Category: Security and GDPR

What Happened?

Web servers and other public servers are always under attack. Our systems deflect and mitigate thousands of unauthorised attempts to gain access every day, both direct login attempts and denial of service attacks where volumes of junk traffic are thrown at servers.

It is impossible to both have an accessible service and an inaccessible service and we are always trying to tread that line and this time we failed to get it right.

We experienced intermittent connection issues across the weekend but some access was still available.

All connection and service was lost during the early hours of Monday morning when the full attack was started.

An attempted ‘ransomware attack’ on the main server encrypted some files before it was stopped by our anti-malware processes. This was an automated scripted bot attack. There was no unauthorised access to customer data or backup data which is separately encrypted and stored. There was no evidence of any data exfiltration (access to data stores, virtual servers, external storage, no increase in bandwidth consumption, and no FTP/SFTP access).

To be clear, no data was viewed, accessed, or removed during this attack.

As we had complete backups from shortly before the attack started it was deemed that the most secure response would be to wipe the main server and so negate any potential additional issues with lingering malware or potential trojans/backdoor attacks.

As per our standard operating procedures in such an event, the servers hard drives and RAID arrays were wiped and reinitialised and the process of reinstalling the base operating system started.

Although the initial steps of installation were successful we experienced additional issues when the new operating system would not load. The server was troubleshooted for potential issues/changes that were preventing the new operating system from loading.

Working with our hosting providers, we established that the attack had also led to a hardware fault with the RAID controller. This additional issue meant our existing server hardware was no longer viable and a new server provision was initiated.

The new server was brought online and the server operating system was installed. This initially failed due to the unavailability of Microsoft’s license approval servers.

By Monday evening at 19:30, the new server was responsive and the restoration process could begin.

Our established processes did kick in but we lost approximately 12 hours of user data when rolling back. However, this episode has provided a valuable learning experience and we have started a more in depth review of our response, looking at our successes and failures and how this might any future response.

We have been proud of our performance to date when it comes to cyber security, with this being our first ever full day outage in our twelve year history, but, as always, there are lessons we can learn and things we can do better.

Below is the details timeline of events, actions taken, and lessons learned.

Timeline

07:00 Initial investigations of the affected server begin

08:00 Attack was identified and its severity assessed

08:30 Total loss of our main server was suspected

09:00 Decision was made to wipe main server and restore to earlier backups.

10:30 The affected server was wiped and the new raid array of hard drives initialised

10:50 Raid completed and new OS installation was started

11:50 New OS installation fails to start correctly

12:00 Second attempt to install new OS

12:40 Second attempt also fails

13:00 Troubleshooting starts on the hardware to try to get Windows to boot

14:30 New server is provisioned

15:40 New server built and brought online

15:40 New OS installation started on new hardware

16:15 New OS installation unsuccessful due to licesne server unavailability from Microsoft

18:00 New OS configuration complete

18:30 Required software and utility installation

19:30 Begin to restore backups

20:20 Backups restored

20:45 Applications start to be restored and access gained

22:30 All services responding normally

Review of the Disaster Recovery Procedure

Our full recovery plans can be viewed on our website;

https://teamkinetic.co.uk/policies/Contingency%20and%20Continuity%20Planning%20Policy

https://teamkinetic.co.uk/policies/Data%20Asset%20Protection%20and%20Resilience

In summary, we failed to meet our recovery time objective (RTO) of 2 hours because of the continued knock-on effects of hardware issues. The actual recovery process from downloading, extracting and installing the most recent backups was close to 2 hours once the hardware and operating system platform was stable.

Incidence Reporting, Communication, and Support

Once the outage was affecting our customers we started to send out regular updates to keep customers informed.

These were sent via email as all internal messaging systems were affected. We also posted on our Facebook page and volunteer manager groups with the current status.

We had multiple members of staff available all day on the phone to take calls and requests for support and believe we did a satisfactory job of keeping people up to date.

This was a major and long-lasting outage and all our affected customers are entitled to a month’s service credit that is redeemable at the next invoicing period. We know this doesn’t make up for lost time and the frustration of not having access to your applications.

What Did We Learn?

Our notification system for monitoring server health failed and was not able to cope with the specific complexity of this attack. We had a situation where our network accessible servers and systems were alive but not working correctly.

Our response times during the weekend exacerbated the monitoring issues.

Our hypervisor server is our most critical single point of failure.

It takes longer to download and extract backups now than it did as they are considerably larger and so our RTO needs to be updated.

Our transactional database backups (which fill in the gaps between full backups) need to be available from off-site backups to further limit the data loss in total failure events like this.

Our hardware provider was too slow to respond and made mistakes in provisioning that were made worse by lower staff numbers over the weekend, changes in shifts, and lack of communication between those shifts.

Almost 70% of the time to restoration of services was spent waiting for our hardware providers to execute their responsibilities.

Our customers are incredibly understanding and supportive, thank you!

Mitigations and Improvements

Add in more sensitive monitoring and also include positive monitoring that tells us that things are OK not just negative monitoring.

Mandate two factor authentication for UAC as well as login.

Switch to a new hardware provider with better response times and procedures for dealing with issues.

Recalculate our RTO bearing in mind the increase in size of our systems.

Move transactional data logs to temp off-site storage at regular intervals within a 24 hour period. Retain these logs transactions for 48 hours.

Provision a duplicate server for quicker server reinstatment. If we get a total failure/loss of the mainserver we can rollback to the most recent backup within the RTO period.

Look at a double daily complete backup of virtual servers. Would need to test the impact of backups on serve performance during regular accessing hours (right now the backup is performed at our quietest time). This would half our potential data loss in the case of complete failure.

Follow up

An attack of this type can cause anxiety for our users, and it is important to us here at TeamKinetic, that you feel confident in our response to this incident and trust that we have taken away the important lessons from this experience.

If you would like to speak to a member of the team, we would be only too happy to spend some time answering your questions. Feel free to use this link to arrange a call with the team.

You can also subscribe to service status updates here.

How TeamKinetic can help with UK-based volunteering for Ukraine.

By Alex Evans

On 1st April 2022

In Community, News & Views, Security and GDPR, TeamKinetic Features, Volunteer Management

For well over the past month, we’ve been updated by news outlets about the war in Ukraine. From Snake Island and “Ghost of Kyiv” to young Amelia, symbolising hope with Let It Go (who has since performed the Ukrainian national anthem in Lodz); we doubt there has been a single person who has felt unaffected by what’s happening.

But it’s what people across the world have chosen to do in these times that we would like to focus on – and how we, as a volunteer management system company, can help. We see day in, day out the work and dedication of volunteers and the impact they’ve made to the lives of those they help; it’s why we do what we do!

At the beginning of the month, nearly 20,000 foreign volunteers travelled to Ukraine. While it’s been advised not to travel to Ukraine, the number of volunteers looking to help within their own countries has only increased. Volunteering for Ukraine continues to cover healthcare, travel and refugee assistance (just to name a few). It lies with refugee assistance we believe our system can be of most benefit.

In recent weeks, the government has announced that Britons will be allowed to open up their homes to millions of Ukrainian refugees displaced by current events- this route will work for an initial 12-month period, matching refugees with those who have offered up free accommodation. From national organisations to the local charities around you, help is needed.

At TeamKinetic, we pride ourselves on the features in our system which allow for fast setup, recruitment and deployment of volunteers to help the set up of such schemes. Our tools help the rapid deployment of volunteers needed in situations such as the one facing Ukraine and its people.

Our instalment of DBS checks has only increased the pace at which volunteers can be approved and well on their way with helping those in need. While we may not know the ins and outs of every organisation’s recruitment needs, it’s been our promise from our very first day to continuously develop our system to accommodate as many organisations as possible. Our DBS checks are one of the many ways we employ important safeguarding within TeamKinetic while maintaining a swift recruitment.

To keep track of the thousands of homes opening their doors, reaching out a hand and the people they will be embracing, is a mammoth task. Our system’s functions can help with recording all information needed to ensure those refugees entering the UK for shelter know they are safe. Our personalisation means no matter what your organisation is looking to collect, or put out to volunteers, it is all accessible in TeamKinetic.

We have a number of organisations starting and developing programs to help Ukrainian refugees – something we are honoured to play a small part of. We want to ensure that anyone who needs a quick start, rapid deployment of volunteers and a platform to do so can find it at TeamKinetic.

It is easy to sit in a country, surrounded by our family members – the people we love – and think there is nothing we can do to help a country roughly 1,949 miles away. But it would be foolish to think such. We can help right where we are, helping those families who’ve travelled 1,949 miles to find safety; to find even a glimmer of hope that one day, they will be able to return to Ukraine. To return home.

We are updating our Terms and Conditions

By Chris Martin

On 14th August 2020

In Policy and Operations, Security and GDPR

Periodically we review and update our operating terms and conditions that form the basis of our relationship with our customers. This time around we are proposing two changes that we wanted to clarify with our customers.

Since the introduction of GDPR we have been reviewing our approach to data processing and we need to make changes on how we manage your data. The second change is relating to our licencing and pricing model.

Data processing

Please don’t worry, this change to our data processing policies will result in no changes to your current processes, we are merely bringing responsibilities and definitions in line with the reality of using TeamKinetic. As always, if you have any questions or concerns, we always like to hear from you, so please do get in touch and I would be happy to talk through how these changes might affect you.

A data controller in responsible for what happens to the data they collect. They define and control what they and their agents can do with the data. Agents processing the data on behalf of the data controller are called data processors.

Our original contract stated that TeamKinetic acted as the data controller and our customers acted as the data processors. This was based on advice we had revived from our legal council during our work to become GDPR compliant, but over the last 18 months it is clear that this definition does not serve the needs of our customers, or reflect reality.

We have now recognised that TeamKinetic would better serve you as the data processor. So what does that actually mean for you, your volunteers and your data?

In short, very little will change for your volunteers, or the way you are able to use TeamKinetic, but some of yours and our responsibilities will change and we want to make sure you are fully cognizant of these changes.

As the data controller, you are responsible for your volunteers data in accordance with your owns policies and procedures and your use of TeamKinetic must fall with in those same constraints. This reflects how our customers already operate in most cases. The data controller then instruct us as the data processors in how we can use your data; you are in effect giving us permission to process your data to enable TeamKinetic to provide you with a usable and effective service.

Now please don’t worry, TeamKinetic’s use of data is wholly appropriate and still compliant with even the most stringent interpretation of GDPR and data protection legislation, so there will be no practical changes required.

We have prepared a data processor document that outlines how TeamKinetic will process your data. This policy document will serve as a our data processing agreement between you the customer (data controller) and TeamKinetic (data processor).

This agreement will be reflected in the customer defined terms and conditions that volunteers agree to when registering. You are able to adjust and edit these terms and conditions from your dashboard, we have created a short tutorial video if you are unfamiliar with where to find this feature.

Licensing and Pricing Model Changes

Don’t worry, we are not about to drop a big bill on you! In fact we are making these changes to make sure you are never surprised by a big bill.

TeamKinetic do not limit the number of volunteers, providers or opportunities, unlike many of our competitors. This means you don’t need to worry if your volunteer numbers suddenly jump up or change. This all forms part of our promise of no surprises in our pricing. However over the years we have made changes to how we price our product and this has resulted in customers being billed in different ways, which is now proving hard to justify and manage.

From this quarter we will be charging for each extra admin you wish to add beyond that set in your contract. For our existing customers their contract will reflect their current admin usage so no current customer will be paying more after this change; guaranteed!

You will be able to purchase additional admin capacity as a monthly subscription, paid in advance, right in your dashboard. Subscriptions can be altered and cancelled at anytime so there is no long term commitment. We are putting the final touches to this admin interface to release shortly.

We will be offering a buffer of extra admin capacity for our existing customers based on their length of custom.

If you have any concerns or questions, then please don’t hesitate to get in touch chris@teamkinetic.co.uk.

IT and Information Governance FAQs

By Rolf Herbert

On 17th October 2019

In Security and GDPR

Have security-related job responsibilities, including oversight and accountability, been clearly defined and documented?

Yes, all jobs have detailed JD in place with attention to Information Governance and responsibility. Chris Martin is currently accountable for Information Governance.

Are policies for information handling and labelling in place?

Yes. TeamKinetic have policies for Information Governance, Continuity, Security, Personnel, Safeguarding, Data sharing and API use.

Are all third-parties vetted prior to being granted privileged access to data?

3rd party contractors do not have access to live data. All data in encrypted at rest and in transit.

Do you maintain an inventory of all important information assets with asset owners clearly identified?

Yes, information assets are held in applications that are directly owned by customers.

Describe the screening process for all users, employees, contractors, vendors, and other third-parties)?

Access to data is limited to the operational team. These staff have all undergone IG training, DBS check and are part of the senior team here at TeamKinetic. No other employees, contractors, vendors or other 3rd parties have access to user data.

Describe your hiring process and how a new employee is granted access to network resources and when these access rights are reviewed.

All prospective candidates are interview by a single team member and by then by a panel of at least 3 current employees. All new starters are inducted and undergo a basic information governance session with Chris. Only staff with a specific requirement will ever be granted direct access to user data.

Do you conduct formal information security awareness training for all users, including upper management?

Yes, all staff undergo basic information governance training.

Describe the physical security mechanisms that prevent unauthorized access to your office space, user workstations, and server rooms/data centres?

All TeamKinetic sites enjoy the following physical security provision.

Security perimeter
Proximity ID (smartcards) for Access control
Receptionist
CCTV cameras
Fire / Flood protection
Cables and network ports are protected from unauthorised access
On-site redundancy and engineering support

Controls are in place to secure access to networked services, This is available via a documented process. Access to provision user accounts is reviewed at least annually.

Remote secure network access is granted using VPN with no Dual–homing / split tunnelling. Appropriate encryption methodologies are employed, documented, reconciled and monitored to AES 256 standard.

All systems in our internal and externally–facing and DMZ environments secured

Do you employ automatic locking screen savers when users’ workstations remain idle after set period of time?

All workstations are locked after a period of inactivity and require a password on resume.

How is the removal of equipment from the premises authorized and controlled?

All storage equipment is first comprehensively formatted and then physically destroyed before being removed.

How do you protect your systems against newly-discovered vulnerabilities and threats?

Our servers that control and serve TeamKinetic are patched with all zero day vulnerabilities and security patches as they are released

How do you prevent end users from installing potentially malicious software (e.g., list of approved applications, locking down the desktop)?

All workstations are operated under a lowest security clearance possible. Without administrator access it is not possible to install software on workstations.

Centralised virus and malware software is used to check workstations and isolate suspect items if necessary.

Do you scan traffic coming into your network for viruses?

Our email servers scan all incoming messages for viruses and quarantined accordingly

How do you dispose of computer media when they are no longer of use and are logs kept of media disposal activity?

All storage capable equipment is comprehensively formatted and then physically destroyed before being disposed of.

Describe how you protect information media (e.g., back-up tapes) that is shipped offsite.

Media and backups that are stored off site are protected by RSA encryption

Please describe your Access Control Policy.

Our access control policy is based on a minimal access level at all times.

Any users or systems that require access to our resources are first required to submit an access proposal explaining what access they require and why.

If successful the access request is then passed to our chief technical officer who will be responsible for setting up the minimal security level possible for successful access and the revocation of that access after the agreed time.

Any requests for access are logged. The revocation of access is checked by one other technical officer once the access date has lapsed to ensure access is not maintained.

Describe the process by which non-employee (e.g., contractor, vendor, and customer) is granted access to network resources and how often these are reviewed.

Only authorised systems engineers are allowed physical access to our remote servers. This access is logged via security card.

No third parties have standing access to the OS of our servers. Any access that has to be granted is provided via lowest possible security level users that are strictly time limited.

Any such permissions are revoked once access has been completed.

To what extent are user’s system use logged and monitored?

Full system logs of bother server and database access are stored for two weeks.

Is an information security incident log maintained?

Yes

Are incident reports issued to appropriate management?

Yes

Are audit logs or other reporting mechanisms in place on all platforms?

Yes

Are internal and external audits performed on regular basis?

Yes

Do you have documented business continuity plan?

Yes

Do you have documented disaster recovery policy?

Yes

Contingency and Continuity Planning

By Rolf Herbert

On 17th October 2019

In Security and GDPR

Contingency and continuity planning policy

Identified Potential Risks

The following identified risks will trigger a potential contingency event, each event is independently risk assessed and will be managed in accordance with this policy.

Natural disaster

Fire
Flood
Sudden cessation of trade
Sale of company
Hardware failure
Software failure
Malicious attack
Data breach
Litigation
Data theft

Application continuity and security

Our hosting network has multiple redundancies and security procedures including, but not limited to;

24 x 7 x 365 Manned Security & Monitoring
Smart Card access policies
Internal and External CCTV systems
Security breach alarms
24 x 7 environmental monitoring systems
Constant evaluation and testing of all systems
N+1 redundant Heating Ventilation Air Conditioning (HVAC) system
Fully redundant air handling units provide constant fresh airflow
Raychem Fluid Detection
FM200 fire suppression equipment
Dual independent power feeds, backed up by dual battery string Uninterrupted Power Supplies (UPS) systems (deployed as standard)
2 Megawatt diesel generators to protect services from any single power failure
Diverse fibre routing via multiple carriers
Truncated internal cable network
ODF/DDF (Optical Distribution Frame/Digital Distribution Frame) bandwidth
Cross Connection to a number of Tier 1 carriers
Internal inventory systems track all cables, circuits and cross-connects
Scalable architecture including multiple redundant core switches and routers

Current up time (99.6%) and SLA agreed uptime (99.4%)

Bug fix procedure and error reporting (minor to mission critical) and estimated recovery time for various scenario outages from minor to complete disaster recovery as a table :

The maximum duration of service interruption upon total failure will be 24-48 hours. In this time a new server will be provisioned using the most recent whole server backup, brought online, checked and the most recent database backup accessible applied.

We expect service level to be near to 100% once the total failure procedure is complete, with a 24 hour allowance for complete back-up roll back.

We expect completely normal service to be resumed within a further 24 hours after the total failure procedure has been completed.

Triggering the Contingency Plan

Predictable Events

In the case of predictable and knowable events, such as the sale of the company, the contingency plan will be enforced at a set date that will be adequately advertised and discussed with our clients.

Unpredictable Events

When the event is unpredictable the plan will be triggered immediately once the issue is identified.

Failover testing, Pen testing and frequency

Our applications are penetration tested after every major release point. Any issues are identified and rectified and the penetration tests repeated.

Backup and recovery strategies are tested monthly for effectiveness, reliability and integrity.

Timely access to components necessary to make use of data

In the event of the company no longer trading we will make available an open source version of the code as it stands at the last version update. A detailed technical specification of the requirements will accompany this to run the code. All user data will be available to download.

Minimize risk of loss

Database data loss is minimised by a combination of transactional and full backups. Transactional logs are taken every 15 minutes and a complete backup taken every day. In the event of data loss due to error or mis-configuration the database can be rolled back to the suitable transactional data point and the data repaired. In the event of total failure or server crash a new instance can be brought online with a maximum data loss of 24 hours.

Application code and content (uploads and other user data) is backed up in full each day to off-site storage. Centralised versioning software is used to maintain a full and complete back of the application code and all changes.

Updates and changes are developed on the beta branch of the application code and fully tested before being merged in to the release branch.

Data Encryption and protection against data theft

Physical servers are protected by secure access and are only accessible by authorised personal.

Strong password policies are enforced on all physical servers.

All default ports are closed and only essential public ports are opened. Database traffic is restricted to only authorised servers and are not publicly exposed.

Latest OS security patches are applied on release.

All database stored passwords are encrypted with individual SALTs.

We recommend all clients utilise SSL to encrypt user to server traffic and prevent man in the middle attacks.

All API access is encrypted via SSL.

Changes

If you require further support or a different service level agreement, please contact the team on info@teamkientic.co.uk.

This agreement can be updated on a customer basis with 2 weeks notice and the agreement of both parties.

Customers can opt out of any single update, but any opt out may have unforeseen impacts and TeamKinetic cannot be held responsible or liable for these. Any opt out is at the risk of the customer.

TeamKinetic, Information Governance

By Rolf Herbert

On 20th June 2019

In Policy and Operations, Security and GDPR

Date last updated – 20th June 2019

This post provides a summary of TeamKinetic’s information governance policy. Full copies of all documents that make up our security policy are available on request. We utilise the Information Governance Toolkit to continually assess our adherence to governance standards and requirements.

Scope

The Information Governance framework covers all staff that create, store, share and dispose of information. It sets out the procedures for sharing information with stakeholders, partners and suppliers. It concerns the management of all paper and electronic information and its associated systems within the organisation, as well as information held outside the organisation that affects its regulatory and legal obligations.

Steven Hall – Information Governance Manager

Rolf Herbert – Information Asset Manager

Roles and Responsibilities

Directors

Coordination and operational management of Information Governance projects
Review of Information Governance compliance and ensure alignment with related policies and procedures
The monitoring and enforcement of records management, retention and disposal policies
Enforcement of information security policies and management of security breach incidents
Establishing and understanding of risk for each part of the business operations

Chief Technical Officer

Define all information assets
Establish an information asset register
Define the executive information asset manager
Define information asset owners
Define policies and procedures for handling information assets
Define security strategy and policies for information assets

Managers

Implementing and enforcing Information Governance practices and policies
Mitigating information risk
Implementing the security and authorisation of information
Ensuring that all employees understand and are equipped to comply with Information Governance processes and procedures

Employees

Implementing Information Governance practices and policies
Implementing the security and authorisation of information
Determining the Employee’s training requirement

All members of staff must understand the need to properly manage the information they create and access.

All members of staff must be made aware of the information governance framework and must ensure they are familiar with its contents.

Training and information will be provided to all new staff members and all staff during regular re-training.

Information Policies

Information security policy
Records management policy
Retention and disposal schedules
Archiving policy
Data privacy policy
Information and communication technology (ICT) policy
Information sharing policy
Remote working policy

Information Procedures

Legal and regulatory compliance
Creating and receiving information
Acceptable content types
Managing the volume of information
Managing personal information
Storing and archiving information
Collaboration and sharing information
Disposing of information

Working with Third Parties

Policies for sharing information information with third parties
Managing how third parties handle personal and confidential information
How Information Governance fits within supplier relationships and contractual obligations
Measurement and metrics for third parties meeting the organisation’s Information Governance goals

Disaster Recovery, Contingency and Business Continuity

Reporting information losses
Reporting information security breaches
Incident management and escalation
Back up and disaster recovery
Business continuity management

Auditing, Measurement and Review

Monitoring information access and use
Monitoring effectiveness of regulatory compliance
Monitoring the effectiveness of information security policy and procedure
Monitoring of ICT and storage infrastructure performance
Risk assessment and auditing
Information Governance review

How Can YOUR Not-For-Profit Prepare For Brexit?

By Rolf Herbert

On 6th June 2019

In News & Views, Security and GDPR

You may not know much about Brexit considering it’s not spoken about every single day! There are many rules and regulations that will affect the economy and organisations as a direct result of Brexit. This also applies to civil society organisations or Not-for-profits. So, how exactly can these types of organisations prepare for Brexit?

Do You Have EU Employees Or EU Volunteers?

If you are an EU citizen the government will be fully committed to safeguarding the rights of those who are legally living within the UK. Essentially what this means is that even when we leave the European Union you will not just be left or forgotten about!

You will still to be able to do all your volunteering opportunities the same as you did before, so there is no need to worry about that!!

Will My Organisation Still Receive EU Funding?

The UK will continue to work with organisations that have EU funded programmes that have been running from 2014 up until 2020. In the event of a no-deal Brexit, the government will be making people aware of the projects that have been agreed to be continued before we leave the EU. If you are funded by a country not in the EU, this will not be affected as it will have no relation to Brexit regardless if there is a deal or no deal.

What To Do If You Receive Personal Data From The EU

In the event of no-deal, if your organisation receives personal data from within the European Union this will greatly affect the way your organisation operates. One of the major implications that may possibly affect your organisation is that you must be fully GDPR compliant, this won’t be an issue for many as GDPR has been a requirement for some time now. For full information on data protection guidelines please click here.

What If We Import/Export Goods From With The EU?

There are many resources full of information about what is going to happen if we leave the European Union with no deal in regards to trading. For more information on specific scenarios that will be relevant to your organisation please click here. This will affect you if you import resources for your volunteering opportunities from other countries.

NVCO Research On Further Brexit Implications On Charities

The NCVO (National Council for Voluntary Organisations) has many documents available on their website detailing specific details about volunteering and Brexit. For further information please visit their website here.

Volunteer Management- How TeamKinetic Can Help

If you are at all interested in making your volunteer programme the best it can possibly be with your own volunteer management software system, please do not hesitate to get into contact with TeamKinetic. We are available weekdays from 9am – 5pm for any phone support or inquiries you may have or alternatively you can email us on sales@teamkinetic.co.uk.

You can also visit our website at teamkinetic.co.uk.

Understanding the Good, the Bad and the Ugly of the internet for volunteer managers

By Chris Martin

On 30th August 2018

In Community, Policy and Operations, Security and GDPR, Volunteer Management

TeamKinetic believes that the internet has the potential for transformation in our world comparable to the Gutenberg’s printing press , but if the last few years have taught us anything, it’s that the internet reflects both the very best and very worst of human nature. What do volunteer managers need to know about the internet to keep their volunteers safe?

I’ll provide some useful resources to give some context and understanding of the darker side of the internet and how we have used this to try and inform our policies and procedures as an organisation and what we think you should consider as an organisation as you become more reliant on digital platforms.

The internet provides almost limitless opportunity for grassroots social action, citizen journalism, voluntary engagement and so many other potentially positive outcomes, but we are naive if we do not recognise and consider the risks.

Jon Ronson, journalist and author recently wrote “So you’ve been publicly shamed” on how the networked effect of the internet can lead to individuals being ostracised. His entertaining and occasionally dark work examined some of the difficult issues around user-generated content and how people’s mistakes are amplified and stored for eternity in the memory of cyber-space. Ronson’s storytelling introduces the reader to the inherent risk for normal people to get caught up in exceptional events and how little control they have over these events once a post goes viral.

Sarah Jeong, now of the New York Times Editorial Board, Vice and The Verge has written extensively on the internet’s inherent problems and her book, “The Internet of Garbage” gives informed insights on the risks and unintended consequences of poor policy and practice and how that can impact organisations and their users. Jeong discusses at length some of the nuanced problems the modern internet has created for itself and how copyright law is being misused as a method of content suppression and removal, due in part to lack of other recourse to individuals who find themselves at the centre of a viral internet storm.

I mention these two texts as they are accessible and informed, and for those who are looking to understand the internet, they will help non-technology people appreciate the inherent risks of a highly networked world, the very real risks that can affect everyday users and voluntry organisations alike.

TeamKinetic is aware that our volunteer management platform has the potential to recruit volunteers in almost any situation. It is effective and easy to use and can be administered remotely with high efficiency to deploy individuals or teams of volunteers at short notice. These characteristics are great if you run a charity, an event or a university internship program, but they are equally great if you are recruiting individuals to partake in less positive endeavours. The creators of any platform which allows users to create content and communicate with each other must be aware of the risks as well as the benefits.

Recent legislation such as GDPR, goes some way to help individuals protect their privacy and increase their control over websites and platforms they engage with. It also gives businesses and organisations the chance to audit exactly what information they collect, why they collect it, and what they are going to do with it. This was a revealing process for us and was very worthwhile. All legislation, however well intentioned, runs the risk of “unintended consequence“. As responsible curators of TeamKinetic we have to embrace some basic values by which to manage our site.

What are our ideals and values?

As an organisation, we have put honesty at the centre of our company values. This is a type of statement that is easy to say, but much harder to live by. We aspire to offer honesty in our pricing, in our customer service and our product.

Our role in supporting the organisations that use TeamKinetic to manage their volunteers goes beyond the provision of software. We want to build a community of volunteers and volunteer managers that can share practice and policy, develop professional connections and work to strengthen the sector as a whole through the development of consistent standards in the wider information technology infrastructure of volunteering.

We want to be able to share expert knowledge and insight based on our user data and experience to help the sector become better at recruiting, deploying and recognising their volunteer’s hard work. We commit to making our data available to researchers, and the resulting insights and findings will be freely available to all who have a valid interest in the voluntary sector.

Finally, we want to create an amazing experience for all our users, that means the best technology, built in a way that is easy to use and importantly every user is protected by good policies and excellent support. Our volunteer-centric approach to development will remain the centre of our business operation.

We hope you will join us on our continued mission to be part of the ‘good’ internet and we look forward to your thoughts on how we can do this.

GDPR Frequently Asked Questions for TeamKinetic

By Rolf Herbert

On 18th May 2018

In Policy and Operations, Security and GDPR, Technical Updates, Whitepaper

This document will continue to develop over time as we respond to more questions from our customer and users. Please feel free to subscribe to stay up to date.

1. Do we need to get renewed consent from every volunteer and provider?

We will be asking all volunteers and providers to review their consent settings for communications and the sharing of their data with volunteer opportunities. You can see this email here

Renewed consent and acceptance of the new EULA will be required when logging in.

We think the consent we have already obtained from volunteers and providers provides us sufficient cover under the ‘legitimate use’ to ensure we do not need to delete users accounts.

2. How long do you keep data after someone has unsubscribed or withdrawn consent?

Unsubscribed relates to email/SMS correspondence, and users are removed immediately from all mass communication and newsletter emails. They will still receive transactional emails specifically related to them and their volunteering. If a user withdraws consent or asks to be removed their volunteer data is immediately anonymised and their personal data is moved to a table only accessible by a system administrator. This moved data is stored for a further 7 days before being permanently removed. We do this to enable us to restore a volunteer profile deleted in error. Data in backups will disappear after our 30 day retention period. Data from backups is restorable but an hourly charge is levied.

3. What is your process if anyone exercises their right to be forgotten.

We will immediately start the removal process for any volunteer requesting to be forgotten or who asks to be removed. The data removal follows the same pattern as above in point 2.

4. How long would it take to delete their data entirely?

Volunteer data is made anonymous immediately. Personal data is immediately unavailable to volunteer administrators and providers. Data in backups will be removed after our 30 day retention period.

Data in backups is only accessible by our network administrators and not by any users at any level of our applications.

5. Do you have an archive of all the data we hold in the database?

All data is transactionally backed up daily and stored encrypted. Backups are maintained for 30 days.

6. Is the data anonymised at any point?

If a request for removal is received then volunteer data is immediately anonymised.

7. Is your data encrypted?

Password data is stored using a one-way hash using a randomised SALT with a length sufficient to prevent practical brute force or collision attacks.

All data at rest in backup or in transit is encrypted using a minimum 30 character length password.

8. Can the TeamKinetic privacy policy be found on the database by volunteers?

Yes. Our full terms and conditions and specifically our privacy policy can be found at https://teamkinetic.co.uk/vk/shared_includes/termsandconditions.htm#privacy.

9. When were your terms and conditions and privacy policy last updated?

Attached to this post are links to:

Our very latest End User License Agreement that was updated May 2018. We ask Volunteers and Providers to Acknowledge this new document when they logon. You can view it at; https://teamkinetic.co.uk/vk/shared_includes/termsandconditions.htm

The email we will be sending to all user regarding their current communication settings that you can view at; https://teamkinetic.co.uk/vk/shared_includes/gdpr-email.htm

And our new Privacy policy document was updated May 2018; you can view at; https://teamkinetic.co.uk/vk/shared_includes/termsandconditions.htm#privacy

I have also included the new Schedule that I will be sending as an addendum to all customers to outline our responsibilities to you under GDPR.

10. Is the website hosted on UK based servers?

All our hosting servers are UK based.

11. Do you have an ICO certification number?

You can find our details at https://ico.org.uk/ESDWebPages/Entry/ZA036104

Registration number: ZA036104
Date registered: 14 January 2014
Registration expires: 13 January 2021
Data controller: TeamKinetic Ltd
Address:
Office 14 Parkway 2
Parkway Business Centre
Princess Road
Manchester
M14 7HR

12. Where do you explain to the volunteer that data is shared with other parties

Our email to all volunteers will reiterate that data is shared with providers and potentially external administrators where a volunteer opts to volunteer on an opportunity outside their application.

For all new volunteers, this consent is explicitly captured during the initial sign up process.

13. What fields can a provider see on a volunteer

Providers can see (but not edit);
Age
Contact phone number
Email address
Gender
Special requirements and disabilities (if the volunteer has chosen to share)
Criminal record check status
Unlocked custom registration fields

14. Can “Admin” users set some “Custom Fields” to be visible to “Providers” or not visible?

Our next release in June 2018 has enabled custom fields to be locked to admins only.

15. Can you make custom registration fields compulsory?

Yes, custom fields can be made compulsory.

16. How long do we store data on volunteer and providers?

TeamKinetic believe volunteering is a lifetime pursuit and as such see no reason to remove a volunteer profile on behalf of a volunteer due to inactivity.

We do believe it is important for a volunteer or provider to have the ability to remove themselves as and when they see fit

We appreciate that some organisations will not share our view, so we will provide a tool that will allow Admin users to search the database for inactive users based on Admin set criteria of time. This will provide a list of inactive volunteers the admin user will be able to remove from the system on mass.

17. Is there any further information of TeamKinetic and GDPR

You can read my last blog on this subject at https://teamkinetic.co.uk/blog/tag/gdpr/

And you can download our whitepaper on this subject at https://teamkinetic.co.uk/vk/shared_includes/are-you-ready-for-gdpr.pdf

18. Do we maintain Data Processing Records

Yes. We have a record of all Data Processors details and access to the data is maintain under strict regulation. We have detail records for the purpose of processing, descriptions of categories, detail data flow diagrams and full documentation of all third party data processors we work with. This is complemented by our policies on security, continuity and privacy.

19. Does TeamKinetic have a Sub-processor or level 2 processor change request process?

TeamKinetic shares very limited data with sub-processors and that data is anonymised. All sub-processes are legally bound by TeamKinetic to meet our data standard as outlined in schedule 6.

All customers are asked to review the schedule below. This will be sent in a separate email to all existing customers as an addendum to our current agreement and will require signing as soon as possible.

Schedule 6 Data Protection
1. Data Protection

1.1 For the purposes of this clause, the following definitions apply;
(i) ‘Data Controller’, ‘Data Processor’ and ‘process’ have the meanings given to them in the Data Protection Act 1998 and from May 2018 the General Data Protection Regulation 2016/679;
(ii) Service Users shall mean those who sign up to use the Services.
(iii) ‘Personal data breach’ has the meaning given to it in article 4(12) of the General Data Protection Regulation 2016/679;
(iv) ‘ Personal Data’ shall mean the personal data of the Service Users including their name, contact details, email, address, disability information, gender and employment or education experience.
(v) ‘Privacy Laws’ means the Data Protection Act 1998, Directive 95/46/EC, the General Data Protection Regulation 2016/679 qne the Privacy and Electronic Communications Regulations 2003; and
(vi) ‘Privacy notice’ means a notice providing individuals with information about the purpose for which and manner in which their personal data will be processed and the organisations that will be undertaking that processing.

1.2 With respect to the parties’ rights and obligations under this Contract, it is acknowledged and agreed that the Customer is the Data Controller and the Supplier is the Data Processor in relation to the Personal Data.

1.3 Where processing Personal Data on behalf of the Customer the Supplier agrees to;
(i) provide the Services in compliance with all relevant Privacy Laws;

(ii) not do anything (or permit anything to be done) which would put the Customer in breach of its obligations under Privacy Laws;

(iii) only process the Personal Data in accordance with the Customer’s instructions and only for the purpose of delivering the Services and not for any other purpose;

(iv) only process the Personal Data in such manner as is described in the Contract and, in any event, only process the Personal Data to the extent that is necessary to deliver the Services;

(v) implement and maintain the technological and organisational measures to protect the Personal Data against accidental or unlawful loss, alteration, destruction, or unauthorised disclosure, dissemination or access, or alteration;

(vi) not disclose or transfer the Personal Data to any third party (save where disclosure has been specifically authorised by the Customer under this Contract) and only provide access to the Personal Data to your personnel where such access is necessary for the provision of the Services

(vii) take reasonable steps to ensure the reliability of any of your personnel who have access to the Personal Data, ensure that those personnel are aware of their obligations set out in this clause 1 and have undergone adequate training in the care, use and protection of personal data in compliance with the Privacy Laws.

1.4 Upon the Customer’s request, the Supplier agrees to permit the Customer or its authorised agents to inspect the Supplier’s premises, data processing activities and systems, and/or have access to, and be provided with copies of any information (including without limitation the Personal Data) to enable the Customer to be satisfied the Supplier are complying with the obligations under this Schedule 6.

1.5 The Supplier must not sub-contract or assign any of its right or obligations under this Contract without the Customer’s prior written consent.

1.6 Where the Customer provides written consent to sub-contracting of the Services under clause 1.6, then the Supplier agrees to impose a binding legal obligation on their sub-contractor to comply with the obligations in this Schedule 6 where that subcontractor has access to, or will be otherwise processing, the Personal Data. For the avoidance of doubt, any such subcontract shall not relieve the Supplier of its obligation to comply fully with this Schedule 6 and the Supplier shall remain fully responsible and liable for ensuring full compliance with this Schedule 6 in all respects.

1.7 The Supplier will not transfer any Personal Data processed under or pursuant to this Agreement outside of the European Union without the Customer’s prior written authorisation. Where the Customer authorises the transfer of Personal Data outside of the European Union, the Supplier agrees to comply with any instructions the Customer may issue which are necessary to achieve compliance with the Privacy Laws.

1.8 The Supplier agrees to notify the Customer as soon as practical, and in any event within five working days, if the Supplier receives;

i. a request from an individual to access their Personal Data or to exercise the rights of individuals under Privacy Laws including the rights of rectification, restriction, blocking, data portability and/or erasure;
ii. a complaint relating to the processing of Personal Data under this Agreement;
iii. notification that an individual wishes to withdraw their consent, or otherwise objects, to the processing of their Personal Data under this Agreement; or
iv. any communication from the Information Commissioner or any regulatory authority in connection with the Personal Data.

1.9 The Supplier agrees to comply with our instruction regarding the response to and handling of a complaint, request, notification or communication described in clause 1.9 and provide such reasonable assistance to the Customer as is required to ensure that the Customer can comply with its obligations under the Privacy Laws.

1.10 The Supplier agrees to notify the Customer promptly, and within 24 hours, in the event of an actual or suspected personal data breach involving the Personal Data processed under this Agreement. The Supplier agrees to co-operate with the Customer fully to investigate such a breach by furnishing the Customer with information as may be reasonably required about the breach and the Supplier’s processing activities. The Supplier also agrees to comply with the Customer’s reasonable instructions regarding the management of and response to the breach and any steps necessary to prevent an equivalent breach in the future.

1.11 The Supplier agrees to comply with the Customer’s instructions as to the period for which the Personal Data shall be retained and regarding secure destruction or return of the data to the Customer following expiry of the Term.

1.12 The Supplier agree to indemnify and keep indemnified the Customer against all claims, demands, actions, proceedings, charges, costs and expenses (including legal costs and expenses) which may be brought against us in respect of or in any way arising out of or in connection with;
i. your breach of the obligations in this Schedule 6; or
ii. a claim that we are in breach of our obligations under the Privacy Laws as a result of any of your actions.

Safer Internet Day and Volunteer Kinetic

By Chris Martin

On 10th February 2015

In News & Views, Policy and Operations, Security and GDPR

TeamKinetic are proud to be part of Safer Internet Day. Safer Internet Day takes place in February of each year to promote safer and more responsible use of online technology.

With just under a 1/3 of people aged 11 – 16 saying they have experienced cruel behaviour online we wanted to take this opportunity to offer this advice when using TeamKinetic.

1. Never meet anyone you speak to on the internet on your own, without being very sure they are who they say they are. If you are unsure contact the administrator and they can check for you.

2. Don’t share extra personal information. All the information the Opportunity provider needs is provided by the system.

3. If you feel threatened or unsafe at any time using the Volunteer site, attending an opportunity or about any feedback left about your time Volunteering, contact the administrator immediately, it is confidential and they will listen to your concerns.

4. Always make sure someone knows where you have gone to Volunteer.

If you follow these simple rules we think you should be safe and have a great Volunteer experience, but if you don’t, please tell and we can see what we can do.

Share your support with #Up2Us or #SID2015 this Safer Internet Day.

You can find TeamKinetic on social media and listen to our podcast:

Twitter Facebook LinkedIn YouTube Instagram Podcast

Have you enjoyed using TeamKinetic? If you could leave us a review on Capterra, we’d really appreciate it! We’ll even send you a little thank you.