9 ms·

The most interesting part of this story is the potential legal risk of holding onto the records that were improperly disclosed. Had the author not notified the

by jawns 3y ago

The most interesting part of this story is the potential legal risk of holding onto the records that were improperly disclosed. Had the author not notified the city that they had royally screwed up by divulging far more sensitive information than they had realized, they likely would have never realized the error, and he would have been free to do whatever he liked with the data. But once he notified them of their error, and they realized that the data was now in the hands of someone who should not have been given access to it, there is an interesting legal question about whether he has the right to keep it. If this were physical property, or money, then there is a lot of case law around what happens when you find yourself in possession of something that was given to you by what was clearly a mistake. If a car dealer accidentally drops off a new car at your address, but later realizes it was intended for another address, you don't get to keep the car. Likewise, if $100,000 shows up in your bank account because it was mistakenly deposited there, that's gonna get clawed back. But what about data? Mere information? I think there is a pretty good legal argument that there are categories of data (e.g. trade secrets) that a person can be ordered not to possess. So I think the author made the right call by agreeing to cooperate with the city's request, even if it was the city's own colossal error that put him in that position. Nevertheless, it would have been nice for the city to reward him for his bringing the issue to their attention, rather than immediately trying to threaten him if they didn't help clean up their mess.

ska 3y ago
> and he would have been free to do whatever he liked with the data. I think that's a pretty strong assertion.
- jawns 3y ago
  You're right, my wording was imprecise. My point was that he could have continued to delve into the information without anyone hassling him, unless the city independently discovered their mistake. But you are right to point out that he still would have been somewhat limited in what he could do with the data without arousing suspicion.
  - IanCal 3y ago
    I think the point is more that just because you can do something undetected doesn't make it legal.
legitster 3y ago
> They thanked me for bringing the situation to their attention and all that, but the mood of the call was as if both parties had a knife behind their back. Somewhere towards the end of the call, I asked them if it was okay to keep the emails. Why not at least ask, right? >...This isn't something I'm even remotely cool with, so we ended the call a couple minutes later, and agreed to have our lawyers speak going forward. Honestly, the city was acting in very good faith, but OP decided to troll them and refused to cooperate with the third party auditor. To this day we have to kind of accept the affidavit he signed that data is gone.
- Uvix 3y ago
  I wouldn't call the city asking for the writer to agree to a warrantless search "acting in very good faith".
  - legitster 3y ago
    A warrant is only required for a police search. You can agree to have anyone search your property as a resolution to any legal agreement if you want to.
    - thsksbd 3y ago
      A warrant is required for all government search, and I can just as easily waive my right for a warrant w/ the police. In fact, a workers for the municipality is the very last government level Id want snooping in my house. Next thing I know Im getting fined for having the wrong colored bathroom tiles.
      - legitster 3y ago
        > A warrant is required for all government search This is not at all true. For example, if you enter into an agreement with your state to be a foster parent, you also have to agree for the state to inspect your home regularly. It's part of the agreement - no warrant required. The state is free to make search a condition of an agreement. So if the state wants to say "Agree to a search or we will pursue criminal proceedings", you are free to accept or deny their agreement.
kelnos 3y ago
> Had the author not notified the city that they had royally screwed up by divulging far more sensitive information than they had realized, they likely would have never realized the error... That would be incredibly risky, though. If the city did later realize their error, they would likely assume malice on the part of OP for not telling them about it. If we think his treatment after telling them wasn't great, imagine how bad it would be otherwise. > ... and he would have been free to do whatever he liked with the data. I don't think that necessarily follows. He could -- and likely would -- get in a lot of trouble for publishing the extra data.
thfuran 3y ago
>But what about data? Mere information? Everything is mere information.
jonah 3y ago
If a merchant mails something you didn't order, you are allowed to keep it. https://about.usps.com/publications/pub300a/pub300a_v04_revision_072019_tech_021.htm https://about.usps.com/publications/pub300a/pub300a_v04_revi... https://faq.usps.com/s/article/What-Options-Do-I-Have-Regarding-Unwanted-Unsolicited-Mail https://faq.usps.com/s/article/What-Options-Do-I-Have-Regard... Additional discussion on if they mis-ship things to you: https://law.stackexchange.com/questions/17533/if-a-retailer-sends-you-something-you-didnt-order-can-you-keep-it https://law.stackexchange.com/questions/17533/if-a-retailer-...
- cortesoft 3y ago
  What if it is USPS who messes up, though, and delivers it to the wrong address, even though the address on the package is correct? Even more confusing, what if the package is FROM the USPS, is addressed to someone else, but accidentally delivered to you?
  - judge2020 3y ago
    You are not allowed to open someone else’s mail, even if it’s in your mailbox.
    - chaps 3y ago
      For mail with someone else's name on it, sure. But in this case, the "mail" had my name on the front, back and side... plus a username and password that only I know. So yeah, not sure that really applies here.
      - pc86 3y ago
        OT but replying here hoping that you see it rather than a new top-level comment on this deservedly popular article. This is a fascinating blog and I hope you have the time to do and write more articles like this one!
        chaps 3y ago
akira2501 3y ago
I'd think he has the right to keep it. That right also comes with any criminal liability associated with improperly handling or releasing that data along with any civil damages that follow from the same. You'd be foolish to actually want to express this right. However, there is zero chance I'd acquiesce to a third party high end security contractor like Kroll in to "scan my systems." I found that a little bit disturbing for a city to unleash it's world wide third party contractor on an unsuspecting civilian that was trying to help them out of a _legal mess_ they created.
f33d5173 3y ago
The US doesn't, as far as I'm aware, have any encoded right to one's personal data. Furthermore, copyright in the US does not extend to databases, such as a list of records. So there isn't a clear legal regime under which to prosecute someone for holding onto records they recieved improperly. Physical property and even some coyrightable data would be a different story.
- bigallen 3y ago
  The City said they were going to go for a fraud and abuse case. I have 0 experience with that subject, but I would assume there would have to be an action, or intent of an action, to make it a crime. I wonder if the data simply existing on a hard drive would be enough to convict. Now that I think about it, I don't think I have a strong moral conviction against a judge ordering someone to delete data that contains sensitive information they received in error. Jail time and a fine? Absolutely not. Forcing them to delete (and confirming deletion)? Yes.
SoftTalker 3y ago
> I think there is a pretty good legal argument that there are categories of data (e.g. trade secrets) that a person can be ordered not to possess. Agree. You can’t un-ring a bell. You can’t un-tell a secret.

by jawns 3y ago

ska 3y ago

> and he would have been free to do whatever he liked with the data. I think that's a pretty strong assertion.

jawns 3y ago
You're right, my wording was imprecise. My point was that he could have continued to delve into the information without anyone hassling him, unless the city independently discovered their mistake. But you are right to point out that he still would have been somewhat limited in what he could do with the data without arousing suspicion.
- IanCal 3y ago
  I think the point is more that just because you can do something undetected doesn't make it legal.

legitster 3y ago

> They thanked me for bringing the situation to their attention and all that, but the mood of the call was as if both parties had a knife behind their back. Somewhere towards the end of the call, I asked them if it was okay to keep the emails. Why not at least ask, right? >...This isn't something I'm even remotely cool with, so we ended the call a couple minutes later, and agreed to have our lawyers speak going forward. Honestly, the city was acting in very good faith, but OP decided to troll them and refused to cooperate with the third party auditor. To this day we have to kind of accept the affidavit he signed that data is gone.

Uvix 3y ago
I wouldn't call the city asking for the writer to agree to a warrantless search "acting in very good faith".
- legitster 3y ago
  A warrant is only required for a police search. You can agree to have anyone search your property as a resolution to any legal agreement if you want to.
  - thsksbd 3y ago
    A warrant is required for all government search, and I can just as easily waive my right for a warrant w/ the police. In fact, a workers for the municipality is the very last government level Id want snooping in my house. Next thing I know Im getting fined for having the wrong colored bathroom tiles.
    - legitster 3y ago
      > A warrant is required for all government search This is not at all true. For example, if you enter into an agreement with your state to be a foster parent, you also have to agree for the state to inspect your home regularly. It's part of the agreement - no warrant required. The state is free to make search a condition of an agreement. So if the state wants to say "Agree to a search or we will pursue criminal proceedings", you are free to accept or deny their agreement.

kelnos 3y ago

> Had the author not notified the city that they had royally screwed up by divulging far more sensitive information than they had realized, they likely would have never realized the error... That would be incredibly risky, though. If the city did later realize their error, they would likely assume malice on the part of OP for not telling them about it. If we think his treatment after telling them wasn't great, imagine how bad it would be otherwise. > ... and he would have been free to do whatever he liked with the data. I don't think that necessarily follows. He could -- and likely would -- get in a lot of trouble for publishing the extra data.

thfuran 3y ago

>But what about data? Mere information? Everything is mere information.

jonah 3y ago

If a merchant mails something you didn't order, you are allowed to keep it. https://about.usps.com/publications/pub300a/pub300a_v04_revision_072019_tech_021.htm https://about.usps.com/publications/pub300a/pub300a_v04_revi... https://faq.usps.com/s/article/What-Options-Do-I-Have-Regarding-Unwanted-Unsolicited-Mail https://faq.usps.com/s/article/What-Options-Do-I-Have-Regard... Additional discussion on if they mis-ship things to you: https://law.stackexchange.com/questions/17533/if-a-retailer-sends-you-something-you-didnt-order-can-you-keep-it https://law.stackexchange.com/questions/17533/if-a-retailer-...

cortesoft 3y ago
What if it is USPS who messes up, though, and delivers it to the wrong address, even though the address on the package is correct? Even more confusing, what if the package is FROM the USPS, is addressed to someone else, but accidentally delivered to you?
- judge2020 3y ago
  You are not allowed to open someone else’s mail, even if it’s in your mailbox.
  - chaps 3y ago
    For mail with someone else's name on it, sure. But in this case, the "mail" had my name on the front, back and side... plus a username and password that only I know. So yeah, not sure that really applies here.
    - pc86 3y ago
      OT but replying here hoping that you see it rather than a new top-level comment on this deservedly popular article. This is a fascinating blog and I hope you have the time to do and write more articles like this one!
      - chaps 3y ago

akira2501 3y ago

I'd think he has the right to keep it. That right also comes with any criminal liability associated with improperly handling or releasing that data along with any civil damages that follow from the same. You'd be foolish to actually want to express this right. However, there is zero chance I'd acquiesce to a third party high end security contractor like Kroll in to "scan my systems." I found that a little bit disturbing for a city to unleash it's world wide third party contractor on an unsuspecting civilian that was trying to help them out of a _legal mess_ they created.

f33d5173 3y ago

The US doesn't, as far as I'm aware, have any encoded right to one's personal data. Furthermore, copyright in the US does not extend to databases, such as a list of records. So there isn't a clear legal regime under which to prosecute someone for holding onto records they recieved improperly. Physical property and even some coyrightable data would be a different story.

bigallen 3y ago
The City said they were going to go for a fraud and abuse case. I have 0 experience with that subject, but I would assume there would have to be an action, or intent of an action, to make it a crime. I wonder if the data simply existing on a hard drive would be enough to convict. Now that I think about it, I don't think I have a strong moral conviction against a judge ordering someone to delete data that contains sensitive information they received in error. Jail time and a fine? Absolutely not. Forcing them to delete (and confirming deletion)? Yes.

SoftTalker 3y ago

> I think there is a pretty good legal argument that there are categories of data (e.g. trade secrets) that a person can be ordered not to possess. Agree. You can’t un-ring a bell. You can’t un-tell a secret.