‘People are furious’: Email addresses of firearms licence holders leaked

The newly created Firearms Safety Authority has accidentally leaked the details of over a hundred gun owners in Auckland.

The email addresses of 147 firearms licence holders were sent to each other in error, after an email was sent with the recipients’ email addresses pasted into the carbon copy (cc) address field, rather than as a blind carbon copy (bcc).

Are you affected? Email aucklandnewsroom@stuff.co.nz

In group emails, addresses in the bcc field will be hidden from other recipients, whereas email address in the cc field are visible to all.

The authority’s firearms registry was just recently launched in June. It is hoped the register will prevent guns from ending up in the wrong hands by requiring gun dealers to register their sales.

READ MORE:
* Firearms registry launched by police to create database of estimated 1.1m guns
* Newsable: Why are firearm owners so against the new gun registry?
* New police plan to keep officers safe, amid rising firearms use

Grant Fletcher​ one of New Zealand’s foremost experts on firearm’s law, said the privacy breach is, “not even remotely close to being good enough”.

“All firearms users are entitled to have their details protected, as are all users of government services,” he said.

Fletcher said people were already hesitant about putting their personal details into the system when it was launched, because there had been similar data leaks overseas which resulted in those gun owners being sent death threats.

“This leak has just further eroded their trust. People are furious. . . the entire firearms’ community are shaking their heads at this.”

In an email, police superintendent Richard Wilson, who oversees Te Tari Pūreke/Firearms Safety Authority, said the privacy breach by the Auckland District Office had been reported to the Office of the Privacy Commissioner.

He said human error was to blame.

“The authority stresses that the event was not related in any way to information held securely in its systems, and did not come about from any breach of its systems, but rather from human error.”

“The email itself was a generic message asking the recipient to update their address, and did not contain any individual information about recipients other than the email address that was visible.”

The email was not sent to any members of the wider public.

“Te Tari Pūreke has also begun a rapid review of its processes around the sending large batches of email, and will be strengthening its processes to avoid future events like this.”

Wilson said the authority immediately ceased sending group emails after it identified the breach.

It also sent a follow-up email to the 147 recipients, asking them to delete the offending email and would make further contact to explain the nature of the breach and how it came about.

“Te Tari Pūreke sincerely apologises to all those affected by this event,” Wilson said.

Police have been contacted for further comment.