Why Bulk Email Imports Can Accidentally Reveal Sensitive Data: A Comprehensive Security Guide

The Hidden Architecture of Email Systems and the Metadata Problem

Email wasn't designed with modern security threats in mind. The fundamental protocols that power all email communication—SMTP for sending, IMAP and POP3 for retrieval—were created decades ago without native encryption or authentication mechanisms. Security features were added only later as afterthoughts, creating persistent vulnerabilities that encryption alone cannot solve.

Every email traveling across the internet contains extensive metadata that remains visible regardless of whether the message content is encrypted. This metadata reveals substantially more about your organizational operations and communication patterns than the message content itself:

• Sender and recipient addresses that map your internal organizational structure
• Timestamps precise to the second that reveal work patterns and schedules
• Complete routing information documenting every mail server the message traversed
• Email client software versions and operating systems used throughout your organization
• Authentication protocol details including digital signatures and security mechanisms

When you conduct bulk email import operations—whether migrating to new email clients, consolidating multiple accounts, or establishing archive systems—these import tools extract and preserve all metadata alongside message content. This happens automatically without most users understanding what information is being captured.

The Multiplication Problem: How Data Spreads During Import

The persistence problem compounds the vulnerability substantially. Once email is imported into new systems, multiple copies exist simultaneously across different infrastructure:

• The original messages remain on source systems
• Copies exist on destination systems
• Backup copies exist on separate archive or cloud infrastructure
• Each copy retains complete metadata accessible to anyone with credentials to any of these systems

This architectural multiplication means that sensitive information that might have existed in a single location becomes distributed across numerous systems, each with its own access control configuration and security posture.

Regulatory Recognition of Metadata as Personal Data

The European Union's General Data Protection Regulation (GDPR) establishes that email metadata constitutes personal data subject to comprehensive protection requirements. Regulators recognize that metadata can be used to directly or indirectly identify individuals and can be combined with other information to create detailed behavioral profiles.

A landmark regulatory enforcement case in Italy confirmed that workplace email metadata constitutes personal data that can infer employee performance, productivity, and behavioral patterns. This establishes important precedent that metadata analysis—even without accessing message content—constitutes processing of personal data requiring legal basis and employee notification.

When email import tools extract DKIM signatures, SPF authentication records, and DMARC policy information embedded in email headers, they reveal your organization's complete email security configuration to anyone accessing the imported data. This technical fingerprinting enables attackers to identify which systems might be vulnerable to known exploits, understand your technology stack, and craft targeted attacks exploiting specific software versions in use.

Email Forwarding Rules: The Hidden Persistence Mechanism

Among the most dangerous elements preserved during bulk email import operations are email forwarding rules and automatic response configurations established on source accounts. This represents a particularly insidious threat because these rules can maintain attacker access even after you've secured the original account.

How Attackers Use Forwarding Rules

When attackers compromise email accounts, they frequently create hidden forwarding rules designed to maintain persistent access to communications without requiring them to maintain active presence in the compromised account. According to security research on email import vulnerabilities, these rules operate silently in the background with deceptive names designed to blend into legitimate mail operations, such as "RSS Feeds" or "Archive," making them difficult for legitimate account owners to discover.

When email import tools export account data from compromised accounts without first identifying and removing these forwarding rules, the rules come over intact to the destination system. This allows attackers to maintain access to copied email indefinitely, even after the original account has been secured with new passwords and multi-factor authentication.

The Structural Problem with Forwarding Rules

Email forwarding rules operate at the mail server level rather than the client level, meaning they remain in effect regardless of what email client you're accessing your account through. They continue operating even when you're unaware of their existence.

Security teams analyzing organizations implementing automated response to unauthorized email forwarding activity have discovered that attackers establish forwarding rules to automatically copy emails matching specific keywords such as "contract" or "confidential" to external email addresses they control. If you import email from a compromised account without first identifying and removing these rules, the attacker maintains access to all newly arriving communications even after the original compromise has been remediated.

Detection and Removal Requirements

The detection of compromised forwarding rules requires active investigation beyond typical import processes. Research on suspicious mail forwarding in Microsoft 365 environments identified that attackers establish forwarding rules specifically to exfiltrate sensitive communications or prevent security alerts from reaching legitimate administrators.

The business impact of undetected forwarding rules includes:

• Data exfiltration risk through unauthorized forwarding of sensitive communications
• Compromise of confidentiality through exposure of internal discussions and business strategies
• Security alert evasion preventing timely detection of additional breaches

Organizations that import email without first implementing automated scanning to identify email forwarding rules, automatic responses, and other message-handling configurations inadvertently transfer attacker-established persistence mechanisms to the destination system.

Attachment Metadata: The Invisible Information Leak

Email attachments represent another critical category of sensitive metadata preserved during bulk email import operations. The risks extend far beyond visible document content into invisible information embedded within file properties.

What Attachment Metadata Reveals

When you re-share attachments through email forwarding during import processes, you're transmitting not just the document files themselves but comprehensive metadata about document history, authorship, and organizational structure. Office documents, Excel spreadsheets, and PDF files commonly contain hidden metadata that includes:

• Revision histories revealing how documents evolved over time
• Hidden rows and columns containing financial or operational data intentionally concealed from some viewers
• Embedded comments from previous collaborators including potentially sensitive discussions
• GPS coordinates and location information revealing where documents were created
• Author information identifying specific individuals involved in document creation

Real-World Consequences of Metadata Exposure

The practical consequences of metadata exposure through email attachment import are severe and well-documented:

A law firm that inadvertently shares a document named "Merger_BigCorp_SmallCorp_Draft3.docx" exposes confidential information about an unreported merger before public announcement through the filename alone. The attachment metadata compounds the exposure by revealing authors, creation dates, modification history, and potentially sensitive document properties.

An insurance firm that shares claim photos containing GPS coordinates in the metadata accidentally reveals the exact location of a client's home, creating privacy violations and potential security vulnerabilities.

A multinational corporation whose product brochure PDF contains metadata about the creator's email address and software versions enables attackers to identify specific employees and tailor malware attacks exploiting vulnerabilities in those particular software versions.

The Psychological Vulnerability

The particularly dangerous aspect of attachment metadata exposure is that it remains hidden and largely invisible to average email users. When you receive an attachment and re-share it through the import process, you have no visual indication of what metadata the file contains, what information is being transmitted to each new recipient, or how that metadata could be exploited.

Email clients do not prominently display attachment metadata, making it virtually impossible for typical users to understand what they are actually transmitting when they forward or import email containing attachments. This psychological vulnerability is actively exploited by attackers who compromise legitimate internal accounts and then forward malicious attachments to additional employees.

The False Security of Password Protection

Password protection of attached files offers a false sense of security during email import processes. Users often believe that password protection makes attached files safer, but import tools extract password-protected files completely, and attackers analyzing imported email can use brute-force attacks to crack passwords.

Contemporary computing power enables AI-based password cracking tools to compromise common eight-character complex passwords in minutes or a maximum of seven hours. With networked computers performing distributed brute force attacks, a single password-protected file could be compromised in substantially shorter timeframes.

Technical Infrastructure Vulnerabilities in Email Migration

Email import operations introduce specific technical vulnerabilities beyond the preservation of metadata, including the interaction between import tools and cloud platforms, the automatic reconnection of integrations and third-party applications, and the misconfiguration of cloud infrastructure protecting imported email.

Cloud Platform Integration Risks

When organizations use import tools to migrate email to cloud platforms, those tools interact with cloud APIs and authentication mechanisms that may or may not be properly secured. If the import tool's credentials are compromised or if the cloud infrastructure is misconfigured, attackers can potentially access email during the import process itself. More importantly, once email is imported into cloud systems with misconfigurations, attackers can access that email indefinitely because the misconfiguration persists in the background without visible indication of the vulnerability.

Authentication Configuration Complexities

The authentication and connection configuration aspects of email import prove particularly critical because the exact port and encryption combination matters significantly when connecting IMAP email accounts. Standard settings of port 465 with SSL or port 587 with TLS are generally required but not universally applied across different email providers.

Additionally, username formatting proves critical as many email providers require the full email address as the username even when some providers accept just the local part of the email address. Email systems have demonstrated that incorrect configuration of these technical details frequently causes import failures that then require manual intervention, creating opportunities for human error and potentially improper handling of sensitive data during troubleshooting processes.

Third-Party Integration Reconnection

Email import tools may automatically reconfigure integrations on destination systems, potentially reconnecting applications that had access to email on source systems and granting these applications access to all imported email without users even realizing the connections were re-established.

When organizations integrate email with CRM platforms, marketing automation systems, HR tools, and other business applications, these integrations are often established through OAuth tokens that grant broad permissions to access mailbox contents. During an email import process, if integration configurations are transferred without explicit review, these application connections may be reestablished with their original broad permissions, granting those applications immediate access to all imported historical email alongside new incoming messages.

The OAuth Token Breach Risk

The Salesloft Drift integration breach discovered by Google Threat Intelligence Group in August 2025 exemplifies how compromised OAuth tokens associated with third-party email integrations can breach hundreds of organizations. From August 8-18, 2025, threat actors utilized compromised OAuth credentials to exfiltrate data from affected customers' Salesforce environments, performing mass exfiltration of sensitive data from Account, Contact, Case, and Opportunity records.

The threat actor appeared to be actively scanning the acquired data for credentials, likely with intent to facilitate further attacks or expand access. Following the incident, Salesloft took Drift offline, with Google indicating that more than 700 organizations may have been potentially impacted.

This incident demonstrates how email import operations that fail to validate the security of integrated applications and OAuth token configurations can inadvertently transfer compromised integrations to new systems.

Regulatory Framework and Compliance Obligations

The regulatory environment surrounding email handling and bulk email operations has intensified substantially, with authorities including the Information Commissioner's Office, the Federal Trade Commission, and data protection authorities globally implementing stricter standards for how organizations must manage email and associated metadata.

ICO Enforcement and Guidance

The Information Commissioner's Office issued formal guidance warning organizations to use alternatives to blind carbon copy email function when sending emails containing sensitive personal information. The ICO notes that failure to use BCC correctly is one of the top data breaches reported annually.

According to ICO data, failure to use BCC correctly is consistently within the top ten non-cyber breaches, with nearly one thousand reported since 2019. The education sector is the biggest offender, followed by health, local government, retail, and the charity sector. The ICO has taken enforcement action, reprimanding two Northern Irish organizations for disclosing people's information inappropriately via email and issuing a reprimand to NHS Highland for a "serious breach of trust" after a data breach involving those likely accessing HIV services.

GDPR Requirements for Email Import

The General Data Protection Regulation establishes that organizations must have appropriate technical and organizational measures in place to ensure personal information is kept safe and not inappropriately disclosed to others. Under GDPR Article 5(f), organizations must protect personal data "against accidental loss, destruction or damage, using appropriate technical or organizational measures."

The regulatory framework establishes that organizations handling bulk email must:

• Conduct impact assessments on how import processes affect data protection
• Obtain proper legal basis for processing personal data during migration
• Implement encryption and pseudonymization where applicable
• Maintain documentation demonstrating compliance with data protection principles

Data Retention and Right to Erasure

The GDPR provides specific obligations regarding data retention that directly impact email import and archive decisions. Article 5(e) establishes that personal data can be stored for "no longer than is necessary for the purposes for which the personal data are processed," and Article 17 establishes the "right to be forgotten" allowing data subjects to obtain erasure of personal data without undue delay.

When organizations conduct bulk email imports, they must simultaneously establish retention policies that align with GDPR requirements, implementing technical controls to ensure that email is deleted after retention periods expire. The practical challenge is that bulk email archives often accumulate significant volumes of data with unclear retention purposes, creating persistent compliance violations.

Email Authentication Requirements

Gmail, Yahoo, and Microsoft implemented mandatory email authentication requirements affecting all senders, with particular stringency for high-volume senders transmitting more than 5,000 messages daily. According to Google's official email sender guidelines, bulk senders must "strongly authenticate" their emails with SPF or DKIM combined with DMARC to prevent spoofing and avoid spam folder placement.

These requirements apply to bulk email import operations that involve re-sending or forwarding messages to multiple recipients, creating additional compliance obligations for organizations conducting email migration operations.

Email Client Architecture: Local Storage vs. Cloud Storage

The architecture of email clients substantially affects how bulk email import operations either mitigate or compound data exposure vulnerabilities. There are fundamental differences between local email clients and cloud-based webmail services that shape the security and privacy implications of imported email.

Cloud-Based Email Vulnerabilities

Cloud-based email services such as Gmail, Outlook.com, and Yahoo Mail store all email on remote servers controlled by email providers. This means that email import operations that consolidate multiple accounts into cloud infrastructure concentrate sensitive data in centralized systems that become attractive targets for sophisticated attackers.

A single successful breach of cloud email infrastructure can expose massive amounts of sensitive data simultaneously because millions of users' emails are stored in the same location. This architectural centralization creates what security researchers describe as the fundamental vulnerability of cloud email—the provider maintains technical access to all email content regardless of encryption implementation.

This means that government agencies can serve subpoenas to the provider to access email, and internal provider employees potentially have access to message content. The Patriot Act grants U.S. authorities wide-reaching powers to access personal data without a warrant, often in the name of national security, while the CLOUD Act further allows U.S. authorities to access data stored overseas by U.S.-based companies, bypassing local privacy laws and potentially without user consent.

Local Email Client Advantages

In contrast, local email clients like Mailbird store all email directly on users' devices rather than on remote servers controlled by email providers, fundamentally altering the security model.

Local email clients provide substantial privacy advantages including:

• Encrypted hard drives protecting data at rest on your own device
• Offline access remaining available during internet outages
• Provider independence avoiding dependence on provider server security
• Direct user control over all stored messages and attachments

Most importantly, with local storage, email providers cannot access stored messages even if legally compelled or technically breached because the provider simply does not possess the infrastructure necessary to access stored messages. This architectural difference means that bulk email imports to local clients eliminate the centralized target that makes cloud email attractive to attackers.

Device-Level Security Considerations

However, local storage architecture concentrates different risks on individual devices, requiring users to implement device-level security measures. Security experts recommend treating local email clients similarly to password managers—implementing device-level encryption through tools like BitLocker or FileVault, using strong device passwords, enabling two-factor authentication for associated email accounts, and maintaining regular encrypted backups to independent locations.

The technical distinction matters substantially for email import operations—cloud email with a desktop client still leaves imported data accessible to providers, governments, and attackers who compromise provider servers, whereas true local storage eliminates that centralized exposure point entirely.

Maximum Privacy Configuration

For maximum privacy with local email clients, security researchers recommend connecting to encrypted email providers like ProtonMail, Mailfence, or Tuta that implement zero-access encryption architectures. Users connecting Mailbird to ProtonMail receive end-to-end encryption at the provider level combined with local storage security from Mailbird, providing comprehensive privacy protection while maintaining the productivity features and interface advantages of dedicated email clients.

This combination approach means that encryption happens on the user's device before messages are sent to providers, email providers cannot access message content even if legally compelled, and locally imported email remains protected by device-level encryption and access controls.

Organizational and Human-Driven Risk Factors

While technical vulnerabilities create the underlying conditions for data exposure through email imports, organizational behavior, human error, and inadequate training substantially increase actual breach risk. According to research on email data loss assessments, 88 percent of all data breach incidents occurred as a result of or were worsened by mistakes of employees, underscoring the significant harm caused by unintentional insider threats.

Unintentional Insider Threats

Unintentional insider-related security incidents differ greatly from insider threats such as espionage or sabotage, which are overtly malicious. Unintentional insider behaviors are almost always the result of negligence or accident, and regardless of intent, these threats can lead to organizational and reputational harm.

Common causes of data exposure via insider threats during email import operations include:

• Falling victim to manipulation or mishandling information through unintentional lapses in adherence to security protocols
• Unknowingly giving threat actors unauthorized access to organizational systems and data
• Engaging with communications from compromised accounts without recognizing the threat

The risk is not limited to untrained staff; well-informed employees across all levels may unknowingly contribute to security incidents because employees naturally have the capacity to accidentally give threat actors unauthorized access to organizational systems and data.

Email Account Compromise Attacks

Email account compromise represents higher-effort, complex attacks that involve threat actors using obtained login credentials or access through malware or credential harvesting to send legitimate-appearing communications to employees without scrutiny from either email servers or message recipients.

Employees who engage with communications from compromised accounts unknowingly transfer sensitive data or redirect funds to actors while further compromising their organization by providing actors with additional attack vectors for subsequent operations. Social engineering remains one of the most effective methods of exploiting employees within organizations to access sensitive data, with these attacks deliberately designed to exploit employees' cognitive biases and routine behaviors.

Insecure Data Storage and Unauthorized Access

Sensitive, confidential, or regulated data stored insecurely—either on physical devices, local systems, or cloud-based platforms—lacks proper protections against unauthorized access, theft, alteration, or loss. This can occur on legacy servers, in cloud-based platforms without encryption, or on personal cloud accounts established without organizational approval.

Unauthorized storage such as copying work files to USB drives or emailing data to personal email addresses in order to work from home creates gaps in security measures. Outdated or forgotten cloud accounts or platforms never properly decommissioned or sanitized continue to contain sensitive data and credentials, with access permissions often left intact allowing unauthorized users to gain access.

Insufficient Offboarding Processes

Organizations that fail to fully and securely remove a departing employee's access to systems, data, and services leave critical infrastructure and sensitive information at risk. As a result of insufficient offboarding processes, departing employees can retain access to email accounts, cloud storage, project management tools, and customer and vendor systems indefinitely.

Such accounts can be unintentionally accessed or remain unsecured, creating persistent vulnerabilities. In 2025, cybersecurity researchers monitored abandoned cloud-based file storage systems previously used by governments, corporations, and cybersecurity firms, with researchers finding sensitive data in systems that had been abandoned for extended periods.

Security Controls and Mitigation Strategies

Organizations seeking to minimize the risks of accidental data exposure during bulk email import operations should implement comprehensive security controls addressing multiple layers of protection.

Data Loss Prevention Systems

Data loss prevention systems specifically designed for email represent a foundational control layer. Email DLP systems monitor email communications to prevent leakage of sensitive or potentially damaging data. According to security research on email headers and data protection, email DLP systems must be capable of monitoring, identifying, and flagging three main types of email data loss:

• Data being sent out of the organization
• Data within the email system being modified or deleted
• Data at rest in email being accessed without authorization

Traditional DLP tools focus on messages in transit, monitoring network traffic for sensitive data and blocking anything deemed suspicious. However, data at rest in email represents an equally significant threat—once an unauthorized individual or malicious insider has access to an email account, they do not necessarily need to send any messages to exfiltrate data but can instead screenshot sensitive information or download the account's contents with most email DLP tools never registering the theft.

Automated Forwarding Rule Detection

Organizations should implement automated scanning that identifies email forwarding rules, automatic responses, and other message-handling configurations before import. Any suspicious rules should be investigated and removed before email is imported to destination systems.

When conducting email import from accounts that may have been compromised, organizations should verify that no unauthorized forwarding rules exist that would transfer sensitive communications to external addresses controlled by attackers. Automated response playbooks recommend investigating alerts related to mail forwarding configuration by retrieving the caller's IP address, forwarding email address, and filters associated with the forwarding address.

If the IP or domain of the forwarding email address is identified as malicious, soft response actions should include signing the user out and deleting the forwarding email address.

Document Metadata Cleaning

Organizations implementing email import processes should implement automated document property cleaning that removes hidden metadata from Office documents, Excel spreadsheets, and PDFs before importing. This cleaning should specifically target:

• Revision histories showing document evolution
• Hidden rows and columns containing sensitive data
• Embedded comments from previous collaborators
• Author information not intended for external disclosure

While this process adds complexity to import workflows, it substantially reduces the risk of sensitive organizational intelligence being exposed through attachment metadata. Some organizations implement this by using document scrubbing tools that automatically process imported attachments before they are stored in the destination system.

Cloud Security Configuration Validation

If importing email to cloud platforms, organizations should implement rigorous validation of cloud security configurations before beginning the import process. This validation should specifically verify:

• Access controls limiting who can access imported data
• Encryption settings protecting data at rest and in transit
• Authentication requirements including multi-factor authentication
• Data residency compliance ensuring data is stored in appropriate jurisdictions

Organizations should verify that multi-factor authentication is enabled on all administrative accounts before import begins, ensuring that compromised credentials cannot provide easy access to imported data. Additionally, organizations should establish a separate recovery email on administrator accounts—distinct from the networked email system—to enable password recovery if the networked email becomes temporarily inaccessible during migration.

Email Authentication Protocol Implementation

Email authentication protocols including Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting and Conformance (DMARC) represent technical controls that reduce the effectiveness of phishing and spoofing attacks targeting users with social engineering messages containing malicious links or attachment requests.

When DMARC is properly enforced with a policy of quarantine or reject, receiving systems can quarantine or block messages that claim to be from an organization's domain but fail authentication, substantially reducing the volume of fraudulent messages reaching employee inboxes. Organizations should verify that these authentication protocols are properly configured on both source and destination email systems before conducting bulk import operations.

Data Classification and Retention Policies

Organizations should implement data classification processes that identify, classify, and protect sensitive information in imported email. Proper data classification involves:

• Identifying content-based characteristics determining sensitivity levels
• Conducting context-based classification examining metadata and file properties
• Implementing user-based classification through which individuals identify sensitive files

Data classification systems should establish at minimum four classification levels including public data freely accessible to employees, internal-only data restricted to organizational use, confidential data including personally identifiable information requiring special access privileges, and restricted data that if compromised could result in criminal charges and massive legal fines.

Security Awareness Training

Training and awareness programs represent essential controls that address the human behavioral component of email security. Organizations should provide regular cybersecurity training for members addressing how to spot common cyber threats and implement best practices.

Training should be embedded into onboarding, annual compliance refreshers, and role-specific learning paths to ensure that employees remain aware, capable, and accountable in adhering to email security policies. The training should specifically address:

• The risks of phishing attempts exploiting organizational email for credential harvesting
• The dangers of impersonating trusted colleagues using spoofed accounts
• The importance of verifying legitimate business reasons before sharing sensitive information
• The hidden metadata risks in email attachments and forwarding operations

How Mailbird Addresses Email Import Security Concerns

When you're looking for an email client that prioritizes security during migration and daily use, understanding how different architectures protect your data becomes essential. Mailbird's local storage architecture offers specific advantages for users concerned about the data exposure risks inherent in bulk email imports.

Local Storage Eliminates Centralized Breach Targets

Unlike cloud-based email services that store all imported email on remote servers controlled by email providers, Mailbird stores your email directly on your device. This architectural difference means that when you import email to Mailbird, you're not creating a centralized repository of sensitive data that becomes an attractive target for attackers.

The practical security benefit is substantial: if an email provider's servers are breached, your locally stored email in Mailbird remains protected because it simply doesn't exist on the provider's infrastructure. Your imported email archive remains under your direct control, protected by whatever device-level security measures you implement.

Provider Independence and Access Control

With Mailbird's local storage model, email providers cannot access your stored messages even if legally compelled or technically breached. This addresses one of the fundamental vulnerabilities of cloud email—the provider's technical access to all message content regardless of encryption implementation.

When you import email to Mailbird, you maintain complete control over who can access that data. There's no third-party provider scanning your messages for advertising purposes, no government agency that can serve a subpoena to access your email archive without your knowledge, and no risk of provider employees accessing your sensitive communications.

Integration with Encrypted Email Providers

For users seeking maximum privacy protection, Mailbird can be configured to work with encrypted email providers like ProtonMail that implement zero-access encryption architectures. This combination provides comprehensive privacy protection:

• End-to-end encryption at the provider level ensures messages are encrypted before transmission
• Local storage in Mailbird keeps imported email on your device rather than provider servers
• Device-level encryption protects your email archive at rest
• You maintain the productivity features and interface advantages of a dedicated email client

Practical Security Configuration

When using Mailbird for bulk email imports, security experts recommend implementing device-level security measures to protect your locally stored email archive:

• Enable device encryption through BitLocker (Windows) or FileVault (Mac)
• Use strong device passwords with complexity requirements
• Enable two-factor authentication for all associated email accounts
• Maintain regular encrypted backups to independent locations
• Configure automatic screen locking when away from your device

This approach treats your email client with the same security priority as password managers—recognizing that local storage of sensitive data requires appropriate protection at the device level.

Avoiding Cloud Provider Data Collection

Cloud-based email services explicitly document metadata collection and analysis in their terms of service, using this information for advertising targeting, spam filtering, and feature development. When you import email to cloud services, you implicitly accept these data collection practices, with all imported historical email becoming available for whatever data processing the cloud provider implements.

Mailbird's local storage model eliminates this concern entirely. Your imported email is not automatically scanned by third-party providers, not accessible to government subpoenas targeting email providers, and not subject to data mining or analysis by advertising networks.

Frequently Asked Questions