Slashdot Mirror
Bank Goofs, and Judge Orders Gmail Account Nuked
An anonymous reader writes "The Rocky Mountain Bank, based in Wyoming, accidentally sent confidential financial information to the wrong Gmail account. When Google refused to identify the innocent account owner's information, citing its privacy policy, the bank filed in Federal court to have the account deactivated and the user's information revealed. District Judge James Ware granted the bank's request, with the result that the user has had his email access cut off without any wrongdoing or knowledge of why." The Reg's earlier story says, "Rocky Mountain Bank had asked to court to keep its suit under seal, hoping to avoid panic among its customers and a 'surge of inquiry.' But obviously, this wasn't successful."
Quick! We need the normal lot of haters in here to spin this as Google being evil! Um... um... they... they host their services in a country that they very well know is subject to U.S. judges' decisions! Yeah! They should've known better! Obviously, Google is evil! TEH SIGNS ARE EVAREEWERE!
Why is the bank sending sensitive customer information to an email account hosted by a provider known for rifling though it's user's emails for information?
Also having a moment of gratitude that I don't use gmail.
Also wondering if I can send someone I don't like sensitive email, and then have a judge erase their email account erased.
San Francisco Photographers
...if a judge in, say, Korea granted the same request to have a gmail account blocked, an innocent user in, say, Germany would loose his email...even if that email contained confidental and critical information to be used by its owner...this is quite pathetic and something should be put in place to stop these low level distric judges making decisions that could affect users across the globe.
Judicial Denial of Service. I could see lots of large corporations taking advantage of this.
At least Google offers free POP and IMAP access, so it's trivial to back up your email locally. I'd still be pissed if something like this happened to me, but Google isn't to blame.
How can I believe you when you tell me what I don't want to hear?
If I get e-mails from banks that I have no relation with, it is usually spam and gets instantly deleted.
Perhaps that's why the recipient of the bank's private data didn't respond to any of their e-mails.
Also, why is a bank sending it's customers' private information over an unsecure connection (e-mail)? Wouldn't the bank be violating security rules even if the e-mail address was correct?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Wouldn't this be like having a package wrongly delivered to your house (through no fault of your own: the sender had the wrong address), and since it contained highly confidential information, a judge ordered your house to be burned to the ground? (Okay, that's a bit extreme, but you get my point.)
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
...wait. I mean, the account holder at this point has probably seen and done any damage that they are going to do with this information. How precisely is this going to help the bank's cause?
Of course, the account may be inactive and they may well have gotten to it before the person who owned it logged in again, but I do have to wonder why it is the recipient's problem that the bank sent this information. If the bank sent me that sort of information in the mail, does that mean that the county can order my house burned down to make sure I can't read that mail, even though I probably have already read it in full?
These decisions make no sense to me sometimes and it scares me because for some things I use only one email account and if my contacts disappeared, I might not be able to find some of these people again easily. I guess it's time to start backing up all my account data to my home machine by default.
This is yet another strike against "cloud computing" taking over. If they can order your account just plain zapped because a bank fucked up, I don't see how anyone's data is safe. At least if you had it stored at home or at work on your own machine, you'd at least know what the hell happened to it.
So why not post the judge's personal info: email, snail mail, phone, etc.?
I'd imagine that a few months of being throttled to unusable status may make that judge rethink the decision.
This decision was handed down by "Lying Judge" Ware. http://www.fa-ir.org/ai/judgeware.htm
Talk about lifetime appointment gone haywire.
They also store all the data forever, in multiple offshore locations.
Couldn't Google simply have deleted the single email. They would also have been able to tell if the user had read it or not, although what they would've done if it had been read, who knows - but it's not the user's fault.
The bank requested the user's identity. Google refused to provide it. So then the bank goes to court not only to get the user's identity but to deactivate the user's account. I'm missing the logic. Okay, maybe the bank fears that enough time has passed that the user has seen the errant email and wants to prevent the user from misusing the information. Now, that might work if the user does not have a local copy of the email. On the other hand, if the user has a local copy and is now angry at the bank for having had their gmail account shut down, the user, who might otherwise have done nothing, now has both the means and the motive to do something. Good move. Wouldn't it have been possible for Google to contact the gmail user and ask him to delete any local copies? And Google, presumably, could have deleted the email from its own servers. I like Google's policy of protecting user identities. But this whole mess sounds like two bureaucrats blindly following policy to the detriment of the end-users. Can't anyone think anymore?
linquendum tondere
I'm the vindicative sort, so if they cut me off like this I would post their "confidential information" as far and as wide as I could.
Truly great logic at work here. We screwed up, so nuke the presumed innocent user. Hell, if I was that guy and had gotten the file off before they killed my e-mail access I think I'd offer it up to Wikileaks in return for their heavy-handed treatment of me.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
You know, if only the bank has include some serious sounding lawyerly language like, "This electronic communication is intended for our customer only. Sever legal action will be taken against unauthorized persons who receive this message and do not delete it immediately." That would have been enough right? Now all these lawyers who inflicted 25 line long legal boilerplate on every mail from corporations are high fiving in glee, laughing at the futile attempt of Rocky Mountain Bank trying to close (other people's) barn door, after their horse is stolen.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
did they try to email the person and just ask them to delete the previous emal?
Presumably they need the user's identity because after step 1: Deactivate account, they need to proceed with step 2: Deactivate user (in case he read the email, he has confidential info in his brain.)
Of course, if that user has communicated with anyone then they will need to be deactivated as well, and so on, and so on... All I know is in the future I'm autoforwarding all my emails from Rocky Mountain Bank to Rush Limbaugh! :)
what if the owner of the wrong email address have already made a backup of the info sent?.. whats the point of deactivating its account?, and they can say whatever they want.. the damage is done already plain simple.
that and the fact they can't know for shure if this person even know what he/she has recived its important and.. what if it just deleted the email becouse have noticed it wasn't for he/she?..
geez.
Not from the United States and not too familiar with the U.S. Constitution, but wouldn't this be a blatant violation of the first amendment?
There is a clearly innocent party here who has had a primary communication medium forcibly disconnected. Not only can they not talk about this confidential material (which there may be an argument for preventing), but they can't talk to anyone about anything. That sounds like a massive violation of freedom of expression...
Hopefully the email recipient gets notice before they lose all of their email.
And more hopefully, they find the offending message and forward it to the judge that made this ruling with a note akin to "Thank you for punishing me for having an email address. Here is the poison message, please order your accounts deactivated as well."
Do people actually put their real names in those forms? Even if they did is John Smith from the United States really going to help you track the guy down.
I have a gmail account but I don't even remember what name it is listed under nor what the password is. I got the account and them realized I don't like Googles privacy policies (the fact that they scan email to build a profile on their users). I wonder what percentage of Google accounts are essentially dead, like mine.
I run my email on my own email server... In my house. What would they have done if they accidentally sent the email to me?
It certainly isn't the banks fault that he picked a bank-like username which caused confusion and lead to him receiving information he shouldn't have. They should probably smash his computer into a million bits as well just to be on the safe side.
So if I lie to my bank and give them an email address of someone I don't like, say the president of the company my business competes with, I can then get his email shut down. I'll remember this.
So, last time I sent a wrong paper to bank I should have asked the judge to close the mail delivery to that bank - have to remember! It should be easy, not even have to ask the post office for owner of the address!
Now, the damage is already done! I wonder who and how covers it to the innocent party (parties?) My e-mail connection is worth a couple of millions, at least, even a short cut would cause huge (future) losses and of course, the trauma - a jury probably would understand that and award me those millions except how to sue a judge / justice system? I might then get the government (tax payer!) relief help (money!) to continue my business - so what I wasn't ready for recession, sorry, I mean for justice(?) - doesn't sound right, didn't have a backup plan for it?
There is today a real need for justice system which would understand technology, at least on basic level. And I wonder how the bank was even able to send to a person who they assumably don't know - if they know who was the receiver, what's the point? Total screwup! No excuses, sorry, there are any amount professional IT people who can make this type of mistakes very difficult, only intentional e-mails (or whatever) can be delivered and then it's another issue totally. Maybe the bank could take the cost of 10 of them out of the CEO salary, he/she wouldn't even realize so small sum!
Google was absolutely right and maybe, just to show how nice they are, they could fight this on behalf of the e-mail owner? Maybe it would even be a good idea, otherwise they may start getting these court orders more in future? If a judge can just order this kind of e-mail (or any!) closing and giving the customer names it definitely will change how the Internet ( or post office or just speaking aloud) works today.
a spammer asked Google to remove thousands of gmail accounts because they received by mail a viagra offer with the wrong price.
This hiring strategy is alarming because the bank is valuing appearance over attention to details.
This hiring strategy is grossly alarming when you realize that the same idiots now oversee the Wells Fargo vSafe. It is an on-line storage facility. Of the several people whom I contacted at their toll-free number to handle issues related to my vSafe, only 1 person knew what she was doing. What scares the shit out of me is that these incompetent people are supposed to safeguard the sensitve financial data that I have uploaded into vSafe.
If you ever contact a Charlie at the Concord call center, then you'll know what I'm talking about.
Google was right to defend its policy. I hope they appeal to the 9th circuit court.
The bank was clearly on the wrong side.
I can only wonder if this user suffered monetary damages due to his email being deactivated.
I hope this judge gets censured. This is clearly an abuse of power and an abuse of process.
Luckily, the user can sue the bank for abuse of process.
They're using their grammar skills there.
Wonder how long until someone sets up a place to collect donations to run a full page ad in whatever paper serves Wilson, WY telling them how "secure" and "safe" their bank is and how the bank has tried to hide their negligence (or at least extreme carelessness) by divulging such sensitive information.
Shouldn't the question the judge would be asking himself be, wtf are a bank doing sending highly classified and sensitive information unencrypted, over frigging e-mail? Google and the customer should really be last in line, long after the excecs at the bank have had their bottoms spanked.
No wonder the bank system collapses every now and then.
HTTP/1.1 400
He marked the first E-mail as junk mail and the second one got sent to his spam box...
Or better yet he hasn't checked it in a while...
So a judge in the US ordered a US company that as servers all around a world to block a user account because a US bank fucked up.
but if the message or user email/account where in a server say in Germany ? does this not takes some jurisdiction problem ?
I think you mean:
"Could I interest you in ocean front property in Arizona ?"
or
"Would you like to donate money to save the rain forest in Antarctica?"
Basically it means, the person is gullible and you are going to try sell them something that doesn't exist, or you can't possibly sell. Since Florida has TONS of water, if you are selling waterfront property cheap enough. I would be interested.
I read Slashdot for the headlines, because the headlines, unlike the articles, are usually original and never duplicated
This judge is a goof. And it's the bank's fault. There is ample legal precedent to show that the bank is at fault until proven otherwise.
About 8 years ago, I got a separate fax number. Almost immediately started getting strange faxes once or twice a day. Turned out to be credit check faxes. With names, account numbers, monthly income, address, previous address, maiden name etc. Not a good thing to be sending out to some random fax number. At each receipt, I faxed the first sheet back to the originating number with a cover sheet that stated that I had shredded any fax information sent in error, and to please stop sending me this stuff. I really did shred the faxes, I really did discard the information. Stopped after about two weeks. Never heard a peep from either the bank or the credit check service.
However, a decade later, it seems ridiculous to expect the recipient to behave the same way. I got a dozen wierd faxes. Most of us get hundreds of spams a week. Most reasonable computer users would discard something as nonsensical as an email claiming to contain SSN and address info. We can respond to a dozen faxes, we cannot respond to hundreds of spams.
JMT, AC
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=976446 for the legal-speak of why they allow it.
http://www.usatoday.com/tech/columnist/2002/04/04/sinrod.htm for a non-legal discussion of a 2002 case where the 9th U.S. Circuit Court of Appeals upheld validity of service of legal process by email.
So, yes, there is a legal obligation to check your inbox on a regular basis which is just one more reason why the remedy granted by Judge Ware was seriously out-of-bounds.
Order Google to provide the bank's lawyers with contact information of the account holder -- sure; order Google to terminate the third party's ability to conduct business affairs as well as his/her ability to receive bills, service of process or other legal notifications which require time-constrained response (e.g. terms of service changes, etc) -- "reversable error".
Has anyone thought that maybe this is on of a shitload of dead gmail accounts? I know that I've got a few (dozen.) I would be nice if this is the case and the bank paid a bunch of lawyers just to have it shut down.
-- I have a private email server in my basement.
Why is the bank using Gmail and not their own private email system? i mean this is a major security issue using the likes of gmail imo.
If I see an unsolicited spreadsheet in my email, I assume it is a virus of some sort and delete it without opening it.
... that they didn't make another error and put an entirely different email address in their court documents? Banks ARE generally run very stupidly with regard to security. Rocky Mountain Bank is showing that they are the worst.
now we need to go OSS in diesel cars
I found this article from very close to the bank's main office.
now we need to go OSS in diesel cars
Who represented the rights of the user to the court?
Was a public defendant even involved, or was no one assigned because there was no face to the account that was deleted?
Help! I'm a slashdot refugee.
If some idiot is stupid enough to send confidential banking info on 1300 customers, IN THE CLEAR, TO A PUBLIC MAIL SYSTEM, readable by Zeus knows how many techs and others, to ANYONE, much less a random 3rd party, I guess they are stupid enough to believe anyone with an ounce of sense would want to assume any kind of resposibility for THEIR MISTAKE by providing an affidavit of destruction, especially how little that might be worth, except to put one, again, on the hook for their screwup. If I got a request like this, I would assume some kind of scam, in fact. Or my spam/phishing filters would. May even be what happened.
This judge's qualifications seriously need reviewing. Chances are this isn't the only boneheaded decision he or she has made.
If POP/IMAP was enabled and local copy stored in user computer, give it as present to the mafia the moment the account is blocked.
The bank should not be emailing confidential information in the first place, it can be intercepted in transit, it can be misdirected, it can be read from hacked accounts, it can be read by google employees.
So bank sends confidential email, shouldn't they be punished for some sort of federal banking / insurance requirements violation?
Considering the potential for harm, the judge in this case was right to act, at least in principle. Mind you, I don't know if the law was on his side since the recipient was effectively an innocent bystander.
The judge was right even if his ruling contradicts law? LOL.
That said, there may very well be laws that regulate the possession of confidential information. Considering that the information belonged to a financial institution, that may be the case.
Can you find me where in the law it says that an account must be shut down?
Often times, I have received email with a footer that cites the information as confidential and stating that the recipient is required by law to delete it if it was sent in error.
So why not order Google to delete the email and nothing else?
Bottom line, the nincompoop that got the info was almost certainly up to no good. You don't just not notice a honking huge spreadsheet being plopped in your inbox.
So wait, the lack of response is indicative of malintent? LOL! Heaven forbid that this person was on vacation, or that the person speaks a different language, or the person is a child who doesn't really comprehend what happened.
I get literally hundreds of emails per week on Gmail claiming to be a bank, the IRS, PayPal, and etc. It goes right to the SPAM folder without being read.
If this happened to me and the emails were classified as SPAM, I would never have found out and I would have lost my Gmail account without warning and chance to appeal.
You sir have your head up your arse.
Often times, I have received email with a footer that cites the information as confidential and stating that the recipient is required by law to delete it if it was sent in error.
and often times i see emails telling me that if i reply with my account details and send $1000 dollars to cover the cost of paperwork, then i'll have millions deposited in my account...
i spent five minutes thinking and all i got was this crappy sig
James Ware
The bank should have take the fall here. At this point if any of us get any information sent to any of our accounts they can close them down. Sure they may send an email requesting our cooperation but how can they trust us? From now on I sure won't trust them. I just hope that gmail user downloaded that file. If it was me and my account was closed like that I'd plaster those numbers all over the net. Some say that it would be a great inconvenience to the people whose information was sent to have to change their all the account numbers over, but how does destroying a gmail account ensure the data was destroyed and their accounts are safe? It doesn't. This is just a cover-up with the judge being to ignorant to realize how things really work.
"Cowardice in a race, as in an individual, is the unpardonable sin." --Teddy Roosevelt
Yes, someone has the problem of their account being deactivated. This sucks. But, imagine, for one moment, had the opposite happened. Say, for instance, the judge ordered to bank to change the numbers of the 1,300 accounts, resulting in 1,300 people having to change their financial information on all documents relating to those accounts. I'm not sure if you've ever had to do this, but it can take months for the changes to finally take hold on everything from direct deposit accounts to credit cards and Paypal accounts. Assuming that everything worked out correctly, that is. Granted, if they were wise, the customers would be doing this now themselves.
Wouldn't the bank need to do that anyway? If just for the sake of security? If the customers information falls into someone else's hands, even if you don't know for sure whether or not someone has read the contents, you still need to inform your customers and expect the WORST possible scenario, that mean asking those 1.3k customers to change their information. It's the banks responsibility.
To this problem. Although it might not go over too well with the customers, either...
I'm not sure where anyone ever got the idea it was OK to put confidential information into an e-mail message, because it's simply not.
Anyone else having trouble logging into their gmail account?
If that was my gmail account I'd be thoroughly fucked.
Most of the places I've registered, if I want to change the registered email address, I need to acknowledge it through my gmail account.
Now, my ISP doesn't offer an email option, so I can't just get one there. And if I'm going to move out of this area, I'd be screwed as well, as I'd have to get a new ISP and thus a new email-address. In the end the Gmail option is easier.
My gmail account is thus the primary account I have for all personal and semi-professional communications.
Since the bank went to court to get my account closed, they haven't broken any laws, so I'd be barking up a tree if I tried to sue for damages.
Google did exactly what they've promised to do - they refused to close the account without a court order.
And I can't exactly sue the court or the judge either.
Now, I do have the contacts saved elsewhere, but how do I easily prove that I am in fact the person behind my gmail account and get those companies to change the address they've saved, when I cannot send them a mail from that account to prove it? Paper work is a bitch.
And when one of my contacts suggests to one of their contacts that they could use me, then they're likely to use the gmail account which is now closed, which makes me look like an arrogant asshole: "He didn't even bother to write back to say no, he just ignored me."
If Google were kind, they would at least make mail to that account bounce with a good explanation like
...every few weeks. I have tried to contact the bank (Chase) to let them know that they're sending to the wrong account.
They make it fucking impossible to contact them - UNLESS I log on with the account to do so (or call them, which I don't feel like doing because I don't live in the USA).
Every couple weeks I reply to the email (even though it says "don't reply", it has a unique reply-to, so I hold out some hope that maybe someone keeps an eye on the occasional reply). This has been going on for months. Attempts to navigate the website to find a simple contact page appear to be futile - there /must/ be one (right?) but I can't find it at a glance, and how much time should I be investing in this, seriously?!
I haven't looked at the emails closely because I don't care what's in them, but I'm sure there's some personal/confidential information in them - and if not, as the owner of the email address, I'm sure I could request some more stuff to get sent to me.
I really want to fix this problem, rather than just hit 'spam' so gmail bins them all (which helps noone, I feel). But the bank has not taken this scenario into account adequately enough - and until they are forced to, they just won't bother.
(Why do banks send emails at all? They should /only/ ever send emails to people that have opted in with a public key so they can be securely signed. Yes, that cuts out a lot of people, but seriously, the people that it cuts out will be better off for it.)
Would federal officers shut down a bank's internet connection if someone accidentally sent them something illegal, say, terrorist training manuals, or (everyone's favorite...) child porn?
There's a small part of me hoping the GMail account belongs to an IRS auditor a few million short of his quota...
The society for a thought-free internet welcomes you.
I hope the person who had their account blocked will sue both the court and the bank. The bank sent him someone else's personal information and then got court protected free access to his personal information? This is wrong! His work and life could be disrupted on behalf of an error from a commercial institution that he may not even be a customer of.
There is a debate between economists on whether inflation should just include the price of products excluding food and energy or should it include housing and health insurance. Both housing and insurance have trippled since the late 1990's. Sure on paper it looks like you make the same but a $175,000 home in 1999 costs $350,000 even during the recession. Suddenly $55,000 a year is not worth jack in most metropolitan areas even if prices do not necessarily show it.
If you health care costs were put in the inflation equation with housing we would see a totally different side of economics that economists should have prevented if they only knew.
Something does need to be done.
http://saveie6.com/
Insurance is good for one thing - mitigating financial risk.
You can not ensure "health". Everyone dies sooner or later. If you have money, it will be later, on average.
If you don't have employer subsidized health care, there are very reasonable, low cost, high deductible health insurance policies that will protect you from a disastrous medical bill. It is irresponsible not to have such a policy, if you have anything at all to lose (like a house).
How we got to the notion that "health insurance" should cover every little thing is ridiculous. Think about how much your car insurance would cost if it covered oil changes and brake jobs, or how about if your home owners insurance covered painting, fence repair and replacing your carpet for normal wear and tear?
This issue is a bit more complicated than you think.
If the bank sent me such a document, and it was by paper mail instead of email, would the judge order my house burned down?
"Rocky Mountain Bank had asked to court to keep its suit under seal ...
What cause of action exactly allows you to sue someone else and seek relief (in a manner that injures the other party) for damages that you caused to yourself?
Even when I *ask* for them to email me confirmations, I get stuff like:
Dear Customer
Account Number XXXXXXXXXXXX1
We just did something at your direction.
If you didn't do it, figure out who we are can contact us immediately.
Read about our industry-leading Privacy Policy and our Security Guarantee online at our website.
Replies to this email end up in a black hole. If you need to reach us, use some other means.
Come on, you know who we are, you send us lots of your money, and we hope you keep on doing so, because we sure as hell don't pay you very much interest.
This issue is a bit more complicated than you think.
They need the contact info so they can name him in the lawsuit in order to get their pet judge to sign the gag order, and fine him for the pain and suffering caused to their customers, by his e-mail address actually being a valid one.
Gag orders are tough when you don't know who you are trying to get silenced, and since you can't exactly gag people whose identity you don't know (no way to deliver service to them, when they ignore email).
And now I log on to slashdot and find out why! Those sons of bitches! Fortunately I use POP and download my mail every 5 minutes, so I still have that document they sent. Off to Wikileaks and ThePirateBay I go.... suck it, bitches!
The over 1300 people who's information was leaked is now on the web. closing the account did nothing.
Why doesn't Google just check to see if the read status of that sensitive e-mail letter is still "Unread" in that GMail account? And if it is, check to see if POP3/SMTP/IMAP is disabled. If it is enabled, then check to see if this message was downloaded by that GMail account owner. Wait, if the GMail account owner already downloaded the message through POP3/SMTP/IMAP, then why bother shutting down that person's GMail account? That's like the most childish thing I could imagine. Point being, if the e-mail was never downloaded or opened by the owner of that GMail account, then Google ought to outright delete that sensitive letter from that account and duke it out with the bank. (Google is invincible after all, right?)
It's pretty trivial to set up a filter in gmail to autodelete all email from rmbank.com, and it might be a good preventative measure in case they send any more "oops" emails.
Step 1) Open bank account with minimum deposit.
Step 2) provide e-mail address of target e-mail account as your address to the bank and agree to have your statements sent to that address.
Step 3) Complain to bank about not receiving your statements via e-mail and "discover" that the "wrong" e-mail address was used.
Apparently the Judge was in his dorm room stoned when they discussed the fifth amendment.
My wife has a gmail account with Gonzalez in the username, a very common Spanish-latino last name, and she gets a lot of missdirected email, and lot with sensitive information, and daily recover password request. :(
It seems it will not last to much
I am "hurting" as much as everyone else in this current fiscal crisis, but I'm not going to take advantage of someone elses accidently-revealed information, as such..... What HAS our world come to?
you can't exactly gag people whose identity you don't know (no way to deliver service to them, when they ignore email).
Or when you've gotten their email account disabled.
What if the bank by mistake send this information via US Mail? Would the bank been able to go to the Postmaster General and ask that the person's physical mailbox be opened and any envelopes inside it be removed? How about forcing the person's mailing address be revoked or changed? Somehow I don't think a bank could make me change the numbers painted on the front of my house. (I hope not anyway.)
Why should email be any different then postal mail in this case?
"Then you can kiss your account goodbye."
You mean my account at mailinator.com?
While not as fool proof, an email forwarder like pobox.com masks your email address changes.
I have used them for ~15 years
As annoying and unfair it might seem to be to the email account holder, there ARE times when things like this are necessary. Note all the things that went right here though. Google wouldn't just up and hand it over without a court order. The judge wouldn't honor the request to keep the order sealed. And as unlikely as it seems, it's important to the customers of the bank to know to what extent their data has been compromised. If they can remove the document and determine that it had never been opened, the breech can be considered contained. If it WAS opened, although the account owner would hardly be considered responsible, the bank's customers need to know that there's a highly unlikely, but possible chance that their data is out in the wild and they need to perform whatever damage control is necessary. The account holder will also have opportunities to collect damages of his own due to the bank's actions. Had Google just complied without the court order, it would have been difficult to determine which party is responsible for the disconnection of the account. Now there's no question.
So, while the bank was able to temporarily have someone's email account disconnected, they did so at the cost of opening themselves up to a great deal of legal liability. Like it or not, this IS the way the system is supposed to work.
Play with my webcams and lights here
Can anyone understand what the bank is hoping for just deactivating that gmail account?
Is the bank really going to leave the leaked data unchanged rather than asking the customers to change details as far as possible?
Anyone else having problem with Gmail? I cannot log in...
...the subject is mostly "Check your account information now" and the sender is "Chase bank". If I hit reply, however, it seems that a whole myriad of other banks want me to check my account information with them now too! What is it with these banks and their account information ?
There does seem to be another strange thing occurrence now, however, in that my bank accounts are suddenly starting to get very empty ; a lot of transfers to the "Cayman Islands", tsss.... darned banks.
Confidential information going over email is just plain retarded to begin with... its no wonder a company that stupid would do something this stupid, and then ask to government to also act stupid in correcting their stupidity. They can get sued for this, and then they can get sued for the info leak. If I invested at that bank I'd be getting my money out while its still there.
"They confiscated everything, even the stuff we didn't steal!"
The lesson I got from this is as follows: If one ever receives information which appears to be sensitive, the only way to make sure one won't get their account shut down by the incompetent to send it is to post this information somewhere public, therefore negating any need to shut down your account (the information is already leaked out).
Now, if the poor owner of the account in this case did in fact retrieve this information, he could still spread it around as widely as he can, so he can go to court and say "You honor, I understand my account was shut down in order to prevent this information leak. I really want access to my personal email so I the only way to get it back I could see was to eliminate the reason to keep my account shut down. It is now no longer necessary to keep my account suspended since the information is already all over the internet."
OK some bank is stupid and some judge screw up. But why did they shut down the account instead of deleting the message?
I don't understand on what grounds the disclosure?
so, if you get sent, let say a bank balacne statement from somone else and some bank you don't do business with, to your (snail) mail box and you just disregard it as spam and further more you disregard anything else from this bank as spam as well (remember you do not do business with them), then a judge can rule that the mailbox is removed and that the postman can not deliver ANY mail to your mailbox anymore... ever again?
sounds interesting, tell me more about this.
this would mean no bills, no unwanted solicitations, no subpoena for that matter, NOTHING could be sent to you by mail, as you would not a an address that mail can be delivered to
How is the bank assuming google has the power to figure out the accidental recipient's real name and address, without going to court themselves?
There are two likely scenarios:
1. the innocent user threw away the email with the data considering it spam. (the judge's decision was unneeded)
2. the not so innocent user downloaded and stored the data on his own machine. (the judge's decision was futile)
The least likely scenario (0.1%) is that he still kept the sensitive data on the google account.
If they can order the removal of an account, why can't they order the removal of a single message???
Patents Drive Free Software as Hurricanes Drive Construction Industry
I would feel a whole lot better if the people that designed and willfully worked with this system would be punished.
Let's put the board of directors from the top fifty banks in the chair, gas or shoot them. Whatever works as a deterrent for the rest of those vultures.
Only then will it be possible to regain a little bit of trust in the system.
Everyone should shove their penis in a light socket and get over it! After that, taking a good healthy look at what the fuck is going on around here would be a good idea, oh and grow some common sense instead of thinking the government and people "above you" are to protect you from yourselves. The banks needs to explode, the government needs to implode and everyone else needs to suck a cucumber
Probably not. The judge in this case has "jumped the shark" and should be removed from office. Rally the voters and expunge this knothead from a position of authority that they are obviously no longer competent to hold.
Why can't the courts in these cases set up third-party intermediaries to receive the information that the plaintiffs are asking for (such as someone's personally-identifying information) and then have all communications go through that intermediary? This is just the same as e-mails from Craig's List users going through Craig's List instead of directly between the users. It could even be a system where no human ever sees the information. Instead it could be encrypted such that no one would ever be able to dig it out. Then the plaintiff could contact the individual and they could carry on a conversation and straighten things out, without the individual's individual dentifying information ever being disclosed.
Perhaps what we need is a government sponsored but publicly run (and open-source developed) central system to provide this service. It would have to be open ource so that anyone could check to make sure that the system didn't have any back doors.
Without a system like this, then the technique used by this bank technique could become a powerful tool to do an end-run around privacy laws. If I want to find out the personal information about someone, or even shut down their e-mail accounts or all of their internet access, all I have to do is claim to have accidentally sent them private information about someone else. Heck, I could just make up bogus info and send it to the individual. Who would know, because that info would be kept sealed "for the privacy of the people in the list."
Apparently the Judge was in his dorm room stoned when they discussed the fifth amendment.
The fifth... And the fourth. And fourteenth. And ninth ...
Personal address book has Megan Fox (foxy@gmail.com) and Corporate address book has Michael J. Fox (Michael.j.fox@bank.com or Lotus Notes/Exchange versions of address). CSR/PB creates a new message to send confidential information to âoeFoxâ by typing in Fox and hitting ENTER. Megan Fox populates the To: field and document is attached. Hit send and take a smoke break. This kind of thing happens all the time and not just at banks. I know folks that have gotten these emails but just continue on with their new identities.
Why did they send all that information to ANYBODY by email?
There is another possibility, that someone in the bank is a criminal, or that a criminal has somehow forced a bank employee to send the email.
In that case, the gmail account owner may or may not be intentionally involved.
Without more facts it is difficult to understand what is going on. Though it sounds bad, it is also clear that more is going on than has been reported, and there might indeed be a good reason why the court ruled to close the account.
... to use the internet as intended. I run my own mail server, thanks :-) If someone were demanding me to shut down my own accounts, well, at least I'd know about it and wouldn't just shut myself off without my day in court.
So was this a mistake or deliberate on the part of the bank employee? What possible email address could be the right one to send this data to? bob123@hmail.com ? And are we to understand that none of this is automated, when loan information on thousands of accounts is transferred from A to B the addresses are typed in by hand? And this information was being sent, why? What did these accounts have in common? How many of these transfers happen daily? The gmail account address came from somewhere; someone's address book, a mailto on a web page, something like that. Surely they already knew the identity of the account's owner. So, would it better for a bank to appear incompetent to its customers, or for it to be known that one of your employees was trying to commit identity fraud? Which one is more actionable on the part of the bank's customers? Of course you send a second email, to yourself, asking that you don't open the first email. That's just basic deniability in case you ever get discovered.
Something along these same lines happened to me a few of years ago. I have a gmail account and don't know the technical details of what I got these emails - my account name is aaaaa.bbbb@gmail by the emails I got had aaaaabbbb@gmail in the TO field. The guy (aaaaabbbb) must have been in the approval cycle for some type of account transactions at ICICI bank [perhaps this was about the time when the DOTs in the account names were made to not matter by gmail?]. I used to get emails asking me to approve certain transactions. This happened 4-5 times over a period of a year or so. First few times, I deiligently explained the situation in my reply mail, and CCed the postmaster@ the said bank. After getting a bit annoyed the last couple of times since this kept happening, I wrote back "Approved" (and after several blank lines, explained the situation again) and told them I'll ado that again in the future. I haven't seen any further messages in quite a while.
-srr
time to auto forward your gmails to hotmail, and auto forward that to ymail, and finally to your work mail, and your domain mail!!
the affected innocent account holder may not have the means to sue the shit out of that incompetent bank. public prosecution laws are needed to make sure that no party pulls out that kind of stunt on anyone, just because they have the money pull out shitty stunts on any 'small people' they think they may chew down.
its bank's INCOMPETENCE. TWICE. not only once. first, they were incompetent enough to have such lacking information security practices that someone was able to send critical data to a random email account on the web.
second, they were incompetent enough to actually file a suit to the end of hampering an innocent person's life, to whatever extent it may be. and it might be a serious extent, if that person was using his/her gmail account for serious correspondence. and this is despite the ethical concerns of doing something as such.
therefore, i call that bank INCOMPETENT, for that's what they are. anyone who is an account holder of that bank should withdraw their deposits from that bank, for, if their level of incompetence is that high, then it is sure that they are screwing up in many other respects.
public prosecution. we need public prosecution of people and organizations and corporations, in case they try to have their way with the law by filing suits that violate human rights and individual freedoms. they should get their ass fined out of their mouth, so that noone will attempt such shit.
Read radical news here
This makes me worry a bit... For a while now, I've been receiving the email of some guy who happens to have the same name I've got. Investment shit. At first, I'd notify the idiot who sent me it of the problem, and suggest they contact the guy directly to get a proper email address... But it just goes on and on. I've got no clue what the guy's email is; as the idiots sending the badly-addressed email won't say, and they're obviously not notifying the guy of the problem. So I've started just ignoring the damn things. Let him figure it out.... And now some douchebag american judge might get pissy with my email account because these idiots can't get it right? Makes me want to quit gmail and at least get back onto a canadian mail provider.
What would have happened if the person had accessed their email, using Outlook/Thunderbird and downloaded the offending email to their home PC (or mobile phone)? Would the court have had the power to seize the user's hardware to remove the files? What is the person (however unlikely) had a photographic memory and had read, memorized the information? I feel rather creeped out at the power that a court has to run roughshod over someone's rights when a bank makes a mistake like this.
I don't get why they didn't just tell google to go in and delete the mis-sent email(s) from the system? I mean, if they person didn't do anything wrong, why request that their email account be deleted entirely? If they're worried the user might have SEEN or copied them, the damage is done either way, the best you can do is remove access...so why have someone's account closed because you fucked up?
In fact, why didn't google suggest that, you know? "How about this, instead of you court-ordering us to delete someone's email account because you're a bunch of idiots, we'll just expunge the offending emails from the system, everyone happy?"
Friend: "The NIC is misconfigured..." Me: "No prob, I'll just telnet in and fix it." *Silence*
Block web access and email to and from their domain on our networks? Should it just quietly discard incoming email?
> The Reg's earlier story says, "Rocky Mountain Bank had asked to court to keep its suit
> under seal, hoping to avoid panic among its customers and a 'surge of inquiry'
"Yeah," said the bank's press agent, "No need to make a federal case out of...ahhh...nevermind."
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.