Empty Batches.

LegacyUser

Inge said: I am sharing this as per advice by the FamilySearch team to see if I can get an answer to why many batches are listed as empty. One example is C96155-1 which only contains 2 images now. There appear to be several batches of German records empty at the moment. As these batch numbers are listed on GeniWiki it would be good to know if and when these batches will have information in them again This issue was also reported on the German Forum in FamilySearch

There is more information in this Case Number 07580407

https://www.familysearch.org/help/myc...

LegacyUser

A van Helsdingen said: I'm surprised/slightly concerned that it is possible to view other people's cases with Support if you have or can generate the URL.

LegacyUser

Inge said: I have no idea if anyone can. I thought the Technical team might be able to?

LegacyUser

A van Helsdingen said: I'm just an ordinary non-LDS customer, and by clicking on the above link was able to view the case and your conversations with Support

LegacyUser

Inge said: Thanks for pointing that out. Now that I know I will make sure I don't add the link to a case to a discussion

LegacyUser

Tom Huber said: The only reason we can see it is because the user provided a URL to the case. Normally, only the case number is provided and we cannot search on that to find it since the case number is not part of a URL.

LegacyUser

Tom Huber said: Hopefully, the German community can provide an answer to your question about empty batches.

The only thing that I can think of is that there may be an agreement between FamilySearch and the custodians of the original records (or restrictive laws) that prevents them from being displayed (and FamilySearch is starting to isolate (or display) specific images that fall outside of the agreement or applicable laws.

Either that, or it is some kind of glitch, and if it is, the engineers would need to know what operating system and browser you are using.

LegacyUser

David Newton said: "The only reason we can it is because the user provided a URL to the case."

Well that's funny because I just tried a few alterations to that URL and came up with this:

https://www.familysearch.org/help/myc...

This is a classic, classic error. It's also a breach of GDPR. You absolutely should not be able to simply change a URL and access other people's information. You should be required to be logged in as the person who originally raised the case to see it.

All someone has to do with this system is to set up a bot to walk through the URLs systematically to find out which ones are live. It's a large name space and it would take a while, but it could be done. Considering the topics that get dealt with by the support people there may well be extremely sensitive information in some of those threads. Once said bot has found that a URL is live then a link could be posted anywhere and this lot would become searchable.

This is security 101 and it has been well and truly flunked.

LegacyUser

A van Helsdingen said: I note that the above URL relates to LDS ordinances. FS probably does not want non-Latter Day Saints like myself to have access to that sort of information.

I strongly agree with David that this is a massive security flaw that should be fixed immediately.

LegacyUser

Inge said: Hi Tom. Thanks for your reply. It was raised by a German Genealogist who has noticed that in the last few months many of the batches from his area in Germany are empty and as I had also come across the odd empty batch I wanted to see if I could escalate the issue. Others also mentioned that they have been posting about this in various forums but not getting answers as to why the batches are empty.
The support team told me to post it in feedback and instead of typing out the entire case again, I pasted the URL not realising that everyone could now read the case.
The Support team did point out that some batches are being recalled due to high error rates because the films were bad quality and they were working on re-releasing them. Then they asked me for an example and to post it here in feedback which I did.

LegacyUser

Inge said: I will see what I can do to pass this on

LegacyUser

A van Helsdingen said: If they all come from the same area, then it's possible they all have the same record custodian (i.e. the archive that owns the record). The custodian may have negotiated a new contract with FS the affects how FS can publish the records.

LegacyUser

Inge said: Well that would be easy for someone to get back to us about I was told it was more likely the batches were being reworked.

LegacyUser

A van Helsdingen said: FS never comments on record restrictions and contracts. There are questions/complaints that were made two years ago on this forum that have gone unanswered- seemingly deliberately, because FS Staff did answer other questions raised in the thread, but were noticeably silent on this issue.

LegacyUser

Inge said: Well I can only live in hope that either someone replies or the problem goes away.

LegacyUser

David Newton said: I got that one on my fifth try I think. I just decremented the last character of the URL down by one each time until it worked.

LegacyUser

A van Helsdingen said: A week later, I am still able to see the Support case that the original poster linked to. I am concerned about the privacy of my own Support cases and the FS website in general. Is there a timeframe for when FS hopes to fix this serious privacy breach?

LegacyUser

Inge said: I have passed this on to the Technical Team for investigation. I am sure they will look into it and get back to us.

LegacyUser

A van Helsdingen said: I started a case with Support. It wasn't clear from their answer whether they thought I was complaining about the recent issues with this GetSatisfaction forum, or the privacy issue. So I made a comment that I hope will make very clear what I am talking about.

Unfortunately this is a typical response from FS Support. I respect and acknowledge that they are volunteers, but too often they make mistakes like this.

https://www.familysearch.org/help/myc...

LegacyUser

Inge said: They are definitely aware of what it is about. Guess right now we need to have patience given the difficulties being faced all over

LegacyUser

Tamra Stansfield said: We are aware and working on a resolution. Thank you for bringing the issue to our attention.

LegacyUser

A van Helsdingen said: Thank you for the update. However such a serious and obvious privacy issue should be fixed faster.

LegacyUser

Tamra Stansfield said: The fix is not simple and therefore will take time.

LegacyUser

A van Helsdingen said: Thank you. I'd like to be informed when this fix is completed.
If this isn't resolved within a few weeks, with regret I'll have to contact the New Zealand Privacy Commissioner, and report this. This is in breach of Principle 5 of New Zealand privacy law, which relates to poor security of information. http://www.legislation.govt.nz/act/pu...

LegacyUser

A van Helsdingen said: I've just been told by FS Support that the vulnerability where you could view other people's support cases has been fixed. If you attempt to do this, you are now redirected to your "My Cases" page.