The scary silence that followed Convio's security breach

It seems like Convio has done their part by getting the information out to clients regarding the security breach. What seems extremely troubling to me is that not all of the organizations seem to have contacted their donors/constituents to notify them of the risk they may face.

Granted - no credit card details were compromised. But, am I the only dummy out here who uses the same password for multiple online sites. If a hacker got my password from a GetActive client that I supported... I would be a prime target for identify theft if that same hacker tried to access my Yahoo! or PayPal account.

That is the next (and scariest) phase of this story.

Convio can only lead their clients by providing draft emails... they can't make the clients actually send the email to their constituents. Should they be more proactive and contact the affected people themselves? Is Convio legally allowed to contact these constituents?

All too often I've seen nonprofits try to sweep bad news under the rug and hope that it goes away. This is not one of those cases.

If you lost a set of keys and those keys have your address printed on the keychain, don't you have an obligation to notify the people who you share that house, apartment, or office with? What would you do if that happened to you? Do you keep your mouth closed and hope no one breaks in? And if they do, would you continue to pretend the thief didn't get the key from you?

Act for Change tells donors about Convio breach

Working Assets members who participate in their Act for Change program received this email on Saturday explaining Convio's security breach.

We regret to inform you that the company we contract with to provide online services, Convio, has identified a breach of one of their internet security systems. There was no breach of personally-identifiable information or credit card data, but your email address and password for managing your Act For Change and Working For Change subscriptions were obtained by an unauthorized third party.

There is potential for misuse of this information should you use the same email address and password on other personal accounts (e.g, banking, PayPal, Amazon, etc.) Convio would like to advise you of important steps that you can and should take to prevent misuse of your personal information:

It goes on to explain some steps donors should take to protect themselves.

Convio confirms security attack email

I received confirmation from Convio this afternoon that the text below was emailed to 92 GetActive clients who experienced the most severe impact of a recent security attack.

**********************************************
Convio has identified a security attack against our GetActive software systems that has resulted in your constituent data being accessed by an unauthorized third-party. We take this attack very seriously and are committed to working with you to minimize the impact on your organization and your constituents. The third-party sought to download email addresses and, in some instances, member passwords. There was no loss of credit card data. We are confident that this is the extent of the breach:

* Only certain clients on the GetActive software platform were affected. No clients using the Convio software platform were affected.

* Unauthorized downloads of email addresses and member passwords were conducted against 92 GetActive clients, including your organization. Preparations for similar downloads were made against an additional 62 GetActive clients, but were not executed and did not result in data loss.

* The breach occurred between October 23 and November 1, 2007.

* We discovered the breach late in the day on November 1, and worked through the night and all day on Friday to make sure we understood fully the severity and how to help you through the situation.

The attack was carried out by an outside party who temporarily gained limited access to our systems. As soon as this attack was discovered, we took immediate steps to correct the situation. We are confident that these steps have restored the security of our systems. We are also cooperating with federal authorities to investigate the illegal access and data theft.

We are notifying you and all other affected clients, as well as those that were not affected so that they understand the situation. We are working over the weekend to provide further information and support and will update you on Monday with the latest information.

What you should do next
We recommend that you notify those constituents with user-created passwords that may have been disclosed. Some of these individuals may use the same email address and the same password with multiple online service providers. Notifying these members will help protect them against compromise of their other online accounts. At the bottom of this message you will find a sample email we have prepared.

Members with user-created passwords are a subset of your full email list. To help your organization communicate with these individual, we have provided a query within your dashboard that can be used to identify this segment of your list. Additional instructions for your GetActive platform administrator are provided below. Please feel free to contact your account manager, who is aware of this situation and will be available to provide support and further updates.

We will provide further guidance about whether we recommend additional notification regarding disclosures that involved only email addresses and any additional updates on Monday. At that time, we will also provide you with a dedicated 800 number and Web page to provide ongoing updates.

Regards,

Gene Austin
CEO, Convio, Inc.
*************************************************

Dodd team uses email chain

Fresh off his embarrassing fundraising scheme to raffle off a Boston Red Sox ticket to the World Series, Senator Dodd is at it with another unique fundraising strategy:

Connecticut Sen. Chris Dodd, lagging far behind the leading Democratic challengers in the fundraising race, tried a chatty strategy on Thursday in an e-mail with the subject line: "Fw: Re: Update?"

The e-mail purports to pass along an e-mail chain that includes messages between two staff members, Tim Tagaris and campaign manager Sheryl Cohen.

First, Cohen asks Tagaris for an update on online fundraising that has been requested by Dodd. Then, Tagaris sends a glowing report to Cohen. Next, Dodd, forwards their e-mail to his "friends," explaining: "I asked my campaign manager for an update on what we accomplished online during the month of October, and I was so pleased with her response that I wanted to make sure you saw the e-mail chain."

Thanks to Nancy Benac for the tip.

Perez slams Mario Lopez

From Perez Hilton:

Mario Lopez was scheduled to attend a benefit for victims of domestic violence and their children in his hometown of Chula Vista (San Diego) on Saturday, October 27th.

He was a no-show, PerezHilton.com has learned. And, what’s worse, he gave an awful excuse has a cover-up!

The Saved By The Bell and Dancing With the Stars blamed the local fires and displaced relatives – victims of the fires – as reason for his absence.

However, this week, video surfaced of Lopez dancing the night away at the Playboy Mansion’s Halloween party - the same night he was supposed to be at the benefit.

The 9th annual benefit raises money for children of Casas Seguras, a shelter for domestic violence victims. Lopez had shown much concern about helping children in his hometown.

Apparently he cared more about having a good time at the Playboy Mansion.

So many people were disappointed. He’d been advertised on their promotional materials and everything, which he had signed off on and was aware of.

And to use the fire as his excuse !!! Not very bright considering the press about Hef’s Halloween party is everywhere!

Do you know who your friends are?

Lucy Bernholz at Philanthropy 2173 questions Newsweek's recent assertion that Facebook is on the cutting edge of changing philanthropy.

To prove her point, she points to some great research over at Care2's frogloop. Unfortunately, the frogloop piece is almost nine months old. Some things have changed since then.

While I agree it is a big challenge for nonprofits to identify themselves as THE OFFICIAL Facebook site, I think most marketers are excited with Facebook because it kicks MySpace butt when it comes to researching who your cause supporters are.

That simple advantage will make it much easier for nonprofits to turn supporters of the cause into a valuable prospect list.

I once had a charity web manager tell me his group had 4,000 friends on MySpace.. which sounded pretty cool at first, but when he admitted he has no way to figure out WHO those people were or how to contact them directly.

Funky fundraising failures

From Fundraising Success Magazine:

Jon Duschinsky is the director of Ressources non profit, a fundraising consultancy based in Boulogne-Billancourt, France. At the 27th International Fundraising Congress, which took place in the Netherlands last week, he presented a session titled Funky Fundraising Failures, in which fundraisers from around the world talked about their professional non-successes.

To read the entire article, go here.

Merkle loses its domain

Michael Mathias, Senior Vice President & Group Leader, at MerkleDomain sent out an email earlier today saying:

Now that we have completed a very successful and smooth transition between Merkle and the former Domain agency, MerkleDomain will now officially be known simply as Merkle.

No word yet on whether Jeff Brooks will follow suit and ask readers of Donor Power Blog to simply call him Jeff from now on.

$714 million raised by road runners and walkers

Marking a trend of continued growth, road runners and walkers raised $714 million for charity in 2006, USA Track & Field (USATF) announced Monday. The figure marks a nearly 9 percent increase over 2005 and shows continued, steady increases since USATF began its annual charity survey in 2002.

USATF highlights a Charitable Race of the Year. Here are the winners for the past several years: 2006, Nike Women's Marathon; 2005, J.P. Morgan Chase Corporate Challenge Series; 2004, Rock & Roll Marathon; 2003, Marine Corps Marathon; 2002, Boston Marathon

The USATF also awards a Charitable Organization of the Year. The past winners include: 2006, Cystic Fibrosis Foundation; 2005, Arthritis Foundation; 2004, American Heart Association Heart Walk; 2003, Susan G. Komen Breast Cancer Foundation Race for the Cure; 2002, Leukemia & Lymphoma Society Team in Training

Finally, if you're interested in the previous annual totals since the USATF began tracking totals: 2006, $714 million; 2005, $656 million; 2004, $575 million; 2003, $560 million; 2002, $520 million.

Fires impact San Diego fundraisers

The 14th annual San Diego Triathlon Challenge, which was scheduled for yesterday, was canceled because of the wild fires.

The event is the primary fundraiser for the local Challenged Athletes Foundation, which provides wheelchairs, prosthetics, coaching and travel expenses to the physically challenged. The half-Ironman distance relay raised nearly $12 million the first 13 years, including more than $1 million last year.

Another major CAF fundraiser, the Qualcomm Million Dollar Challenge bike ride from San Francisco to San Diego, was cut short last Tuesday near Santa Barbara as the cyclists entered fire-ravaged Southern California.

Charity galas are great advertisement for shopping center

Outside of Tucson, Arizona is an upscale shopping center called La Encantada.

Throughout the year, La Encantada features events such as a simulated snowfall during the Christmas season, a culinary showcase in the summer and a performing-arts festival in November featuring such groups as the Tucson Boys' Chorus and the Tucson Guitar Society.

But marketing director Linda Shalit thinks she has found a way to entice people who would otherwise think the center is too high-end for their bank accounts.

Charity fundraising events.

La Encantada waives site rental fees for non-profit organizations looking to sponsor an event there and as a result, 11 charities used the space last year - raising over $500,000 for local nonprofits.

Sounds like a win-win to me.

Mistrial declared in Islamic charity trial

In 2001, the Bush administration designated the Holy Land Foundation for Relief and Development a terrorist sponsor. Once the largest Muslim charity in the country, the organization had its assets frozen and later seized by the government.

However, on Tuesday a mistrial was declared for the terrorist financing charges stemming from fundraising allegations. Emma Schwartz at the U.S. News and World Report questions the impact this mistrial will have against other Muslim charities:

What the mistrial means for the future of terrorist financing cases is still unclear. The government has a handful of pending investigations. It has frozen assets of a few Michigan-based Muslim charities. It has raided several Virginia-based Muslim charities. And in March, it indicted the Islamic American Relief Agency for sending money to Iraq during the 1990s, when the country was under sanctions.

Other Muslim charities and religious leaders called the verdict a relief.

Reading this story made me think of a related article I saw a couple weeks ago and forgot to mention on this blog. I've been surprised more fundraisers haven't blogged or talked about the quandary many Muslims found themselves in as they considered how to give zakat, a donation required of Muslims, especially during Ramadan.

Recent heightened scrutiny of Islamic charities by federal officials is running headlong into the determination of Muslims to donate to causes that serve the neediest and to abide by their holy book, the Quran. As fears intensify, community leaders have called on the government to create guidelines for safe contributions.

Go here for more on this subject.

Trent Stamp on Daily Show

It's been long awaited, but Trent Stamp's video from his Daily Show appearance is now up on Comedy Central's website:



Enjoy.

UC gets $420 million gift

The University of Cincinnati received a $420.7 million gift thanks to the hard work of two people who see the world very differently.

Sam Anand, mechanical engineering professor at UC's College of Engineering and Brigid O'Kane, an associate design professor in the College of Design, Art, Architecture and Planning, or DAAP, began applying for the donation about two years ago. They submitted a 90-page proposal that focused on the collaboration between the two colleges, which will be the prime benefactors of the donation.

The gift is the largest in the school's history.

The gift of in-kind contributions of cutting-edge computer software, hardware and technology support comes from PACE, or the Partners for the Advancement of Collaborative Engineering Education, a consortium of General Motors, Inc., EDS, Hewlett-Packard Co., Siemens PLM Software and Sun Microsystems, said Greg Hand, UC spokesman.

Chapman-Moore said demonstrating "the great collaboration" between the two colleges was critical to UC being chosen for the donation.

Virgina Tech processes 90,000 gifts since shooting

This blog has previously discussed the fundraising actions taken by Virginia Tech's development office after the campus shooting earlier this year.

I was a little surprised today to see the school has received more than 90,000 gifts of consolation from around the world. The response was so large, the school has its own archive room tagging, photographing, and logging all donations into a database.

The Associated Press reports:

Tech has received items from across the country and around the world, including letters from Argentina and the ambassador of Jamaica, a U.S. Coast Guard buoy with signatures of Tech graduates from Puerto Rico and a jacket with signatures of University of British Columbia engineers from Canada.

Though there have been many proposals for what to do with the -- including a possible museum to house the collection -- no decision has been made.

Charity earns $4 million on eBay today

The recent auction on eBay of an original letter by US Senator Harry Reid concerning Rush Limbaugh sold to the highest bidder for over 2 million dollars. Limbaugh has said that he will match the money that the auction raises. So, four million dollars will be going to the designated charity, The Marine Corps - Law Enforcement Foundation.

Giving book not getting attention

It sounds like sales of former president Bill Clinton's book "Giving," have dropped far since its release in early September. The handbook for civic activism was published by Alfred A. Knopf with an announced first printing of 750,000. According to Nielsen BookScan, "Giving" sold nearly 50,000 copies its first week, but hasn't approached that since. For the week ending Oct. 7, only 9,600 copies sold.

Man forced by judge to be PETA donor

Craig Miller is a 43-year old man from Minnesota. He is also one of the newest donors to PETA's membership database.

Miller pleaded guilty on Monday to three charges for illegally baiting and killing a black bear. As a result, a judge ordered him to donate $500 to PETA.

The charges stem from an incident on September 1st when Miller used dog food to bait a bear, then cut the bear's head off, took the fur and left the meat in the field. It seems like leaving the meat to rot is the criminal offense.

The hunter tried to make the kill legal and get a Colorado Department of Wildlife seal that would have allowed taxidermy work on the pelt, but the department investigated and found evidence of the crimes.

When Miller plead guilty, his lawyer probably told him to expect a sentence including probation, loss of hunting privileges and more than $5,000 in fines.

What Miller did not expect was for the judge to force him to make a $500 donation to People for the Ethical Treatment of Animals (PETA).

A couple blogs that cover hunting news have called the judgement "ludicrous."

“We’ve had restitution ordered to our organization in the past,” said PETA spokeswoman Daphna Nachminovitch. “I would not say it’s common. It’s a gesture on the part of the judge to say this bear mattered and that a donation should be made in his memory. Five-hundred dollars isn’t going to make up for the suffering this bear endured.”

The sentence was handed down by retired District Judge Chuck Buss, who was filling in for the vacationing Judge James Boyd.

Since the money is going into the general fund, I bet Miller will show up in PETA's next annual report... and if he thinks the court's mandatory donation is tough, just wait until the organization tries to track him down for that renewal gift.

AFP expands ethical code

This hit the wires yesterday:

The Association of Fundraising Professionals (AFP) has expanded its Code of Ethical Principles and Standards of Professional Practice, the only enforced ethical code for fundraisers in the world, to apply to for-profit businesses involved in fundraising.

The changes, which include the addition of seven new standards and the alteration of one standard, now allows for-profit businesses to join AFP as members and actively promote ethical and efficient fundraising.

AFP has traditionally been an individual-based membership association and represents more than 29,000 charitable fundraisers around the world. However, the tremendous growth of fundraising has led to the creation of numerous for- profit businesses working in the charitable sector, making it imperative for ethical standards to be promulgated beyond just those individuals who directly raise funds.

When I asked a couple friends last night what impact they felt this change would make... the first reaction I got was, "well... this should make it easier for AFP to grow their membership rolls for sure!"

You can go here to see seven of the new standards.

Baby Jessica's $1 million trust fund

Twenty years ago, an 18-month old girl named Jessica McClure captured the nation's attention when she was trapped in a well behind her parents Texas home.

Sympathetic viewers were glued to their televisions as "Baby Jessica" was rescued after a 2 1/2 days. Strangers showered the family with teddy bears, homemade gifts, cards and cash. The money was placed in a trust fund which Jessica is to receive when she turns 25.

An Associated Press article today reports that Jessica is leading a quiet existence today - however that might all change in 3 1/2 years when all the donations sent to her when she was a baby mature into a payment of $1 million or more.

I found an article from 1997 on the ten year anniversary of the rescue - and it looks like the trust fund was valued at $1 million even then - so isn't it possible the money has significantly appreciated since then?

The story made me wonder, "Why was a trust fund set up?"

Her parents, Chip and Cissy McClure, have been described as poor teen-agers in 1987 struggling to make ends meet during the depths of the oil bust.

The McClures were also criticized for quickly spending at least $80,000 of the money sent to them. Much of it went toward a failed business. They divorced in 1990.

So, I guess well wishing donors wanted to make sure the money actually got to Jessica, but setting up a trust fund that matures when she hits 25 seems to miss the point of donor intent.

Either way, if you sent money to Baby Jessica, rest assured knowing that in a little over 42 months from now, that money will reach its intended target.