Early on the Fourth of July, the US government announced it was taking over the main website of the BP oil disaster response, deepwaterhorizonresponse.com. From early on in the disaster, that site has served as a joint venture of BP and various government agencies to post press releases, media advisories, photos, video, and other PR materials about the oil, including a mailing list for media and other interested parties.
Now, the Department of Homeland Security wants to make a "one-stop shop" for the disaster response under a .gov URL. That means shutting down the current site, and taking another look at who has access to post on the site, with government deciding control of the content and message.
So why did DHS allow BP to walk off with the mailing list of everyone who signed up for information about the disaster?
I’ve received emails from the site every day since it went live 10 days after the disaster. Every email has come from some variation of "Joint Information," or "Deepwater Horizon Response." Yet today, less than 24 hours after DHS announced it planned to take over the response website, I get my very first email from "BP America Press Relations," titled "BP update on Gulf of Mexico spill." The email from BP was sent to the same address with which I signed up on the original response website.
It seems quite clear that either BP made a copy of the mailing database before it loses access to the site, or the government will continue to give them access to the database. It’s also clear that no matter what, this is in clear violation of the privacy policy of the website, of the US Coast Guard, and of the government itself. On the mailing list signup page, it quite clearly states:
All information is retained for the sole use of the site owner and will not be distributed or sold.
In this case, according to the site’s privacy policy, the "site owner" is exclusively the Coast Guard (cached from July 1, before the website transfer announcement).
This web site and the information it contains is provided as a public service by the U.S. Coast Guard.
While the privacy policy doesn’t explicitly mention the site’s mailing list, it does clearly state the Coast Guard’s policy for the use of email addresses of people who email the site for information.
We use the information to improve our service to you or to respond to your request. Sometimes we forward your e-mail to other government employees who may be better able to help you. Except for authorized law enforcement investigations, we do not share our e-mail with any other outside organizations.
Considering the Coast Guard owns the site, information on the site "will not be distributed," and that the Coast Guard stated "we do not share our email" with anyone outside government except for law enforcement, BP has no right to be in possession of an email list from this website.
If BP wants to email people who signed up on deepwaterhorizonresponse.com, it needs to take several steps before it can start emailing people without warning. First, it should treat the list on an opt-in basis. That is, they should email the list explaining how BP got the email addresses, and that if people want to receive email from BP, they should affirmatively opt-in to receive further emails. Anyone who doesn’t can’t be emailed. Second, email addresses are valuable things. BP should compensate the government for each email address that opts in to BP’s list.
What BP shouldn’t do, and what the government shouldn’t allow, is what evidently happened this morning: BP making off with a copy of the list and treating it as its own, with no regard for the people who signed up for the list in the first place.