Know-how

← All articles

“I only show free or busy”: why a forwarded invitation still exposes data

What a contact sees in the calendar is not what lies in the system, and a forwarded invitation carries its contents into an environment you do not control.

“I can simply forward invitations. In my calendar at my other clients it only says ‘busy’, and my contact there cannot even see where the appointment takes place.” You hear this objection from consultants, freelancers and interim managers who work for several clients, and it is not unreasonable, because it is true for what appears on the contact’s screen.

Several envelopes and a handwritten card on a wooden table, highlighted with an orange stroke, cover image for the article on forwarded invitations, Calendar Butler

It does, however, answer a different question from the one that matters. What counts is not what your contact sees in the calendar, but what lies in the other company’s system once the invitation has arrived there, and in every calendar system display and storage are two different things.

This article follows the path of a forwarded invitation into another company’s system, shows who can read along there, and explains why an anonymous block is enough for reconciling several calendars. How an invitation is built on the inside is described in our article on the ICS file, here the question is what happens to it afterwards.

Display is not storage

Who can read along in the other company

Which parties have access in a given case depends on the configuration of the company in question, but in a large corporation you have to expect several, because mailboxes and calendars there rarely belong to the individual user alone. Behind the word storage hide several places.

None of these places asks which view you chose for your colleagues. If you delete the entry later, it disappears from the view, but not necessarily from archive and backup.

What “free or busy” actually controls

The setting controls what colleagues see, and that is a legitimate concern, because nobody should learn in the corridor that you are sitting at another client’s on Thursday. It does not control the access of those who are responsible for running the system, and it does not control what happens to the data when the company searches it for legal reasons.

In addition there is a question of loyalty toward the sender of the invitation. The client who invited you wrote the invitation for you and the other attendees and not for a third company, and many contracts say that information about projects and participants is to be treated as confidential. Whether this applies to your contracts is written there and not here, but it is worth looking before the next forward goes out.

What is displayed in the calendar is not what lies in the system.

Calendar Butler

An example nobody means badly

Quote: What is displayed in the calendar is not what lies in the system.

A consultant who works for two companies receives an invitation from client A on Monday evening with the subject “Review pricing strategy product line North” and forwards it to her mailbox at client B, so that nobody there gets the idea of scheduling her for Thursday morning. The example is invented but typical, and the consultant acts sensibly, because she makes sure the appointment appears in both calendars.

In the view of her colleagues at B it says “busy”, and everything seems fine. In the mailbox, however, lies a message that contains the subject, the attendees from A and possibly the dial-in link, and if months later a mailbox at B is searched as part of an audit, this invitation shows up among the hits without anyone ever having looked for it. For client A that would be information about its pricing strategy that ended up in a foreign house, and for the consultant it would be a conversation she would rather not have.

What another calendar really needs

The other calendar merely needs to know that you are unavailable from nine to ten. Start, end and a marking as busy are enough for that, and every further line of the invitation is ballast that only creates risk.

The Calendar Butler works on exactly this principle. It is invited to your appointment like one more attendee, reads the invitation once, takes the date and time from it and sends an anonymized block to your other calendars. Subject, description and attendees of the original appointment do not leave the calendar in which they were created, and the foreign system holds only an entry with start, end and the label “Blocked”. Because the block carries its own identifier, it follows every move and every cancellation of the original.

Three questions before the next forward

Who has access to your mailbox and calendar in the company you forward to, how long are messages retained there, and what do your contracts say about the confidentiality of appointments and participants? If you have no answer to one of these questions, the forward is a risk you take without need.

And if you want to know what is in one of your own invitations, save the file, open it with a text editor and ask yourself for every line whether you would have wanted to show it to the other client.

Sources

  • RFC 5545: Internet Calendaring and Scheduling Core Object Specification (iCalendar). rfc-editor.org
  • RFC 6047: iCalendar Message-Based Interoperability Protocol (iMIP). rfc-editor.org
  • How the Calendar Butler works and deployment options. calendarbutler.com

End the appointment ping-pong.

Calendar Butler reserves your appointments in every client calendar and keeps your data protected.

Try free for 30 days