nhw: What appears to have happened with RapLeaf

Nicholas (

nhw) wrote,
@ 2007-09-07 07:39:00

Entry tags:

rapleaf

What appears to have happened with RapLeaf
A few weeks ago I heard about this website called "UpScoop" (Won't give the link, but you can find it easily enough) which offered to check your address book and see what social networking sites your contacts are using. I hesitated about trying it for several reasons: the sites I use most (LinkedIn and Facebook) have pretty decent lookup services of their own, and I was not especially interested in extending this sort of drain on my time.

But I was convinced to give it a try, mainly because their assurances on the privacy of my data appeared pretty watertight. At that time, the following statements, dated 10 April, still appeared on their website privacy statement (scraped from a Google cache as the original page has disappeared):

We will not email or contact any email address obtained from address books.

Upscoop does not email, contact, or spam any friends from an email address book.

Upscoop does not sell, rent, or lease email addresses to partners, clients, third-party marketers, or other third parties.

That all seemed to me pretty watertight, though I did a bit more due diligence by checking around its reputation in the blogosphere and it seemed to be OK. So I let it run through my address book, which found actually very little that I didn't already know (I think two people who are on Livejournal, and that's it; also it introduced me to the rather useless Hi5.com social networking site).

NB however that for a lot of you, my address book includes your real name along with your normal address. There was nothing in UpScoop to suggest that they were scraping real names as well as email addresses, let along that they were retaining that data to set up their own new service.

Boy, was I wrong.

Given the fact that almost everyone I know seems to have received an email from UpScoop's parent company RapLeaf this week, and that the UpScoop privacy policy has now been scrapped along with all of the above crucial reassuring sentences, I can only assume that a) they retained all my address book details, certainly including personal names, for their own use and b) they then themselves ran it through their system as part of setting up the new RapLeaf service earlier this week (since I haven't been near it for weeks).

This is extraordinarily scummy behavior.

Having got hold of my address book on false pretences, they have then used it to market their own business, in the course of which they have intimidated and harassed my friends.

I am sorry to all of you for having believed their lies, and thus being indirectly responsible for them spamming you earlier this week.

I would be very interested to hear from American lawyer types as to whether I have any case against them.

I am posting a reference to this entry to every recent blog entry on RapLeaf I can find.

Edited to add: I see that RapLeaf have now posted a public apology, which includes hat-tips to

rfmcdpei and

sevenorora. Good for them. I'm still hopping mad, though; it doesn't explain their apparent retention of data from my address book for their own commercial purposes.

(Post a new comment)

	purplecthulhu 2007-09-07 07:22 am UTC (link)
	Thanks for the info. Since I try to keep my LJ name and real name separate, and have be wracking my brain as to how the two might have been linked, I'm glad it's sorted out. I take it you'll be removing real names from your address book? (Reply to this)

	deannawol 2007-09-07 07:24 am UTC (link)
	I am sorry to all of you for having believed their lies, and thus being indirectly responsible for them spamming you earlier this week. No worries. It happens. Makes a change from the gender-incorrect spam that I ususally get! :) (Reply to this)

	annafdd 2007-09-07 07:26 am UTC (link)
	Do they still insist on snail mail opt-out? (Reply to this)(Thread)

	drplokta 2007-09-07 07:32 am UTC (link)
	No, you can now opt out by email. (Reply to this)(Parent)(Thread)

	annafdd 2007-09-07 07:47 am UTC (link)
	have now done so. Nicholas, it's not your fault. They're scum and they'd be paying for this dearly if the US had a serious data protection legislation. (Reply to this)(Parent)

	ang_grrr 2007-09-07 07:42 am UTC (link)
	It makes more sense now! (Reply to this)

	fjm 2007-09-07 07:50 am UTC (link)
	Thanks. It may explain a rather nasty peice of anonymous comment on my lj yesterday. It contained my real name which was particularly strange. (Reply to this)

keyser_infinity
2007-09-07 08:41 am UTC (link)

Thank you for commenting on my post so I could find all the information contained here.

The developments regarding the emails and change of privacy policy highlights the fear that I was talking about, what is a privacy policy really worth if they can annoy thousands of users with unsolicited emails, completely scrap the privacy policy they had earlier published, create a new privacy policy, then say sorry on their blog?

This is not just a problem with RapLeaf - a privacy policy should be transparent and binding.

(Reply to this)

del_c
2007-09-07 08:51 am UTC (link)

My email may be in your Outlook address book from recent correspondence, but I don't *think* I had a notification from Rapleaf. However, I may have done, and junked it as spam.

Does anyone know a safe way I can inquire whether I'm in Rapleaf's database, without typing my details in and therefore alerting them to my existence? Or should I just keep shtum and count my blessings?

(Reply to this)(Thread)

	nhw 2007-09-07 12:35 pm UTC (link)
	I should keep shtum if I were you! (Reply to this)(Parent)

	drasecretcampus 2007-09-07 01:45 pm UTC (link)
	Try www.rapleaf.com/pub/firstname-initial-surname or variations. (Reply to this)(Parent)

slovobooks
2007-09-07 08:52 am UTC (link)

No problems on my part, as you really can't be held responsible if someone outright lied to you. It is, however, a bit odd to see that they've already got this much information about me. Still, I'm one of the people who always puts my name on things, so I can see how they would manage to find it all. What's really interesting is that they've managed to put the fadas in the right places!

(Reply to this)

deannahoak
2007-09-07 09:18 am UTC (link)

It's still scummy of them; the apology completely doesn't cut it. They didn't even apologize for scraping the addresses--just for sending the e-mails.

The e-mail address they have for me--the Livejournal one--can't even be replied from, and shortly I won't even have it anymore. I sure as hell don't want to give them another address by sending e-mail from a main account, so they have victims a bit stuck.

(Reply to this)(Thread)

deannahoak
2007-09-07 09:25 am UTC (link)

Another thing that bothers me about them is that it's a flat-out lie that you have to have an e-mail address to search someone by. The pages are set up under someone's real name, so typing in "http://www.rapleaf.com/pub/firstname-lastname" for anyone turns up their page. :P

AND they make you delete information by e-mail address rather than by name, and they don't let you do it preemptively. I can't request that they delete my information until someone has already searched for it.

(Reply to this)(Parent)(Thread)

deannahoak
2007-09-07 01:46 pm UTC (link)

Oh, and I'm not mad at you. If you hadn't posted this, I wouldn't even know what was going on. I knew there was no way that someone searched for me by my LJ address and so just ignored the e-mail I got.

LJ should be made aware of the issue, though. I submitted a support request, and we'll see if it does anything. LJ users are particularly vulnerable because they *cannot* send mail from their LJ address.

(Reply to this)(Parent)(Thread)

redfiona99
2007-09-07 02:11 pm UTC (link)

I did something similar and got this reply:

Dear LiveJournal user redfiona99,

LiveJournal does not have any relationship with the company Rapleaf. We also do not release information on LiveJournal users except as required by a valid U.S. court order. This does not, however, prevent other companies from harvesting information which is publicly visible.

In this case, your email address is publicly visible on your profile page. To prevent future occurances such as this from occuring, we recommend that you go to http://www.livejournal.com/manage/profile/ and change your contact info settings so that it is visible either to friends only, or nobody.

Regards,
Eric
LiveJournal Abuse Prevention Team

(Reply to this)(Parent)(Thread)

	deannahoak 2007-09-07 02:26 pm UTC (link)
	Ah, great. But because of the way the LJ e-mail is set up--that you can't reply from it--you have no way of getting the info off. I fret what danger Rapleaf is putting children in. :( My eight-year-old has her own e-mail address.... (Reply to this)(Parent)(Thread)

	matgb 2007-09-07 04:36 pm UTC (link)
	You can actually, using a client that's configurable or gmail. I have my gmail set to send as whatever the mail was sent to, so if someone sends something to matgb @ lj then I reply as such. (Reply to this)(Parent)(Thread)

	deannahoak 2007-09-07 06:46 pm UTC (link)
	Huh. LJ says you can't do that (http://www.livejournal.com/support/faqbrowse.bml?faqid=113&q=email&lang=), but it appears to have worked. Thanks! (Reply to this)(Parent)(Thread)

	matgb 2007-09-07 06:52 pm UTC (link)
	Yeah, the LJ FAQ says many many things, and a fair chunk of them are actually accurate as well. Gmail lets you send from any address you can prove you receive mail from, which is a useful little trick--abusable by some but they'd need access. (Reply to this)(Parent)

	deannahoak 2007-09-07 03:15 pm UTC (link)
	Oh, and yes, someone else noted that I could e-mail their support from a different address and have myself removed, but given their lack of ethics with the way they collected the first address, why on earth would I want to provide them with a better one? (Reply to this)(Parent)

	removing oneself from rapleaf (Anonymous) 2007-09-07 03:12 pm UTC (link)
	Hi Deanna, welcome to the Rapleaf frustrated consumers. I hate them really hate them.... But there might be hope for you (to get your profile removed) Write from a different e-mail address to support@rapleaf.com and ask for removal of the email addresses you list in this e-mail. This should get the job done. Regards (Reply to this)(Parent)

	hfnuala 2007-09-07 09:20 am UTC (link)
	Ah, that's how they connect my lj to my surname. I was wondering. Not-directed-at-you Grrrr. (Reply to this)

flyingsauce
2007-09-07 09:55 am UTC (link)

Absolutely not your fault, Nick, and thanks for the heads-up.

"It is humbling being wrong, and we’ve been wrong a lot at Rapleaf."

Their apology is that of a company that admits to being consistently "stupid", and are desperately trying not to be even more stupid and offensive, which they also admit is very probable. How they honestly expect anyone to have any confidence in them as a business is completely baffling.

(Reply to this)

uitlander.myopenid.com
2007-09-07 11:09 am UTC (link)

All of this says *AVOID* in big flashing letters regarding Rapleaf and any other company this Auren character is involved with. "We're a young company and we didn't know any better" is no excuse - anyone with half a brain can see that the way he's been grabbing at private data is just plain wrong (and probably quite illegal). This guy portays himself as an entrpreneur, his companies have big name investors who will have done due diligence. This is not some teenage kid in a back bedroom saying 'whoops'. I do not believe that no-one considered the privacy issues here, or bothered to think about the legalities. This was just a blantant landgrab, and one that has hopefully blown up very badly in their faces.

Yeah I'm angry these scumbags have stolen private personal data (and at the time of writing I have yet to receive any assurance it has been permanently deleted from their systems). I don't think it was just down to you - they seems to have grabbed at least one e-mail addy I've never given to you.

I will say that it is never a good move to give your e-mail password out to a third party (or any other login details), no matter what the reason, and I'd advise you to go and change it immediatly if you haven't done so already.

(Reply to this)

I threatened them with reputation-destroying

bellatrys
2007-09-07 11:45 am UTC (link)

by pointing out that I *have* a reputation online already, thankyouverymuch, one that is way older than theirs and way more trusted in my comms, and I could easily post a diary at one of the larger political blogs and get them vast amounts more of negative attention than they already have gotten, and they deleted my profile without a peep about having to send in snail mail, which I also pointed out to them that as someone who has worked in database maintenance back in the days of DOS only, I knew was simply bullshit for them to claim as necessary. I see they've also taken that requirement down wholesale, although I cant claim that my threats to further trash them online if they didn't stop making people jump thru that hoop (a clear effort to dissuade people, just like the hoops for sending in rebates) were the clincher in their decision.

The unctuous tone of the groveling apology doesn't fool me, either. I worked with a guy who thought "How To Win Friends & Influence People" was gospel, and he would pull this kind of shit all the time - the overstepping of boundaries, the bullying, the arrogant "I know better than you what's good for you" and the cringing Gollum-impersonation and fulsome proclamations of having had "a learning experience" when enough people responded to make him realize that he couldn't get away with *this* time-yeah, there are enough old internet hands involved in this whole project on so many levels that for them to claim they were just wet-behind-the-ears babes in the woods rings smarmily hollow...

(Reply to this)(Thread)

	Re: I threatened them with reputation-destroying nhw 2007-09-09 07:44 am UTC (link)
	Having read the Valleywag articles about him, I think your characterisation of the CEO's apology is spot-on! (Reply to this)(Parent)

	Thanks Nicholas (Anonymous) 2007-09-07 11:49 am UTC (link)
	Am most relieved to find where they got the info from... Anne (www.belgianwaffle.net) (Reply to this)

	More on the Smarm Factor bellatrys 2007-09-07 12:06 pm UTC (link)
	I wondered at the egregious breast-beating of putting a long list of all the people who have criticized them at the end - you know why they did that? For the trackbacks. Now anyone who comes across and reads one of those posts about their clusterfuckery via Google etc, will also see the link at the bottom to Auren's apologia. Sneaky. And very very clever, in a Gollum-y way. (Reply to this)

redfiona99
2007-09-07 12:23 pm UTC (link)

Could you as the US lawyers if there's something similar to the Freedom of Information act so we can find out who uses Trustfuse and point out to them how scummy the parent company are and then hit them in the wallet.

Although I don't know if that's a little vindictive because they did at least remove my information and made me more aware of what I've got out there with my name on it.

Another thing of interest would be if there was a way of coding your user info page to make it un-scoopable by robot, and if LJ would let us implement that.

Also, no worries, everyone gets got by liars at some point.

(Reply to this)(Thread)

uitlander.myopenid.com
2007-09-07 01:09 pm UTC (link)

Another thing of interest would be if there was a way of coding your user info page to make it un-scoopable by robot, and if LJ would let us implement that.

I think the only option you have on that one is to check the clicky box somewhere in manage profiles that offers to try and keep your profile away from search engines. Essentially I think that means that your LJ pages are listed in a file called robots.txt (http://www.robotstxt.org/wc/exclusion.html) sitting at the top of the LJ directory tree. This essentially says 'please leave these pages alone'. Its voluntary, no-one has to abide by it, but the vast majority of indexers/search engines respect it.

(Reply to this)(Parent)

	xnamkrad 2007-09-07 01:47 pm UTC (link)
	That explains why I got two emails but not the other ones I use (yes I know its sad but I have 8 emails in use at the monent - depending on who I'm talking to) No worries, the fault is totally theirs. (Reply to this)

	sevenorora 2007-09-07 02:40 pm UTC (link)
	So that's how they got my name. Don't worry, though, I don't hold you responsible. btw: might I suggest www.ecops.be? (Belgian governmental contact point for internet abuse) (Reply to this)

	rfmcdpei 2007-09-07 06:42 pm UTC (link)
	Hey, it's hardly a problem. Scummy people who lie in order to get personal information for business purposes are going to deserve what's coming to them, methinks. (Reply to this)

	A form of Phishing? sevenorora 2007-09-07 07:33 pm UTC (link)
	I was wondering, can these actions by Upscoop/Rapleaf be categorised under Phishing? (Reply to this)

	purplepooka 2007-09-07 07:41 pm UTC (link)
	Do you have me in your address book? I think we've only ever talked on LJ (and at Worldcon). I'd assumed they were just fishing LJs, and that was why it came to my livejournal.com e-mail, which I have never given out or used. It called me Emma, but then that's the name I give under my details. (Reply to this)(Thread)

	nhw 2007-09-09 07:33 am UTC (link)
	Yes, I do; as a matter of interest, did it have your surname as well? (Reply to this)(Parent)(Thread)

	purplepooka 2007-09-09 12:10 pm UTC (link)
	No, just Emma. If others had them sent to their LJ e-mails addressed to whatever name they have down for their journals, then it could be entirely unconnected to your address book. (Reply to this)(Parent)(Thread)

	nhw 2007-09-09 12:22 pm UTC (link)
	Hmm. I have just "Emma" for your LJ address, but I also have your surname for your non-LJ address; but then again am not sure if I had the latter at the stage I first tried Upscoop (in fact I'm fairly sure I didn't). Anyway, the bottom line is, I'm very sorry that we are even having to ask the question. (Reply to this)(Parent)(Thread)

	purplepooka 2007-09-09 12:29 pm UTC (link)
	Don't worry about it, I don't actually mind people being able to see my LJ, as anything personal is friends-locked. Recent experience with internet idiots has convinced me that posting on popular public forums in my real name or LJ name would be a very bad idea, but I'm not going into full scale hiding over it or anything. (Reply to this)(Parent)

	sammywol 2007-09-07 08:06 pm UTC (link)
	Thanks for solving the mystery. I had no clue. (Reply to this)

	inuitmonster 2007-09-07 08:44 pm UTC (link)
	don't worry about it... I am so buried in spam as it is that I woudn't have noticed the RapLeaf post but for all the people going on about it. (Reply to this)

	aramuin 2007-09-07 10:03 pm UTC (link)
	It's not your fault and I can't help but feel that really you got the worse end of the stick because they took the information from you (after promising not to) and that was an awful thing to do. (Reply to this)

	bohemiancoast 2007-09-09 07:23 am UTC (link)
	Ew ew ew ew ew! I have just checked out my Rapleaf listing, and they've linked 'bohemiancoast' stuff with {real-name} stuff (though, oddly, not my LJ) and they've linked it with stuff that isn't mine. I am now going to work out how to remove every trace of my identify from Rapleaf without registering. Oh god what scum. (Reply to this)(Thread)

	nhw 2007-09-09 07:34 am UTC (link)
	I would email opt-out@rapleaf.com - they already have your address, after all, and it increases the pressure on them to do the right thing. (Reply to this)(Parent)(Thread)

bohemiancoast
2007-09-09 07:48 am UTC (link)

Yes, they do have my real email address, and I have emailed the opt-out address.

Actually I'm not very private about a lot of my online stuff; they don't have anything on their sheet that's not straightforward for someone to find. It's the gathering it on one place, and linking it to profiles that *aren't* me in a really stupid way that's so irritating -- my particular concern is that they're going to endlessly link stuff of mine to stuff for other people named {firstname-lastname} -- I don't exactly have an uncommon name. I'm not even sure they got it from you -- they've not linked to my LJ, for example.

I particularly dislike the way they're endlessly talking about how ethical they are, while simultaneously consistently behaving in a knowingly highly unethical way.

(Reply to this)(Parent)

whatifoundthere
2007-09-09 05:40 pm UTC (link)

Hi. I'm here by way of

purple_pen, who directed me to this post when I complained about RapLeaf in my own journal.

I'm hoping that RapLeaf is driven into bankruptcy and leprosy by what they have been doing, but in just case they don't -- what I'm wondering now is whether there's any way to make their "opt-out" system stick? I opted-out with my main e-mail address (which RapLeaf linked to my real name, city of residence, and a picture of me), and I suppose now they're going to delete that profile. But what's to stop them from re-making the same profile all over again, the next time their spiders reconstruct this supposedly "public" information that mysteriously only they happen to have? As a friend of mine pointed out today, this is even more scary, since they've promised to stop spamming us (meaning next time, I might not actually know they did it).

(Reply to this)

	brightglance 2007-09-10 02:00 pm UTC (link)
	Right, that explains where they got my main e-mail address - it didn't show up linked to my livejournal at all, thankfully, and the spelling of my surname came out with wrong characters, so not much damage done. (Reply to this)

Mini Sitemap:

Username:		Create an Account Forgot your login? Login w/ OpenID
Password:
	Remember Me
	English • Español • Deutsch • Русский…