Ofquack

[Alan H]

Latest post of the previous page:

I do indeed. Never post to forums when you're tired and have 15 tabs open.

[Alan H]

I wonder how long it'll take OfQuack to change either the data they supply or their privacy policy? I'll let you know!

[Alan H]

OfQuack have finally removed the seven duplicate entries in their register and managed to add eight new quacks! They are now on target to register 768 quacks by the end of the year, 8% of their stated goal! What a marvellous achievement that'll be.

[Alan H]

OfQuack say that their values include:

********************************************************************************
CNHC - Mission and Values
http://www.cnhc.org.uk/pages/index.cfm?page_id=84
~~~~~~~~~~~~~~~~~~~

Values

CNHC's key values are that:

* We are professional and strive for excellence
* We are impartial, fair and balanced.
* We are open and transparent in our business
* We behave ethically, with integrity and show respect
* We take pride in delivering quality and value for money
* We are accessible for all who meet, or seek to meet, our standards

[Retrieved: Thu Mar 12 2009 23:56:06 GMT+0000 (GMT Standard Time)]

###################

We know that OfQuack were set up with money from the Prince's Foundation for Integrated Health (FIH), but their tie-up continues. Their domain name is registered to:

Registrant:
George Gray

Registrant's address:
33-41, Dallington Street
London
EC1V 0BB

This address is the address of FIH and George Gray is their Acting Chief Executive. Impartial, fair, balanced, open and transparent, eh?

[Alan H]

This is the one where OfQuack abrogate their responsibilities by allowing an AltMed trade body to 'guarantee' the good character of their own paying members!

The Complementary Therapists Association (CThA)

The form the CThA uses looks as if it was made by OfQuack, so presumably OfQuack are happy with a third party 'guaranteeing' the character of the members they are regulating. The form asks the quack to agree:

6. I agree to the CThA providing an independent Good Character Reference on my behalf to the CNHC.

The CThA say they are: "a leading organisation representing over 9,000 Complementary Therapists in the UK and Ireland." So exactly how do they know the character of all their paying members?

But wait a minute...OfQuack say registrants must provide "an independent reference of their good character". (My emphasis.)

Allowing the CThA to provide that reference is 'independent' how exactly?

What happens when something goes wrong with one of the quacks (as it inevitably will)? Who is responsible if one of these quacks is not such a good egg as the CThA has guaranteed?

[Alan H]

OfQuack have finally fixed their registration number search. Up until recently, it caused a severe database error!

Nope! Spoke too soon. It is still got lots of bugs in it and can crash all too easily.

[Alan H]

This is the one where OfQuack abrogate their responsibilities by allowing an AltMed trade body to 'guarantee' the good character of their own paying members!

Another trade body they trust implicitly is the London and Country Society of Physiologists (LCSP) Register of Remedial Masseurs and Manipulative Therapists.

[Alan H]

OK, it's a Monday evening and nothing on the telly...

I came across this on the Complementary Therapists Association's website (previously mentioned). They have been having discussions about OfQuack on their forum:

Additionally, they continue to make meaningless PR statements. One was headlines in all the newspapers that we were going to be "legal". Not so. We are being regulated voluntarily. All these incorrect statements only serve to embarrass the more professional therapist and provide ammunition to the media which has already labelled CNHC 'offquack'. And that was by their own admission !!! When has the Department of Health stated it 'approved' or for that matter 'disapproved' of any regulator? If you have seen this written down somewhere - I should be much obliged if you could direct me to it.

But whatever, OK lets play the PR game. Department of Health 'approval' - what does this mean to the Practitioner? What do you think it means ? From where I sit, it means NOTHING! There is NO promise of NHS referrals from GP's. No assurance under National healthcare provision. No credibility from anyone or anywhere. Zip, naught, nothing for the practitioner. If you read all the information that is readily available. The medical profession will NOT refer to us because they say there is insufficient evidence that what we do is effective. Of course W know that not be true. WE see the evidence every day in our practices. However, THEY say they need evidence first. The likes of our "friend" Edward Ernst is the biggest instigator of pouring water on those coals. Going back to the House of Lords Report in 2000. It makes the point quite clearly. We will NOT be integrated. We will NOT get the referrals until we provide the evidence and it is recommended that this is where we put our efforts. There are many therapists who will say they are doing the research. What do THEY say> We haven't done it under random controlled trials - therefore they are worthless. I was at a Conference at the Royal Society of Medicine last year. That was exactlty the point they made. WE are not doing the research under controls which they approve. Therefore, it is disregarded.

So what does DoH approval mean in terms of voluntary regulation? NOTHING! No access to Government decision making. No special status. No role in any statutory regulatory process.

At that time, it will require MORE THAN 9000 practitioners to register within 12 months in order to cover its annual running costs of 370,000 in order to break even. Well - just ask any professional organisation what they think about the prospect of sourcing that many members in 12 months. Most haven't managed to do it in their entire existence and many have been in aroun d for a long time !! It's a complete nonsense. WE (some of those representatives who sat around the Federal Working Group table) tried and tried and tried again to get them to see sense that this was a ludicrous target but would they listen ? Of course not. Time will tell. The only way that would happen is if each professional association automatically assigned their entire database over to the regulator - and they ain'g going to do that because it would put them out of business. In any case, that would create data protection problems. So, each therapist would have to register themselves. Have you ever tried to organise 9 000 people to do something in that space of time ? It's a joke.

It's not looking too good for OfQuack [---][/---] they're getting attacked from all sides!

Someone else said:

Its no wonder we are all known as quacks, we cant seem to get along can we?

We arent quacks, but we do need to get our house in order.

Meanwhile all this in-squabbling between the GRCCT and the CNHC is going to make us look as if we don't know our ***es from our elbows. So what's the answer? Also by the way - do we REALLY want integration into the NHS? I would hate to think that I would be closely monitored in the Reflexology treatments I give to clients (would we have to call then "patients"?). How do you measure intuition? Would we have to have regular "supervision" and "team meetings"? Yuck! Well that's just my opinion.... Any comments?

A little knowledge is a dangerous thing.

Add to this the following statement that I found lurking in on one of the CNHC job specification links that did work…. The additions in brackets are mine.

‘The CNHC Register will go “live” on 19 January 2009. Over the next 15 months, CNHC needs to register 10,000 practitioners, from a range of disciplines including Massage Therapy (No surprises here – Chair of the Massage Council is Chair of CNHC– but most of the massage organisations are not recommending it)
Nutritional therapy (Has withdrawn from CNHC),
Alexander Technique (1000 practitioners and not yet ready to be regulated),
Bowen Technique (800 practitioners and not ready to be regulated until April 2009 -earliest),
Cranial Therapy (Less than 500 practitioners),
Naturopathy (800 practitioners and not ready to be regulated),
Shiatsu (1000 practitioners not ready to be regulated)
Yoga Therapy (Not even close to being ready – estimate another 2 years).’


I think we can deduce two things from the above statement:
Firstly - Nobody at CNHC has the most vague idea how long it will take to convince CAM practitioners that it is worth joining a regulator which is run by a bunch of Nurses and which none of the major therapies support
Secondly - Nobody at CNHC can use a calculator.

By my calculations (excluding massage) if every single member of every organisation in all their listed therapies joined (assuming they miraculously became ready) within 15 months they would have only 4000 registrants. That only leaves 6000 massage therapists to recruit… the Massage Council only managed 600 in three years!... To achieve 10,000 in 15 months CNHC need to recruit 157 individuals each and every week for 64 weeks from January 2009 all the way through to April 2010…..and don’t forget that is at a cost to each therapist of £80 - £125….. GET REAL GUYS!

I find it most frustrating that whenever Complementary Medicine does something with unity and professionalism some group of self-serving idiots, unfortunately usually from the orthodox medical profession, pops up to muddy the waters and again make us look incompetent.

Hilarious.

[Alan H]

I wonder how long it'll take OfQuack to change either the data they supply or their privacy policy? I'll let you know!

They are watching us!

They've just removed the address line from their data of registered quacks that the public can see. Their Privacy Policy (in case anyone needs reminded of it [---][/---] they obviously do) says:

The Published Register

CNHC will make part of your register entry available to any enquirer as part of the published register.

The public can inspect the following information on the online register:

* Your full name
* Your profession or practice discipline
* Your approximate work location
* Your registration number
* Any restrictions imposed on your registration

(My emphasis)

They give the full postcode, so I suppose that's their 'approximate work location' (although many will be mobile). But if this was supposed to allow the registered quacks to keep their home address private (and they may have their reasons for doing that), the full postcodes give you a pretty good idea where they live [---][/---] in most cases down to a few houses.

And there's still no registration numbers as promised!

However, they are STILL in breach of their own Privacy Policy because they STILL give their personal land line and mobile numbers of their quacks. Unbelievable!

Your home address, contact details, date of birth and other data are not available to the public.

Oh yes they are!

Did no one at OfQuack think through what details needed to be made public? Or did the person who write the Privacy Policy just forget to consult with anyone else in the organisation? Is there anyone competent there? Hello? Hello?

[Alan H]

They've managed to add a few new quacks to their register whilst making a mess of sorting out the mess they made with their privacy policy. They now have:

122 massage therapists
35 nutritional therapists

At this rate, they'll have 715 registered by the end of the year. What was their target again? Oh yes, it was 10,000...

[grammar king]

We had David Colquhoun speak to us at the university last night and he briefly outlined how he managed to get into OfQuack. He says someone sent him an email telling him that they were advertising for committee members, and he thought that, seeing as he's highly qualified, he'd apply and have a laugh blogging about how they came up with excuses not to hire him. The only problem was, they didn't turn him down! What a character, by the way.

[Alan H]

Does no one at OfQuack have a clue what they're doing?

Now we know they wrote a Privacy Policy that they have subsequently forgotten all about and failed to comply with [---][/---] and still fail to comply with (see the sorry tale of incompetence, above) [---][/---] I thought I'd do a bit more checking.


OfQuack's Data Protection Register entry

They have an entry in the Data Protection Register of Data Controllers. This can be found by going to DPR search page and entering OfQuack's Registration Number (given at the bottom of their Privacy Policy page): Z1361970.

Their entry in the register gives details of the data they hold, what they will use them for and where they gather them from. For the registration of quacks, they say:

Purpose 4

Licensing and Registration

Purpose Description:

The administration of licensing or maintenance of official registers.

Data subjects are:

Staff including volunteers, agents, temporary and casual workers
Complainants, correspondents and enquirers
Offenders and suspected offenders

APPLICANTS FOR A LICENCE OR REGISTRATION

Data classes are:

Personal Details
Financial Details
Goods or Services Provided
Offences (Including Alleged Offences)
Criminal Proceedings, Outcomes And Sentences.

Sources (S) and Disclosures (D)(1984 Act). Recipients (1998 Act):

PROSECUTING AUTHORITIES
COURTS

Data subjects themselves
Business associates and other professional advisers
Employees and agents of the data controller
Suppliers, providers of goods or services
Persons making an enquiry or complaint
Financial organisations and advisers
Local Government
Central Government

Transfers:

None outside the European Economic Area

All the usual stuff here, but it's the last section on transfers that is interesting. All other seven purposes have the same statement saying that they will not be transferring any data outside the EEA. (The EEA is the EU plus Iceland, Norway and Liechtenstein.)

Why? Because the EU have (believe it or not) tighter data protection standards then many other countries, including the USA, where data can be sold much more easily (see below). I understand it is allowed to transfer data on individuals in the UK to other EEA countries, but that data cannot be transferred to countries outside the EEA without the express permission of each individual. What frequently happens is that companies, if they want to store data outside the EEA, undertake to keep the data under the same protection standards.

So, if OfQuack wanted to store the data they have collected outside the EEA, they should be stating that in the DPR and should be telling their data subjects, shouldn't they?


Where are their data stored?

All this is a moot point, surely? OfQuack are a UK organisation and aren't even concerned with any other EEA country, never mind the USA or elsewhere?

Well...

Looking at their website and domain name and where it's hosted, a DNS lookup reveals the following for cnhc.org.uk:

DNS servers
ns1.force9.net [195.166.128.16]
ns2.force9.net [195.166.128.17]

...

cnhc.org.uk 1 A 212.159.9.91
cnhc.org.uk 1 A 208.112.52.60
cnhc.org.uk 1 A 212.159.8.91

So, their nameservers are owned by force9, which is owned by plusnet, which is owned by BT. Force9 are based in Sheffield, UK. The DNS A records give three hosts: 212.159.8.91, 208.112.52.60 and 212.159.9.91. Looking these up gives Sheffield, UK as the location for the first IP address, Newark, Delaware, USA for the second and Sheffield, UK for the third. Any of these servers could be access by anyone visiting OfQuack's site at http://www.cnhc.org.uk [---][/---] test this by refreshing this page repeatedy and see each of the three servers come up.

The USA server resolves to mitaresidential.com.

The website of Mita Residential says: "Mita Residential, the Preferred Rental Agency of Punta Mita Vacation Rentals" in Mexico. WTF??????

Surely some mistake here? But, no. The connection between OfQuack and Mita Residential can be verified by visiting the 208.112.52.60 IP address directly: this takes you to OfQuack's home page at http://208.112.52.60/pages/index.cfm and the location of this IP address 208.112.52.60, can be verified by looking it up as above.

What this means is that one of the hosts of OfQuack is a Mita Residential server!

What on earth is the connection between OfQuack and a Mexican holiday villa company? I thought it might be that the two websites were designed by the same company, but the Mita Residential one is designed by a Mexican company Kubic and OfQuack was designed by imaginit, based in Crawley, UK. It could be that Kubic and imaginit share some programmers (for website design, programmers can be spread worldwide!), but whatever the link, one of OfQuack's websites is in the USA. Why 'one of OfQuack's websites'? They will have their website duplicated so that, if one server goes down, their website should still be available from one of the other servers: good sensible planning (did I really just say that about OfQuack?). But the link is a mystery, but one they really should be explaining.


So what's this got to do with data protection?

Well, I think it is likely that their SQL database (that stores the data on all their registered quacks) will be duplicated and shared on each website server. I am open to correction (I run two websites and the SQL databases are stored on the same server as the website, but by no means an expert), but this seems likely. If this is the case, then they are transferring and storing personal data outside the EEA. If their website server in the USA does not actually store personal data, but only passes it on to a database server in the UK, then they might not be in breach of the Data Protection Act.

If they are storing personal data on their server in the USA, are they acting illegally by transferring personal data outside the EEA? Well, yes it can be done legally [---][/---] but only with certain safeguards and almost always requiring the permission of the data subjects. The Information Commissioner has issued a guidance sheet here:

The USA
In the USA there are laws that apply to specific industries which provide some protection for personal information, but there is no general data protection law. The Privacy Act 1974 establishes certain controls over how the executive branch agencies of the federal government gather, maintain, and disseminate personal information. The Privacy Act can also be used to obtain access to information, but it applies only to records the federal government keeps on US citizens and lawfully admitted resident aliens.

However, the European Commission considers the ‘Safe Harbor’ scheme to provide an adequate level of protection. When a US company signs up to the Safe Harbor arrangement, they agree to follow seven principles of information handling and that they can be held responsible for keeping to those principles by the Federal Trade Commission or other oversight schemes. You can find a list of the US companies signed up to the Safe Harbor arrangement on the US Department of Commerce website at http://www.export.gov/safeharbor/doc_sa ... _index.asp.

So, are OfQuack using a Safe Harbor company? Checking the list of Safe Harbor companies listed for Delaware (where the Mita Residential server is based) shows none of the five listed companies look like they have anything to do with Mita Residential:

AstraZeneca Pharmaceuticals LP
Fort Hill Company1
Mind Candy Inc
ModernThink, LLC
Recombo Inc.

Website access to quack's personal data and Data Protection

I hadn't realised this myself before I started investigating OfQuack, but this guidance also says:

Putting personal information on a website will often result in transfers to countries outside the UK. The transfers will take place when the website is accessed by someone outside the UK. If you load information onto a server based in the UK so that it can be accessed through a website you should consider the potential for a transfer to take place and whether that would be fair for the individuals involved given the potential effect on them. If it is your intention that the information will be accessed outside the EEA, then this is a transfer.

So, by making their quack register available on the Internet, they are transferring data outside the EEA [---][/---] unless they somehow block anyone outside the EEA from accessing it. However, using a proxy server based in the USA, I can still get the personal details from their search page, showing that they are not stopping someone outside the EEA from accessing the personal details of their registered quacks. But their Data Protection Register entry says they won't be transferring any data outside the EEA!

Conclusion

So, even if OfQuack have all the necessary safeguards in place that allows them to ensure that data transferred to the USA is protected as if it was within the EEA; even if they have told their quacks that they will be transferring data outside the EEA and got their individual permission to do so; even if they are using a Safe Harbour company to host their website in the USA, OfQuack have failed to properly inform the Information Commissioner and have lied on their register entry about where they are storing the personal; details of their quacks. They also have to explain the link with Mita Residential.

I'm sure this can all be easily fixed, but it's just another demonstration of OfQuack's continuing lack of integrity, total incompetence and downright stupidity.

[Maria Mac]

Anyone else wondering if Alan has a life?

[Alan C.]

Anyone else wondering if Alan has a life?

I think he should give up electrical engineering, and go into investigative journalism.

[Alan H]

Anyone else wondering if Alan has a life?

I think he should give up electrical engineering, and go into investigative journalism.

I've already given up the engineering...

[seantellis]

Life or not, he's certainly got a lot more tenacity and spare time than I have. Well done that man.

I just love the mental picture of OfQuack's data residing in a little old beige box 386 humming away in the corner of a Mexican trailer park somewhere. (Even if it's not a very accurate picture.)

[Alan H]

There's a bit more to the story...I had missed something out by forgetting OfQuack also use a second website...

Although OfQuack use the website http://www.cnhc.org.uk and access to their register of quacks can be done from that website, it looks like requests are passed through to another website http://www.cnhcregister.org.uk and searches can also be carried out from this latter website. This domain name isn't owned by OfQuack or even Charles Windsor's FIH. It's registered to OfQuack's website developers, imaginit. (Of course they'll have a suitable agreement in place, won't they?)

So where is this website based?

Well...cnhcregister.org.uk is hosted by a completely different web host to their main website. The DNS records give only one server: 76.12.83.212. This is a server run by HostMySite, based, you guessed it, in Newark, Delaware, USA. The details of this server can be found here. The owner details are:

OrgName: HostMySite
OrgID: LNH
Address: 650 Pencader Drive
City: Newark
StateProv: DE
PostalCode: 19702
Country: US

For some reason, they only have one A record in the DNS, so there are no backup websites, just this one. I suspect that's because that is where the only copy of their database is stored. With the multiple servers I talked about above, although it's a good idea to have multiple servers, I suspect it's more bother than it's worth because of the extra work required to keep them all synchronised.

So, if I am right and this is the server where they do hold the database of their quacks, it is still in the USA. So, if you followed my last post about this, you'll now expect that this host is a member of the Safe Harbor scheme to ensure the integrity of the personal details of all those quacks being shipped outside the European Economic Area, won't you. Unfortunately, HostMySite don't appear on the US Government's Department of Commerce Safe Harbor list for Delaware (neither do LNH or LNHI), so they are not considered a safe place to store personal details of UK citizens.

We've been here before, haven't we? Even if they don't have their database on this USA server, they are definitely passing all search requests (via a simple HTML form and some javascript) through it and name and address details are passed back to the website visitor through it. So, under the guidance of the Information Commissioner, it is considered to be transferred outside the European Economic Area, so they still appear to be in breach of the Data Protection Act.

I wonder how they'll weasel out of this one? As I see it, they can either of the following:

1. move their data to a server within the EEA [---][/---] and of course tell all their quacks that they have allowed their personal data to slip out of their control and correct their erroneous entry in the DPR and explain their inability to control data to the Information Commissioner

2. move their data to a Safe Harbor server in the USA [---][/---] and of course tell all their quacks that they have allowed their personal data to slip out of their control and correct their erroneous entry in the DPR and explain their inability to control data to the Information Commissioner
just as much as they care about whether any of the quack therapies actually work.

I wonder which they'll choose? Watch this space.

[Alan H]

Yet more incisive blogging from the Black Duck!

Will the Government Bail Out Ofquack?

[Alan H]

Latest OfQuack totals:

Massage therapy: 137
Nutritional therapy: 35
Total: 172

They are now on target for 685 by the end of their year, just 7% of the number they are aiming for.

[seantellis]

Once again, excellent detective work, Alan. Are you passing this on to the Data Protection people?

Also, TAM London just posted their list of speakers, including Simon Singh and Ben Goldacre. http://tamlondon.org/

[Alan H]

Once again, excellent detective work, Alan. Are you passing this on to the Data Protection people?

Of course! I had started an email, but I accidentally forgot to save it before I rebooted my PC...I'll try to get it re-written and off tomorrow.