This isn't a cut-and-dry issue. The internal tool was purportedly used to alert about privacy and security issues on external websites. But the message sent to users was not privacy or security related.