"Surprise" letter from EAA's Young Eagles in mailbox today.
"Dear YE Volunteers, blablabla, we want to continue the positive legacy and let you know about some administrative changes... blablabla... best practices, blablabla.... Youth Protection Policy .. blablabla ... required to complete training and background check elements blablabla".
Scan of the letter attached here.
So, I guess YE is going down the tubes?
Here's my response I wrote to them:
Michelle, Brian,
(Michelle, we have communicated a number of times in regards of our chapter's YE rallies and other activities).
I have just received the letter about YE's training and background checks. I have completed the training course: I do understand necessity of such things to protect Chapters, EAA, etc. Working for a large company, we have to go thru similar things at our work.
What bugs me a lot is the background check process. The very fact that a non-profit volunteer based organization would require it's paying members to go thru such a thing is unusual, strange, and somewhat offending. The necessity to provide your SS# and other private information is very questionable, especially given my relationship with EAA as a paying member rather than an employee.
What has caused this sudden change in policy, given 25 years of the YE program? Was there a lawsuit? What happened?
I have done a quick research on the background checks' provider, American Checked, and, frankly, even all the other concerns aside, would not be comfortable providing them any of my personal information; not even speaking of SSN, especially in this day and age of ID theft, etc.
Their Privacy Policy is very basic and aside from "we don't talk to anyone and your information is well protected" is leaving a lot of questions open.
Doing a bit more research, I find it even more questionable.
The redirect page for the check is leading to some obscure domain (www04.8f7.com, registered via a domain proxy w/o ANY references to "American Checked", see http://www.whois.com/whois/8f7.com), makes it look like a prime phishing attempt: phishing being a hacking technique (mis)leading victims to submit their private information to a malicious party.
Their SSL Certificate (basically, a thingie that confirms that the website is legit) was issued to BackChecked, LLC in Phoenix, AZ: while on their main website (http://americanchecked.com/) they list themselves as "AmericanChecked, Inc" in Tulsa, OK.
Even assuming they are legitimate, and the domain is indeed theirs, such a configuration via obscure URLs and SSL certificates issued to entities other than named on the main website as they have raises questions about their IT folks' professionalism (to me as a Security Software Architect, frankly, this looks like something done by unprofessional and or careless people). Basically, "if those guys can't set up their web stuff properly, how would I trust them to safeguard my SSN"? To give an aviation analogy; I would never trust a mechanic that consistently forgets to torque and safety wire my prop bolts do my engine overhaul.
Even forgetting all this and assuming their setup was top-notch and I had no issues with them, what happens if they leak? (Even the best do; case in point: NSA). What if an EAA Member's reputation, business, social standing, etc, is damaged due to this background check process? Lack of any formal communication from EAA describing these possibilities and how they will be handled is not adding any confidence.
Bottom line is, in my humble opinion requirements for such background checks would've been reasonable if we were to work for a CIA, FBI, or other similar type agencies. This seems very troubling as a requirement to continue engaging in a weekend, hobby volunteer activity, which YE is for the most of us.
Personally, my participation as an official Young Eagles pilot and coordinator will probably end if the background checks requirements are indeed implemented. I am positive that a vast majority of YE pilots and volunteers would have similar opinions, possibly putting the whole YE program in jeopardy.
I hope this is not how it will end.
--
"Dear YE Volunteers, blablabla, we want to continue the positive legacy and let you know about some administrative changes... blablabla... best practices, blablabla.... Youth Protection Policy .. blablabla ... required to complete training and background check elements blablabla".
Scan of the letter attached here.
So, I guess YE is going down the tubes?
Here's my response I wrote to them:
Michelle, Brian,
(Michelle, we have communicated a number of times in regards of our chapter's YE rallies and other activities).
I have just received the letter about YE's training and background checks. I have completed the training course: I do understand necessity of such things to protect Chapters, EAA, etc. Working for a large company, we have to go thru similar things at our work.
What bugs me a lot is the background check process. The very fact that a non-profit volunteer based organization would require it's paying members to go thru such a thing is unusual, strange, and somewhat offending. The necessity to provide your SS# and other private information is very questionable, especially given my relationship with EAA as a paying member rather than an employee.
What has caused this sudden change in policy, given 25 years of the YE program? Was there a lawsuit? What happened?
I have done a quick research on the background checks' provider, American Checked, and, frankly, even all the other concerns aside, would not be comfortable providing them any of my personal information; not even speaking of SSN, especially in this day and age of ID theft, etc.
Their Privacy Policy is very basic and aside from "we don't talk to anyone and your information is well protected" is leaving a lot of questions open.
Doing a bit more research, I find it even more questionable.
The redirect page for the check is leading to some obscure domain (www04.8f7.com, registered via a domain proxy w/o ANY references to "American Checked", see http://www.whois.com/whois/8f7.com), makes it look like a prime phishing attempt: phishing being a hacking technique (mis)leading victims to submit their private information to a malicious party.
Their SSL Certificate (basically, a thingie that confirms that the website is legit) was issued to BackChecked, LLC in Phoenix, AZ: while on their main website (http://americanchecked.com/) they list themselves as "AmericanChecked, Inc" in Tulsa, OK.
Even assuming they are legitimate, and the domain is indeed theirs, such a configuration via obscure URLs and SSL certificates issued to entities other than named on the main website as they have raises questions about their IT folks' professionalism (to me as a Security Software Architect, frankly, this looks like something done by unprofessional and or careless people). Basically, "if those guys can't set up their web stuff properly, how would I trust them to safeguard my SSN"? To give an aviation analogy; I would never trust a mechanic that consistently forgets to torque and safety wire my prop bolts do my engine overhaul.
Even forgetting all this and assuming their setup was top-notch and I had no issues with them, what happens if they leak? (Even the best do; case in point: NSA). What if an EAA Member's reputation, business, social standing, etc, is damaged due to this background check process? Lack of any formal communication from EAA describing these possibilities and how they will be handled is not adding any confidence.
Bottom line is, in my humble opinion requirements for such background checks would've been reasonable if we were to work for a CIA, FBI, or other similar type agencies. This seems very troubling as a requirement to continue engaging in a weekend, hobby volunteer activity, which YE is for the most of us.
Personally, my participation as an official Young Eagles pilot and coordinator will probably end if the background checks requirements are indeed implemented. I am positive that a vast majority of YE pilots and volunteers would have similar opinions, possibly putting the whole YE program in jeopardy.
I hope this is not how it will end.
--
