6 ms·
Judge Orders Google To Deactivate User's Gmail Account and Disclose Identity
- ianbishop 17y agoThe thing that really blows my mind about this whole story is this: What the fuck was a bank doing sending the confidential information of thousands to a GMail account in the first place?
- stakent 17y agoAnd why all emails were not strongly encrypted?
- seiji 17y agoHave you ever seen an encrypted email sent to a wide audience?
- NathanKP 17y agoHopefully they weren't sending social security numbers and account info to a wide audience.
- stakent 17y agoDid I say its easy? The point is that there is an organisation. And some people are responsible for security. And yes, it will cost.
- jrockway 17y agoWhy do it right when the legal system is perfectly happy to violate the rights of innocent people at no cost to you? "It's the economy, stupid."
- blasdel 17y agoFuck encrypting the email itself -- it should only contain a link to an https site that the intended recipient has credentials to log into (preferably with multi-factor auth). This is what real, grownup banks do!
- Dobbs 17y agoMy understanding is they were breaking regulation by not. The company I work for does customer opinion surveys. We occasionally do some for a large national bank. When we send data, of any form to the bank we are required to encrypt the email before we send it. This is just for something like random customer surveys not even at the level of actual account data.
- jwecker 17y ago"Hi, you received an email from us yesterday with confidential information. Please contact us immediately and destroy the file. It's the email with the subject 'Re: Do we have a way to back up our data?'"
- lnguyen 17y agoThere's absolutely no reason for it to have been done. That type of information should only be available to pre-approved, secured email addresses. And that certainly should be a company.com address, not gmail.com. The only plausible "excuse" would be that an employee decided to take a shortcut thinking that no harm would be done (and no one would know) and had a "oh f*ck!" realization when it went to the wrong address (and don't they wish they were using GMail with Undo!). This is still unacceptable. If it was a common and accepted practice, it's inexcusable.
- NathanKP 17y agoWhat the fuck was a bank doing sending the confidential information of thousands to a GMail account in the first place? Maybe the employees were so irritated with Microsoft outlook they have been using Gmail instead. But seriously if I were a member of that bank I would be withdrawing my money right away. If there security procedures are so lax that they send a confidential email such as that through Gmail then they aren't responsible enough to hold anyone's money.
- jhancock 17y agoDon't count on a bank handling data security well. Here's a story for ya', I won't use the bank's real name, but it rhymes with HSBC. Anyway, a while back, I was logging into my online banking and the password no longer worked. So I called tech support to see what's up. They said, oh yeah, your password can't be more than 8 characters now. If it was more than that previously, it got truncated [not sure they actually used that word], so try the first 8 characters. So what does this tell you about the way they were/are storing my password?
- frisco 17y ago(Hint: you can't truncate a hash and get a subset string of the original password to still work.)
- jhancock 17y ago+1 for frisco (hopefully most of us) that understands the basics of a one-way hash!! The more precise answer is they at least were storing password in plaintext.
- jedediah 17y agoIt could be that the bank was hashing the passwords all along, but just truncating the user's input before hashing it and comparing it to the saved value. Not that I think this is what happened, but I'm just saying it could be.
- deleted 17y ago[deleted]
- RobKohr 17y agoThen would would the newly entered shorter value match to? 123456 -> hash code 1 123 -> hash code 2 (which doesn't exist in their db)
- deleted 17y ago
- cschep 17y agoDoes Google have any incentive to fight this? I find myself wishing that they would just reply with "No, that is ridiculous." Why, WHY?, would someone be held legally responsible for not replying to an email!? That is the most ridiculous and stupid thing I've ever heard in my life. The bank messed up, we all mess up, but isn't it within his legal right to publicly distribute that list if he wanted? Obviously he didn't, but it's not his problem that they sent it to him! Frustrating. Maybe I should move my email to my own servers.
- palish 17y agoI doubt he would be able to legally distribute the list.
- mikeyur 17y agoPlus it wouldn't be fair to the 1300 bank customers who don't know how crappy their bank really is - and how insecure their personal information is.
- acdha 17y agoPerhaps, but unless he signed an NDA or something it's actually pretty hard for the bank. US copyright law gives an implicit license to the recipient - and data cannot be copyrighted so reformatting would actually make that difficult. All, of course, modulo the bank's success in making it expense enough to get their way without a decisive legal position.
- naveensundar 17y agoThere are many things wrong with this order, but the most obvious ones are: 1. Both the emails could be in the spam folder of an account which the user is heavily dependent on. 2. In the future, to deactivate somebody's account just send a sensitive mail to that account.
- kpanghmc 17y agoMy question is what does deactivating the e-mail account accomplish? If I received that e-mail and I intended to sell it or use it for my own malicious purposes, I would have saved the data off somewhere by now. Deactivating the e-mail account doesn't seem to accomplish anything.
- pyre 17y agoIt prevents the user from selling off the data if this is an infrequently checked account (i.e. the user has not had a chance to even make the decision to sell the info). Not that I agree with the ruling.
- fauigerzigerk 17y agoThen why didn't the court just authorize google to delete that particular attachment? It's on their servers after all. Google can also see whether the attatchment has been downloaded. There's absolutely no reason why the account should be suspened.
- pyre 17y agoBecause the judge is an idiot, and that's not what the bank's lawyers requested?
- absconditus 17y agoBeing technologically ignorant makes one an idiot?
- rtrunck 17y agoNew business idea: start a email service similar to Gmail and operate it in a country with a more reasonable judiciary and/or better privacy rights.
- varjag 17y agoThere isn't such a country. A conflict with money will get your ass served anywhere.
- deleted 17y ago[deleted]
- albertsun 17y agoWhile the bank obviously made a monumental screw up, Google's initial response to the bank is at least in part to blame. Regardless of the privacy rights of the person who's Gmail account it is, there obviously should be an interest in protecting the confidential information of the 1,300 customers. Google could have responded by helping the bank recover and delete the file, as well as sending an unmissable notification to the Gmail user.
- jey 17y agoSure, with a court order. Why should Google randomly delete emails from an account just cause some company/bank asked them to?
- brown9-2 17y agoThis would set a pretty nasty precedent in which Google would be helping companies delete files from individuals email accounts without their knowledge. Wouldn't that be the definition of what we'd call Evil? I think they did the correct and ethical thing by following their privacy policy.
- NathanKP 17y agoThe bank already screwed up by not following a privacy policy. That's why they ended up sending private information to a Gmail account. Google did the right thing by showing the bank what it means to stick to a privacy policy.
- catweasel 17y agoAn 'unmissable' notification from Google wouldn't be anymore unmissable than the request email sent by the bank. Which is why the bank wanted Google to disclose the identity of the user. If Google deleted a users emails and disclosed their identity to a third party then Google would be in breach of their own privacy policy. They would be exposing themselves to litigation, hence the requirement for a court order.
- billswift 17y agoExcept that it could have ended up, possibly along with the original email, in a never read spam folder. Google has more direct means of reaching an account holder.
- alanthonyc 17y agoApparently, the judge who ordered this doesn't have very good judgement: "In 1998, Judge Ware was reprimanded by the Judicial Council of the Northern District Court of California for fabricating the story of being the brother of Virgil Ware[5], a 13 year old black boy shot by teenage racists in Alabama in 1963 on the same day as the 16th Street Baptist Church bombing. According to a story Judge Ware had told many audiences, he was riding his bike with his brother Virgil on the handlebars when Virgil was shot and killed by white racists.[6] The incident was a real one, however it happened to a different James Ware," http://en.wikipedia.org/wiki/James_Ware_%28judge%29 http://en.wikipedia.org/wiki/James_Ware_%28judge%29
- manish 17y agoGood finding. I hope there is some way to appeal in a higher court.
- jhancock 17y agodon't be offended, hey, its Friday ;)... but you can't appeal to a lower court.
- deleted 17y ago[deleted]
- radu_floricica 17y agoWhich points to a really huge invisible elephant: what do you do when a judge is plain wrong?
- jwecker 17y agoAppeal. (In theory).
- tokenadult 17y agoAnd sometimes move for an appellate court order staying the order of the trial court, if the trial court's order would have an irreversible bad effect.
- manish 17y agoThere should be some way to fight this. It is not acceptable for some one send you a wrongly addressed email and then make court deactivate your email account. I wonder how could a Judge rule this way?
- brown9-2 17y agoWell, its not rare for a judge to make a bad ruling, and "the way to fight this" is to appeal to a higher court. Rulings are reversed all the time.
- lnguyen 17y agoImagine the consequence if it was sent via an old-fashioned method: snail mail or fax. Clearly the remedy would not be to destroy the home, office or deactivate the phone line of the receiver. It's an extremely poor understanding of technology but sadly, not at all surprising.
- jey 17y agoI don't understand why the order is to deactivate the account, and not just recover/delete the email and maybe release the identity of the account owner?
- naveensundar 17y agoBy the same reasoning: 1. If I "accidentally" send an email to the bank I could get the court to kick the bank off the interwebs. 2. If I send a sensitive snail mail "accidentally" to the bank, can I get the court to lock down the bank's premises and order a search for my mail (and any copies of it)?
- NathanKP 17y ago2. If I send a sensitive snail mail "accidentally" to the bank, can I get the court to lock down the bank's premises and order a search for my mail (and any copies of it)? That is a good point if we assume that physical mail is the same as internet mail and if we assume that an email account is a location just like a physical location.
- jhancock 17y agoNo, because your not a bank ;). Our government thinks very highly of banks, don't expect similar treatment.
- jrockway 17y agoBy the same reasoning: If I go buy 12 trillion dollars worth of ice cream and it melts, the government will pay me to do it again. This time I will try and find a freezer, I promise!
- acg 17y agoYou've got to wonder who's paying the judge's salary
- jhancock 17y agoThe federal government? He has a job for life and can go home and get baked on some righteous NoCal weed every night. Really, what else do you expect?
- acg 17y agoRather single minded response, I'm not sure what you are asking. To spell it out, asking who is paying his salary is to ask a number of questions (I think you've immediately assumed conspiracy): - If it is the people/government are they getting their money's worth? - If he's taking backhanders is it corruption? - If it's neither of these what is the motivation for this sort of justice? Perhaps I don't understand the make-up of the federal government in the US but it's presumably has to answer to the citizens.
- slackerIII 17y agoSomeone should accidently send some confidential info to the judge's email account.
- TallGuyShort 17y agoHow do they know he didn't already download a copy and keep it? (not that I think they ought to pursue that, I just think that if the bank is worried about their security - they screwed themselves over long ago!)
- dkokelley 17y agoDoes anyone know what sort of precedent is set for the rights someone has who unintentionally receives confidential information? I think that it would apply directly here.
- petercooper 17y agoI wonder.. the easy reaction to this is "Don't use a third party for your e-mail" which is easy enough if you're a geek, but then if you have your own server/domain, could you end up with a court order taking your server or domain off the air under similar circumstances?
- pyre 17y agoI imagine that if you didn't reply to requests in that instance they would just go to your hosting provider. If you were your own hosting provider, then they would just take your to court, and if you didn't show up then the ruling would be in the bank's favor. At some point, you would have to respond to them.
- tom_fb 17y agoThis kind of stuff only happens in America
- araneae 17y agoThe bank was completely out of line to request this. What they should have done was to insure every single person on that list against identity theft for the rest of their lives. Then, if a significant number of them did have their identities stolen, request the identity of the gmail user; only then would their be evidence of wrongdoing on the part of the gmail address owner.
- absurdman 17y agoAnd what of the 1,300 people? They should all be notified that their security was breached, AND they should be suing the bank.
- lucifer 17y agoThere is a mad logic to it: Reasoning for de-activing the account: gmail account holder has not replied to follow up emails from the bank to destroy email and sensitive content. Therefore it is possible that the account is dormant and/or infrequently used. If that is the case, deactivation insures that the sensitive data is protected if the user happens to at this late date access their gmail account and lo and behold, surprise email from idiot bank. (This also applies if sensitive data is in the spam folder.) Reasoning for disclosing identity: gmail account is active and frequently accessed, but the user (for whatever reason) has decided not to respond to the idiot bank. This raises the possibility that s/he has malicious intent of misusing the idiot bank's customers' information. Therefore lets find out who this person is in case the idiot bank's customers' information happens to show up elsewhere on the internet.
- rokhayakebe 17y agoDude the guy/gal does not have to respond to any email unless he wants to. This is not a conversation. It was a request to communicate, and s/he can decide to remain silent.
- lucifer 17y ago> Dude the guy/gal does not have to respond to any email unless he wants to. Obviously. (There is nothing in the earlier comment that in any way addresses the recipient's rights.) Equally obvious is the fact that the bank in question certainly has to take every possible measure to limit the impact of their stupid mistake. Its possible (ianal) that they even have a legal obligation to do so.
- ekiru 17y agoIf I were the owner of the gmail account in question, and I were planning to sell or otherwise misuse the bank's customers' information, I would certainly reply to the bank and claim to have deleted the file. In fact, I would actually delete the email, but I'd have already transferred the data to some very heavily encrypted storage elsewhere(deniable encryption, of course).
- nearestneighbor 17y agoGoogle must not have very good lawyers. This is clearly a miscarriage of justice.
- billswift 17y agoGoogle most likely doesn't that care much; it's not their email account being terminated. They go through the proforma requirement that a judge sign off on or require whatever, then stick it to their customer since it's no longer their fault.
- jrwoodruff 17y agoWhat would they have done if this guy e-mailed back and said "Yea, I found your e-mail in my spam folder. It's been deleted. K bye." Would we have even heard about this?
- mcantor 17y agoWouldn't it be funny if this person had a desktop client auto-fetching their e-mail via POP3, and released the data just to spite the judge & bank afterwards?
- mitko 17y agoI will be happy to hear which was this bank so that I put my money of there if I have account. I wouldn't like my money support an institution with such poor practices and with such disrespect for people's privacy.
- milkshakes 17y agotime to move my email offshore
- cabalamat 17y agoIt's just as well the bank didn't send it by smail mail, then the judge would have ordered the recipient's house to be bulldosed.
- Hoff 17y agoImagine if someone emailed confidential data to various of the folks involved in the court case, and then demanding its return under the same terms as this decision. This decision would then become a whole new form of denial of service.
- EGF 17y agoI have a serious question about this entire thing. Does this set a precedence for future "mistakes" by large companies to deactivate and identify accounts simply because they send compromising information? Put another way, what if you wanted to "nuke" someones gmail account - do you simply need to send "confidential information" then ask for the court order? It is certainly a far fetched and expensive plan, but the question is really about precedence this case has set. I spoke to a lawyer friend about this entire thing: "The judge should have conducted a "balancing test" in which he asked whose rights it was more important to protect: those of hundreds of people whose account information was in the hands of some schmuck, or those of the schmuck who won't be able to email that dirty joke to his Mom if his email is suspended. It seems that the rights of the hundreds of account holders are more important, but you can protect their rights without suspending the schmuck's email address (and that is where I agree with Mr. Morris). The court could have ordered him to turn over all of the data he inadvertently received and swear under oath that he did not retain any further copies and that he did not distribute the copies to anyone else. Once that is done, if it turns out that the sensitive information was compromised in any way, the account holders can hold the bank accountable AND the schmuck. If the schmuck is a decent guy -- and if an IT professional certifies that he purged all the data and that it was not otherwise disseminated to outsiders -- then the story should end there and there is no First Amendment violation." I think this balance test makes way more sense than what happened in this case.
- extension 17y agoThe schmuck can't "turn over" the data and there's no conceivable way to verify that he deleted it, so this scenario just puts the blame on him if any of that data ever leaks and there's nothing he can do about it. Also, I'm no legalologist, but I don't see how the rights of the bank's customers are being violated. Their agreement with the bank has been severely breached, but that's between them and the bank. Violating the schmuck's fundamental rights to correct someone else's mistake doesn't seem very balanced to me.