Judge Orders Google To Deactivate User's Gmail Account and Disclose Identity

http://www.mediapost.com/publications/?fa=Articles.showArticle&art_aid=114264

by Flemlord • 17 years ago

141 100 17 years ago

mediapost.com

ianbishop• 17 years ago

The thing that really blows my mind about this whole story is this:

What the fuck was a bank doing sending the confidential information of thousands to a GMail account in the first place?

stakent2• 17 years ago

And why all emails were not strongly encrypted?

seiji• 17 years ago

Have you ever seen an encrypted email sent to a wide audience?

blasdel• 17 years ago

Fuck encrypting the email itself -- it should only contain a link to an https site that the intended recipient has credentials to log into (preferably with multi-factor auth). This is what real, grownup banks do!

Dobbs• 17 years ago

My understanding is they were breaking regulation by not. The company I work for does customer opinion surveys. We occasionally do some for a large national bank. When we send data, of any form to the bank we are required to encrypt the email before we send it. This is just for something like random customer surveys not even at the level of actual account data.

jwecker3• 17 years ago

"Hi, you received an email from us yesterday with confidential information. Please contact us immediately and destroy the file. It's the email with the subject 'Re: Do we have a way to back up our data?'"

lnguyen2• 17 years ago

There's absolutely no reason for it to have been done. That type of information should only be available to pre-approved, secured email addresses. And that certainly should be a company.com address, not gmail.com.

The only plausible "excuse" would be that an employee decided to take a shortcut thinking that no harm would be done (and no one would know) and had a "oh f*ck!" realization when it went to the wrong address (and don't they wish they were using GMail with Undo!). This is still unacceptable. If it was a common and accepted practice, it's inexcusable.

NathanKP6• 17 years ago

What the fuck was a bank doing sending the confidential information of thousands to a GMail account in the first place?

Maybe the employees were so irritated with Microsoft outlook they have been using Gmail instead. But seriously if I were a member of that bank I would be withdrawing my money right away. If there security procedures are so lax that they send a confidential email such as that through Gmail then they aren't responsible enough to hold anyone's money.

jhancock8• 17 years ago

Don't count on a bank handling data security well.

Here's a story for ya', I won't use the bank's real name, but it rhymes with HSBC.

Anyway, a while back, I was logging into my online banking and the password no longer worked. So I called tech support to see what's up. They said, oh yeah, your password can't be more than 8 characters now. If it was more than that previously, it got truncated [not sure they actually used that word], so try the first 8 characters. So what does this tell you about the way they were/are storing my password?

frisco• 17 years ago

(Hint: you can't truncate a hash and get a subset string of the original password to still work.)

tlb• 17 years ago

From their point of view, if someone can read the database on their mainframe, that's already doomsday. They put all their security outside that perimeter, but no further layers like encrypting table columns inside.

They store passwords the same way they've always stored PIN codes (where encrypting would be pointless): there's a ALPHA(8) field right next to the NUMERIC(4) field for your PIN. Those design decisions are from an era where adding an extra VARCHAR(64) to store a MD5 password times 100 million accounts cost real money. It was probably the right decision.

Rather than sneer at the older generation, try to see the constraints they worked within. It opens your mind to imagine what "right decisions" now will seem silly to later generations. Non-GC languages with threads kludged in? Program syntax limited to ASCII? Silicon? IPv4 & NATs?

cschep• 17 years ago

Does Google have any incentive to fight this? I find myself wishing that they would just reply with "No, that is ridiculous."

Why, WHY?, would someone be held legally responsible for not replying to an email!? That is the most ridiculous and stupid thing I've ever heard in my life. The bank messed up, we all mess up, but isn't it within his legal right to publicly distribute that list if he wanted?

Obviously he didn't, but it's not his problem that they sent it to him!

Frustrating. Maybe I should move my email to my own servers.

palish2• 17 years ago

I doubt he would be able to legally distribute the list.

mikeyur• 17 years ago

Plus it wouldn't be fair to the 1300 bank customers who don't know how crappy their bank really is - and how insecure their personal information is.

acdha• 17 years ago

Perhaps, but unless he signed an NDA or something it's actually pretty hard for the bank. US copyright law gives an implicit license to the recipient - and data cannot be copyrighted so reformatting would actually make that difficult. All, of course, modulo the bank's success in making it expense enough to get their way without a decisive legal position.

zaphar• 17 years ago

Once he received the email from the bank about the mistake he would be in definite hot water if he distributed the list. I believe even if he hadn't recieved the email from the bank he would still be in trouble if he distributed it but I'm less certain of that. IANAL of course so take this with a grain of salt.

naveensundar2• 17 years ago

There are many things wrong with this order, but the most obvious ones are: 1. Both the emails could be in the spam folder of an account which the user is heavily dependent on. 2. In the future, to deactivate somebody's account just send a sensitive mail to that account.

kpanghmc• 17 years ago

My question is what does deactivating the e-mail account accomplish? If I received that e-mail and I intended to sell it or use it for my own malicious purposes, I would have saved the data off somewhere by now. Deactivating the e-mail account doesn't seem to accomplish anything.

pyre5• 17 years ago

It prevents the user from selling off the data if this is an infrequently checked account (i.e. the user has not had a chance to even make the decision to sell the info).

Not that I agree with the ruling.

jwecker3• 17 years ago

I think people on this board especially understand that something as simple as an email account can directly affect our means of making a living and can have very serious consequences, therefore we understand that a blanket deactivation could be the equivalent of "to help me fix my mistake, you must lose your job."

To non-geeks loosing an email account isn't as big of a deal, so it's easy to see why a judge would not realize the significance.

NathanKP6• 17 years ago

I wonder if anyone has heard anything at all from the holder of the Gmail account? I mean it could very well be that the emails just ended up in spam, but I think it more likely that the email account simply isn't used anyway.

That said it is obvious that no one wants their email account to be terminated, especially not those who use it for business, and if the court has that power to simply deactivate someone's account then something is very wrong with our judicial system.

scott_s• 17 years ago

I know many non-geeks who would consider losing their email account a big deal and would be upset. More than just geeks rely on their online identities to talk and work.

skolor• 17 years ago

The problem is more general, that the current set of lawyers, policy makers and the like just aren't familiar with anything digital. Given 20 years, when the current law students/other 20-somethings, who have grown up with the Internet, iPhones and a constant connectivity to anyone you want, start getting into policy creating offices and sitting as judges, I expect to see many changes to the way issues like this are handled.

rtrunck• 17 years ago

New business idea: start a email service similar to Gmail and operate it in a country with a more reasonable judiciary and/or better privacy rights.

varjag• 17 years ago

There isn't such a country. A conflict with money will get your ass served anywhere.

albertsun• 17 years ago

While the bank obviously made a monumental screw up, Google's initial response to the bank is at least in part to blame. Regardless of the privacy rights of the person who's Gmail account it is, there obviously should be an interest in protecting the confidential information of the 1,300 customers.

Google could have responded by helping the bank recover and delete the file, as well as sending an unmissable notification to the Gmail user.

jey2• 17 years ago

Sure, with a court order. Why should Google randomly delete emails from an account just cause some company/bank asked them to?

brown9-22• 17 years ago

This would set a pretty nasty precedent in which Google would be helping companies delete files from individuals email accounts without their knowledge.

Wouldn't that be the definition of what we'd call Evil?

I think they did the correct and ethical thing by following their privacy policy.

NathanKP6• 17 years ago

The bank already screwed up by not following a privacy policy. That's why they ended up sending private information to a Gmail account.

Google did the right thing by showing the bank what it means to stick to a privacy policy.

catweasel• 17 years ago

An 'unmissable' notification from Google wouldn't be anymore unmissable than the request email sent by the bank. Which is why the bank wanted Google to disclose the identity of the user. If Google deleted a users emails and disclosed their identity to a third party then Google would be in breach of their own privacy policy. They would be exposing themselves to litigation, hence the requirement for a court order.

billswift3• 17 years ago

Except that it could have ended up, possibly along with the original email, in a never read spam folder. Google has more direct means of reaching an account holder.

alanthonyc• 17 years ago

Apparently, the judge who ordered this doesn't have very good judgement:

"In 1998, Judge Ware was reprimanded by the Judicial Council of the Northern District Court of California for fabricating the story of being the brother of Virgil Ware[5], a 13 year old black boy shot by teenage racists in Alabama in 1963 on the same day as the 16th Street Baptist Church bombing. According to a story Judge Ware had told many audiences, he was riding his bike with his brother Virgil on the handlebars when Virgil was shot and killed by white racists.[6] The incident was a real one, however it happened to a different James Ware,"

http://en.wikipedia.org/wiki/James_Ware_%28judge%29

manish2• 17 years ago

Good finding. I hope there is some way to appeal in a higher court.

jhancock8• 17 years ago

don't be offended, hey, its Friday ;)... but you can't appeal to a lower court.

radu_floricica• 17 years ago

Which points to a really huge invisible elephant: what do you do when a judge is plain wrong?

jwecker3• 17 years ago

Appeal. (In theory).

rimantas• 17 years ago

Does the judge have an Gmail account? I may want to send some sensative information there and the ask him how should I deal with that.

jpwagner• 17 years ago

No he doesn't...

http://en.wikipedia.org/wiki/James_Ware_(judge)#Noted_ruling...

jacquesm• 17 years ago

How come the guy didn't get thrown off the bench for that ?

Judges are supposed to be beyond doubt, if a judge has done something like that their career should be over.

manish2• 17 years ago

There should be some way to fight this. It is not acceptable for some one send you a wrongly addressed email and then make court deactivate your email account. I wonder how could a Judge rule this way?

brown9-22• 17 years ago

Well, its not rare for a judge to make a bad ruling, and "the way to fight this" is to appeal to a higher court. Rulings are reversed all the time.

lnguyen2• 17 years ago

Imagine the consequence if it was sent via an old-fashioned method: snail mail or fax. Clearly the remedy would not be to destroy the home, office or deactivate the phone line of the receiver. It's an extremely poor understanding of technology but sadly, not at all surprising.

jey2• 17 years ago

I don't understand why the order is to deactivate the account, and not just recover/delete the email and maybe release the identity of the account owner?

naveensundar2• 17 years ago

By the same reasoning:

1. If I "accidentally" send an email to the bank I could get the court to kick the bank off the interwebs.

2. If I send a sensitive snail mail "accidentally" to the bank, can I get the court to lock down the bank's premises and order a search for my mail (and any copies of it)?

NathanKP6• 17 years ago

2. If I send a sensitive snail mail "accidentally" to the bank, can I get the court to lock down the bank's premises and order a search for my mail (and any copies of it)?

That is a good point if we assume that physical mail is the same as internet mail and if we assume that an email account is a location just like a physical location.

jhancock8• 17 years ago

No, because your not a bank ;). Our government thinks very highly of banks, don't expect similar treatment.

jrockway3• 17 years ago

By the same reasoning:

If I go buy 12 trillion dollars worth of ice cream and it melts, the government will pay me to do it again.

This time I will try and find a freezer, I promise!

acg2• 17 years ago

You've got to wonder who's paying the judge's salary

jhancock8• 17 years ago

The federal government? He has a job for life and can go home and get baked on some righteous NoCal weed every night. Really, what else do you expect?

acg2• 17 years ago

Rather single minded response, I'm not sure what you are asking. To spell it out, asking who is paying his salary is to ask a number of questions (I think you've immediately assumed conspiracy):

- If it is the people/government are they getting their money's worth?

- If he's taking backhanders is it corruption?

- If it's neither of these what is the motivation for this sort of justice?

Perhaps I don't understand the make-up of the federal government in the US but it's presumably has to answer to the citizens.

slackerIII• 17 years ago

Someone should accidently send some confidential info to the judge's email account.

TallGuyShort• 17 years ago

How do they know he didn't already download a copy and keep it? (not that I think they ought to pursue that, I just think that if the bank is worried about their security - they screwed themselves over long ago!)

dkokelley• 17 years ago

Does anyone know what sort of precedent is set for the rights someone has who unintentionally receives confidential information? I think that it would apply directly here.

petercooper• 17 years ago

I wonder.. the easy reaction to this is "Don't use a third party for your e-mail" which is easy enough if you're a geek, but then if you have your own server/domain, could you end up with a court order taking your server or domain off the air under similar circumstances?

pyre5• 17 years ago

I imagine that if you didn't reply to requests in that instance they would just go to your hosting provider. If you were your own hosting provider, then they would just take your to court, and if you didn't show up then the ruling would be in the bank's favor.

At some point, you would have to respond to them.

tom_fb• 17 years ago

This kind of stuff only happens in America

araneae2• 17 years ago

Not really. A lot of European countries, particularly the UK, are a lot worse.

ig1• 17 years ago

Although at least in the uk the company would get prosecute for sending client details unencrypted over the internet.

jhancock8• 17 years ago

nah, incompetence knows no country.

araneae2• 17 years ago

The bank was completely out of line to request this. What they should have done was to insure every single person on that list against identity theft for the rest of their lives. Then, if a significant number of them did have their identities stolen, request the identity of the gmail user; only then would their be evidence of wrongdoing on the part of the gmail address owner.

absurdman• 17 years ago

And what of the 1,300 people? They should all be notified that their security was breached, AND they should be suing the bank.

lucifer2• 17 years ago

There is a mad logic to it:

Reasoning for de-activing the account: gmail account holder has not replied to follow up emails from the bank to destroy email and sensitive content. Therefore it is possible that the account is dormant and/or infrequently used. If that is the case, deactivation insures that the sensitive data is protected if the user happens to at this late date access their gmail account and lo and behold, surprise email from idiot bank. (This also applies if sensitive data is in the spam folder.)

Reasoning for disclosing identity: gmail account is active and frequently accessed, but the user (for whatever reason) has decided not to respond to the idiot bank. This raises the possibility that s/he has malicious intent of misusing the idiot bank's customers' information. Therefore lets find out who this person is in case the idiot bank's customers' information happens to show up elsewhere on the internet.

rokhayakebe2• 17 years ago

Dude the guy/gal does not have to respond to any email unless he wants to. This is not a conversation. It was a request to communicate, and s/he can decide to remain silent.

lucifer2• 17 years ago

> Dude the guy/gal does not have to respond to any email unless he wants to.

Obviously. (There is nothing in the earlier comment that in any way addresses the recipient's rights.)

Equally obvious is the fact that the bank in question certainly has to take every possible measure to limit the impact of their stupid mistake. Its possible (ianal) that they even have a legal obligation to do so.

ekiru• 17 years ago

If I were the owner of the gmail account in question, and I were planning to sell or otherwise misuse the bank's customers' information, I would certainly reply to the bank and claim to have deleted the file. In fact, I would actually delete the email, but I'd have already transferred the data to some very heavily encrypted storage elsewhere(deniable encryption, of course).

nearestneighbor• 17 years ago

Google must not have very good lawyers. This is clearly a miscarriage of justice.

billswift3• 17 years ago

Google most likely doesn't that care much; it's not their email account being terminated. They go through the proforma requirement that a judge sign off on or require whatever, then stick it to their customer since it's no longer their fault.

jrwoodruff• 17 years ago

What would they have done if this guy e-mailed back and said "Yea, I found your e-mail in my spam folder. It's been deleted. K bye."

Would we have even heard about this?

mcantor• 17 years ago

Wouldn't it be funny if this person had a desktop client auto-fetching their e-mail via POP3, and released the data just to spite the judge & bank afterwards?

mitko• 17 years ago

I will be happy to hear which was this bank so that I put my money of there if I have account. I wouldn't like my money support an institution with such poor practices and with such disrespect for people's privacy.

milkshakes• 17 years ago

time to move my email offshore

cabalamat• 17 years ago

It's just as well the bank didn't send it by smail mail, then the judge would have ordered the recipient's house to be bulldosed.

Hoff• 17 years ago

Imagine if someone emailed confidential data to various of the folks involved in the court case, and then demanding its return under the same terms as this decision. This decision would then become a whole new form of denial of service.

EGF• 17 years ago

I have a serious question about this entire thing.

Does this set a precedence for future "mistakes" by large companies to deactivate and identify accounts simply because they send compromising information?

Put another way, what if you wanted to "nuke" someones gmail account - do you simply need to send "confidential information" then ask for the court order?

It is certainly a far fetched and expensive plan, but the question is really about precedence this case has set.

I spoke to a lawyer friend about this entire thing:

"The judge should have conducted a "balancing test" in which he asked whose rights it was more important to protect: those of hundreds of people whose account information was in the hands of some schmuck, or those of the schmuck who won't be able to email that dirty joke to his Mom if his email is suspended. It seems that the rights of the hundreds of account holders are more important, but you can protect their rights without suspending the schmuck's email address (and that is where I agree with Mr. Morris). The court could have ordered him to turn over all of the data he inadvertently received and swear under oath that he did not retain any further copies and that he did not distribute the copies to anyone else. Once that is done, if it turns out that the sensitive information was compromised in any way, the account holders can hold the bank accountable AND the schmuck. If the schmuck is a decent guy -- and if an IT professional certifies that he purged all the data and that it was not otherwise disseminated to outsiders -- then the story should end there and there is no First Amendment violation."

I think this balance test makes way more sense than what happened in this case.

extension• 17 years ago

The schmuck can't "turn over" the data and there's no conceivable way to verify that he deleted it, so this scenario just puts the blame on him if any of that data ever leaks and there's nothing he can do about it.

Also, I'm no legalologist, but I don't see how the rights of the bank's customers are being violated. Their agreement with the bank has been severely breached, but that's between them and the bank. Violating the schmuck's fundamental rights to correct someone else's mistake doesn't seem very balanced to me.

Judge Orders Google To Deactivate User's Gmail Account and Disclose Identity

Related Stories