* CC + Reply All = Trouble
Recently a nice lady in the Human Resources department at my university sent out a note to a dozen people reminding us that we had not yet finished signing up for our new medical insurance coverage.
Unfortunately, she put all the e-mail addresses into the CC (carbon copy) line, where they were visible to everyone in the list. Predictably, someone on the list composed a response to her, hit REPLY ALL and sent some mildly personal information about the state of her medical concerns to all the recipients on the original list, none of whom cared a whit about her problems.
Luckily, there wasn’t much that was very private in that message, but it did prompt me to write to the head of Human Resources about the incident. Part of my message was as follows:
1. Many people unthinkingly use the CC line for addresses to a distribution list.
2. Many people unthinkingly use Reply All for replies to every e-mail message.
The combination can lead to embarrassing violations of confidentiality; when the HR department staff use CC instead of BCC (the “blind carbon copy” function that conceals the distribution list), the Reply All function can inadvertently violate privacy.
In this case, there was no particularly sensitive material revealed, but a different case could easily violate Health Information Portability and Accountability Act (HIPAA) and the university’s rules on employee confidentiality.
I’m sure that once your colleagues understand the issue, they will learn not to use CC for distribution lists when the intention is to communicate with individuals; by default, all of us should use the BCC list unless we need to stimulate group discussion of an issue or it’s important for the members of the group to know who received the message.
It’s important that we not dismiss this issue as too easy or too obvious to bother with. “Against stupidity, the gods themselves contend in vain,” wrote Friedrich von Schiller in his “Maid of Orleans” (Die Jungfrau von Orleans) in 1801. Nonetheless, the CC + Reply All habit becomes a covert channel for release of confidential information for people who refuse to keep an address book and simply look up any old e-mail and Reply All to it as a lazy way of sending a new message.
If you doubt the seriousness of the problem, I suggest you look through your own archives of e-mail and count how many obvious cases there are of e-mail messages with inappropriate subject lines and inappropriate distribution lists sitting in your received-folders. I think you will be dismayed by the results of your research.
I’ll continue this topic in my next newsletter.
