A $1 Billion Email Gaffe

Jake writes in with the story behind an explosive NYTimes scoop last week. It seems that the Times's pharmaceutical industry reporter, Alex Berenson, scored a page-one blockbuster when he revealed that Eli Lilly was looking to reach a settlement with federal prosecutors over the company's alleged inappropriate marketing of anti-psychotic drug Zyprexa. A settlement figure of $1 billion was mentioned. This scoop dropped into Berenson's inbox when a lawyer for one of Lilly's retained firms mis-addressed an email to a colleague with the same last name as that of the Times reporter. Some online observers are speculating that auto-complete is to blame, but this has not been confirmed.
Update: 02/08 17:19 GMT by KD : Jake writes in with an update: it seems that while Berenson did receive a misdirected e-mail from Pepper Hamilton, that e-mail did not contain a detailed description of the status of the Eli Lilly settlement talks. Berenson got his story from other sources.

Comments

auto-complete is at fault?

[ChrisMounce]

I notice the software is being blamed rather than the user.

Re:auto-complete is at fault?

[schwaang]

Because who hasn't been bit by auto-complete or other software features which are pitfalls for human nature waiting to happen?

My current peeve in this area is my cellphone directory. Every entry is in the same huge list, which means I have to thumb carefully past people I definitely *don't* want to call by accident (but still need to have in my book). The lame workaround is to use an alphabetic prefix to move important people to the top of the list, take-out restaurants to the bottom, etc. Is this really the 21st century?

Re:auto-complete is at fault?

[Buran]

And how are you going to prove that I agreed to it? As you pointed out in your own message, these are a joke. How exactly are you going to extort that $1,000 out of me? How are you going to force me to turn it over? You can't prove in court that I agreed to your license because you provided the goods before you had my signature or other agreement. Software licenses and real-world goods licenses don't give you the goodies until AFTER you agree.

If someone emails me something and then whines about what I do with it, perhaps they should have come to me first and said "I'm sending you (x), but if I do, will you not do (y) with it?" and then only sent it after I agreed? THAT would be enforceable.

The lawyer is SOL.

Re:auto-complete is at fault?

[isomeme]

Sufficiently bad design can justify blaming the software.

I routinely send emails to a member of my team named David. At some point a few months ago I emailed another person named David. Guess which one Outlook always autocompletes to, forcing me to arrow down to pick the correct one? I've sent a couple of (innocuous) emails to the other David when I forgot about this 'feature'.

You'd think any sensible autocomplete feature would remember your last selection for the same string, or at least make the default choice the most recently emailed match.

I don't know what Eli Lilly's lawyers charge

[agrippa_cash]

but I'm sure they can afford PGP/gnupg AND a highschool kid to show them how to use it.

It's funny, you know ...

[ScrewMaster]

but if I were running a major law firm that regularly handled confidential matters for multi-billion dollar clients ... I'd certainly encrypt the Hell out of every communication that left my offices. I mean, all they had to do was install some free (free!) encryption software like PGP, and there'd have been no problem.

Huh. I'll bet they will now.

Re:It's funny, you know ...

[fm6]

Except that email encryption is generally done with public key encryption. That means that every recipient has a public/private key pair; the public key is used to encrypt the message and is known by everybody who wants to send them email; the private key is used to decrypt the message and is only known by the recipient. When I say "known by" I really mean known by the user's software — few people bother memorizing umpteem-bit key values.

If the lawyer had been encrypting his messages, his email would have automagically used the specified recipient's public key, just as it automagically used the specified recipient's email address. So the reporter would still have gotten the leak — but it would be a secure leak!

Note that I hate the cutesy cliche word "automagically". But it serves a certain sarcastic purpose in this context!

Um, no.

[Minwee]

Some online observers are speculating that auto-complete is to blame, but this has not been confirmed.

As I tried to explain to one of the Three Letter Acronyms of our company this morning, "Auto-Complete" is not to blame. "Not Paying Attention" is to blame. If you can't be bothered to look at who you are sending stuff like this to, then please step back from the computer and have someone else handle complicated things like email for you.

Surely if you are doing billion dollar deals then you can afford to hire someone capable of working a keyboard without embarrassing him or herself.

Re:Um, no.

[vux984]

As I tried to explain to one of the Three Letter Acronyms of our company this morning, "Auto-Complete" is not to blame.

Agreed.

"Not Paying Attention" is to blame.

Yes, but mistakes happen. You can't just tell people 'pay more attention' and expect that to solve all problems.

If you can't be bothered to look at who you are sending stuff like this to, then please step back from the computer and have someone else handle complicated things like email for you.

Surely if you are doing billion dollar deals then you can afford to hire someone capable of working a keyboard without embarrassing him or herself.

The sarcasm was unwarranted, but the idea is right. If you are dealing with really sensitive material, it should be vetted by a 2nd set of eyes before its released.

And in any case it holds it in the outbox for 5 minutes before actually sending, so if you have one of those... "push send... oh shit"... moments you can still stop it from being sent.

And maybe something can be done at the software level, like a custom email client that requires you enter a passphrase that encrypts the email . The software won't send without a passphrase, and the recipient must know the passphrase to open the email. Each case file would have its own passphrase, and the case file is included in the message. So if the email reached the wrong recipient they wouldn't know the passphrase and couldn't read the message.

You could speed the process up by maintaining a dictionary of cases and passphrases, and let the recipients automatically open any email in the passphrase dictionary, and rather then enter a passphrase have them enter a case number. So, anyone involved with the case would have to add the passphrase-case number pair to their dictionary just once.

Its not bullet proof... I'm sure better solutions exist. but it would be more effective at dealing with this sort of mistake than either 'typing in the address each time', or 'yelling pay more attention' at people.

You'd use a separate email program entirely for casual non-sensitive communication with your family, friends, reporters, your chauffer, dog groomer, and staples representative...

Re:Very Nasty Stuff

[repapetilto]

First of all I want you to just realize that you're grouping all psychiatrists together here just based on the bad ones. And second of all its a job like any other. Really don't trust your body to doctors or psychiatrists or anyone like that, they are people just like you who do the same half assed things sometimes. The only difference is that they're more informed so their half-assed opinion is better than yours. If you're ever confronted with someone prescribing something for you do your own research to the best of your ability, or at least get second/third opinions.

Re:WARNING: GNAA

[Lehk228]

no it screws with YOUR browser. my browser is just fine.

Re:I advised my attorney to encrypt

[Anonymous Brave Guy]

In the opinion of several lawyer friends I've asked about this one, that's wrong, too. Oh, and I mean factually, not ethically. It sounds like there is at least some credibility in some jurisdictions if you have a notice *before* the rest of the content, but all these corporate types appending legalese essays to the end of every outgoing message are just jumping on a bandwagon with no wheels.

No, I'm not going to tell you who my lawyer friends are or the jurisdictions in which they practise. Yes, if you take anything you read on Slashdot as legal advice, you're a fool. No, I am not a lawyer myself.

Re:Very Nasty Stuff

[Anonymous Coward]

"I remember reading statistics showing that the VAST majority of people who go see a psychiatrist end up with a prescription, regardless of if they truly had problems."

This just might be because a large number of people go to a psychiatrist after their psychologist refers them to a psychiatrist. The psychologist (or better in conjunction with the patient) has decided that MAYBE you do need meds, and the psychologist can't prescribe them. A lot of people make use of both a psychiatrist and a psychologist, typically with the psychiatrist as a secondary specialist and the psychologist as the primary. One is not a replacement for the other, different approaches, both effective when used together. Worst thing to do is badger your primary general doc into prescribing some of these things without interacting with a psychologist or a psychiatrist, that gets done a lot and is pretty much the worst of all (and accounts for a lot of the ADD overprescription). Not that I think there aren't a lot of people who go to a psychiatrist and get an unnecessary prescription, but the problem isn't entirely where you're placing it.

Since when did Tom Cruise start reading Slashdot (ducks)

-sk

Re:The best part is,

[rjstanford]

If these guys would use PGP or some other form of encryption, then even if you did send something critical like that to the wrong address, it wouldn't be so devastating. The technology to protect email has been around for nearly twenty years.

That pretty much assumes that the encryption is done out of band. Personally, most usable variants of email encryption are handled by the client itself (at least as an initiant). At some point, when you select "Jim Smith" as the intended recipient, you have to expect that it will be delivered to "Jim Smith" in a format that he can open, regardless of any interim encryption. This might involve encoding it with his public key, but that wouldn't help the fact that you meant to send it to "Jan Smythe" now would it?

Any more intrusive method just wouldn't be used in the real world, since the hugely vast majority of all emails are actually intended to be read by the person that the author listed in the "To:" field. Any kind of catch-all solution smacks of vistaNag.

Get Over It

[Chris Johnson]

"You have zero privacy anyway. Get over it." -Scott McNealy

This is exactly why Scott's idea isn't entirely a bad thing. The fact is, there is a certain amount of parity.

You and I don't necessarily have privacy from Eli Lilly Corporation should it try to profile things about us in order to make up a more compelling lie to get us to try its products.

But, much to its surprise, Lilly doesn't have privacy either as it tries to negotiate an enormous payoff to the government to escape the consequences of one of its screw-ups.

The dystopia is clearly the idea that consumers and citizens are helpless pawns of the big corporations who can skilfully control outcomes to be anything they want, by controlling their messages and carefully monitoring what people are thinking. They'd get away with murder, because they could always tell what's going to be deemed acceptable and what has to be covered up.

The reality and the counterbalance is: it will always be possible to catch information that's off-message when it slips through holes like this one, and that opens up the controlling corporation to the force of public opinion.

They don't have privacy either. If they insist on being monsters- opportunities will arise to bring that to light.

Keep the parity. Make sure these entities remain vulnerable to mistakes of this nature. If they arranged it so that if you publicised the leak you were sent to Guatanamo Bay, it would be quite the chilling effect- you've got to protect freedom of speech w.r.t. stuff that's accidentally leaked. The burden of self-protection has to stay on the company's side, they can't make it your responsibility to not reveal their shattering secrets when you're not actually part of their organization, or might actually be their enemy.

Give me a blame break

[mombodog]

"Some online observers are speculating that auto-complete is to blame" How about blaming the fucking moron that sent it to the wrong person.

Re:WARNING: GNAA

[OrangeTide]

then filter -1. that's the beauty of the /. system, you don't have to hack in a bunch of protection you let a minority do the enforcing and the majority can benefit.

Re:Very Nasty Stuff

[Anonymous Coward]

I was on this terrible crap for a while...after 2 weeks I had gained 15 pounds (not exaggerating).

My brother also gained a lot of weight on psych meds. You know what though? It sure beats locking himself in a bathroom for four days (really happened), throwing out every article of clothing he owned, including what he was currently wearing, leaving him literally without a shred of clothing to his name (really happened), and several other things which are far, far worse, if you can imagine.

I myself took Paxil ten years ago and chose to stop because of side effects. I had some nausea, shaky hands, chills, and loss of appetite. Big fucking deal. But that was my choice. My brother has his choice, and he chooses to endure some weight gain and other side effects in exchange for, I don't know, not randomly murdering people. He was fully and completely informed about these side effects before taking the drugs. How about you stay out of other people's horrific personal hells and let them deal with it how they see fit?