Feeds

Child protection website insecurity fixed

Abuse report page was unencrypted

Next gen security for virtualised datacentres

A member of the public was shocked to find that links to a web page used to report incidents of suspected child abuse to the Child Exploitation and Online Protection Centre were insecure.

Concerned parties visiting a confidential report abuse webpage on CEOP's webpage from either Facebook or Google were directed to an unencrypted page, before being redirected onto a page with a secure SSL link – if users actually decided to file a report.

The oversight meant that search queries or other actions performed on CEOP's landing page were open to eavesdropping because they were sent in the clear.

There is no evidence that any such eavesdropping actually happened, however. CEOP said that the security shortcoming with its site, which it downplayed, has now been resolved.

In a statement, CEOP's chief exec, Peter Davies, said: “The risk was a hypothetical one and there is no evidence to suggest anyone's details have been jeopardised.

"We thank the member of the public who brought this issue to our attention and have rectified the problem, so people can continue to report any concerns they have to us, with the reassurance that their report will remain secure."

The Information Commissioner's Office confirmed that its is looking into the incident.

An ICO spokesperson said: "We are making enquiries into the circumstances of this alleged breach of the Data Protection Act before deciding what action, if any, needs to be taken."

CEOP is a specialised police agency, set up in 2006, that leads the UK's fight against child abuse. It also runs various education programmes aimed at making children aware of the dangers posed by paedophiles who attempt to meet children online, for example. CEOP lobbied for Facebook to put a panic button on its website.

Jim Gamble, the former head of CEOP and an outspoken advocate of the Facebook panic button, resigned last year over government plans to merge the agency with a new National Crime Agency, due to commence operations in 2013. ®

The essential guide to IT transformation

More from The Register

next story
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
UK fuzz want PINCODES on ALL mobile phones
Met Police calls for mandatory passwords on all new mobes
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
EU justice chief blasts Google on 'right to be forgotten'
Don't pretend it's a freedom of speech issue – interim commish
Detroit losing MILLIONS because it buys CHEAP BATTERIES – report
Man at hardware store was right: name brands DO last longer
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
Yes, but what are your plans if a DRAGON attacks?
Local UK gov outs most ridiculous FoI requests...
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.