Sunday, December 16, 2007

WGME News 13 web site compromised - staff is unprofessional

It all started when I decided I wanted to be a weather watcher. I went to the WGME web page and clicked on the Weather links. Since I did not find what I was looking for, I decided to use the "search" bar and typed in the words "Weather Watcher". The results of that search returned several options; the second option was a page called "Weather Editor". I clicked on that and to my surprise I was brought to a web page that controlled the content of their weather page. I was shocked.

Now just a quick note here, my background is in Information Technology, specifically, system security, and I also have some experience writing and publishing web pages.

I really couldn't believe my eyes. Just to be sure of what I was seeing I scrolled down to the UV Index section, and on the cool autumn day, changed it to "Severe". Low and behold, I reloaded the WGME weather page and there it was: Today's UV Index - SEVERE.

I really couldn't believe it and based on my background I thought about the catastrophic damage that someone could do to the WGME brand by taking control of this page. I mean, in Maine, weather is a big deal and I can only imagine how many hits this page must get in a day.
Because of my background I did what I would have wanted someone to do for me if I was in charge of their web site or IT department. I called them and explained to them what the problem was. I spoke to a man name "Jay" (I did not remember his name at this point) and at the time I could not remember specifically what the chain of events was that got me to that page. I did not remember using the search bar and thought I had clicked on a link to get there. This happens to me often because I operate at lightening speed.

In any case after I got off the phone with Jay, I realized that he did not take down my name or any contact information and I don't remember him even saying thank you. But I know what it's like to be in panic mode with your computer system so I dismissed it. I went back to the WGME web page and tried to retrace my steps because it was bothering me that I could not remember how I got to the Weather Editor. Then it hit me: the Search bar.

I immediately called the WGME telephone number back and another man answered the phone. I told him I had just talked to someone about their web page and had more information. He didn't cover the phone and I heard him say "Hey Jay, it's that guy about the web page". I then remembered Jay's name. I explained to Jay about the search bar being the culprit and he tried it exactly like I did and got the same results. I jokingly said something like "gee, don't you think I should get some sort of prize for finding this and telling you about it instead of hacking your web site". He said something like "Ha, yeah, probably, huh" and then said if I still wanted to find out about being a weather watcher, he would transfer me to the weather department, which he did. I realized again at that point that he STILL did not take down my name or contact information.

So, I did what anybody would do. I wrote an email to the general mailbox and since the individual mailboxes of the general manager, IT manager, News Director, etc. are not published I took a guess (being in IT) at the general manager's email address and happen to get it right. My email explained the whole situation, similar to this posting and at the end I said in a kidding manner "So do I get a mug, or a job interview" (since I am seeking employment). Since nobody asked yet, I provided my name, address, phone number and email contact information at the end of the email.

To my surprise I received the following from Terry Cole, the general manager of WGME and this is verbatim:

"Ron You can get a mug and a ball cap if you want. Call me Thursday or Friday and I will arrange.228-7700 thanks'
Terry Cole

I could not have been more insulted. I went out of my way, from one professional to another and saved them from what could have been something quite embarrassing. I remembered that one of the first things I said to "Jay" was that I had made a change tot he UV index number so that they could fix that change immediately. So Terry Cole sends me and email asking me to call him if I want a mug or cap.

I sent him an email back explaining that he obviously misunderstood the intent of my email and what I was looking for was a professional thank you. I explained that it was not my life's work to get a WGME Coffee Mug and that the professional thing to do would have been to contact ME to thank me, not ask me to contact HIM to arrange for a coffee mug delivery. Especially since he already had my contact information.

In conclusion, I believe that WGME had no bad intentions, but sometimes our actions, which are extentions of our intentions, can be misinterpreted. From a professional standpoint, I can understand that the I.T. department may have been overwhelmed with the discovery of a large hole in their security. However, I also believe that the circumstances called for a professional response to me as a fellow I.T. person, and as a regular viewer who went above and beyond the call of duty to do a favor for a company to whom I owe nothing.

No comments: