Disclaimer - I am not technical enough to know if this is a big deal, or if it is, how big of a deal it is.
This afternoon, we were talking about finding phone numbers for folks - how it’s often challenging even in the age of Google. For giggles, I searched Google for “Arif Mamdani phone number.” What I found was kind of surprising - a page on the civicspacelabs.org website that appeared to be CivicSpace contact manager - and interestingly, it appeared that Google had actually crawled their contact management pages and had captured my name, along with others. Clicking the link from Google’s results page returned an Access Denied error as it should - un-authorized users shouldn’t be able to view pages on a website that are private. Clicking the Google Cache link however turned up this:

and

which pretty clearly shows a bunch of names, including mine, along with phone numbers.
Now, as I said, I’m not techie enough to really understand what happened here, but it looks to me like it’s a bit of problem.
added March 17, 2006:
So the issue that this raises - at least the issue I want to raise is not about CivicSpace, their website, or their ability to configure the code they are developing correctly. The issues are really around privacy, security, and confidentiality - all of which David raises in his comments on this post.
See, the problem here is that most non-profit organizations (PTP included) don’t have explicit policies for what they do with information, and what they will do in the event that information is compromised. In the case highlighted here, it’s clear that user information was made public in ways that the users were probably not aware of (I certainly wasn’t), and probably did not consent to (I certainly didn’t).
What this spotlights is the fact that David points out - that as greater parts of the non-profit sector turn to CRM applications that are online and/or integrated with our websites, the potential for data to be accidentally exposed increases. It therefore behooves us to start a serious conversation about how we treat our data.
For my part, seeing this has made me commit to getting PTP’s privacy policy off my task list and clearly posted on our website - and it’s made me realize that in addition to have a policy that states what we do your information, we also need to have a policy that clearly states what we will do in the event that we learn that your information has been compromised.
What are you going to do?