’t have a complete membership list beyond December 2021.

The loss of accurate membership data also included people who were in arrears with payments. labourlist.org/2022/01/labour…

What’s more, the party have reportedly been advising colleagues to ‘refrain from any public commentary (on social media or otherwise) on this matter’.

Frustrated members have now gone to the Information Commissioner’s Office themselves for answers.
skwawkbox.org/2021/11/04/eva…

The ICO however, while having directed Labour to respond to those requesting copies of their data, have said that “The ICO’s role is to provide an outcome to individuals and we are unable to act as a mediator in these situations.”

The party website states that it can hold information on party members for up to fifteen years (in the case of Electoral Register data), and variously up to 6-10 years for names, addresses, donation values, call notes and correspondence, and profiled data.
labour.org.uk/privacy-policy/

Of key concern, given cases like Cambridge Analytica, is the potential for highly sensitive information - financial, constituent, or other identifiable data, specifically current party membership information - to be abused by malicious actors should it fall into the wrong hands.

At least 5 law firms are now looking to take up lawsuits against the party and Tangent, for refusing to engage in the matter, with a firm telling @allthecitizens they already had ‘1000 claimants’

Likewise, every single member who joined our efforts has, as of yet, been ignored.

Meanwhile, we will continue our efforts to find out what data Labour held on its past and present members, and push for greater transparency from them while investigations into the breach are still ongoing.

Labour and Tangent were approached for comment.

https://twitter.com/allthecitizens/status/1460300653234991104?s=20&t=DFNaVOybmkVO73h4zcCOHA

Read the full story from @MC_00_ below in the @BylineTimes:

https://twitter.com/BylineTimes/status/1533750570753921024?s=20&t=fxy7lBp_gMI6pkDMmdzhkw