Autofill error leads to disclosure of world leaders' personal data

Be careful what you autofill.

Personal details of world leaders at last November’s G20 Summit in Brisbane were accidentally sent to organizers of the Asian Cup football tournament by the Australian immigration department through the use of Outlook's autofill function, The Guardian reported Monday.

While the leak was inadvertent and deemed ultimately low-risk, the breach highlights data security concerns that have become a global issue as businesses, educational institutions, and other organizations proved vulnerable over the last few years to both cyber attacks and accidental personal data disclosures – some of which could have been easily prevented.

The G20 breach involved information on 31 international leaders, including United States president Barack Obama, Russian president Vladimir Putin, German chancellor Angela Merkel, Chinese president Xi Jinping, Indian prime minister Narendra Modi, Japanese prime minister Shinzo Abe, and British prime minister David Cameron, according to The Guardian.

Names, dates of birth, titles, passport numbers, and visa grant numbers were among the data disclosed after an immigration employee “failed to check that the autofill function in Microsoft Outlook had entered the correct person’s details into the email ‘To’ field,” an officer in Australia’s Department of Immigration and Border Protection wrote in an email, dated Nov.7, 2014, to the office of the nation’s privacy commissioner.

“The cause of the breach was human error,” according to the letter.

Security researchers have warned of the potential dangers of autofill, a setting that lets a browser or app use stored data to automatically fill out forms, because when combined with the human tendency to err, the consequences of such convenience can range from embarrassing to dire.

In 2012, The Boston Globe’s Peter Post blogged about a woman who was fired for missending an email that contained disparaging comments about her boss…to her boss. Two years earlier, a UK police officer sent a file containing thousands of confidential criminal records checks to a local journalist, whose email had been saved after it was used to submit previous Freedom of Information requests.

The use of autofill can also make certain stored information vulnerable to attack, as occurred with the Safari browser in 2010. Google warns users: “It's important that you use Autofill only on websites you trust, as certain websites might try to capture your information in hidden or hard-to-see fields.”

“AutoFill is a feature that requires exchanging some security and privacy in favor of convenience,” tech analyst Tony Bradley wrote for PCWorld in 2010.

A quick way to avoid potential trouble is to disable the feature on browsers: Google Chrome has it under the “Passwords and forms” in its advanced settings options, while Firefox has it in its “Privacy” panel.

There are also middle-ground options: iPad and iPhone users, for instance, can limit autofill to contact information while disabling the use of names and passwords.

The best advice is, however, is to exercise care and good judgment.

“I am not suggesting that everyone abandon AutoFill and go back to tediously typing in the same information every time the need arises,” Mr. Bradley wrote. “I am, however, advocating that IT admins and users in general understand that the same features that provide convenience for the user also make it more convenient for an attacker to breach or compromise the data stored there.”

A related but separate issue that the Australian immigration department is facing in the G20 leak is its decision not to disclose the breach to the world leaders involved, reasoning that the unauthorized recipient had immediately deleted the message and emptied his deleted items folder, and that “the risks of the breach are considered very low.”

The decision has led opposition leaders to call for an explanation from government officials, especially as debates around online security legislation take center stage in Australia.

“Only last week the government was calling on the Australian people to trust them with their online data,” one senator told The Guardian, “and now we find out they have disclosed the details of our world leaders.”