Mash Me A Spammer

Match Me A Job directors Ifran and Tahir

One thing my friends and family know for certain is that when they have issues with spam, data breaches or dodgy looking emails, they can always come to me for advice.

In some ways it's like being that member of the family who can "fix laptops" - something I've worked hard to disassociate myself from over the years. However when I get spam myself I'm often a little puzzled, having taken numerous steps to avoid subscribing, being implicitly opt-ed in to or otherwise engaging with spammers.

This particular case involves my use of Jobsite.co.uk - an online jobs board who seem to have struggled in the past with data protection (in comparison to platforms like Monster). I added my details as a contractor looking for work and regularly poke through the jobs listings for suitable contracts.

What I can reasonably expect from this is - and according the general terms and conditions of such boards - that recruiters advertising live roles might grab my details and notify me of roles they have. They might store my details so that if that role doesn't suit a future role they might have will. That's all above board as far as I'm concerned.

This is important - these roles are live roles offered by the agencies on behalf of organisations. The distinction is that a jobs board provides the interface between candidate and agency (or directly from hiring organisations).

The standard (happy path) use of jobs boards looks like something like this:

Normal jobs board process - Click to enlarge

The Washing Machine

Match Me A Job however - and apparently the directors' other companies - do not fit into this paradigm. They scrape candidates details from Jobsite.co.uk and then absorb them into their "client" database. This may possibly include the entire set of organisations related to the MMAJ directors. MMAJ are not yet approaching the same league as other idiots such as My Job Matcher - but they appear to be trying to make a quick buck in similar ways.

Interesting business model: Instead of marketing, getting exposure of your brand and working at improving the corporate identity through direct engagement... they're essentially scraping Jobsite's candidate database and using it to create a new jobs board / platform as a competitor. Easier to get private equity partners to buy your company with a much bigger candidate database...

Jobsite seemingly take little interest when companies like MMAJ and MJM steal their candidate DB are reported to them. Normally they tell me that "they have no control over what the recruiters might do with your data", apparently unconcerned about someone creating a competitor to them from their own data. Monster, however, take a much dimmer view and have sanctioned people in the past for the same. As do ICO.

Back to MMAJ.

They then use other jobs platforms - like jobg8.com - to mesh the candidate keywords with the jobs on those platforms. Any results are then sent to the candidate. Note: These are not live roles offered by MMAJ or jobg8.com - they are offered by other recruitment agencies, and I'm not convinced that some of the agencies know their job ads are on jobg8.com a lot of the time. MMAJ don't actually have live roles nor are they allowed to do this given the specific consent provided when I subscribed to Jobsite.co.uk.

The diagram below shows how the flow of actual consent (c.f. data protection and marketing consent from a data subject - from people like us) in this situation:

The reality - everything outside of the primary Jobsite.co.uk platform in this case is unlawful

These emails are sent from fictitious MMAJ recruiters who's names are manufactured from a list. None of the replies I ever sent back to them ever received a response and none of the filed accounts for the company reflect employing so many people (even on a contract basis).

In fact, when I sent various requests and notices to them via email I selected around 10 recipients plus their info@ and Irfan's email address - All but the info@ and Irfan's address returned "Recipient unknown" messages.

One might have expected that these unsolicited messages would actually be useful had all the roles actually been live - in fact all of them were expired by the time the links were sent. An example below shows a totally unrelated job role (I'm a Solutions / Enterprise / Business / Data Architect working mostly in the financial industry), from an agency who I've actually worked with in the past.

Url shows Jobg8.com and the mailshot shows MMAJ's logo. Link clicked within 10 minutes of receiving the email.

Example "job" link from MMAJ gets you something like this - Click to enlarge

If it's a bug, no-one could have reported it as all the MMAJ 'staff' email addresses return "recipient unknown". I suspect no-one reported it and no-one wanted it.

By this time though, your name, address, DoB, entire employment history and possibly other details (depending what you decide to share on your resume) are now in the hands of a string of organisations monetising said data. In fact if were being more cynical I might suggest that this is one of many data laundry enterprises, churning out data to be monetised.

When I was caught in this particular machine cycle I received over 100 emails in the space of a few weeks, all for roles that were almost completely unrelated and all unavailable.

After being the recipient of attempts to breach systems and data stores over the years I'm more inquisitive about emails from strangers that seem to know a lot about me.

Data Protection

MMAJ essentially refused to answer my SAR - the only time they actually attempted to fulfil it was after I lodged a case in the small claims court. That lack of response was a breach of the requirements of a DPA section 7 request / notice. 

PECR paragraph 22 requires that an entity acquiring personal data for the purposes of direct email marketing must first acquire the explicit consent of the subject; prior to the sending of any unsolicited marketing messages (which a job alert is). Because I subscribed to a specific jobs board with the expectation to receive messages from recruiters about their own live vacancies, no consent was in place for MMAJ.

Even the DPA requires explicit consent to acquire, store and process personal data (many sections in the Act to refer to) and MMAJ failed to acquire this consent for the purposes they actually enacted.

The regulator, ICO, also enforces non-compliance with registration as a data controller - two of the companies operated by the MMAJ directors are registered (ZA110541, ZA110536) but not MMAJ itself. One of my companies is a registered DC because of the personal data that is sometimes acquired during the course of investigation - I know from experience that regular information and update mail shots are available directly from ICO, and you have an option to sign up when you first register as a controller.

A company who routinely scrapes, stores and shares personal data should certainly be registered. MMAJ's directors operate companies which had been registered for some time.

Any which way you want to spin that, the directors are responsible and aware of their obligations.

MMAJ's Position

Only in their filed defence did MMAJ reveal their process and essentially answer the SAR I sent:

• They admitted scraping the personal data from jobsite.co.uk - although they claim it was for the purpose of "recruitment", not offering live job roles themselves; and despite effectively entering me into a subscription process which I had no say in until some time after the fact
• They claimed I did not avail myself of the unsubscribe link; however they didn't have consent as per PECR in the first place to send the emails with the links in them, nor is it best practise to click links in emails you've received from persons unknown
• They claimed I'm not a genuine job seeker - which was amusing. In fact they claimed I'm a sadistic opportunist. As a contractor of nearly 20 years experience I suppose some would consider me mercenary; I'm quite an aggressive racer when I compete in a kart too, but MMAJ clearly wanted to avoid the actual issues and enter into a mud slinging competition
• They ignored my emailed SARs and NBA for months but replied when the paperwork was served; yet claimed to be essentially pro-active in their response

There's always a case for reasonable exception - that's the whole point of a legitimate jobs board. What we should not have to stand for is being subscribed to services (and spammed as a result) which we do not want, nor were consulted about.

The entire defence seemed to be based around the total lack of accountability for which a company handling personal data should have. The law apparently doesn't apply to them - they're special.

B2C-style recruiters are the more typical business models, but the most concerning development of late is B2B recruiters. They're outsourced agency staff who may not even work inside the EU (therefore breaking the stringent data protection laws of the EU and UK). Agencies out source their searches to other agencies, who presumably take a small percentage for candidates that eventually get a contract or role.

Corporate Entities

From the companies related to the two directors of MMAJ, Irfan Lohiya and Tahir Islam, seem to exchange recommendations for each other and share infrastructure. Not unusual and a good cost mitigation option.

Tahir's LinkedIn profile lists him as a case handler for Lloyds Bank, although he may just be a silent / investment partner. All correspondence relating to the litigation was signed by Irfan who seems thick with links to recruitment - working for agencies as per his LinkedIn profile whilst running his own. Nothing really wrong with that though.

Astoria Green Executive Search, Jobm8 (not jobg8.com),Total Jobs, Green Recruitment Solutions, Top Resourcing, Proficient Outsourcing Ltd and MMAJ are the companies one or both directors own / operate - only Jobm8 and MMAJ are nominally shared.

That's a lot of very small companies - question marks for me arise relating to; if MMAJ has my data, who else does? With idiots like MMAJ you shouldn't rule anything out.

Summary

In the end I had an issue with the postal deliveries, meaning I missed a lot of paperwork relating to the case. I couldn't therefore press the claim home and the last I'd heard MMAJ refused to engage in mediation pre-trial. It's a shame because I'd created a retrospective data consent agreement and wanted to see it enforced at district level. Of course, there's no guarantee but I could easily disprove each statement of the defence - some of which by using their own evidence.

The amount of time you have to spend on these things is immense - unless you're a lawyer being paid to write and argue the case there's virtually no financial benefit to it. What I do for a living is investigate (in other fields) - and that's where the commonality is for me, and that the regulator is often swamped with other cases from local government.

But also because there are so few - if any - people actually raising awareness of the growing problem in data protection.

It took direct legal action to force MMAJ just to answer my SAR, and even then it was without any acceptance that they'd actually broken the law. If someone hold their hands up and says, "Ok - yeah. We were wrong - really sorry and it won't happen again" it's generally a reasonable situation which needs no further prodding.

In May 2018 the British equivalent of GDPR comes into force so the additional weighting in favour of explicit / DS enacted consent; the types of activity MMAJ admitted to (or were observed enacting in cases where they denied it) would net them massive fines and potentially criminal convictions. Had I engaged ICO over the matter they could have invoked their powers within the law to review criminal prosecution against MMAJ (if they'd had the time amongst their already mountainous case loads).

I've worked with a lot of recruiters over the last 20 years and there are some real diamonds out there. Recalling past conversations with recruiters I've known for years as well as new firms who made a silly mistake with their data handling - all it takes is a five minute phone call to resolve. However there's also some real used car salesmen holding the reputation of the industry back.

There's so many of them though.

Commodity Update

It seems that it's a two-way street - After writing a post this week about tips for handling tricky recruiters, a large section of the recruitment industry itself has outed one particular individual.

http://www.irg-uk.com/viral-email-blows-whistle-on-bad-rec2rec-recruiter/

Preservation, Physics and Psychology

I've had some time to think and reflect since the frenetic pace of my last permanent role and I thought I'd share some of the lessons learnt over the years. These thoughts relate to hiring and expectation management - Numerous other hiring managers adopted the process I developed due to it's success in finding the right people; I've even been recommended because of it. I spent a lot of the beginnings of my career working at consultancies so I got to see a lot of different IT & development departments.

I took those experiences into the latter half of my career and built on them in ISV's and online gambling & gaming firms. After I left my last employer a number of people there approached me about grumbles and for career advice so maybe if you're thinking about getting on your bike, some of these observations from the last 15 years may help you make sure that bike's in good working order before you need it...

So What's Physics Got To Do With It?

Relax, I'm not about to yell "In the NAME of SCIENCE!!", wave a sword in the air and the lead nerd equivalent of the charge of the light brigade. In simple terms, inertia is simply defined as "a body's resistance any change in motion". So if a body is already moving, that body won't change direction unless something forces it to. For example, if there was no gravity or air-resistance on a tennis ball, Nadal's returns would never bounce in but just continuing to  travel on at their fantastic speed.

That's some pretty boring tennis.

In terms of the people that you have working for you right now, at what point does their reluctance to change career direction become inferior to the options, choices or influence to move to the next stage? They will be the forces that eventually inspire them to change course and jobs, their inertia overcome.

For example, we've probably all worked for companies at one point or another that fail to deliver on promises and end up only inspiring dissent. I'm sure we've all see the kind of offices I'm talking about - The last drops of enthusiasm drain away at around 10am on Monday mornings, where senior management just weren't interesting in keeping you happy, would often take credit for yours & your teams achievements as their ideas - often right in front of you. The kind of places where it's very difficult to conceal what's happening from your team. Your superiors are making your job even more difficult then criticising you for not hitting those moving targets. But hey - that's the same in any company to a greater or lesser extent so we just learn to deal with it better!

A simple exercise in shared ownership and expectation setting for team members can mean that what the seniors do above you is irrelevant to your team members. It can also ensure that senior management get the ammunition to laud amongst their peers and their seniors whilst your people further build a sense of achievement and self-worth.

So let's look at inertia, and that seeming reluctance to take that next step. The deciding factor there is levels of personal happiness.

Happiness Is Not An Illusion

Even your own happiness shouldn't be measured by short-term pressures such as "how do I keep my boss from getting angry?" or "how do I make sure I don't get fired?". Both those questions conceal underlying issues about your relationship with your line manager that you need to review. Maybe you need to think about how to set expectations more realistically, or maybe that boss refuses to have his or her expectations set any differently and you need to define delivery plans differently.

No-one is going to fix it for you - you've got to take charge and do it yourself. Your boss will be impressed if you resolve a problem via initiative anyway and relying on other people for your own happiness is a bad idea.

For example, I could define my own happiness at work measured against certain criteria. So if those criteria included whether I can be in a position where I'm learning something new (or how to do something I already knew better) and I'm able to contribute to the organisations mission statement, that satisfies my own happiness criteria. There's nothing complicated there and it's pretty easy to keep that learning mode switched on.

I've been fortunate enough to work for two great organisations in the last six years who have enabled a massive personal leap forward in both technical and business acumen. My reasons for leaving both organisations were to springboard into a specific career channel on my own for the next ten years, and I'm incredibly grateful to both companies for the immense wealth of experience gained. 

For my personal happiness the problem at my most recent employer was that it's a thankless, hard-working environment where politics are constantly at play - There's someone trying to pull the rug from under your feet all the time, listing all of your smallest shortcomings alongside none of your major achievements to the heads of department and above. Most of the senior management originated at the same group of companies and there's little longtitudinal career travel. However, the amount I learned and the various performance and security concepts I got exposure to combined with the great technical people I was fortunate to work with outweighed all those negatives instantly. Overall I'd actually describe the entire experience as extremely positive and constructive but then I'm known for having a very optimistic approach!

On one project we worked from October through to January missing out Christmas and New Year entirely. We got the project live with 30 seconds to spare (failure would have meant the company ceasing trading in certain countries) and I finally celebrated xmas / new year with friends in February. I really enjoyed the vibrancy and energy across the teams but the level of effort isn't sustainable for any length of time. Some of the developers involved were getting serious grief from wives and partners as a result, others just reaching the end of their tether entirely. Around five percent of the department handed their notices in over the following eight months.

Of course, whilst I could have stayed at my present employer for many years there was nothing there to provide any kind of objectives or markers of success. Crucially, the exposure to new things or improving things stopped over the course of a quarter. I'd already learnt how to do push-ups in space and I'd be stuck in the same career situation for the foreseeable future; fantastic experience but no longevity. It's a shame because the business itself is a global success.

If you've ever read Soul of a New Machine by Tracy Kidder you'll get an idea of what the environment could be like in places. Sometimes the development department delivered requests even the CTO thought impossible to implement, other times we'd fix live security issues that few people seem to have ever heard of. All sorts of people wanted to consult with us ranging from a very large software company from Seattle to security departments in national government. The company has it's own patents, creates relationships with specific ISV's in order to get feature requests and help develop those products. Almost all the companies in the same market sector viewed this organisation as the target to aim for and we were used to building software that would come under attack every minute of every day.

So the inertia here - the reluctance to move on - was big but the force enacting a change in career direction was much bigger. It took quite a lot to make me think about moving on despite an extremely tough working environment with a very high turnover of staff but after going through two or three relationships and having all your friends make some very unsubtle comments your perspective is adjusted. Forest. Trees.

It's a personal thing and defining your own happiness is very much up to you. 

Moving on from recent examples, some places do have an entrenched management structure that all used to work together at whichever organisation(s) they all came from - usually only creating glass ceilings for everyone else, or bring in people who won't question them. It's very difficult to make your way through that structure although it is possible with the right strategy. There's an element of that in most organisations to a greater or lesser extend though, more so in family-run businesses.

A good friend of mine whom I've known for many years went from working in a call centre to working in banks, then on to being an accountant. In his case, happiness is defined as caring about the people you do business with (as well as being able to use his brain!). He couldn't do that in a call centre, and banks generally have too much internal politique for good people like him. It took years but he's happy - it's still hard work but it's the sense of achievement and associated rewards that provide him the next objective.

That inertia was overcome by a desire to improve himself and his quality of life combined with the determination to succeed - An admirable level of tenacity.

Should I Stay Or Should I Go?

Perhaps it's more about the Psychology of Staying - At what point do you assess your own happiness and realise that your current situation falls far short of your expectations? How many times will you grumble about leaving then never get round to it because "the time isn't right"? How many holiday requests will get refused before you (and your partner) start having serious issues?

I think we've all had difficult situations motivating staff where they've seen the grass on the other side (especially when you have contractors as well as permies) and are struggling to justify their current life choices as a result. Your aim should be to take care of their best interests and create more feathers for their cap. Give them something "for free", like a new programming technique or methodology, and you'll see an increase in enthusiasm. They're going to get that "new thing" one way or another, so you may as well get the perceived credit.

An occasional pat on the head, perhaps a bonus or a payrise a little over the rate of inflation may keep someone quiet for a while but eventually it'll be the same situation and same grumbles again. Remember that no pa-yrise is the same as a pay-cut and there's no such thing as a "job for life" in information technology so don't assume long-term loyalty. As an employer, the people that come to you threatening resignations unless they get a pay-rise will only do the same to you again in a year. Making your people feel valued is worth far more than any pay-rise or bonus in the long term (although they can help), assuming your paying fairly for the market to start with. 

Beating people with a stick then criticising them for not being stick-proof is not a good approach. I remember on a particularly large and difficult project being told that I wouldn't be given any project management or architectural resources. I spent some time with my boss explaining that growing the perm team by another 50% in six months, taking care of the BAU tasks and covering live issue support was plenty (along with my actual day job). Doing all the project planning and architectural support within the team wasn't possible at that stage, and wouldn't be until we could hire or promote some senior developers. A massive redevelopment project, in a proprietary development environment on bespoke frameworks was going to be tough enough on everyone..Never mind doing it on our own.

Both myself and members of the team had to work 60-80 hour weeks for over a year to make sure we got the job done. I was denied requests to promote within the team or find senior developers on the market so nominated technical leads to perform the senior dev functions. Kudos to the guys I put in those roles, they achieved an incredible amount and it's a huge credit to them that the products and frameworks were delivered.

Following what became a tricky product delivery I was ironically pulled up for planning and architectural criticism. Don't take that as shifting blame though, it was my responsibility to ensure delivery and mine alone. By the way, that taught me that "I told you so" comments need to be very carefully phrased :)

Back in the world of physics, impulse is defined as force multiplied by time. Essentially, a large force for even a short time creates the same amount of change as a smaller force for a much longer time.

In people-terms, impulse is far more dangerous. One person leaves and starts telling their former colleagues about the benefits (the "grass is always greener" effect). They start making impulsive decisions about their futures that you have no control over and cannot convince otherwise. All it took was a little extra nudge to focus those existing thoughts and ideas. 

It's a visible indicator of your working practises when your people start leaving in numbers, especially in the current market where perm developers can almost name their price.

Sound-Bite Summary

In order to get closer to that state of equilibrium, start at the beginning; the recruitment cycle for your growth or replacement phase. Usually it's better to wait to find the right people - the people that have a particular vocation or love of a job - to fill a vacancy than shoe-horning in a bad fit. Long term it'll save you (and them) a lot of pain. No-one checks all the boxes but if you can find someone with an attitude that fits your working environment and is hungry for it, the situation will be more constructive for both sides. In fact, far more constructive than a star player [prima donna] who needs to be the centre of attention all the time (and whom the rest of your team will probably hate).

Contractors don’t matter - they're just there to see you through until you've built your teams the way you'd envisioned it. That's not being mean or heartless, I'm a contractor myself coming from a  development management and development background and I know where I stand.

Whilst the axiom of "A happy workforce is a productive workforce" rings true, what you're really doing is preparing and training people for their next job. The only choice you have to make is whether or not that next job is going to be within your organisation or your competitors.

Which would you prefer?

Time Machine

It's been an interesting week - Got a replacement phone and decided that Nokia Lumia 800 is the way forward. I had to downgrade my HTC Desire to a Blackberry due to work, so going back up to a smart phone has been a real joy.

What I didn't know was that the Desire and Lumia share the same processor; surprised me as the WP is slick and has a great UX. The Desire ended up grinding a bit and was always running out of storage so we'll see how this goes. I've already lined up an idea for WP app, so as soon as Expression arrives I can get stuck in with some dev time.

Also feels like I've been set free just knowing there's 12 weeks left to go before starting work for myself. Paperwork's largely sorted so time for a beer in the garden I think.

Cheers!

Great scott, Marty!

I handed my notice in yesterday in what will be the biggest career change I've experienced in my short career.

When you take an objective view of any situation you're involved in and realise that nothing about that situation benefits any of your own goals or objectives, sometimes you come to the conclusion that it's just not worth doing.

The time I've had at this company has been a huge benefit - I've learnt so much about so many subjects and had the chance to work with the most highly skilled group of people I've ever met, but from this point I'm not going to learn anything new and there's virtually no opportunity to progress career or add to my achievements.

It's not as if there's any animosity or resentment either, if I can I aim to ensure my departure is a blip rather than a bump and that there's adequate continuity.

It boils down to time - I can't get to my long term goals without time spent with the latest technologies on my resume, and potential employers aren't interested in talking to someone with the length of notice clause I have in my contract. I need to apply my core experience to more specific areas in commonplace use. Some of the clauses in the contract prohibit particular blog topics too so it'll be akin to being set free in some respects (I won't miss being permanently on call either :) ).

When I was in Alberta earlier this year, the guy organising the NHL trip to Saddledome spoke about his motivations and experiences in setting up his own business. Struck me that it's (whatever "it" may be for each of us) a lot easier than we think or fear.

The Axiom Of Larry: "Make it happen".

I've also quit smoking with the help of the local quit clinic. So really, it's all about time and travel.

1.21 Gigawatts