Bank Sends Email to Wrong Gmail User, Sues Google For His Identity

http://mashable.com/2009/09/24/bank-sues-google-identity/

by dnewcome • 17 years ago

34 44 17 years ago

MrMatt• 17 years ago

Maybe they should be sending secure links to sensitive files rather than the files themselves. At least they could regenerate the links rather than just hope that the files get to the correct place.

kp212• 17 years ago

Not 100% sure on this, but emailing sensitive customer info doesn't sound PCI compliant. Maybe customers should look into suing this bank.

tedunangst2• 17 years ago

PCI compliance has nothing to do with how you handle your loan information.

mdasen• 17 years ago

This begs the question, what was the bank doing emailing bulk sensitive data in an insecure fashion?

It seems like the bank needs better security policies and thinks that it is acceptable to go after innocent people rather than admit that they don't take data security seriously. I understand getting caught in a situation like this. It happens and while it might be a sign of bad policies, it might also just be unlucky. What matters is how one handles these situations - and the bank isn't handling it well. You have a data breech. Do you notify account holders affected, help them change their account numbers, take responsibility, and put in place policies that will prevent it from happening again? Or do you yell at Google and go after some innocent Gmail user trying to hide yourself from responsibility?

Heck, they even wanted their lawsuit to be confidential: http://www.informationweek.com/news/internet/google/showArti...

At least the judge decided that their embarrassment wasn't cause to keep the lawsuit private.

manish• 17 years ago

I agree with you. It is the bank which has done a mistake. Mail user or google has nothing to do with it.

mhb3• 17 years ago

http://en.wikipedia.org/wiki/Begging_the_question

lsb• 17 years ago

People use "this begs the question" to mean "this begs [you to ask] the question", and while it's not historically correct accurate, it's modern usage.

People 100 years ago would have thought that Americans using "mad" to mean "angry" instead of "crazy" was equally reckless.

tedunangst2• 17 years ago

Wouldn't it make more sense to link to the source?

http://www.theregister.co.uk/2009/09/23/google_sued_for_gmai...

afed• 17 years ago

Not if you're driving hits to your own blog posting.

unalone• 17 years ago

Doesn't look like the poster works for Mashable. On the other hand, Mash is where he saw the information, so why not post the link there? It's not a bad thing to link to the site that you personally rely on for news.

roc2• 17 years ago

I actually have a similar story. As it turns out, I share a first initial and last name with an incumbent congressman's campaign manager.

During their last campaign, I received quite a bit of wholly unsolicited email bound for the manager. Despite a couple "I'm not the guy you're looking for" emails, (i even sent one directly to his 'official' address on the campaign website) I continued to receive the emails.

Most were fairly benign. Some were harmless, but definitely from the sausage-making side of politics. Quite a few were... very personal. I can easily imagine they'd leverage this precedent if they realized what I was getting.

So this whole topic hits pretty close to home when I wonder about what extents these rulings might go to.

Would they turn over my account itself? Would they scour my outgoing messages to see if I forwarded it? Would they pop open every archive I emailed to see if that might contain the information? Would I be compelled to turn over passwords and keys for secured archives? (violating my client's privacy as well) Would they supply a list of IP addresses where I viewed the messages (and might have made copies)? Would they demand access to those machines?

Exactly how much of mine (and thereby my associates) privacy would these courts be willing to violate due no fault of my own?

electromagnetic• 17 years ago

In this case they're suing google to acquire the users identity, and google has said they're willing to give the user the chance to oppose the order.

As far as I know ownership of email hasn't been contested in court, but the email was addressed to the accidental recipient, which even under mail tampering laws wouldn't mean he had done anything wrong. The laws for mail are to prevent me mail-box diving my neighbour or opening accidentally delivered mail, however if the mail was mis-addressed to me then it's legally mine through and through.

This email was mis-addressed, which wasn't the fault of the recipient. I highly doubt the Judge will rule in the companies favour and risk setting a precedent against federal mail laws for email, it would seem kind of absurd.

roc2• 17 years ago

If you're familiar with these laws: if I misaddress something to a PO Box, will the government reveal the identity of the accidental recipient? Will they if I ask nice, or must a court compel them? Is there any sort of requirements that need to be met?

I realize that in this case they haven't asked for anything beyond identity yet. But I'm forced to wonder what happens after they've ascertained identity?

There's no need to compel Google to reveal that person's identity unless there's a follow-up action that they feel they can't execute unless they know the identity of the unintended recipient.

So what is the follow-up action of stripping away this innocent person's privacy? I'm forced to conclude it would be yet-another injustice.

jgrahamc• 17 years ago

Imagine that you are the owner of jgc.org and that there's a popular web site called igc.org. Now imagine that amount of email you receive daily misdirected to jgc.org.

A lot of this mail is mailing lists that didn't do double opt-in and hence *@jgc.org got added to the list. But quite a lot is just personal mail.

For a while I used to receive the itineraries for the private jet of a famous entrepreneur because they were meant to be CC:ed to someone at igc.org but came to me instead.

mustpax• 17 years ago

I imaging if you owned noreply.com you'd get a hefty amount of private correspondence in as well. I bet there are plenty of services out there that use noreply@noreply.com thinking it's the email equivalent of /dev/null for some magical reason.

josefresco• 17 years ago

I wrote an article a while back on this topic and whether the owners of test.com, check the email account test@test.com.

Didn't get a good answer but I would imagine they could see a lot of very personal information come their way as many geeks I've known use that to test their software.

NathanKP• 17 years ago

noreply.com is for sale. Someone ought to try it. ;)

mikeryan• 17 years ago

This may actually be a good thing in the long run. Assuming Google wins the case, this would set a good legal precedent around unsolicited email.

tamas• 17 years ago

I had this fun idea of registering an email address with an username being a common noun. Although I found it strange that the address was still available, but I didn't care too much about it, I was happy to have the account. (You know, new inbox smell).

And then emails started to arrive to the address. Of course, lots of them were spam-spam-spam-spam. But there were also some personal letters. For a while I thought it was some mistake, and replied nicely to them pointing it out, and tried to inquire about what could be the reason behind the confusion, but never really figured out.

The mails kept coming, and I realized that they weren't even addressed to the same person. Up to now I have at least 30 alteregos, giving out my email address to their friends, relatives, and using it in an attempt to register on web sites. Most of them seem to be female, so I get many mails trying to hit on "me" after that talk on im or seeing my profile on some website, etc. Also pictures of nieces, invitations to bbqs, and questions about my iron and if I can bring it to "the club" next Tuesday.

I just hope I won't get sued one day.

DannoHung• 17 years ago

There has to be some sort of precedent for this with physical mail.

On the other hand, I don't think that the bank is being unreasonable when you consider that Google said, "Sorry, no, you'll have to file a suit about this and proceed through legal channels."

jodrellblank• 17 years ago

The bank is being unreasonable by pursuing this at all.

Whatever the outcome, they should contact the people with the accounts involved and start changing details, and should update their data handling practises.

Even in the best case that Google logs prove the user did not open the email, it's still been through who knows what unsecured SMTP servers and is who knows where in Google's replication and backup systems and available to an unknown number of system and mail administrators.

What do they hope to gain?

covercash• 17 years ago

If anything, I think the identities of the bank employees should be revealed just so this nightmare gets put on their permanent records (the internet).

dkokelley2• 17 years ago

This makes sense. The bank is doing what it should be doing, by bringing the matter through proper legal channels. If Google just handed over the information, they would be liable to the account holder. I personally hope that the legal system finds the bank was negligent and denies access to the guy's personal information.

Also, what are the 1,300 bank customers doing about this? I'm sure that a class-action suit will be filed against the bank.

pyre3• 17 years ago

Apparently the bank didn't want them to know about it. Pursuing the gmail-account owner is their way of dealing with the issue.

dkokelley2• 17 years ago

The bank has a duty to inform their customers that their identity may have been compromised.

philwelch2• 17 years ago

My gmail account happens to be my first initial and last name. I get more mail addressed to other P. Welch's than I get addressed to me, but probably because I don't really use the account (I foolishly got it back when gmail accounts were considered a status symbol and used it for online file storage).

ciupicri• 17 years ago

So in order to find out who's behind a (Gmail) email address, all I have to do is send an email and then claim that I didn't want to send it to that person.

Bank Sends Email to Wrong Gmail User, Sues Google For His Identity

Related Stories