What was the Better Business Bureau thinking?

"Setting the Standard for Reliability, Credibility and Ethics"

This is one of the mottoes of the local branch of the Better Business Bureau, which serves Eastern Massachusetts, Vermont, and Maine. You see its stickers plastered on the front doors of shops and business all over New England, and even the Massachusetts state government recommends it to consumers as a source for information about local businesses and an avenue to resolve disputes.

However, the Better Business Bureau has not lived up to its reputation, its mission, or the trust of the public. In the past two days, I have found that practically every person who has used its online complaint system in the past three years, along with every business that has been involved in a dispute entered into the system, has had sensitive information carelessly exposed on the BBB website. The security hole resulted in the following problems for tens of thousands of people and businesses:

* Contact information such as names, telephone numbers, mailing addresses, and email addresses of people using its online complaint system have been viewable by every other user of the system.

* Sensitive financial information and details of disputes with businesses and contractors have also been viewable by other users of the system

* The names of businesses that are the subjects of disputes, along with the details of potentially inaccurate accusations against them, have also been viewable by any user of the system.

* Additionally, all of the above information has been viewable by anyone who knows the last name and phone number of a complainant, as well as anyone with access to a single, unprotected URL on the website.

* This affects people and businesses all over the country, as the BBB handles disputes in which only one party involved in a complaint resides in New England.

I estimate as many as 20,000 records, consisting of every complaint submitted since about September 2002 until August 31, 2005, were exposed until Fidelity Observer alerted the Better Business Bureau to the problem and the BBB closed the hole. I believe more than 30,000 individuals and businesses were affected in total.

How did the security vulnerability work? It's not some obscure hacker trick, or an unusual set of technical conditions that need to be in place. If you had registered a complaint with the system, and still had the case number (which was emailed to you) all you needed to do was change a single digit in your access URL to see someone else's record. Here's a screenshot of my logon URL, which displays the top part of my case summary. Immediately below it is a screenshot of someone else's record, which was gained by changing a single digit in the URL.





Even if you didn't have a case number, you could still gain access to the system and all of the records. All you needed to do is find out the name of someone with a dispute (by looking at message boards, blogs, news records, etc.), find their phone number (by using Zabasearch or even directory assistance). With the last name and a telephone number, the system allows you to bypass submitting an actual case number.

I will note that I have no proof that the BBB system was accessed by anyone for malicious purposes. However, the exploit is so easy, and the hole was open for so long, that I find it hard to believe that the system wasn't violated at least once in the past three years.

Naturally, if you are someone who used this system, you are probably angered by the BBB's careless treatment of personal information and dispute details, and may even be worried that others have accessed it for malicious purposes.

But even if you are not a user of the BBB's services, there is still a lesson in all of this: Don't trust a company's website just because it says it is committed to privacy and security. Talk is cheap, as evidenced by the BBB's empty promises about credibility and reliability, and its own "Commitment to Online Security":

Physical, electronic and managerial procedures have been employed to safeguard the security and integrity of personal information. Billing information is encrypted whenever transmitted or received online. Personal information is accessible only by staff and volunteers designated to handle online complaints or requests. All BBB agents and contractors with access to personal information obtained on the BBB web site are also bound to adhere to this policy.

As Fidelity Observer has discovered, these words meant nothing for the past three years. Users trusted the site, and trusted the BBB to protect their information, but it turned out to be a big fat lie. The system was poorly designed, never properly tested at the outset, and never subjected to security audits over a three-year period. The management of the BBB, which spends a lot of time trying to get businesses to buy memberships and sponsor themselves as "patrons", didn't bother evaluating this consumer-oriented tool or the supposed security measures that are meant to protect consumers' data.

Is the BBB guilty of breaking any laws? Maybe not. Companies that handle financial information -- such as Fidelity Investments -- are bound by regulations governing the data of its customers. But the BBB is a non-profit organization, and non-profits have largely slipped under the radar screen of regulators over the years.

Maybe it's time for that to change.