Every customer address in our order system has a field called delivery instructions. It was added in 2015 so that customers could tell drivers things like use the side gate or leave it with the neighbour, and it is free text, two hundred characters long.
In April an analyst building a report on failed deliveries searched that field for common words and sent me a list she thought I ought to see. About four thousand two hundred addresses mentioned a key safe and its code. Several hundred gave an alarm code, a gate code or the place a spare key was hidden. A smaller number said when the house would be empty. Most were customers receiving goods on behalf of elderly relatives, and the instructions had been typed in good faith so that a driver could get a delivery inside.
The field had never been classified as sensitive, because nobody had imagined it would need to be. Our data catalogue described it, accurately according to its name, as an operational instruction, so it had travelled wherever operational data goes. It was copied every night into the data warehouse, where around ninety people can query it. It was in the test environment, refreshed from production each quarter, which our development partner's staff can read. It was in the daily file we send to two subcontracted carriers, and it was printed on the paper run sheets drivers carry. Every one of those copies had been approved on the basis of what the field was meant to contain. None had asked what was actually in it.
We now classify a field by sampling what it holds, not by what it is called, and every free text field gets that review once a year. A code typed into delivery instructions is detected as it is entered, removed from the instruction and stored in a separate encrypted field, shown only on the driver's handset for that drop and deleted once the delivery is complete. The warehouse and test copies were cleansed, and now receive the instructions with any number masked. The carrier file carries what a carrier needs to deliver and nothing more. Customer services tell callers that a code can be given safely in its own box, and most customers now use it.
A free text field ends up holding whatever people needed to say. That is rarely what the person who named it had in mind.
– Serguey Shinder
Top comments (0)