Falmouth officials are investigating an Internet security breach that allowed a resident to post a public notice to the town’s website this month.

The notice appeared on Falmouth’s home page after town officials responded to a request for public information and released email addresses for all subscribers to the town’s online notification system.

The incident has raised questions about Maine’s Freedom of Access law and prompted calls for legislation that would allow people to prevent municipalities from releasing email addresses provided for similar services.

“It was a colossal goof,” said Faith Varney, chairwoman of the Falmouth Town Council. “It never occurred to anyone that something like this would happen.”

Town officials gave the subscribers’ list to Michael Doyle on May 31, after he submitted a request under the Freedom of Access law, said Town Manager Nathan Poore.

Town officials believe the list included an email address that allows authorized people to post public notices about emergencies and special events, such as road closures and community gatherings.

The notice in question was posted June 9 in “News & Announcements” on the town’s home page, Poore said. It encouraged readers to check out Doyle’s controversial blog about Falmouth issues and events.

Poore saw the notice on June 10 and immediately blocked additional postings from that email address, which has since been changed.

“That email address was thought to be protected,” Poore said. “It’s not clear why it wasn’t protected.”

Doyle said he didn’t intend to post a notice on the town’s website. He acknowledged that it may have happened when he sent a notice about his blog to some of the more than 3,000 email addresses he received from the town’s subscribers’ list.

Doyle said he sought the subscribers’ list because he’s trying to gather and disseminate information about town government to Falmouth residents. “It’s nothing nefarious,” he said.

Poore said no other personal information from subscribers was released and no other aspects of the town’s website were compromised, including links that allow business transactions through third-party administrators.

“We’re confident nothing else got manipulated on the website,” Poore said.

But the town’s information technicians and its website provider, Virtual Towns and Schools, are reviewing the incident to determine exactly what happened, Poore said.

Poore also contacted the Maine Municipal Association to seek the group’s support in pursuing legislation that would allow people to block cities and towns from releasing email addresses provided for municipal notification systems.

Poore said he has received dozens of questions and complaints about Doyle’s unsolicited emails, though few have asked to be removed from the subscribers’ list.

“People aren’t signing up with us to get spammed,” Poore said.

Poore said the exemption from the Freedom of Access law would apply only to email lists for public notification systems. It wouldn’t restrict access to other communications received or sent by municipal officials, which are considered public information.

Geoff Herman, a lobbyist for the Maine Municipal Association, said Falmouth’s website breach may have been the first of its kind in Maine.

However, he said, there is growing concern about commercial interests and advocacy groups accessing email lists held by public bodies.

In 2003, the Maine Department of Inland Fisheries and Wildlife got an exemption from the Freedom of Access law after receiving complaints that outside interests were using email addresses from hunting and fishing license applications to contact outdoorsmen. Now, the applications allow hunters and fishermen to indicate whether their email addresses are confidential.

Herman said the association’s 70-member legislative policy committee will consider submitting a bill next year on behalf of Maine municipalities.

Doyle questions whether municipal email lists should be confidential.

“If you don’t want your email address to be in the public domain, don’t sign up for notifications from the town,” he said.

Staff Writer Kelley Bouchard can be contacted at 791-6328 or at:

kbouchard@pressherald.com

 

Copy the Story Link