Hackers or Overly Curious? Opinions please

[HotHolly]

Well, when you shoot weddings you get all sorts of weird issues. I expect it by now, so not too much phases me anymore. Except this sit. caught me by surprise. Lets not go into too much detail, b/c Im not sure how I should respond yet. So, just give your gut reaction.

What would you do if a B&G (or client in general) guessed at passwords until they got access to restricted files on on your photo site? And then they distributed the passwords to their entire family so they could see their wedding photos.

My question - would this be considered hacking? How seriously should this be addressed? Does this behavior (in your opinion) go beyond audacious? Or were they just too excited and I should look the other way? Opinions here?

[ttusa]

I see this as hacking. I'm not familiar with all the wedding business protocol, but trying to get access into restricted areas is not cool.

[Ahh!]

Just like anyone I catch with their hand in the cookie jar, I would ask them, "Can I help you?" and gently discover the nature of their inquiry. WIP is just that, whether for an accounting audit, a criminal investigation, a project plan, a oil painting, or a Hot Holly Masterpiece. It is the right of the individual responsible for that work to determine the time and place of its disclosure. In some cases it is a matter of law to violate that control....here..it seems that some implied scolding may suffice.

[ngoduyviet]

First thing first, immediately change all passwords.

Secondly, make it known to them that you know, and will report to authority of this unless they stop. If they stole any digital negatives, they'll need to remove them completely from their systems.

What they did would be hacking & stealing in my opinion. If I'm not mistaken, it was made into law a couple of years back that hacking into websites is now a federal offense and carry jail time.

[JamesB]

if you did not give them access to those specific files, then it is hacking.

you should change any access to those files they had or remove the files from being able to be accessed. no telling who is copying them

James

[Ahh!]

comments deleted by me

[Ahh!]

Originally Posted by ngoduyviet

If they stole any digital negatives, they'll need to remove them completely from their systems.

Holly,
Sorry, its been a long day and I assumed that you would be changing passwords, and somehow that this aspect was not possible. If it is, then the flippancy is no laughing matter and needs to be dealt with very seriously. PPA can also help with the "firm tap on the shoulder".

In addition, you need very strong passwords asap, and consider encryption or VPN if anything is outside your firewall.

Sorry again...yes, if this is happening, the gloves are off.

[carrbowl]

Holly, How did you find out they knew the passwords? Or maybe you don't want to disclose that. The reason I ask, is because that might help in finding out why they hacked in.

[shutterflypro]

Why are you posting a non completed wedding to the internet.

The last thing you should do as part of your workflow is place your images in an area that is accessible from the internet.

While I do not say that your clients are right in what they did, matter of fact they are wrong. However, half of the blame falls directly on you.

First problem, you placed the images where they were accessible online without them being in a completed state.
Two you were obviously not using complex password structures. You should evaluate this.

Once again your clients were in the wrong but so were you.

Now as far as a solution to the issue. Let them know that you know they have accessed them and change the password or remove them from online. And just let them know that you will put them back online when you are ready.

I would also recommend that you evaluate your online policys that you use in your business.

[PeteQ]

Obviously the passwords you are using on your system are pretty simple. I would suggest you get yourself a random password generator. I swear by mine. There are so darn many things these days that people tend to use one or a variation of one password for everything. It's like a master key to your work and possibly your identity. Better safe than sorry.

Oh yes, I agree that what they have done should be regarded as illegal. If they downloaded images now they are into copyright violations, etc....

[Steelsun]

It is considered hacking. The correct term is "Unauthorized access to a computer system"
Since you did not allow them, and had taken steps to stop entry (i.e. password), they were unauthorized. If they copied any of the images, it is theft. Actually just viewing the images, since they cache on the local machine, is considered theft by many courts.

These are FEDERAL level felonies by the way, not local misdemeanors (although Texas also has state laws for this).
And if your system/server is in another state, then they hacked across state lines, which adds a whole new level of offense (interfering with interstate commerce, transport across state lines of stolen goods, etc).

[Ahh!]

I am inclined with Raymond, more than Brian on this, because of the business relationship at stake. While the extremes are there, I personally would lock up to prevent future problems while warning this client of their error. You may win a loyalty and lifelong customer to photograph their family far into the future.

[PeteQ]

Just out of curiosity Holly, did they balk at prices or copyright, or getting images on dvd? Maybe they were trying to get the files so they could keep their order to a minimum. Before you worry about losing a business relationship (which is an important point) take a look and see if there was much of one there anyway.

[HotHolly]

Hmmm. I was careful about how I worded this when I posted. Some of you made assumptions. Its hard to not give too many details and still get to the point.

The images were duly password protected. I had said it was at the 'work in progress stage' meaning it wasn't the completed presentation yet. They got into it before I finished. They cannot steal negs. They cannot see 1/2 processed images, RAW, or anything like that.

If someone correctly guesses passwords, does that go beyond curiosity? It was a double password, case-sensitive system, so it took some effort. I wouldn't have been so irked if she didn't distribute the passwords.

This couple has been difficult from day 1, Pete. You really don't want to hear. She's a rule-breaker, exception-maker type. Demands what she wants, when she wants it. She has been asking for the passwords. I don't think she told her family she gave them the passwords before they were issues either. Im trying to tactfully handle the family while figuring out what to do with the B&G.

[carrbowl]

man...that makes it tough...because you don't care about that relationship, but what does it look like to others?? And other people that know them, know she already bad mouths everyone so you don't have to worry about that...good lucky Holly...this is a tough one...