A security and privacy disaster?