nav search
Data Center Software Security Transformation DevOps Business Personal Tech Science Emergent Tech Bootnotes BOFH

Shooting org demands answers from Met Police over gun owner blab

What data did marketing agency subcontractor have access to?

By Gareth Corfield, 21 Apr 2017

Following The Register's report on the Metropolitan Police breaching its own data protection statement by handing the addresses of tens of thousands of London firearms owners to a marketing agency, the British Association for Shooting and Conservation (BASC) has written to the force demanding the decision be investigated.

On Wednesday the capital's 30,000 firearm and shotgun certificate holders received a leaflet in the post advertising products from the Smartwater forensic marking company.

Alarmed gun owners immediately wondered how their addresses had been passed to the direct marketing agency whose return address was given on the envelope, YDM – Yes Direct Mail – of Leeds. The Met's data protection statement for firearm and shotgun certificate holders (which can be read via the link above) does not authorise the processing of data for marketing or advertising purposes. The force has not answered our questions about what data YDM was given access to.

"I received the pamphlet and thought it a bit odd," said one private individual who contacted The Register and asked not to be identified, for obvious reasons. "They must have at least breached a duty of care to keep the details of all these people confidential."

Smartwater, dumb marketing

Firearms and shotguns are a highly attractive target for thieves and burglars. Gun owners are routinely advised by the police not to reveal to strangers where they keep their firearms, particularly if they are stored at home.

The Met told El Reg that the mailshot was an in-house initiative and that data was not supplied to Smartwater, which will only gather information from gun owners who contact them to buy their products as a result of the police-sponsored advertising campaign.

"There is a return address on the envelope for leaflets which are not delivered. Any leaflets which are returned in this way will be destroyed as an additional security measure," said the Met. It added that no companies had been given access to the National Firearms Licensing Management System, the UK-wide database for every single legally registered gun in the country.

Met contractor Corporate Document Services (CDS) will "retain no personal information on any of our certificate holders," the Met told us. It confirmed that YDM (website here, requires Flash), a CDS subcontractor, is "signed up to Data Protection Acts and operates in accordance with CDS security accreditation" [sic].

If the subcontractor was given a pile of pre-printed leaflets referring to "keeping your firearms safe" and a list of 30,000 people to post them to, that is an obvious security blunder. Routine mail from firearms licensing departments around the country, including the Met, is normally hand-addressed by firearms licensing officers. Though the Met insists it hasn't broken the law, its own data protection statement is crystal clear; data handed to the Met by gun owners is only to be processed for law enforcement purposes, not advertising or marketing.

"The MPS has not been paid to supply information to this accredited contractor [CDS]," huffed the force. £6.6m is being spent by the Met over the next three years promoting and handing out Smartwater products to Londoners, under the project name MetTrace.

The force press office admitted that its main idea with the Smartwater initiative for gun owners was about deterrence, thanks to the stickers that Smartwater sells, rather than identifying stolen guns. Almost all lawfully owned firearms and shotguns in the UK are stamped with serial numbers that are recorded on a police-operated central database, and, in the Met's own words, "Forensic science is easily capable of recovering filed-off serial numbers on guns misused by criminals."

Security in obscurity

The Reg report moved BASC, the UK's largest shooting organisation, to write to the Met Commissioner to clarify the legal basis for passing on addresses of firearm and shotgun certificate holders to external contractors.

Bill Harriman, BASC's director of firearms and one of Britain's leading gun law experts, told The Register: "We are seeking assurances from the Metropolitan Police that the manner in which this scheme has been rolled out has not actually put at risk the home security of firearms and shotgun certificate holders.

"We can see no legal authority which allows the Met to breach the Data Protection Act by passing on sensitive, confidential information to as many as three external companies. We are concerned that each time that information is passed on, it heightens the risk that sensitive, personal data will be compromised.

"The Met appears to have struck at the heart of a key tenet of firearms security which comes from obscurity. Those who shoot are told at every turn by the police to take every precaution against strangers discovering where firearms may be stored. Such information is currency for criminals.

"BASC is treating this as a potentially serious breach of trust by the Met. We do not believe certificate holders have given their permission for their sensitive, valuable personal information to be passed on to third parties."

Firearms owners are a regular target for "good ideas" dreamt up by senior police officers, normally those with no knowledge or experience of firearms licensing issues. The Register understands that this initiative most likely came from the Smartwater division of the Met rather than the firearms licensing department. ®

The Register - Independent news and views for the tech community. Part of Situation Publishing