Serious concern: Why were XenForo customers never informed about this alleged internal data leak?

[vbresults]

This is a very strange post. The court document uses clearly speculative language (no evidence) when suggesting that a XF employee was potentially involved, and "purchase orders" is just another way of saying "email receipts".

As the source is anonymous, it could be anyone who had (licit or illicit) access to the licensed email account. It could be a party related to the suit. An email account has every piece of this data. There is no evidence so we don't know.

The XF privacy policy clearly states they do not distribute your information to a third party without your permission or as required by law, and they are subject to the law themselves. To suggest XF has a "backdoor" to your admin panel is deranged.

 

[Tamer]

Discussing a public court judgment that directly mentions XenForo is perfectly reasonable on a XenForo community. But making serious allegations about a company, its staff, and customer data, then falling back on the “I’m just casually posting my thoughts by the pool” nonsense when you get nowhere with those claims, is immoral and disrespectful. @Starbucks

 

[Starbucks]

Discussing a public court judgment that directly mentions XenForo is perfectly reasonable on a XenForo community. But making serious allegations about a company, its staff, and customer data, then falling back on the “I’m just casually posting my thoughts by the pool” nonsense when you get nowhere with those claims, is immoral and disrespectful. @Starbucks

well, I was actually at the pool, having a coffee bc it was like 11am, and well, it was around 30 degrees, and just like every single morning, I enjoy starting my day sitting at the pool with a coffee and scrolling through X, IG and well, since this morning, this discussion. Besides, I promised @smallwheels I’d read his novel post the next morning bc it was quite long. Interesting post btw, lot of text, but interesting.

I believe there’s nothing wrong with sharing my thoughts. After all, we all do it. Just like you’re calling it disrespectful and immoral that I share my thoughts about court matters while enjoying a cup of coffee. Whether they make sense or not, it seems my questions triggered some emotions, as I read something and asked questions that people didn’t like. However, they all have the right to express their opinions about that post, about me, and well, about others.

Oh and it did get me somewhere, tho. It gave me a bit of a tan because I sat in the sun for a while too long reading all the posts.. so yeah.

 

[Tamer]

We have a Turkish expression for this: “The sun has gone to your head.” It literally means the sun has gone to someone’s head, but the point is that after too much sun, someone starts acting dazed and talking irrationally or inconsistently. Given the poolside explanations, it feels pretty accurate here.

 

[Starbucks]

We have a Turkish expression for this: “The sun has gone to your head.” It literally means the sun has gone to someone’s head, but the point is that after too much sun, someone starts acting dazed and talking irrationally or inconsistently. Given the poolside explanations, it feels pretty accurate here.

Well… with almost 300 sunny days a year.. that might be accurate so, less coffee in the sun I guess jeje

 

[Tamer]

Definitely! Less coffee in the sun and fewer conspiracy theories.

 

[zappaDPJ]

This thread reminds me of a song. I can't imagine why.

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[Mendalla]

This thread reminds me of a song. I can't imagine why.

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

LOL. How about this one? "Storm in a glass" is apparently the Dutch version of "tempest in a teapot".

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

 

[Sim]

FWIW, I've been a defendant in multiple court actions here in Australia as a result of defamatory material that was posted by third parties on my site.

In one case, co-defendents were Google / the hosting company / a media company / another forum / my forum.

The conversation I had with the lawyers went something like this (paraphrasing)

• lawyer: there were messages posted on your forum which we believe defamed our client
• me: yes, those messages were clearly in breach of our forum rules and were deleted by us
• lawyer: my client wants to pursue legal action against the person who posted them, based on evidence we have already gathered, we believe it was this person
• me: yes, that fits with what I am seeing
• lawyer: we'll need full details including IP addresses and such so we can pursue this - if we get a court order will you be willng to comply?
• me: yes, let me know what you need
• lawyer: don't send us anything now - I'll send you what is called a Consent Order which will be approved by the court instructing you to provide us with the details
• me: sure - I'll wait for you to send that to me

... and a few weeks later, I received a signed document "BY CONSENT between the Plaintiff and the Fifth Defendant, the Court orders that: ..."

Now obviously this is in Australia and the exact details and procedure would likely be different in the UK or Northern Ireland or wherever this occurred - but this has happened to me twice now and so there is a definite pattern which these things tend to follow.

Based on some of the stuff I've read in this thread - it doesn't really seem to me like there is an issue? Seems like pretty standard stuff based on my experience?

 

[frm]

Based on some of the stuff I've read in this thread - it doesn't really seem to me like there is an issue? Seems like pretty standard stuff based on my experience?

The only thing argued, that I couldn't get across to anyone, was that the alleged (if there was one) XenForo staff member cooperated and provided the details first. Perhaps in the same conversation, the staff member also told them to get the court order. (April 2023)

But, before the court order was officially received, the plaintiff emailed their private investigator in celebration that they confirmed much of what they already knew. This email got entered into discovery. (April 2023)

Then, the court order came (NPO) and XenForo (the entity) sent over the same information that the alleged staff member sent. (June 2023)

In your conversation, you could've very well told them everything, because you knew it was coming anyway. But, for it legally to stick, they needed the court order, so they told you to hold off.

 

[Sim]

The only thing argued, that I couldn't get across to anyone, was that the alleged (if there was one) XenForo staff member cooperated and provided the details first. Perhaps in the same conversation, the staff member also told them to get the court order. (April 2023)

But, before the court order was officially received, the plaintiff emailed their private investigator in celebration that they confirmed much of what they already knew. This email got entered into discovery. (April 2023)

Then, the court order came (NPO) and XenForo (the entity) sent over the same information that the alleged staff member sent. (June 2023)

In your conversation, you could've very well told them everything, because you knew it was coming anyway. But, for it legally to stick, they needed the court order, so they told you to hold off.

I don't really see the difference between what you've described and what I described. If there is a difference - it's just semantics.

 

[frm]

• lawyer: there were messages posted on your forum which we believe defamed our client
• me: yes, those messages were clearly in breach of our forum rules and were deleted by us
• lawyer: my client wants to pursue legal action against the person who posted them, based on evidence we have already gathered, we believe it was this person
• me: yes, that fits with what I am seeing
• lawyer: we'll need full details including IP addresses and such so we can pursue this - if we get a court order will you be willng to comply?
• me: yes, let me know what you need
• lawyer: don't send us anything now - I'll send you what is called a Consent Order which will be approved by the court instructing you to provide us with the details
• me: sure - I'll wait for you to send that to me

Your version of events.

Twisted to meet this scenario, which has everyone up in arms because it was released to a third party without explicit consent from the license holder, and not to law enforcement (per XenForo's privacy policy).

XenForo Limited will not sell, distribute or lease your personal information to third parties unless we have your explicit permission or are required by law to do so.

• Sands: there were messages posted on a forum that you license to [Bond] which I believe defamed me [by hosting a forum that allows and promotes defamation of anyone]
• Sands: I want to pursue legal action against the person who runs that forum, based on evidence I have already gathered, I believe it was [Bond]
• Alleged XF staff member: yes, that fits with what I am seeing (also maybe IP addresses and purchase dates), April 2023
• Sands to Investigators: Everything we knew (minus perhaps purchase dates and IPs) match — entered into discovery, April 2023
• Alleged XF staff member: You'll need to get a court order (if you want this to stick), April 2023, before, during, or after that interaction.
• Sands (/legal team) months later: Here's your court order, XenForo, June 2023
• XenForo: Here's Bonds' information as directed by the court, June 2023

Sands, the first plaintiff, and a third party, allegedly got in contact with someone at XenForo. That person, not representing XenForo, worked with them and provided some material and/or confirmed what Sands already had on Bonds. They also told Sands that he would need a court order, with an unclear timeline. Before the court order was issued, Sands emailed his investigators, confirming much of what they already knew (April 2023 discovery). The court order came down, and XenForo released the same information that the alleged staff member did (June 2023 discovery).

Had it not been for that celebratory email to Sands' investigators, everything would've been peachy, as there wouldn't have been a breach of the privacy policy by confirming/giving up details without the official court order as it wouldn't have wound up in discovery to paint this in such a bad light (April giving up information/June getting the order).

But since the alleged staff member knew that the order was coming, I don't find it a breach because then they are "required by law" (at least, once the order is in hand). Nonetheless, the staff member revealed some information to a third party without the official court order in hand, thus putting it in a grey area and up for interpretation.

 

[Jake B.]

But since the alleged staff member knew that the order was coming, I don't find it a breach because then they are "required by law" (at least, once the order is in hand).

you’re SO CLOSE to the point… so close.

 

[mjda]

So if I email someone who has your personally identifiable information, and I claim to be law enforcement, you're perfectly fine with that person giving me your information before a court order is supplied? I'm definitely not ok with that concerning my information. I don't think it's the end of the world, and this thread has certainly been blown way out of proportion, but the person who gave up the information before the court order needs to be reprimanded at the very least. Whether they "knew" the NPO was coming, or not, is irrelevant and doesn't change the fact that they violated the XF privacy policy and user trust by complying before they were required by law to do so.

 

[frm]

but the person who gave up the information before the court order needs to be reprimanded at the very least. Whether they "knew" the NPO was coming, or not, is irrelevant and doesn't change the fact that they violated the XF privacy policy and user trust by complying before they were required by law to do so.

The judgment also doesn't explicitly state that someone at XenForo did, only that a person at XenForo might've said to get the order. We won't ever know until an official announcement is to/ever be made. It could have been someone associated with Bond, like an authorized user on his account, or a compromised email address, etc.

Discovery has revealed emails passing between the first plaintiff and a confidential source who appears to have been working for Xenforo, a forum software provider used by Tattle Life until December 2021. The first of these was dated 22 March 2023 but it was clearly preceded by previous email correspondence which has not been located as it is believed to have involved a different email address. The emails indicate the source has identified an IP address said to be hosting the Tattle Life site. The first plaintiff asked if he should proceed with a court order against Xenforo and is advised that he should.

That's why I use alleged.

But, it's not too uncommon to work with law enforcement "off the record" until it's necessary to be put on the record. Is that what happened? Can't tell by the judgment alone, as there are emails that seemed to have conveniently disappeared, and nobody is explicitly named.

It's all speculation.

 

[Sim]

Twisted to meet this scenario

So now you're accusing me of lying? Okay then.

 

[frm]

So now you're accusing me of lying? Okay then.

No, I just modified your anecdotally based investigations to fit this scenario (copy/paste and reworded it) so that you were caught up and aware of the sequencing in a format that you could relate to.

I don't know how that came across as accusing you of anything.

 

[Sim]

No, I just modified your anecdotally based investigations to fit this scenario (copy/paste and reworded it) so that you were caught up and aware of the sequencing in a format that you could relate to.

I don't know how that came across as accusing you of anything.

Okay - I re-read your post and can see how your choice of words lead to my confusion. "Your version of events. Twisted to meet this scenario"

 

[frm]

Whether they "knew" the NPO was coming, or not, is irrelevant and doesn't change the fact that they violated the XF privacy policy and user trust by complying before they were required by law to do so.

Since this is in the UK where there are hate speech laws, this could've been a moral dilemma. That's how I find it somewhat excusable. Humans are fallible, and systems account for human error. If that's what happened in this case.

but the person who gave up the information before the court order needs to be reprimanded at the very least

Internally.

If it unfolded the way I imagined, there are really only two options: Ignore it or throw that person under the bus, formally by name or anonymously, with the latter probably not going over too well with the responses here, unless terminated. (Therefore, only one real option.)

The other option that I see potentially opens XenForo up to litigation.

I'm only in support of XenForo because I have a vested interest to be.

If it played out like that, Bond and his toxic community have more than enough to bury or bleed XenForo (comparing their bank and community support to XF's balance sheet), because there is legal standing to, which is probably not an outcome that this community would like to see.

Enough said, I guess, as I'm just beating a dead horse, and you know why I stand where I stand completely now.

 

[Anthony Parsons]

is irrelevant and doesn't change the fact that they violated the XF privacy policy and user trust by complying before they were required by law to do so.

Did they? Maybe you're from the US? Australia, similar to the UK, you are required by law to follow the directions of police and court officers, by law, no court order needed. That is legal, without court order. If a solicitor asked you for information, or random person, that is not legal and up to yourself, but if a police officer asks for it, or a court officer, that is already standing law, and you can provide it legally to them. You certainly do not need a court order for everything in Australia, and being Commonwealth and all, UK is no doubt similar. Court orders are used here, but they aren't required for everything.