Our Spring magazine is finally here! Click here to view and read our new articles!

#Bellogate – UCL in chaos after mass email prank

Students at University College London (UCL) were waking up this morning to find their university Inboxes filled with thousands of spam and joke emails following an attack on UCL servers by an unknown prankster at 10.47PM last night. The attack may have been timed to take advantage of the closure of UCL administration and IT services during the night and leaves communication between the university and students in a state of disarray.

The entire UCL student body of more than 27,000 students as well as several thousand recent alumni were bombarded with emails throughout the night under the sending address “all-students@ucl.ac.uk”, informing that they had been signed up for the One Direction Fan Club, the UKIP newsletter, the White House email update service and the adult website PornHub, among other web servers sending automated updates. All mass emails sent to UCL students now face the destination of Spam folders or burial in Inboxes beneath mountains of junk email and prank sign-up responses, as well as messages sent by other students taking advantage of the unlocked ‘reply all’ function.

 

Email informing UCL students they had been signed up for the One Direction fan club posted by The Cheese Grater magazine

The first message contained only the word ‘bello!’ and allowed students to use the ‘reply all’ function to send messages to all fellow recipients. Viral pranksterism set in at around 11PM once the weakness in the email servers became known, with no official response from UCL administration or UCL’s Information Services Division (ISD) throughout the night. The ISD operates between 9.30AM-5.30PM on weekdays and runs on automation during night hours – making a coordinated response to the email breach impossible. The incident was quickly dubbed ‘bellogate’ by students and the Twitter hashtag ‘#bellogate’ had become the No. 1 Trending topic in the UK within two hours of the first email being sent.

A UCL student’s Inbox at 2.47AM on 09/10/14. Identity protected.

Initially thought to be the work of a hacker gaining access to the email account privileges of UCL President and Provost Michael Arthur, it is now understood that the first ‘bello!’ email instead came from an original address and not an official UCL account. The provost@ucl.ac.uk account did not exist under any official channel and appears to have been created for the purpose of sending the first ‘bello!’ message. This raises further questions as to how the prankster was able to bypass safeguards around the UCL email servers as well as how the ‘reply all’ function was made available to the public following the original message.

bello 1

Particularly riling for UCL email recipients was the news that all students had been collectively registered as applicants for longtime rival Kings College London (KCL)’s BA War Studies programme under the name ‘Flight Lieutenant Bello’, as well as prank emails sent by KCL students asking for updates on the crisis:

bello KCL flight

No official response was made by the UCL Provost or senior administration until 9.45AM on Thursday October 9th, as the crisis so unfolded entirely outside of normal working hours. Numerous parody Twitter and email accounts impersonating UCL staff took advantage of the university’s silence during the episode, as well as the @UCLBello account, which  utilised a photo of UCL Professor John O’Keefe, whose Nobel Prize for Physiology was announced on October 6th.

At 9.45AM, the first response from UCL was made. UCL ISD Manager Michael Cope issued a statement instructing students:

UCL ISD are investigating this problem as a matter of urgency and are attempting to ensure that all access to the affected list is shut down for the time being.

In the meantime, please ensure that if you are receiving these emails, you do not respond to the list, as this is compounding the quantity of email being sent.

More than 3,000 emails have been sent to students since 11PM last night.  At this stage it remains unclear how faculty and staff will communicate with students in lieu of access to a mass emailing system. Academic schedules and classes currently remain unchanged though the entire UCL student email service will likely require an overhaul if not replacement in the wake of #bellogate.