From: Matthew Somerville To: Subject: Re: Date: 4 July 2004 18:13 Thank you for your email of the 22nd of June. I apologise if I have caused any upset or inconvenience as this was not my intention. I am happy to discuss the matter with you to try and resolve it amicably. From a practical perspective, I believe that my site provides a useful service, in particular in giving access to information that is not available to everyone through your website. I think its key effect is to lead to more people attending Odeon cinemas (I cannot use your site, so without my version I would not be attending an Odeon to see films). You will realise that I am not taking any commercial advantage from the site - it exists only to provide a service to others and to provide a greater access than that currently provided by your site. In that connection, and in relation to something you said in your email, I do not collect or store any user data myself. Any user data input via my site is passed straight through to the registration page of your website. All users are therefore actually registered on your site, along with their data protection choices. It is as if they went to the registration page of your site and filled in their details there. The same applies to amendments to and removing their data. In the process of creating my site, I uncovered no less than three security holes in your site, leading to public availability of all personal data held on the Odeon server. I immediately informed Odeon and received the following reply: "On behalf of ODEON I would like to extend my thanks in bringing this flaw to our attention. As a result of the details you have sent to us, the issue was passed to our web engineers who have solved the bug with immediate effect. Again, thank you for your feedback and for using www.odeon.co.uk" Also, in an article in the Independent last September, you said you were not going to ask me to take the site down - may I ask what caused your change of view? In view of the above, rather than taking the site down I believe that it would be in everyones' interests (including yours) if it stayed up, although I certainly do not wish to get into a dispute about this with you and would only want it to do so on the basis that you are happy with this. Therefore, is there some way that a sensible compromise can be found so that you are happy for the site to stay up? I am happy to consider making amendments to the site if you would like to emphasise to a greater extent than at present that it is not officially connected with Odeon. Perhaps you would be kind enough to consider this and to let me know what you think? Yours, Matthew Somerville