ISD statement about mass emailing of students on 3 January 2018

Last Wednesday (3 January 2018) a large number of emails were sent to all UCL students and a number of other recipients. Normally in these instances the messages are blocked as restrictions are in place to stop the mass emailing of large email groups. However, on this occasion the message was transmitted. A large number of students responded with a reply-all email which then generated further emails and some students took the opportunity of unrestricted emailing of the list to send further messages to all the recipients. ISD apologises for the disruption this caused to students across the university. 

The original email was an enquiry from a student that was sent to the all-undergraduate and all-postgraduate email lists as well as some smaller lists and individual recipients. As soon as ISD was made aware of the issue we blocked access to the all-student lists. However, some email systems internally continued to transmit the message for a period after the block was put in place. Additionally, the smaller groups and individual email addresses in the email continued to receive emails for much of the day. With Information Security Group approval, ISD took the decision to remove these emails automatically by deleting any messages on the mail system with the appropriate message id.

Normally at UCL all large email distribution groups have access controls placed on them to restrict their use and block any reply-all responses. Due to a recent change to the system that controls email distribution groups these access controls were temporarily removed in error. ISD apologises for this mistake and the obvious disruption it caused.

We have now restricted access to the all students lists and we will be reviewing the change in process that allowed this to happen.

We do urge all UCL staff and students to avoid using reply-all responses to emails unless their response needs to be seen by all involved. In any instance of mass emailing please report the occurrence to the ISD Service Desk and not to the other recipients of the email except the original sender where appropriate.