BARRY COLLINS
A holiday kids’ club proves there’s a hell of a long way to go with online safety education.
A holiday kids’ club proves there’s a hell of a long way to go with online safety education
I’m a sucker for true crime on Netflix: The Staircase, Making a Murderer and, most recently, The Disappearance of Madeleine
McCann. However, the latter obviously wasn’t on the watchlists of the staff or parents at the Cancún resort I’ve just visited. Unbelievably, the possibility of child abduction didn’t even seem to occur to them.
Madeleine, if anyone needs reminding, was seemingly abducted from her family’s holiday villa in Portugal in 2007. The documentary retraces the case in minute detail that I’m not going to dive into, save for the fact that the most credible working theory is that Madeleine was snatched from her apartment while her parents dined about 50m away. I can’t believe any parent has gone on holiday since and not had the case at the back of their minds, but clearly I’m wrong.
As with most family resorts, our hotel had a kids’ club where you could park the sprogs for an hour or two while stress-testing the pool bar’s all-inclusive policy. When we handed over our youngest on the first morning, we were asked for our mobile phone numbers so the kids’ club staff could contact us via WhatsApp if anything went wrong.
WhatsApp might seem a curious choice, but as the hotel was flooded with fast Wi-Fi and even answering a text message in a non-EU country such as Mexico costs the equivalent of a VW Golf, it was a sensible solution. What was far from sensible was the way the system was implemented.
Instead of individually contacting parents if Poppy grazed her knee, the
hotel slammed all the parents’ numbers into one WhatsApp group. That might just about have been okay if all they did was broadcast messages from the account, but it was much worse. Parents and staff were using the app for two-way communication, which the entire group could read.
So, there I am, sipping my Long Island Iced Tea by the pool, when startling messages start to appear:
“Hi, Isabelle room 3422 will not be coming this afternoon. Thank you,” wrote one parent.
“Rayla’s mum – can you approach Azulitos [the kids’ club] please? The session has finished,” wrote a staff member moments later.
“Bobby from room 4402 won’t be coming today, he’s unwell,” came another parent’s message.
It went on and on like this. Parents broadcasting the names of their children and their room numbers to a bunch of complete strangers, and the club staff doing likewise. And because none of the parents knew each other, you’ve got their names and mobile phone numbers appearing alongside each message in WhatsApp. If you tried to design a system that encouraged child abduction, you’d be hard pressed to do any better.
Immediately, you begin to think of the ways the data could be abused. If an abductor had told the staff that he/ she was collecting Rayla because her mum had gone to the sauna, would they have checked? Had an abductor rung a parent and told them of a family emergency they needed to deal with in reception, might they have temporarily left their kids on their own in the room? And how easy would it be to pretend you’re a doctor coming to treat little Bobby?
My first instinct was to talk to the staff and try and convince them why this system was a terrible idea. But most spoke with only broken English (still much better than my broken Spanish) and the conversation wouldn’t have got far. My second thought was to make sure we didn’t share any personal info via
the app, and ensure we collected our daughter on time, lest the kids’ club broadcast her name and room details.
I’ll be reporting the system to the travel operator so they can (hopefully) educate the resort staff about its dangers, but it rammed home to me how little thought people give to online safety, even when it concerns their children. I’m not suggesting for a second the staff or parents were acting out of malice, just naivety.
The hotel should know better, but so should the parents. The problem is, a bunch of 30-and-40-somethings have never had lessons in e-safety – it was the equivalent of space travel when we were at school. Some kind of state e-safety education is unrealistic, but while authorities mull over how to deal with the tech giants, perhaps one of the things they could enforce is mandatory, in-app training before you’re allowed to use apps such as WhatsApp. Eradicate the “I didn’t know” excuses for inappropriate data sharing, online harassment and so on.
We’ve been back almost a week and I can still read the messages from the group. I can’t help wondering who else is reading them.
But it was much worse. Parents and staff were using the app for two-way communication, which the entire group could read
A bunch of 30-and-40-somethings have never had lessons in e-safety – it was the equivalent of space travel when we were at school