Goldman Sachs Demands Google Unsend One of Its E-mails

rudy_wayne (414635) writes A Goldman Sachs contractor was testing internal changes made to Goldman Sachs system and prepared a report with sensitive client information, including details on brokerage accounts. The report was accidentally e-mailed to a 'gmail.com' address rather than the correct 'gs.com' address. Google told Goldman Sachs on June 26 that it couldn't just reach into Gmail and delete the e-mail without a court order. Goldman Sachs filed with the New York Supreme Court, requesting "emergency relief" to avoid a privacy violation and "avoid the risk of unnecessary reputational damage to Goldman Sachs."

Comments

Reputational Damage

[what2123]

Ha. Hahahaha. Ha.

Re:Reputational Damage

[Anonymous Coward]

yeah.

Re:Reputational Damage

[bondsbw]

Not that I care a hoot about bad things happening to GS... not that I believe this should have been emailed...

But I wish it weren't so easy to send a message to an unknown address, particularly one on a different server. I'd almost rather have a separate protocol for sending to known/safe addresses than for unknown addresses.

Re:Reputational Damage

[ColdWetDog]

That's why there are TLD's just for that purpose.

Re: Reputational Damage

[JoeJohnson2175]

Actually, exchange server does have security to help inforce this. Maybe they need new IT policies.

Re:Reputational Damage

[ketomax]

Don't worry it will be automatically deleted after 30 days.

Re:Reputational Damage

[bondsbw]

I don't see how that would help this situation. The "testing" was an internal business process, not an email system test. The email was a report related to testing.

Re: Reputational Damage

[Anonymous Coward]

I'm not actually aware of any mail servers that DON'T have this functionality. Complete fails.

Re: Reputational Damage

[bondsbw]

In this case you are correct, and modern versions of Outlook and Exchange help warn users when sending outside the domain.

My complaint is more general, including personal mail. Email security in general use is little better than 20 years ago.

Re:Reputational Damage

[Krojack]

OOhhhh I get it... because Google marked it as spam.

Re:Reputational Damage

[Anonymous Coward]

That's why JPMorgan Chase has all email clients require confirmation for external addresses. And, anything marked private gets flagged and halted on the way out.

Hey GS IT get your act together.

Re:Reputational Damage

[datapharmer]

It is called a filter. We use them all the time. Add confidential, private, internal only and the email won't leave our domain. Why is it goldman sachs hasn't figured it out?

Re:Reputational Damage

[flyingsquid]

So basically what happened is that someone started typing an email to "Joeblow@gs.com" and got as far as "Joeblow@g" before the autocomplete helpfully added "gmail.com". And then they hit "send". Through a combination of carelessness and cluelessness, this employee managed to put hundreds of millions if not billions of dollars of customer funds at risk. Well, given what happened the last time Goldman made a mistake of this magnitude, it's clear that there's only one course of action for the company. And that's to give this employee a massive bonus.

Re:Reputational Damage

[lannocc]

It's a problem with your email client. Messaging and browsing clients are still somewhat in the stone-ages, IMHO.

Re:Reputational Damage

[Anonymous Coward]

But I wish it weren't so easy to send a message to an unknown address

It sounds like you have something misconfigured.

In Thunderbird, go to the "Tools" menu, "Account Settings" menu option, "Open PGP Security" page, and look at the checkbox next to "Encrypt messages by default." It think you may have that unchecked.

Make sure that box is checked.

Now go send a test email to a made-up bogus address. See the "Recipients not valid, not trusted or not found" message? That's what normally happens when you try to send a message to an unknown address.

HTH. If you're using something other than Thunderbird (yes, I'm aware there are scores of excellent mailreaders) chances are still really good you have an option like that one. This stuff got pretty mainstream about 20 years ago.

If your mailreader doesn't have that option, then it's time to upgrade to 1990s-or-later tech. You don't need to be bleeding edge, just get yourself to the late twentieth century and you should be just fine.

Re:Reputational Damage

[Anonymous Coward]

Why were they "testing" with sensitive information?
If your testing how to send an email attachment just send some bogus info.

Re:Reputational Damage

[Anonymous Coward]

TLD? tl;dr.

Re:Reputational Damage

[Em Adespoton]

What this also indicates is that "Joeblow@gmail.com" was already in the employee's address book, which means it is someone they correspond with. Given this, did the employee then contact that person and ask them to delete the previous email? I presume they did, and got a "fat chance" in reply. And if THIS was the case, you can rest assured that "Joeblow@gmail.com" has already saved the email elsewhere and likely forwarded it to other email addresses; so this attempt at a court order, while it may show that the employee was attempting to do the right thing (so protecting their job), won't actually accomplish anything in the name of privacy or "name polishing".

It's like Barbara Streisand has suddenly requested the world forget about her... and they have.

Re:Reputational Damage

[Em Adespoton]

Not that I care a hoot about bad things happening to GS... not that I believe this should have been emailed...

But I wish it weren't so easy to send a message to an unknown address, particularly one on a different server. I'd almost rather have a separate protocol for sending to known/safe addresses than for unknown addresses.

Email clients don't send messages to unknown addresses; the address was obviously known to the sender and had been the recipient of emails from them in the past.

But it would be nice to have something like "google circles" for corporate email, and have them enforced on the client -- that is, you cannot send an email to an individual without having first classified their address as having a specific relationship to you, and then you must click through a "send this to everyone with that relationship?" dialog before being able to send to the individual.

Of course, then you get into the issue of list cleaning, but this could also have the benefit of being able to encrypt the message against "group keys" -- something that would be transparent for internal mail, and would involve a one-time setup for external mail. Anything not at least doing key *signing* would be flagged for review prior to release; this would fix a large swathe of data leakage issues currently experienced by pretty much every company with an intranet out there.

Re:Reputational Damage

[bondsbw]

*facepalm* I'm not talking about me.

I'm talking about the billions of other email users around the globe who don't understand what PGP means or TLS or SMTP or anything that isn't the Send button. I'm talking about users who, like this guy, make very simple and understandable mistakes that could put many people and their possessions at risk.

Re:Reputational Damage

[bondsbw]

But it would be nice to have something like "google circles" for corporate email, and have them enforced on the client -- that is, you cannot send an email to an individual without having first classified their address as having a specific relationship to you, and then you must click through a "send this to everyone with that relationship?" dialog before being able to send to the individual.

Of course, then you get into the issue of list cleaning, but this could also have the benefit of being able to encrypt the message against "group keys" -- something that would be transparent for internal mail, and would involve a one-time setup for external mail. Anything not at least doing key *signing* would be flagged for review prior to release; this would fix a large swathe of data leakage issues currently experienced by pretty much every company with an intranet out there.

All of this was good and I highly agree that this kind of thing would be beneficial to all kinds of messaging protocols including email.

Email clients don't send messages to unknown addresses; the address was obviously known to the sender and had been the recipient of emails from them in the past.

What? This doesn't make sense one bit. I can email practically any email address on the planet.

Re:Reputational Damage

[Anonymous Coward]

Indeed. Everybody knows that Goldman-Sachs are nothing but a bunch of parasitic bloodsuckers. How can this leak damage their reputation even further? What does it reveal, that they eat children for breakfast to boot?

Re:Reputational Damage

[Iniamyen]

Why were they "testing" with sensitive information? If your testing how to send an email attachment just send some bogus info.

In the case of GS, these are the same things.

Re:Reputational Damage

[Cryacin]

Where's the undo button? Oh right, speed dial my lawyer.

Re:Reputational Damage

[Cryacin]

Somebody read the howto manual from Chernobyl.

Re:Reputational Damage

[Anonymous Coward]

Separate protocol? wtf are you talking about.

That would have absolutely nothing to do with an MTA. Maybe you can use an MUA that enforces a policy such as that one.

Re:Reputational Damage

[obarel]

Come on, can't you just let someone be condescending without replying with a perfectly reasonable explanation?
He gets to feel superior, you get to mumble something about idiots and reading comprehension, it's a win-win in my book.

Re:Reputational Damage

[antdude]

See, I hate those autoremember and autocomplete features. I disable those. Argh.

Re:Reputational Damage

[Em Adespoton]

All of this was good and I highly agree that this kind of thing would be beneficial to all kinds of messaging protocols including email.

Email clients don't send messages to unknown addresses; the address was obviously known to the sender and had been the recipient of emails from them in the past.

What? This doesn't make sense one bit. I can email practically any email address on the planet.

Context is king. You can email practically any email address on the planet, but your client doesn't autocomplete to some unknown person's email address when you begin to type an address into the address line. All addresses must be known to send them -- as you said, you can email practically any email address on the planet. Your client doesn't do it randomly for you by guessing what address you might want to send to (unless the address is already in the list of contacts you've sent to).

Re:Reputational Damage

[kaladorn]

Won't this strategy fail if the email address you don't mean to send something to IS a valid email in your address book? If so, you can still send the email to the wrong place pretty easily.

Autocomplete and lack of sleep once had me send an email to my Ex's Ex. The content was benign thankfully. They had very similar email addresses and names so I then changed one of them significantly and removed the other entirely from my address book.

Re:Reputational Damage

[Anonymous Coward]

If only I had mod points...

Re:Reputational Damage

[mikael]

Then you could always CC the email to a company mail distribution list. There have been times where sysadmins have updated the mail client to do this as default, only to shut down the system once there was a category 5 mailstorm across the network.

Re:Reputational Damage

[mikael]

Agreed. DOS mail clients from 20 years ago could handle hierarchical email discussions. But somehow 20 years on, we're back to a single list.
While you can create folders, you still have to move the messages manually, and then as soon as the title changes, it's back to the main list.

Re:Reputational Damage

[bondsbw]

True, but at least there are corporate policies in place at most companies to manage such a situation.

Want to keep your job and not be subject to criminal prosecution? Don't share any emails with trade secrets or other private info.

Besides, since we are talking about better systems, let's go ahead and make it more difficult to accidentally send mail to mailing lists. "This message will be sent to 'GS Employees', a mailing list with 32,912 users. Are you sure?"

Re: Reputational Damage

[Anonymous Coward]

Inforce? Wait to the spelling nazi's get hold of this one. I'm gonna let it slide, 'cause it happens to me all the time. Also I'm a Christian and it would be wrong to take you to task for such a transgression.

Re: Reputational Damage

[kenh]

Or, he just mistakenly typed '@gmail.com' instead of '@gs.com'

Before autocorrect, people used to make this kind of mistake all the time, it was so common we had a name for it - we called it a 'typo', and we were forced to take ownership of the mistake.

Now we either call it txt-speak or we blame it on auto-correct.

Re:Reputational Damage

[Neil Boekend]

Do you know the procedure for deleting an autocomplete contact in Outlook after you have send them 1 erroneous email?
Delete the entire autocomplete list.

Re: Reputational Damage

[Anonymous Coward]

Standard for deleting one autocomplete entry in most applications is .

Re:Reputational Damage

[benf_2004]

Deleting an entry from the auto-complete list in Outlook is very simple. http://office.microsoft.com/en...

Re: Reputational Damage

[Em Adespoton]

Knowing how corporate email works, it's highly unlikely anything past the @ sign was typed. For internal mail, you don't use @; more likely he typed in a name and his address book autocompleted it without ever displaying the actual address being sent to. Auto-complete isn't the same thing as auto-correct, and has been around since the 90's in corporate email clients.

But yes; it could be a new person being added to an email, and they hand-typed it for some unknown reason, and automatically added @gmail.com to the end.

Or it could be an employee who wanted to cc the memo to their or someone else's gmail account and is using this whole thing as the excuse, because they were found out.

But auto-complete is the most likely, as it happens constantly in all businesses.

Re:Reputational Damage

[lucien86]

You just have to ask Clippy.

Re:Reputational Damage

[iamhassi]

Didn't google ask for this?

Google: we can't do that without a court order
Bank: here is your court order
Google: WHAAAA?? Can't believe you just gave us a court order!
Bank: ....... O_o

Re:Reputational Damage

[Anonymous Coward]

Don't be silly - this is a contractor, not a manager. He'll be carrying a cardboard box of his things out the door by the end of the day. And working at another bank by the end of the week.

Re: Reputational Damage

[KevReedUK]

Do you know any users who HAVEN'T been conditioned into clicking "yes" to any such prompt? (Please note, I said users, not admins)

Re: Reputational Damage

[bondsbw]

You're right, it probably isn't the ultimate solution. Perhaps someone should also be in charge of such a mailing list and double-check anything that comes through.

Re:Reputational Damage

[RockDoctor]

Where's the undo button?

It's between your ears, above the access to the "Send" button.

There is this process called "reading", whereby you optically process the information on the screen (or even slices of dead tree) in front of you, perform OCR upon it (moving your lips while doing OCR has been optional for bit over a millennium), check the information in the message, and then only pick up your mouse and position the cursor over the "Send" button.

Surprisingly, many lawyers have at least a basic familiarity with this process. But it's not exactly a trade secret.

Slashdot offer a similar error-checking option near their "Submit button. So I'd better use it.

Re:Reputational Damage

[Neil Boekend]

OK, so they fixed it after I went for better pastures.
I would like to withdraw my previous post. Just pretend it isn't there or something

why?

[Anonymous Coward]

why would this moron do that ffs. thats a problem on their end not with google.

Re:why?

[Anrego]

This all seems fairly reasonable to me.

You have enough people doing enough things, eventually someone is going to make a stupid mistake. In hindsight there is probably plenty of stuff that could have or should have been in place to prevent this, but then there always is when looking back at a problem.

Google seems to be acting reasonably. Putting a process in place where companies can quickly and conveniently "take back" emails seems like a bad idea. Requiring a court order ensures that this goes through a strict process and is well documented. Google doesn't seem to be "fighting" this so much as saying "get a court to tell us to and we'll happily do it for you".

And I don't get the impression that Goldman Sachs is pounding their fists on the desk here either. They are doing everything they can to repair or prevent damage caused by a mistake they made. They are seeking out the court order and probably other stuff internally.

Re:why?

[oh_my_080980980]

Step back and see what Goldman Sachs is asking. What if they are lying? How does Google know what Goldman Sachs is asking is valid. What would happen if the user was suppose to get email, suddenly finds that email not longer present because Goldman Sachs or someone else asked Google to delete it.

Think Potsy, think.

Re:why?

[JaredOfEuropa]

The real question is: should the court order such an action, and under what conditions?

Analogy alert: GS mistakenly sends me a letter by physical mail, then asks the post office (or asks a judge to order the post office) to send a mailman round, break into my house, and retrieve the letter. That clearly won't happen; worst case is that the judge would order me to surrender the letter. In case of email, is Google (under their terms & conditions and the letter of the law) allowed to "break into" my mailbox and remove the offending letter? And should they be?

Re:why?

[gman003]

Well, that's what the court is for. They get to decide if deleting this email is the right thing to do or not.

Who else would you suggest? Goldman Sachs is out, obviously. Would you rather Google be the one to decide?

Re:why?

[Anrego]

Or what if this email was going to be evidence in a case against Goldman Sachs.

This is exactly why this goes through the courts. Sorting stuff like this out is kinda why courts exist.

Re:why?

[tiberus]

Granted it all seems reasonable, the issue I see is that it's not practical. You can't un-send an e-mail, not really. I have to control my desire to chuckle, in that sad sort of way, every time we get this sort of request internally. Unless the message was just messed in some way that keeps it from being sent, it's gone pretty much as soon as you hit send. We don't have a practical way to pull it off a system that isn't running Outlook (and even then if it's been read, it's a no go) and if the recipient has a Blackberry, pretty much all bets are off. I'm left wondering what real result or final state Goldman thinks they are going to achieve, the damage is already done. P.S. Wondering why anyone at Goldman ever sends anything to a GMail address . . .

Re:why?

[rolfwind]

Is google gonna have to run tech support everytime someone mistakenly sends an email?

Should the USPS intercept a letter upon request everytime someone made a mistake in sending it out?

No, it's not doggone reasonable. In fact, it's so unreasonable, that only a company with the pull of Goldman Sachs can demand it.

Do you think you go to google with the same request, they'll bow down to you? Do you think the courts would have granted it so fast?

Of course not, because it's a drain on their resource to help some dumbass rectify his own damn mistake.

Re:why?

[Roadmaster]

Not an entirely accurate analogy. You own the house (and even if you didn't, the *mailbox* from which you retrieved the letter is distinct from the dwelling where you're likely to store it afterwards).

In gmail's case, google *owns* everything, and they just let you use the storage and mailbox assigned to you. So given a court order, they could remove the email without technically accessing anything that's actually yours.

Now, if the recipient makes a local copy, then your "break into my house" analogy would be more accurate, applying to the copy in the recipient's system.

Re:why?

[Anonymous Coward]

Your analogy would have been perfect, except for the "break into my house" part. In this case, the mailbox is the one at the post office that you're renting from the man. Does the mailman have access to your pobox? Yes, at all times. Can they recover an item from there without breaking into anything? Sure, it is even in your rental contract.

Does all of this make sense with e-mails, which can be downloaded, saved and such?

No, not at all.

Re:why?

[Wycliffe]

I agree. I think the most reasonable action is to try to contact the owner of this email address and explain the situation.
Maybe give him $1000 to sign a retroactive non-disclosure agreement. Odds are it's just a random normal person
that would gladly take $1000 to keep quiet. I get confidential emails for a large company that has a similiar domain
to one I own all the time. I probably average about 20 a day. I sometimes notify them but I mostly just delete them
and move on with my day. I sometimes feel bad as many of them are things like "I didn't receive my shipment" but
it's no different than it going into a black hole elsewhere and never getting read.

Re:why?

[Pieroxy]

As always, the analogy is flawed.
If the court ordered someone to break into your house and delete the attachment you saved locally, your analogy would hold. As it is, what GS is asking would be analogous to the court ordering the post office to remove the letter from your PO Box. Seems much more reasonable to me.

Re:why?

[Anonymous Coward]

This all seems fairly reasonable to me.

You have enough people doing enough things, eventually someone is going to make a stupid mistake. In hindsight there is probably plenty of stuff that could have or should have been in place to prevent this, but then there always is when looking back at a problem.

Hindsight?

You know, I could have sworn we enacted a few policies at some pretty high levels with regards to how financial institutions protect private information...

Not to mention any sort of internal corporate mandate for encrypting sensitive documents, especially when using a known open medium such as email...

But what the fuck am I saying...we're talking about a financial institution that was involved in one of the largest financial scams of our time, and got away with it cleanly. Profited even.

When you end up profiting not following the rules, it should come as no surprise that shitty habits tend to get shittier for greedy elitists.

Re:why?

[Anonymous Coward]

Here is a lesson from this:

This is why divisions with critical info use some form of IRM/RMS. A mistake with a document being sent results in an encrypted document landing in the destination mailbox. Not a good thing, as the name and length of the file is readable... but not a complete leak either -- damage is mitigated. Plus, in Outlook this is as simple as clicking "do not forward" when attaching a document.

The parent has it right. These are two companies doing proper process/procedure to deal with a fuck-up, and nothing more.

Re:why?

[Bengie]

Not to degrade your analogy, but if you get mail in your mailbox and it doesn't have your name or an exception like "or current resident", it's a federal crime to open it. I could get prison time for opening mail that is addressed to only my wife.

Re:why?

[fustakrakich]

Requiring a court order ensures that this goes through a strict [corrupt] process...

Because we all know the courts never just rubber stamp orders from powerful people. This is how the "right to be forgotten" will evolve. Goldman Sachs would like nothing better than to have K's flashy thing to help us forget we elected it to be king of the world.

Re:why?

[Imagix]

Unfortunately your analogy is also flawed... the mail _was_ addressed to the recipient. GS "wrote" the wrong address on the envelope.

Re:why?

[jcochran]

Ah, but by definition, the email that the unmentioned gmail.com user has is addressed to him or her. GS may have made a mistake in the address they sent it to, but it IS addressed to that gmail.com user.

Re:why?

[Anonymous Coward]

The real question is: should the court order such an action, and under what conditions?

Analogy alert: GS mistakenly sends me a letter by physical mail, then asks the post office (or asks a judge to order the post office) to send a mailman round, break into my house, and retrieve the letter. That clearly won't happen; worst case is that the judge would order me to surrender the letter. In case of email, is Google (under their terms & conditions and the letter of the law) allowed to "break into" my mailbox and remove the offending letter? And should they be?

Believe it or not in some countries e-mail is treated the same way as regular mail in law. You can be sued and ordered to destroy any copies you may have made of it legitimately such as by backing up your hard-drive. In Iceland a guy just got sued by a businessman who sent this guy an incriminating e-mail by mistake, the guy then passed the mail on to his friends and duly got sued for breaching telecommunications laws when one of the copies found it's way onto the desk of a special financial crimes prosecutor. Even if you duly destroy the e-mail the sender can still SLAPP sue you at a later date, he might loose the lawsuit but you'll still have to lay out large sums of money for lawyers.

Re:why?

[Monoman]

It makes sense if the email hasn't been retrieved yet. GS wants SMTP to have a Recall Unread Message feature which it doesn't. So in the meantime, they expect Google (or the postman) to do the retrieval for them. Should this be possible? Sure, for a fee until SMTP (or another protocol) will let users recall their own messages.

FWIW - You can recall internal messages with Outlook/Exchange. I'm sure others do it too.

Re:why?

[Anonymous Coward]

It's not at all like being given permission to break into your house. They almost certainly don't even look at, touch, or otherwise have access to your email since they can just find it by an id or regex, and the item they're looking for isn't yours (if the court determines so).

So a more apt analogy would be that they mistakenly put something into a lockbox at the bank in your name, which you've never used before and otherwise sits empty, and are asking the bank to remove it before you go there and take their item out.

Re:why?

[N1AK]

You might benefit from following your own advice. He's supporting the idea that the correct channel for this is for GS to have to get a court to agree to order the email be removed. He made no judgement on the obvious theoretical issues, which you seem to think are novel insights, because it is self-evident that a court can and should examine these matters before it orders Google to do anything.

Re:why?

[Anonymous Coward]

This is a popular myth but only true in limited circumstances depending on your local state laws. Federal law prohibits you from interfering with the delivery of the mail to its intended mailbox not recipient. What this means is that, from a purely federal standpoint, if you own the mailbox that the mail is delivered to, properly addressed regardless of name, then you can open the mail.

Now the big question, is what are your state laws. Some states do in-fact, prohibit a person from opening mail that is not addressed to them, in which case it would still be a crime to open your wife's mail.

As always IANAL, just been in the legal field for a decade.

Re:why?

[N1AK]

The real question is: should the court order such an action, and under what conditions?

There is considerable difference between the two cases. Post is only more controversial because it requires someone to trespass, and potentially break and enter, your physical home. If the post service could 'vanish' your paper letter by pressing a button then I'd suggest that yes it should use that ability when a court decides there is sufficient need rather than involving an innocent third party in a technical legal issue.

If GS can persuade a court that the letter was of no interest to the recipient, and that its distribution breaches the rights of someone else then in 99.99% of cases requiring a potentially global manhunt to find the recipient and order him through the courts to delete the email is a monumental waste of money and a burden on the third party. In the small fraction of cases where the recipient cares then one would hope they would be informed of what has happened and have the chance to appeal the removal.

Re:why?

[X0563511]

How would you feel if the postman was just supposed to check to see if it was still in your box, and take it if it was?

I'd be fine with that, provided a court was the one to decide it should be done.

Your gmail account is your mailbox, not your house. If you were to save the contents of that message somewhere else, that would be akin to bringing the letter inside from the mailbox.

Re:why?

[Anonymous Coward]

"You have enough people doing enough things, eventually someone is going to make a stupid mistake. In hindsight there is probably plenty of stuff that could have or should have been in place to prevent this, but then there always is when looking back at a problem."

You got a solution to fix stupid? Please, tell me more.

Re:why?

[grahamm]

I disagree with your disagreement of the analogy. What if your house is rented or you have put the physical letter is in a safety deposit box in the bank? In both these cases the physical location is owned by someone else and you are just renting the space. Is this any different from you renting the e-mailbox space on the google (or other ISP) servers?

Re:why?

[IronChef]

> That clearly won't happen

Not until Scalia gets the case!

Re:why?

[Noah Haders]

If someone offered me $1000 to NDA an accidental email? Then I'm sure they would also offer $10k or more.

Re:why?

[nospam007]

"Some states do in-fact, prohibit a person from opening mail that is not addressed to them, in which case it would still be a crime to open your wife's mail."

It IS addressed to him, that's sorta the point.

Re:why?

[Stewie241]

It depends how the headers were populated. It is possible to include both a recipient name and a mailbox specification in RFC 822. If it was addressed like:
Jane Smith then one could argue John Doe should not open the message.

As crazy as it sounds to do something like this on the Internet, there is precedence in some messaging services. Skype, for example, lets you delete messages after they have already been sent. Obviously there is no guarantee that the other person didn't read it yet, but if not, then it is effectively unsent. If it had been read, the other user has to go by memory unless they copied and pasted the email.

Google has the ability to do the same thing with mail sent to a GMail account in many situations. IMAP clients will tend to sync up and would likely go and remove the message at the next sync. If the user had not read it yet, it would be effectively 'taken back'. If the user had opened and taken a cursory glance at it they would in essence accomplish the same purpose. If the user has a POP client they are obviously out of luck.

What I wonder though is what sort of data it is and whether this is a sole measure of protection or an additional measure. Depending on how quickly they discovered the error and got a hold of Google, there is likely a very slim chance the message wasn't read at all. Further, they have no guarantees that the message wasn't copy and pasted or otherwise stored. Perhaps it is a best effort type of deal.

Re:why?

[Chris Mattern]

Most people use Google mail by simply accessing Google's servers via web. Since the email is stored on Google's own server, they can delete it. Now, if it had been *me*, they'd have been SOL, because I have all my Google mail forwarded to my private IMAP server, and it's out of Google's hands. But the average Gmail user, yeah, Google would be able to kill the mail.

Re:why?

[Wycliffe]

If the email contained credit card numbers and such and you don't want to go to jail then $1000 is fairly generous.
You could possibly figure out how to sell it on the black market but most people are not willing to break the law and
risk jail time especially if their identity is already known. Now, on the other hand, if it's stuff that I could sell to a
newspaper about corruption then I would probably be willng to sell it to the highest bidder.

Re:why?

[pscottdv]

You're analogy is great. Now imagine GS calls the post-office and asks them to pull a letter out of your box. What is the proper response of the postmaster?

Re: why?

[Anonymous Coward]

You wouldn't have to sell the credit card numbers on the black market you idiot. Contact CNN and sell them the story that a large investment bank just emailed confidential customer information. The confidential information never needs to be published to do the damage.

Re:why?

[war4peace]

Is this any different from you renting the e-mailbox space on the google (or other ISP) servers?

Yes. It's called "Contractual Terms" or "EULA".

Re:why?

[war4peace]

He's an analogy? Damn!

Re:why?

[Anonymous Coward]

I wonder how this will be dealt with if it is sitting in an ost or pst file on someone's hdd now. (I need to check this but... ) If a company sends you an unrequested package using Royal Mail in the uk, they can't just request you pay for it or return it... it has been sent to you and is now yours.

hmmmm... I'm off to check my gmail account :)

Re:why?

[war4peace]

Maybe. The GP raises an interesting point though.
Is the "address" (johndoe123@example.com) the same as its user (Mike Somehow who uses the previously mentioned e-mail address)?
Real life example: I rent an apartment which was previously occupied by a foreign citizen. I receive snail mail addressed to:
- The owner
- Previous renter
- Me
- My wife
- Unspecified recipient (SPAM)
- Others (named people who don't live at my address).

I am legally entitled to open mail addressed to me and "unspecified recipient". Now, in case of an e-mail address, the same could apply. The actual recipient might not be the one who "lives" there, and there might be elements that specifically mention a different recipient than me. Since an e-mail is a non-physical item, I can't really "return without opening" but I could destroy it (after or instead of reading its contents).

Is this covered by the GMail EULA? I confess I've never read the whole damn thing.

Re:why?

[pscottdv]

:-)

Re:why?

[BronsCon]

Yes, in the case of Gmail, the property in which the letter is stored (your inbox) is owned by the deliveryman, who does have legal access to that inbox. That's the difference.

Not that they should be allowed to; and it seems they know this, which is why they're insisting upon a court order.

Re:why?

[Anonymous Coward]

This is a very good analogy, but it is flawed. The mailbox is under the control of Google, not "in your home". To use your terminology, it would be like GS sending a letter by mail to your P.O. Box. Then the judge orders the post office to access that P.O. Box and remove the letter.

If you want the "breaking into your home" analogy, I'd say that would be more like if the recipient of the email had saved a copy to their local computer (read: put it in their home). Then if Google were to hack into the computer to remove that downloaded copy (read: break into their home), your analogy would be much more correct.

Re:why?

[EvilJoker]

For the physical analogy, it may not always be that simple. There was this case, but there were more details involved.

Re:why?

[Anonymous Coward]

If I were to get an emergency court order, I expect Google would comply. The only reason the Goldman Sachs name matters that I see (beyond "soft power" in court) is that it got attention. If a random user were to contact Google they wouldn't get such an immediate response of "get a court order." If a random user were to go to court for an emergency court order, it would be much harder to get attention.

That being said, if a did know to go to the courts, and did get a court order, I expect everything after the court order would be exactly the same. Being Goldman Sachs only ensured they got attention, not that some "special, trans-legal process" took place. (I hope...)

Re:why?

[Noah Haders]

If the email contained credit card numbers and such and you don't want to go to jail then $1000 is fairly generous. You could possibly figure out how to sell it on the black market but most people are not willing to break the law and risk jail time especially if their identity is already known. Now, on the other hand, if it's stuff that I could sell to a newspaper about corruption then I would probably be willng to sell it to the highest bidder.

No, I'm not talking about selling the email on the black market. I'm saying if somebody offered me $1000 to sign a retroactive NDA I would treat that as a first offer, and a lowball at that. I'm not compelled to sign an NDA, and I don't have to if I don't want to. I don't even have to read the email, I can just move it to my computer and let it sit there. I would probably zip it up and let the zip file show the date of compression. then I would bargain.

think of it another way. If GS is sending its lawyers to court to get a court order to compel google to do this, then they're already spending $50k in lawyer fees I bet ($500/hr * 100 hours add up). So this is a high value email. From my perspective, if they were to give me enough to pay off my mortgage, I would feel pretty happy and in my happy state would be amenable to entering a contract.

on the other other hand, I'm not going to sign a contract with GS lawyers without a lawyer of my own, so I'm going to have some costs on my side as well that need to be made whole.

so yeah, show me the money.

Re:why?

[Anonymous Coward]

So, give them 10k and save 10 times that on lawyers.

Re:why?

[Anonymous Coward]

The real question is: should the court order such an action, and under what conditions?

Analogy alert: GS mistakenly sends me a letter by physical mail, then asks the post office (or asks a judge to order the post office) to send a mailman round, break into my house, and retrieve the letter. That clearly won't happen; worst case is that the judge would order me to surrender the letter. In case of email, is Google (under their terms & conditions and the letter of the law) allowed to "break into" my mailbox and remove the offending letter? And should they be?

WHOA, that gmail inbox is not owned by you, for one thing. If something was misdelivered to the wrong USPS owned box in a housing subdivision, they would likely undeliver it under the same pressure.

Re:why?

[guruevi]

Why wouldn't you be allowed to sell sequences of numbers you have received in the mail?

Re:why?

[meerling]

Good point. What if it's proof of illegal activity. The account holder should forward it to the police, several different news outlets, and wikileaks just in case. ;P

And then do it again using something other than Gmail just in case they put up a filter to prevent that.

As far as I'm concerned, Goldman Sachs totally screwed up by sending confidential information to a member of the public in the first place. Their error is not sufficient reason for Google to panic or violate the trust of their entire user base just to fix someone elses stupidity.

Re:why?

[meerling]

Can, Should, and Will Only Due So With A Valid Court Order are very different things.

Sure they can, but how do you think every user of Google products will think if any company out there can say, "oops, didn't mean to send that, google, go fix my screw up and delete that from peoples inboxs."?

Should they do it? Maybe, but again, at this point we only have Goldman Sachs word that they 'should'. Maybe their entire story was fabricated and it was proof sent out by a whistleblower. Maybe it wasn't sent by a whistleblower, but it is proof of illegal activity that should be turned over to the appropriate legal or regulatory agency. We only have the companies word for it, and do companies ever lie about stuff like that?

So Google is going with "Will only due so with a valid court order" on this. Good choice. You won't piss off the customers because a court made you do it, and you won't get yourself in legal trouble because a court made you do it. Yep, this is the right choice if they have any functioning brain cells at all.

There's also a fourth option of just plain refuse. Claim the mail system is sacrosanct and it won't be messed with. Of course there are two big problems with this. First is almost nobody will believe you. Second is you are then looking at a big as legal battle you probably won't win because you are not the federal government. That's why I didn't list this one in the beginning, though I did mention it at the end to avoid having a million responses pointing this one out.

That's my say, disagree or whatever ;)

Re:why?

[Anonymous Coward]

>>You got a solution to fix stupid?

Hang a few to "encourage" the others. (cf Voltaire)

Re:why?

[Noah Haders]

So, give them 10k and save 10 times that on lawyers.

small minds think small. this email is very valuable to GS, or at least the costs of it getting 'out in the world' are very high. They're spending mad money on lawyers and they don't even know if anybody recieved or read it! It could be an old or unused account, or the email could be deleted right away.

now imagine if you're the recipient, and you let GS know not only that you recieved the email but that you know it's a valuable email and you saved a local copy. Now GS has crazy amounts of incentive to get you under contract to keep it confidential. I would be negotiating to get this amount.

true, they could try to do it the hard way, and sue you instead, or try to sic the cops on you, or whatever. But they know there will be a Streisand effect and even if they squash the email, the story of them going after the email will get in the wild which will be expensive in terms of bad press.

so i would say the guy with the email has some pretty good leverage, and he should use it to get as much as he can.

Re:why?

[canajin56]

I could get prison time for opening mail that is addressed to only my wife.

No you couldn't. Well, I'm assuming you live with your wife and didn't steal the letter from her mailbox. The relevant law is 18 USC S 1702 "Obstruction of correspondence"

Whoever takes any letter, postal card, or package out of any post office or any authorized depository for mail matter, or from any letter or mail carrier, or which has been in any post office or authorized depository, or in the custody of any letter or mail carrier, before it has been delivered to the person to whom it was directed, with design to obstruct the correspondence, or to pry into the business or secrets of another, or opens, secretes, embezzles, or destroys the same, shall be fined under this title or imprisoned not more than five years, or both.

Notice that it includes taking, opening, and destroying, all equally. If it was a felony to open your wife's mail, it would be an equal felony to remove it from the mailbox and bring it inside. It's not a felony. Mostly because this only applies while the mail is in the possession of the post office. Contrary to a related urban legend, your mailbox is not considered property of the post office. Once the letter is placed there, it is considered delievered. Taking mail from somebody else's mailbox is considered "theft" which is not a federal crime. Some states make mail theft worse than regular theft, but it's stealing regardless.

Because the law is "delievered to the person to whom it was directed" it is may still be considered "obstruction of correspondence" if you open or destroy somebody else's mail, if it was delievered to you accidentially. However, the key is still that your intent was to prevent them from getting the mail, or to pry into their secrets. If you get a letter, open it, and realize "hey, who is this from?" you are not a felon. You still need to get it back to the post office so they can deliver it properly (if they put it in the wrong box) or return it to the sender (if the person has moved without a forwarding address), otherwise you are obstructing the deliever (this is the "secreting" part of the law). But again, the law requires intent. It's not a crime if you just forget to do it.

Re:why?

[gbjbaanb]

or let me put it this way, they offer you $1000, and you say "no way dudes, I want $10,000 or the puppy gets exposed to the world". Next thing you're up on blackmail charges. They have their own lawyers already paid for, so using them against you is just business as usual for them.

Take the $1000 and don't be a dick about it.

Re:why?

[Roadmaster]

Righto, unless you're renting your house from the postal service, or are using their "USPS bank" for your safety box, they are completely different entities, so I still maintain it's a bad analogy. Google owns both the post office and the safety deposit box where you put your letter.

Re:why?

[Noah Haders]

no man, you just don't get it. here's how I would do it:

"hey, i hear where you're coming from, it's an easy mistake to make and I've done it before. And I understand that because it's so sensitive you're not comfortable unless you have an NDA in place. But if you want me to sign a binding contract then we need to come to an understanding of the value of my participation."

only a chump takes the first offer. if you ask for too much it's not like they're going to get offended and walk away.

Re:why?

[Anonymous Coward]

Rest assured GS will have to pay for the cost of removing that e-mail, which will probably involve legal fees as well.

It's a drain on GS resources alone.

Re:why?

[slimjim8094]

FYI, the US post office considers itself the owner of your mailbox. That's why it's a felony to steal somebody's mail - you're stealing from their property. The analogy is actually pretty accurate - the "post office" owns the mailbox and only the recipient can remove stuff from it without a court order.

Citations: http://msgboard.snopes.com/cgi-bin/ultimatebb.cgi?ubb=get_topic;f=107;t=000617;p=0 and http://www.mackinac.org/5394. Both have a lot of people complaining about it but it seems to be true.

Re:why?

[BronsCon]

You, sir, fail to recognize the difference between a house and a mailbox. Once you understand the difference, you'll see why the analogy fails.

Re:why?

[HornWumpus]

Are you 12?

In a situation like this there is no need to say the threat out loud.

Lawyers are experts at blackmail without crossing the legal line into blackmail. In this situation the first place to go is a good lawyers office.

Offer the lawyer a % of the settlement, so he will truly rape GS for you.

Re:why?

[farble1670]

sigh. it's sad that's where your mind goes.

Re:why?

[Noah Haders]

why? it's not like we're dealing with a little old lady or a church. if goldman sachs wanted to cut a deal with me, why wouldn't I exploit that as much as possible? I have no inclination to do them a solid.

my brother, who works in finance, has a favorite expression for when he gets the extreme upper hand in a deal. "ripping their faces off".

Re:why?

[Bucky24]

What about a mail slot that is built into the house?
...
Hmm I actually decided to read the article cited (thanks for citing it :D) and apparently a mail slot built into the house is NOT property of the US Post Office.

Re:why?

[farble1670]

first, you do realize what you suggest is called extortion, and it's illegal obviously. for a minute i was thinking that was your line but i guess not.

if goldman sachs wanted to cut a deal with me, why wouldn't I exploit that as much as possible?

if you saw someone drop $20 on the street, would you pick it up and walk away?
if you saw an unlocked car w/ a briefcase, would you open the door and take it?
if a business left their bank bag on the counter unattended, would you grab it?
if you were a used car salesperson and had the opportunity to unload a lemon on a young, first time car buyer, would you do it?

with your attitude, the answer to all these questions is "of course, why wouldn't I"? the reason you wouldn't is because you realize that we live in a society and despite laws and law enforcement and courts, it largely depends on people "doing the right thing" to maintain order.

for most of us, this is just ingrained in our personalities. call it empathy. we subconsciously put ourselves in the place of others and give it the "how would you like it?" test. i know this type of thinking is completely alien to you, but i just wanted to give you a little glimpse into how the humans think.

my brother, who works in finance, has a favorite expression for when he gets the extreme upper hand in a deal. "ripping their faces off".

i'd love to get your parents in a room and just tell them what a great job they did on you and your brother. clearly upstanding, pillars of our society you two are.

it's not like we're dealing with a little old lady or a church

GS is an investment firm that manages the money of many old ladies and churches, so yeah, you are dealing with them indirectly.

Re:why?

[Noah Haders]

meh. in this scenario they're asking me to sign a contract, something I'm by no means obligated to do. This contract puts me at risk for significant penalties. I want to be compensating for taking on this extra risk.

by no means would I ever shop around the info or try to sell it. I never said that. That would be unethical and unnecessary. If it said something controversial I may leak it to a news agency, but not sell it to them either. I'm an upstanding person. Aside from that, goldman can kiss my ass.

Re:why?

[TemporalBeing]

The real question is: should the court order such an action, and under what conditions? Analogy alert: GS mistakenly sends me a letter by physical mail, then asks the post office (or asks a judge to order the post office) to send a mailman round, break into my house, and retrieve the letter. That clearly won't happen; worst case is that the judge would order me to surrender the letter. In case of email, is Google (under their terms & conditions and the letter of the law) allowed to "break into" my mailbox and remove the offending letter? And should they be?

You analogy would be better if the mail had been left in the mailbox, which is regulated by the USPS and Federal Law, and which the postman has rights to access.

So it would be more like:

GS sends you a letter by mistake. They get a court order to order the USPS to remove it from the mailbox that they put in it, which happens to be yours. The postman then looks at the contents of the mailbox, verifies it is still there, and then removes it, sending it back to the sender or as otherwise directed by the courts. If, however, you checked your mail and took the mail out and into your house, then there is nothing for the USPS to do - it is no longer in the mailbox. If, however, you keep all your mail in your mailbox then the USPS would be within their ability to remove it from the mailbox.

So, to keep all your e-mail on Google's servers (or any ISPs servers) opens up the opportunity for this to happen. To keep the opportunity from happening then you need to download your e-mail from anyone else's servers and store it locally, deleting it from the providers servers after you have your local copy.

Alternatively, you can rent your own server and host your own e-mail server; but then you get into another situation in which the service you are renting from may be required by the courts to turn over the server to the courts, or get shutdown and you've now lost everything except what you had backups for. And yes, that has happened where the FBI shutdown a hosting provider and took all the servers in order to get to one of their clients; everyone else was screwed for a while.

Wanted!

[Anonymous Coward]

Did you get that email? I will offer $1000 for it.

Non-story.

[u38cg]

Already blocked

Re:Non-story.

[mwvdlee]

Just because an issue was quickly resolved doesn't make it a non-story.

If Goldman Sachs uses the insecure SMTP protocol to transmit highly sensitive unencrypted data, they deserve the reputation damage (and a security audit).

Re:Non-story.

[wonkey_monkey]

That doesn't make this a non-story, only a slightly out-of-date one.

Re:Non-story.

[Anonymous Coward]

I hope they charged GS a tidy fee of at least 1mm for this blocking service.

Re:Non-story.

[Nos.]

First, nowhere does it say they were using SMTP, at least not that I saw. They are likely using SMTP with TLS.

Secondly, they had intended on sending that document within their own domain, which likely means it wouldn't have left the control of GS anyways. I'm not saying this is the best way to do things, but it's not necessarily insecure.

Re:Non-story.

[Anonymous Coward]

Sure. Everyone should send PGP-encrypted e-mail using IMAPS and an open source operating system, preferably running the Linux kernel. Meanwhile, in the real world...

Re:Non-story.

[Anonymous Coward]

The mail was sent June 23rd, that is not quickly resolved.

Re:Non-story.

[mwvdlee]

Assuming the data was in some attachment (of could have been easily put in an attachment), how about just encrypting the attachment if it contains information so incredibly sensitive that it warrants a court order if it ever leaks out.

You don't need PGP, IMAP or any specific OS, just a small bit of common sense.

Re:Non-story.

[SpzToid]

Now I want this interesting new gmail feature for my own personal use too! Call it beta if you want, go ahead, it seems to be working well enough already.

Who should I address my own Feature Request to at the GOOG? Maybe Fat Chance?

Re:Non-story.

[Impy the Impiuos Imp]

' Google said, "The Gmail account, DummyThrowawaySoICanSignUpForBigBrother9LiveFeed@gmail.com, had not been accessed in quite some time." '

Re:Non-story.

[Charliemopps]

Already blocked

Yea no, the idea that blocking the email relieved the privacy concern is a joke. They sent that "massive privacy leak" or whatever, over the open internet. In fact, it sounds like they are routinely doing this, and their only concern is that they sent it to the wrong address. The real story here is that Goldman Sachs is sending this kind of info via email!!! In my job, if I were to send even your name and address via email outside our corporate network I'd be fired on the spot. The email traversed dozens of potentially compromised pieces of hardware on its way to google. There's no way to tell which route it took on the way to google. Goldman may think they have a peering agreement with google, but if they had an interface down on a core router when that email was sent it very well may have hit the open internet to get there. Blocking the email did absolutely nothing, the security issue is still real and the victim should still be notified. The fact that Goldman Sachs thinks this fixed the problem just means Goldman Sachs security controls are a joke.

Re:Non-story.

[Thud457]

You don't need PGP, IMAP or any specific OS, just a small bit of common sense.

Who needs common sense when you can hire an army of lawyers to clog up the courts with your idiocy?

Re:Non-story.

[phorm]

[Some of your emails have been removed at the request of the sender. For details on the email removed, please check the following link]

Re:Non-story.

[LordLimecat]

Was there a court order, or not? Reuters does not make that clear.

Re:Non-story.

[Bill, Shooter of Bul]

Yes it is. Becuase it was.

Its like trying to tell me how Target's POS systems were not necissarily insecure prior to the breach.

Re:Non-story.

[Anonymous Coward]

I use S/MIME on as default for everything, so the time/effort it takes to encrypt a document on my part is effectively zilch, once I make sure that I have the recipient's key. It can't get any easier than that.

Re:Non-story.

[Anonymous Coward]

As the summary states, the intended destination was their own internal email server... no external networks involved.

Re:Non-story.

[Anonymous Coward]

It has also notified us that the email account had not been accessed from the time the email was sent to the time Google blocked access. No client information has been breached

Yeah right. It just means it was *only* leaked to Google employees, not to a stranger on the internet.

Re: Non-story.

[Anonymous Coward]

This. S/MIME on OSX (cue the haters) is baked-in, transparent, and absurdly easy to set up; the hardest part is getting a certificate. Still, I think GS could have handled this better with a document server: email shouldn't be used for sensitive documents, but some form of document server can allow sharing thst's restricted to internal IPs/logins.

Re:Non-story.

[Solandri]

This is something that's bugged me about people (ab)using email. This sort of stuff doesn't even need to be "sent". Presumably anyone with a GS brokerage account has a login to some place on the GS website. The email should just be a notice that some new important information is available, and they need to login to their account and read it. (If they don't and they lose money because they didn't, then the fault is theirs.)

People seem to have long forgotten that email isn't secure. As we used to say in the 1980s, sending someone an email isn't like sending a letter in a sealed envelope. It's like sending a postcard - anyone along the route the email takes to the final recipient can read it.

In this particular case, if you've got the same information which needs to be read by multiple recipients, email is a stupid way to do it. Why make x copies and send it to the corners of the world via the Internet, when you can put just one copy on your company's website and only authorized people can view it after logging in? Multiple recipients for an identical large or important file should immediately equate to "not for email" in your mind.

Re:Non-story.

[Anonymous Coward]

Goldman Sachs are the ones doing the audits mate, you're forgetting which world you live in.

Too late now

[itzly]

If this is interesting information, it has already been copied from the Google server to somebody's personal computer.

Re:Too late now

[Anonymous Coward]

Exactly what I was thinking. If it came to me by accident, it would automatically be downloaded into Mail, then within the hour, just as automatically be safely backed up to Time Machine. What then? Heck, if I might not even see it for days, since I use email for very little and nothing important.

Re:Too late now

[KiloByte]

No -- according to the updated article, the account hasn't been accessed between the mail was sent and Google breached it to comply with Goldman Sachs' demand.

Re:Too late now

[Anonymous Coward]

Yep. All this article convinced me to do is to start automatically backing up "my" gmail.

Re:Too late now

[Grauwyler]

Google didn't mention if they checked to see if the user account is set to automatically forward all mail to an external mailbox.

Yeah

[boristdog]

Barbara Striesand never returns my e-mails either.

Re:Yeah

[Anonymous Coward]

Barbara Striesand never returns my e-mails either.

Yeah, with her being capable of morphing into Mecha-Streisand you'd think she'd at least be running a mail client.

Re:Yeah

[tquasar]

Thanks for "yeah". What the heck does yea mean" Ya? Da? Yay? Ye'all? Dunno.

E-mail?

[Scutter]

Massive privacy breach....e-mailed a report...containing sensitive details...e-mailed...

The problem here isn't that it was sent to the wrong account. It's that it was e-mailed AT ALL.

Re:E-mail?

[MikeBabcock]

Good luck explaining this to companies ... I'm still working over people who insist on sending confidential Excel spreadsheets by E-mail.

Re:E-mail?

[Dr. Evil]

"testing internal changes... with sensitive client information"

Should violate all security policies right there.

Re:E-mail?

[Anonymous Coward]

But they were encrypted right....right?!?

HA HA of course not

Re:E-mail?

[Anonymous Coward]

Its unfortunate that there is no widely used (and more secure) alternative.

Email can be secured, but very few bother and this is unlikely to change.

There are lots of ways to ferry information around securely, but none even approach the universal nature of email.

Best you can do in these cases is provide a secure portal for a client to log into and view their report, but this will inevitably be met with "can't you just email it to me", and while you can ramble on about security till your teeth fall out, when it comes down to it, if that's what the client wants, that's what they are going to get.

Re:E-mail?

[nahpets77]

What if they had used encryption? Seems to me that had they send an encrypted attachment they wouldn't have had to go through all this trouble.

Re:E-mail?

[Hotawa Hawk-eye]

Don't put anything in an email that you wouldn't put on a postcard. If you MUST email sensitive information, encrypt it before sending -- the encryption is the envelope.

Re:E-mail?

[Chewbacon]

First, they don't understand it's not secure. Second, if the thought did cross their mind, then they wouldn't know who to ask for a secure solution or be patient enough to take the time to implement it.

Did companies learn nothing from Target?

Re:E-mail?

[jeffmflanagan]

Correct. Confidential data should only go over an encrypted email system like we use in health care to protect PHI. It's bizarre that they're eve able to send a confidential report over plaintext email, which is the equivalent of a postcard.

Re:E-mail?

[Charliemopps]

Massive privacy breach....e-mailed a report...containing sensitive details...e-mailed...

The problem here isn't that it was sent to the wrong account. It's that it was e-mailed AT ALL.

Right, the breach occurred the second the guy hit "Send"
There is no "Fixing" this. The fact that Goldman Sachs doesn't have any security controls to block the sending of spreadsheets outside their network is eyebrow raising to say the least.

Re:E-mail?

[Charliemopps]

Don't put anything in an email that you wouldn't put on a postcard. If you MUST email sensitive information, encrypt it before sending -- the encryption is the envelope.

No... encryption doesn't work either. If the data is only sensitive in the short term then you can encrypt it. So, for example, a configure file that wont matter in a month when you change it. But if the data is actually sensitive, like your financial records, eventually that encryption will be worthless and if anyone saved that file, they'll be able to decrypt it.

Re:E-mail?

[swb]

Mostly for the same reason most people don't encrypt email. Key management and trust are beyond many people conceptually and practically difficult if you email people not using your encryption system or using other platforms.

There are gateway products though that greatly reduce these burdens, but in many cases might not solve this problem because they're primarily designed to limit eavesdropping not misaddressing messages, although I'm sure someone has thought of them (ie, encrypting attachments but requiring approval of the sender for unknown recipients to decrypt them).

What I wonder is what email would look like had Microsoft decided to integrate a PGP-like encryption system and key management into Outlook and Exchange so that encrypting a message would be as simple as (un-) ticking a box when sending a message.

Create an account in Exchange, generate an exportable keypair to go with the account. The keypair could then be imported into other applications to decrypt/encrypt email.

Re:E-mail?

[omnichad]

It was supposed to be an internal email. So it would have been securely transmitted and stored otherwise. Not to say this isn't a good additional safeguard.

Re:E-mail?

[nahpets77]

Yes, I guess the fact that encryption was never properly integrated into Outlook/Exchange has prevented its widespread adoption. However, I believe that the added hassle of encrypting attachments is justified when sending sensitive/confidential information via email. I worked for a large tech company that had very strict rules for dealing with confidential information, including using encryption for emails. I'm amazed that more companies don't require it because the repercussions of a breach can be severe.

Re:E-mail?

[Anonymous Coward]

even if they had had the brainpower to put up an encrypted mail policy/system (okay, unfair. They probably do have the brainpower, but it's all taken up by inventing new ways to siphon money out of retirement funds), a reasonably automated system would have encrypted it to the wrongly entered recipient anyway. Chances are high that there might have been an error since there was no known key, but still.

Re:E-mail?

[WaffleMonster]

Massive privacy breach....e-mailed a report...containing sensitive details...e-mailed...

The problem here isn't that it was sent to the wrong account. It's that it was e-mailed AT ALL.

I don't know particulars of systems involved. From description it is plausible message was to be routed and delivered exclusively intra-domain rather than inter-domain so it would never involve SMTP to external systems not managed and controlled by Goldman.

For all I know they could have a reasonably secure internal e-mail system for communicating sensitive information WITHIN their organization.

Re:E-mail?

[swb]

Sure, they should require it but the usual desk-pounding by management that something be done is usually tempered by the costs associated with implementing it.

You need an enterprise-wide key management system to issue and manage the encryption keys, software to actually use the encryption in the various places and ways people may share the files (email, web document systems, ftp, etc). You have to take into account the ability of vendors and customers might decrypt the content if they aren't using your system.

And then there's the training and transaction costs involved in using it -- extra steps employees have to take, dealing with lost keys or passphrases,

None of this says it's not valuable and there are products that make it easier, but it's also not free.

Re:E-mail?

[Anonymous Coward]

I hear you.

Last year I was cc'ed on an Excel spreadsheet containing all the admin passwords for all our remote data centers (over 30 in total).

The request? Please change the passwords to match what we have in the spreadsheet because they are hard-coded in all our login scripts. The entire help desk (all contractors) and a bunch of non-admins, including developers and QA folks, were cc'ed on that email. They also cc'ed my manager, because you know, that will make it better.

Yes. Seriously.

I wish I was lying. I wish it was just so I could have an interesting Slashdot comment. But no. This is what I have to deal with every day.

Re:E-mail?

[guruevi]

So what's your solution chief.

OTP encryption can't be broken. There are still encrypted WWII messages that aren't broken. The question is, how long will your sensitive information be sensitive. It is physically impossible for something to be perpetually valued (unlike what Disney wants you to believe, if Steamboat Willy loses it's copyright it is not going to break the box office, it is just a historical curiosity).

Within 100 years, Goldman Sachs probably won't be around anymore and all their clients will have died. What numbers are in that account today will be a historical curiosity, even if it were damning the entire company today, when it's broken they'll just put in a formal apology for crimes past. Even so, if it was created today, what bits do you think will be left over within 100 years?

Current encryption (256-1024 bit) with a good key is projected to be good enough for at least several hundred years even if we get to quantum computing between now and then. By then, it will be similar to reverse engineering the Enigma.

Re:E-mail?

[Anonymous Coward]

Why?

All kinds of companies and organisations routinely use production data for testing. Healthcare systems, military systems, utility companies, ISPs and more. They import real customer data into non-production database.

For large databases it's difficult and time consuming to generate enough fake information to replicate the size of the real thing. Additionally, QA is a lot better since it's real information that's being tested against.

Re:E-mail?

[Anonymous Coward]

Which is fine until you get a local doctor in a small town who needs the medical records and doesn't have anyone technical enough to deal with encryption.

Re:E-mail?

[SecurityGuy]

Eventually the sun will engulf the earth. Long before that I'll die. Before that, I'll change banks, credit cards, whatever. Encryption only has to work long enough, not forever.

Re:E-mail?

[tquasar]

Early company email. I could take back email that had not been read by the recipient. .

Re:E-mail?

[h4ck7h3p14n37]

Many large companies automatically encrypt emails with a certain keyword in the subject line. The large investment bank I worked at used to do this.

What's shocking to me is that the contractor was able to reach gmail at all. We were restricted to only connecting approved devices to the corporate network and could not access any websites unless we were connected to the bank's VPN and were routed through their filtering proxy.

Re:E-mail?

[cheesybagel]

Hence the comparison to an envelope. Those aren't exactly foolproof either.

Re:E-mail?

[Anonymous Coward]

Maybe Google should explain to Goldman Sachs how the internet works. As they did to the Church of Scientology.

Re:E-mail?

[canajin56]

Why? They employees doing the test were already cleared to work with the client data, or it would "violate all security policies" to have them doing the work using the old flowcharts. If you gave them fake data you would firstly also need a control group so you can be sure the fake data is just as challenging as real data (with real data you can just compare performance to the established average). And second, you're wasting time on your test! Even if the workflow ends up being less efficient so you get less work done per month, you still got some work done! If it was fake data, you would not be getting any work done while testing the new workflow.

Re:E-mail?

[zAPPzAPP]

Maybe they were setting up a system to automatically detect and intercept all emails containing 'sensitive client information'.

Re:E-mail?

[biodata]

This x 10^6 Anyone who has used the internet should have realised pretty early on that sending an email is equivalent to sending a postcard - it will probably arrive at the destination if you use the right address, but there are no guarantees, and you have no control over who sees the email on the way as it is not a private protocol. People should have to get a licence by demonstrating minimal competence before they are allowed to use potentially dangerous technology, just as they do with driving a car.

Re:E-mail?

[Anonymous Coward]

Hell, where I work at least we encrypt and sign documents that are protected.
Private is against policy to email.

Re:E-mail?

[antdude]

I assume they don't encrypt their e-mails. What if they do encrypt their e-mails? Then, that would be OK.

Re:E-mail?

[sjames]

Eventually doesn't matter. The encryption just has to make breaking the encryption cost more than the information is worth, keeping in mind that the value of the information will depreciate over time.

This weeks insider tip is next weeks old news. Current passwords become worthless after they are changed.

Re:E-mail?

[sjames]

If GS are mere mortals, why are they paid like gods?

Re:E-mail?

[Dr. Evil]

"Maybe they were setting up a system to automatically detect and intercept all emails containing 'sensitive client information'."

...by sending the sensitive client information to random gmail accounts? I guess it didn't work.

Re:E-mail?

[Tarlus]

Sure! They had SSL enabled for all of their email clients. That makes it totally encrypted and secure, right?

Right??

Re:E-mail?

[Anonymous Coward]

well... i do see managers send out all sorts of sensitive stuff over mail/dropbox and other mediums... Even when the they are informed that "this does not follow our security-guidelines" they just ignore it and do it anyway...

People ignore security if i requires even 2 second extra work, or if they would need to spend 5 minutes once to learn how to use some tool.

People are lazy... And when something happens they just claim that it's not their fault and that it should have been stopped automatically in the system if it was not allowed.

We have had a policy of that all laptops must use disk-encryption... guess how many that ignores it, usually with the comment "I have never lost a laptop in my life so i don't need to".... funny thing was that we had a break-in in one of our offices and one of the people that "never had lost a laptop" got his one stolen...... (and no, he does not use encryption on the new one either.)

I'm starting to think that the only way to get users to actually care about this is to implant some electroshock equipment in them and whenever they do something that breaks the security-policy they would get a small zap..

Re:E-mail?

[Scutter]

His inability to handle the data securely in no way absolves him of responsibility to adhere to HIPAA regulations. "I don't know how" is not a defense and he should be (rightfully) penalized.

Re:E-mail?

[Neil Boekend]

Forgive me, I am not experienced at this.

Why can't a filter between the internal network and the big bad internet strip out certain file types? Say: XLS, XLSX and XLTM?
Or why can't there be a warning: "You are about to send a spreadsheet outside GS. Spreadsheets can contain sensitive information. Are you sure the file is scrubbed clean of that sort of information?"
And be damn sure the employee knows what'll happen if they click "Yes, send" while they should have clicked "no, cancel".
They get fired. From a cannon. Into the sun.

Re:E-mail?

[MikeBabcock]

I believe you. Its incredible to me what people put in E-mails.

I told a security contractor to call me once to get the new password and he replied "can't you just E-mail it to me?"

Re:E-mail?

[Gallomimia]

True enough, but he was emailing it internally. Ideally it shouldn't leave the building or VPN. This is a huge huge problem these days. Email is obsolete but non-technical people don't even know what to use as an alternative. I don't even know what to use as an alternative, unless I conjure up some SSH keys and perform an SCP.

Re:E-mail?

[MikeBabcock]

Sure, maybe ... for the vast majority of cases, I'd rather users *never* send attachments by E-mail and instead use corporate web-based sharing for secure documents.

Attachments downloaded from servers can be verified as transmitted, and how many times, and by whom. E-mails cannot. You can't even guarantee a user received the E-mail.

Re:E-mail?

[antdude]

Yeah, and it is a very bad idea to use e-mails for huge attachments too.

Re:E-mail?

[MikeBabcock]

If I had a dollar for every user that complained about my 15MB attachment restriction ...

Re:E-mail?

[antdude]

Haha, it's bad for slow Internet speed users like dial-up. ;)

Too late

[Slizzo]

"avoid the risk of unnecessary reputational damage to Goldman Sachs." I'd say it's too late for that now, mate.

Disclaimer?

[Lawrence_Bird]

At least every lawyer type e-mail I get has a giant disclaimer at the end if you are NOT the intended recipient. Perhaps GS should have considered using that? Over paid dopes.

Re:Disclaimer?

[blane.bramble]

The problem with that is, is if was sent to your email address, you are the intended recipient.

Re:Disclaimer?

[u38cg]

These disclaimers are worthless (legally), as you can't accept conditions just by receiving something; none of the heads of contract are satisfied. However, if they motivate the receiving party to do what you want them to then they serve their purpose.

Re:Disclaimer?

[msauve]

What's your email address? Because, I want to send you an email with a giant disclosure at the end which says you owe me $1 million if you read the email.

Re:Disclaimer?

[wonkey_monkey]

What good is a disclaimer going to do? Are any instructions within legally, or in another way, enforceable?

Re:Disclaimer?

[blane.bramble]

I've also seen a creditable argument that because the disclaimer is at the end of the email, and you would have to read the email and therefore all of it's content before reading the disclaimer that warns you not to, that they are particularly worthless.

Re:Disclaimer?

[fuzznutz]

At least every lawyer type e-mail I get has a giant disclaimer at the end if you are NOT the intended recipient. Perhaps GS should have considered using that? Over paid dopes.

Every time I see one of those worthless disclaimers, I crack up. You can't unring a bell and I am under NO obligation to delete any email that was sent to me if it was addressed to my email account. If you typed the wrong address, that's your problem, not mine.

Re:Disclaimer?

[PA23]

Can't image those disclaimers are enforceable...Plus I have a disclaimer on my email server that states that "any email received by this system is subject to full public disclosure at the sole discretion of the recipient. If you do not accept these terms do not transmit your email and disconnect now"

Re:Disclaimer?

[CanHasDIY]

***** IMPORTANT INFORMATION/DISCLAIMER *****
This document should be read only by those persons to whom it is addressed. If you have received this message it was obviously addressed to you and therefore you can read it, even it we didnt mean to send it to you. However, if the contents of this email make no sense whatsoever then you probably were not the intended recipient, or, you are a mindless cretin; either way, you should immediately delete yourself & destroy your computer! Once you have taken this action please contact us.. no you idiot, you cant use your computer, you just destroyed it, and by the way, you are also deleted, but we digress......

The Originator of this email is not liable for the transmission of the information contained in this communication, unless they are the originator in which case they probably are liable and rightly so considering the content of the aforementioned communication.

In the event that the originator did not send this email to you, then please return it to us and attach a scanned-in picture of your mothers brothers wife wearing nothing but cami-knickers, and we will immediately refund you exactly half of what you paid for the can of Pal Meaty-Bites you bought when you went to Woolies yesterday.

We take no responsibility for non-receipt of this email because we are running Windows NT & everyone knows how glitchy that can be. In the event that you do get this message then please note that we take no responsibility for that either. Nor will we accept any liability, tacit or implied, for any damage you may or may not incur as a result of receiving, or not, as the case may be, from time to time, notwithstanding all liabilities implied or otherwise, ummm,shit, where was I..umm, no matter what happens, IT's NOT, and NEVER WILL BE, OUR FAULT!

The comments & opinions expressed herein are my own and NOT those of my employer, who, if he knew I was sending emails and surfing porno sites,would cut off my gonads and feed them to me for afternoon tea.

-- http://www.goldmark.org/jeff/s...

Re:Disclaimer?

[jeffmflanagan]

>The problem with that is, is if was sent to your email address, you are the intended recipient.

No you're not, when the email was sent by mistake.

Re:Disclaimer?

[blane.bramble]

You are incorrect. The email may be mis-addressed, but you are still the intended recipient of that email, as given by the fact the email envelope has you as the recipient. You therefore have a legally acceptable record that that individual email was sent directly to you.

Re:Disclaimer?

[Anonymous Coward]

Fortunately, the law uses a reasonable interpretation of the idea of "intent", instead of your autistic reading.

Re:Disclaimer?

[ComputerGeek01]

>The problem with that is, is if was sent to your email address, you are the intended recipient. No you're not, when the email was sent by mistake.

I'm having trouble figuring out where to begin explaining how incorrect this statement is. Your argument is intent? OK, let's start there. The users intent was to send an Email. This user intentionally entered real world confidential information into the body of this Email message. Then this user intentionally entered a fully qualified and valid Email address into the "TO:" field of the Emails header and finally they intentionally sent this message to the previously mentioned Email address. Tripping over a power cable is a mistake, everything about this action was deliberate.

Re:Disclaimer?

[fuzznutz]

You crack me up too. If you had ever read one, you would realize that those disclaimers are the epitome of hostile. I only delete spam and everything else goes into the searchable record. I have archived email from the time before there was an Internet. I don't delete my email because some "asshat" asks me to on some bullshit disclaimer. If you don't want me to read an email, don't send it to me. If you are some pansy who believes that others should be able to order him around with some bullshit legalese boilerplate sendmail addendum, go right ahead and delete it and feel good about yourself. Then you can wring your hands, worrying about removing the tags on your pillows. As far as who "is like me", nobody I know pays any attention to those things.

Re:Disclaimer?

[Skater]

I've tried replying to let them know they sent the email to the wrong address (as requested in the disclaimer), along with a bill for $200 for the service. They never respond.

Re:Disclaimer?

[alexo]

But if the email goes to someone who isn't a selfish, hostile asshat like you are, they will do as asked (emphasis mine) and delete the email. Don't assume that everyone is like you.

Let me answer for the OP.

When I get an email that was obviously not meant to be sent to me, and did not include any disclaimers, I will usually send a reply point out the mistake. If I'm in a good mood and have some free time, I could even try to deduce what the intended address should have been and include it in my reply.

If that email included a disclaimer, POLITELY PHRASED as a REQUEST (featuring words like "please" and "thank you"), I will usually do my best to comply because, hey, I'm a generally nice guy.

If, on the other hand, the disclaimer used DEMANDING or THREATENING language, or trying to assert non-existing legal rights, fuck them. Being a "hostile asshat" to bullies is a virtue.

Re:Disclaimer?

[Cajun Hell]

The problem with that is, is if was sent to your email address, you are the intended recipient.

This is incorrect, and yet, the error does not matter.

Intent is known only by the sender. From the recipient's point of view, it does make sense to assume that an email addressed to you, is intended for you. That asumption is sometimes wrong, but it's a rare occurance. And whenever you're wrong, you won't know until you've already read some of the email. This really is the best any recipient can be reasonably expected to do.

The sender has all the power here (they get to decide whether or not to encrypt, for example, and which key to use (typically looked up by intended-recipient's name!!)) so I think they should have all the responsibility.

Re:Disclaimer?

[Anonymous Coward]

Even worse are the copyright notices on emails.
Most business emails don't contain anything that can be copyrighted at all (unless the emails contain source code, music, movie scripts, etc).

Therefor these copyright notices are fraudulent. A recipient can claim that all of your emails contain this fraudulent statement. The recipient can therefor claim he didn't know something was copyrighted when something actually copyrighted was sent in the email. An actually lawyer wrote about this in his blog.

Re:Disclaimer?

[Anonymous Coward]

. . . will do as asked . . .

Really? Where, in Robotland?

. . . selfish, hostile asshat . . . Don't assume that everyone is like you

Oh, I always assume the worst.

Re:Disclaimer?

[Anonymous Coward]

I've tried responding quoting that I'm unable to delete because the law requires all emails to be kept for a minimum of 8 years. I've had some interesting answers to that

Re:Disclaimer?

[Anonymous Coward]

You write many inane comments on slashdot. If they are indicative of your personality in the office, I feel sad for your coworkers.

Re:Disclaimer?

[Anonymous Coward]

Unless you're a powerful company apparently, in which case Google will remove the email from the recipients inbox just because you asked.

Didn't you know? Hard rules like you're talking about only apply to us plebeians.

Re:Disclaimer?

[Cederic]

Speak for yourself. My emails are finely crafted works of art. They are culturally significant and future archaeologists will travel the world seeking the remnants of discarded storage drives containing encrypted backups of my Sent Items folder in the hopes of completing their collection.

Re:Disclaimer?

[mdielmann]

He intended to sent the email to someone. He clearly didn't intend to send it to the ultimate recipient, else he wouldn't have spent thousands of dollars to undo that act. Perhaps he sent it to ndielmann@foo.bar instead of mdielmann@foo.bar. Fortunately, you obviously never make typos. And people have never accidentally called the wrong number before, either.

Clearly the recipient isn't in the wrong if he reads it - he got an email in good faith. This is why they want to get it removed before it's read.

Re:Disclaimer?

[Lawrence_Bird]

Here is a standard one:

This electronic communication originates from Lawyer A&B, LLP. This
communication and any file transmitted with it contain confidential and
protected information, which may be subject to the attorney-client
privilege, or otherwise be protected against unauthorized use. This
communication is also subject to the Electronic Communications Privacy Act,
18 U.S.C. Sec. 2510-2521. The information herein and any file transmitted
with it is transmitted in this form based on a reasonable expectation of
privacy. See ABA Formal Opinion No. 99-413. If you are not the intended
recipient of this communication, you are hereby notified that any
retention, dissemination, distribution or copying is strictly prohibited.

If you have received this message in error, please advise the sender by
immediate reply and delete the original message.

Emphasis added. There is nothing there about reading the message - that is assumed as there would not be a reasonable way to determine you are not the intended recipient.

And here you can read about what happens when you keep credit card statements sent to you when you are not the intended recipient.

Re:Disclaimer?

[Anonymous Coward]

No. It is not deliberate. It is a mistake and Google accepted that. Due to confirmation bias you are going to have this wrong interpretation of the event forever.

Re:Disclaimer?

[BlueScreenO'Life]

Does the email contain a logo? Then it's copyrighted.

Goldman Sachs is one of the most dangerous...

[MindPrison]

...companies in the world.

This is a test case for them, it's all about control and it's all about the money.

Do you guys remember this: "Give me control of a nation's money and I care not who makes the laws."?
Well, you better remember it - and understand what it means, because your FREEDOM is at stake!

Cryptic to you?
READ BETWEEN THE LINES!

Re:Goldman Sachs is one of the most dangerous...

[Anonymous Coward]

Do you guys remember this: "Give me control of a nation's money and I care not who makes the laws."?

Yeah, didn't Petyr Baelish say that?

Re:Goldman Sachs is one of the most dangerous...

[Anonymous Coward]

Do you guys remember this: "Give me control of a nation's money and I care not who makes the laws."?

Yeah, didn't Petyr Baelish say that?

Nice try to push it onto a fictional character. It was Mayer Amschel Rothschild.

Re:Goldman Sachs is one of the most dangerous...

[metlin]

Take your Prozac and walk away slowly from the keyboard...

Re:Goldman Sachs is one of the most dangerous...

[Anonymous Coward]

>READ BETWEEN THE LINES!
I did. It says THE JEWS DID IT right? I'm right, aren't I?

Re:Goldman Sachs is one of the most dangerous...

[Anonymous Coward]

They are dangerous, but not wholly evil. You may recall they were the first big bank to strike against High-Frequency Trading when the Investor's Stock Exchange opened -- and they probably had the most to lose by shutting down the HFT advantage. On Slashdot, where nobody has ever invested or worked with money in their lives, you'd think that Goldman Sachs was run by Stalin and Mao's lovechild.

Re:Goldman Sachs is one of the most dangerous...

[Anonymous Coward]

you knob

Checklist

[Anonymous Coward]

[x] testing internal changes with access to live systems and actual data
[x] unnecessary reputational damage to Goldman Sachs
[x] privacy violation

I don't see any boxes left for Google to tick.

You get what you pay for...

[Anonymous Coward]

You get what you pay for. Goldman used a cut-rate contractor, and the person the contractor hired used live sensitive data to a live e-mail address? Instead of using test data and a test address? Goldman tried to get something done on the cheap instead of hiring someone, and it burned them badly. Good!

The court ought to make Goldman reveal who the contractor is, and how much the person who screwed up was getting paid. Was it a fair market wage? How much did the contractor keep versus the person doing the work?

Re:You get what you pay for...

[fustakrakich]

You get what you pay for.

Yes, Goldman Sachs bought themselves a nice compliant government. I would say they got a bargain.

Re:You get what you pay for...

[canajin56]

This was an email about a test, not a test about an email. The email was a summary report on testing they had been doing on their "internal processes". AKA they had a new checklist or flowchart or whatever, and they were making sure that this new process meets the federal reporting requirements, while also not sucking (or whatever other requirements they have for an "internal process").

Damn you autorrect!

[tommten]

hate it when it renders my information sensitive :)

Encrypted?

[Anonymous Coward]

First of all they shouldn't be emailing that to anyone.
Second of all, why was it not encrypted???

No "sensitive data" filtering?

[swb]

There are more than a few email filtering products, some designed specifically to prevent sensitive data from being emailed at will via heuristics designed to detect sensitive information.

You would think as heavily regulated as Goldman is they would have these kinds of systems in place to prevent this kind of thing from happening.

Re:No "sensitive data" filtering?

[CanHasDIY]

You would think as heavily regulated as Goldman is supposed to be they would have these kinds of systems in place to prevent this kind of thing from happening.

FTFY.

Regulations only work if they are actually enforced.

Re: No "sensitive data" filtering?

[Anonymous Coward]

This was a contractor doing it. Someone hired to do work at GS as an employee of another company. All financial institutions block external email for employees, but occasionally contractors for third party systems need to access their own company's stuff within a bank's network to do their jobs. Seems reasonable right? If you go to a client site who happens to be a bank, can you live without access to your own emails, dev envs, etc?

Employees at banks are typically blocked from sending outside attachments, because everyone knows this type of stuff happens, but there's always a subclass of people to whom the controls may not apply. Like the 3 people inside your network who are permitted to use outside email. You can't control the kind of fuck-ups your vendors hire. Even good companies hire fuck-ups occasionally. Yeah, this type of data should never have been sent over email, but again, you can't control the kind of people your vendors hire.

Banks take this shit really seriously. They want to keep this information private not just to protect clients but also because it's the keys to their kingdom. This isn't a list of a few piddly customers, this is probably major hedge funds or pension funds that do millions or billions in transactions. Institutional clients are non-exclusive and always deal with lots of banks. Do you want your competitor to know that your client and their client are mutual so that they can be solicit them for more business? I don't think so.

And regardless of how you feel about the company, this is CLIENT data. Don't punish the clients just because you think the company is evil.

What if this was Citi or Chase or a bank where any of you had an account. Would you feel the same? Do you still think the sanctity of free email should be protected when it's suddenly your data at risk?

Re:No "sensitive data" filtering?

[Cajun Hell]

The irony is that if the people at Goldman did things right, then a filtering tool wouldn't be able to work (because it doesn't have the recipient's key).

Re:No "sensitive data" filtering?

[zAPPzAPP]

Maybe that is exactly what they were trying to set up, hence the need to send such information to test it.
Of course they should have used bogus information in that case...?

Minor inconvenience

[mwvdlee]

"By contrast, Google faces little more than the minor inconvenience of intercepting a single email - an email that was indisputably sent in error," it added.

Losing a few thousand dollar is little more than a minor inconvenience for GS.
So how about it GS... send me a few thousand dollars.

Google is abso-fucking-lutely right to require a court order. If they don't, it'll just open the flood gates for other companies and people to "retract" damaging e-mails. The news here isn't that Google required proper legal procedures before violating it's users rights, it's that GS sends highly sensitive data by e-mail.

Re:Minor inconvenience

[plasm4]

What's shocking is that google has locked the user out of their email account while this is happening.

Re:Minor inconvenience

[Somebody Is Using My]

As disturbing is that the threat of "reputational damage" is enough to get a court on your side.

The United States government should not be helping people or business protect their reputation from their own mistakes. It opens a floodgate to potential abuses. This request should have been laughed out of court. "You screwed up, bub; you deal with the consequences."

I can see this ruling being used as a precedent in many future law cases.

Re:Minor inconvenience

[Ionized]

google locked THIS EMAIL.

big difference.

Delusional goal

[Anonymous Coward]

This is so delusional. From a technological point of view it is exactly has pathetic as when a judge mandates that some data is to be deleted from a database. Meanwhile there are already a huge number of copies (including DB backups, personal backups, browser history / cache, could backups [say your DB was replicated among x computer in the cloud and one harddisk gave warnings about it's lifetime expectancy and got replaced while still having the data, etc.) and the data is "out there".

It reminds me of the DeCSS fiasco.

Sadly as long as the juridical system will be disconnected from reality, such non-sense is going to keep happening. It can be summed as this: "We order you to destroy the knowledge allowing man to make fire".

Not gonna happen. Poor delusional fools.

Just to make a "statement" someone should put DeCSS inside the Bitcoin blockchain.

When will these fools learn? You cannot control leaked data. This is impossible. So you have two choices: don't leak or deal with it.

This is Google's fault...why, exactly?

[L. J. Beauregard]

That oughta larn 'em to check before they click send. But it probably won't.

Should have filed in Nevada

[BenJeremy]

...and used Microsoft's legal team. They would have gotten the gmail.com and google.com domains and then it would just have been a matter to use Microsoft name servers to commit a DoS attack against gmail's hackers, erm, users.

The Federal judges in Nevada are suckers for a good story, I hear, even if it's blatantly false.

How the fuck?

[Anonymous Coward]

How the fuck did they reach anyone at Google to get that response?!

Re:How the fuck?

[Kardos]

It's the "they have lots of money" effect that ensures their requests are read and acted upon, rather than automatically filtered out and discarded.

Re:How the fuck?

[u38cg]

They almost certainly have a contractual relationship with Google on other matters that would involve a human. From there it's a matter of a few phonecalls.

Re:How the fuck?

[Anonymous Coward]

lawyers

Re:How the fuck?

[cheesybagel]

The CEOs probably know each other from their meetings at the World Economic Forum. So you just place a phonecall to the right person or talk with them at the golf course and heads roll.

Simple way

[emanuele_fanton]

It isn't simpler to ask the destination address to delete it? As for security NSA already had a copy and so deleting it from google server is futile!!!

Re:Simple way

[cheesybagel]

You are assuming it was not stored in umpteen mail servers along the way. You do know how SMTP works right?

Re:Simple way

[emanuele_fanton]

No, I don't! Don't interested this much.

But what about the email footer????

[schwit1]

Aren't these legally binding? :-)

Re:But what about the email footer????

[Anonymous Coward]

Even if those e-mail footers were binding, isn't it terribly stupid to put them at the end of the mail? I mean, if I stop reading before I get to the end, it won't apply to me anyway.

Re:But what about the email footer????

[Anonymous Coward]

I thought so.

--
NOTICE: This reply is confidential and for the sole use of the intended recipient. If you are not the intended recipient, any reading, copying, replying, quoting, disclosure, distribution or use of any part of this reply is strictly prohibited and may be unlawful. If you believe that you reached this reply in error, please do not read it or any replies thereto, and notify the poster immediately and then close this reply and delete it from your system/browse cache.

I think I accidentally all those things...

Re:Too late mate...

[NatasRevol]

By about a decade.

So can I

[Kardos]

make the same request when I accidentally reply-all to save myself 'reputational damage'? Or does this only work for large companies with lots of money?

Re:So can I

[Anonymous Coward]

only for large companies with lots of money

Re:So can I

[The Raven]

Works for you as well, if you can hire an attorney to talk to a judge and convince the judge to grant a court order to... nevermind, your phrasing is shorter and means the same thing.

This is why

[Anonymous Coward]

I always write the body of the email before filling out the "to" line.

For some reason, it's easy to hit ctrl+enter while I type and I have found no way to turn off this "auto-send" feature.

At least now when I accidentally hit this key combination it complains about missing a recipient.

Non-disclaimer

[Anonymous Coward]

I have occasionally replied to mails with such disclaimers with my own non-disclaimer:

I can not be bound by one-sided disclaimers. I have the right to read, disclose, forward, publish, and act on any mail sent to me. If you wish to keep your confidential secrets, start by not sending them to me. Non-disclosure agreements can be arranged, at a cost.

Cannot unsend an email

[grahamm]

Someone should tell Goldman Sachs that you cannot unsend an email. Usenet articles can be cancelled, even though most servers ignore cancels, but like snail mail, once email is posted it cannot be recalled.

Re:Cannot unsend an email

[KiloByte]

Not in this case. Google did unsend the mail. One more reason to never use a mail provider that's not responsible to you.

Re:Cannot unsend an email

[cheesybagel]

Tell that to Microsoft. Exchange has a feature just like that. It does not work all the time either. But corporate types love this.

Re:Cannot unsend an email

[MichaelSmith]

If you act fast enough

GS could, if they wanted to, put a 30 minute delay in their outgoing email, or maybe a second step through a web form to authorise outgoing mail. It could be set to hold messages going to known non-professional domain names.

Recourse for the blocked email?

[timrod]

What I'm wondering is whether or not the person whose email account was blocked because they received an email from Goldman Sachs has any form of legal recourse against Goldman Sachs.

Re:Recourse for the blocked email?

[Anonymous Coward]

The email was blocked, not the account. The person probably didn't even notice anything.

Re:Recourse for the blocked email?

[Anonymous Coward]

Nobody's account was blocked, the one individual MESSAGE was blocked.

Unnecessary(?) Reputational Damage

[Anonymous Coward]

"avoid the risk of unnecessary reputational damage to Goldman Sachs."

I think the reputational damage is quite well deserved in this case.

What's with the outrage?

[sunking2]

They asked google to do something, google said they can't without a court order, and now they seem to be getting one.

Re:What's with the outrage?

[Anonymous Coward]

they could've asked the recipient (then google to delete the secretly kept copy, then the NSA)

Always wondered what happened to Oscar

[smittyoneeach]

I always wondered what happened to Oscar Goldman after the Six Million Dollar Man wound down.

Re:Always wondered what happened to Oscar

[Megane]

Now they call HIM the Six Billion Dollar Man.

Re:Always wondered what happened to Oscar

[smittyoneeach]

And that's just mixed in with his pocket lint!

They DESERVE the reputational damage

[Anonymous Coward]

Everyone makes mistakes. I understand that. I make mistakes too.

But here's what I don't get. I am sending an email to dude@gs.com and accidentally type dude@gmail.com. But I also I just happen to have dude@gmail.com's PGP key and a sufficient trust path to know the key is correct, for the confidential information in question? That's the part I simply don't believe. All of Goldman Sachs' protestations that the sender just happened to also know dude@gmail.com and that they key was verified, ring hollow.

Of course, the silliness here, is that Goldman Sachs isn't really saying that happened. I'm totally making up the bullshit about their "protestations." And that is the problem, because if the information is confidential and if this is important enough to go to court over (and maybe it really is), then their routine security practices are a joke and they should have a reputation for having complete disregard for protecting confidential information. They are telling the public that they can't be trusted. So, everyone: listen to them.

After 2008, Greek crisis etc what damage will this

[dbIII]

After 2008, Greek crisis etc what damage will this do to their reputation?

Cannot unsend an email

[Anonymous Coward]

Apparently it can. If you act fast enough, *and* get the necessary court order.

What law?

[countach]

My question is, what law gives a court the right to do such thing? While there may well be laws that compel companies to keep their own data private, I find it hard to believe there is a law that gives a court the right to undelete stuff in a scenario like this. Courts don't tend to do stuff no matter how reasonable unless there is some law that says they should.

The disturbing thing about this is that the real owner of that mail box, whoever he may be, doesn't get to show up in court and put forward his viewpoint.

Re:What law?

[Anonymous Coward]

Laws? HAHHAHAHA

Rod and his Bridgestone tires could have helped

[ryansuzuki]

https://www.youtube.com/watch?...

NOT an accident

[Anonymous Coward]

It is like a twist on the movie Trading Places. They want some really bad data to fall into competitors hands to screw them over, "accidently" email it to gmail, then scream about it to make it look like they don't want it out there, validating the info in peoples minds so when it inevitably leaks, people will act on that data and be the sucker....

It's Called DLP, you technological Slacker

[Anonymous Coward]

Data Loss Prevention, they sell them You could buy one, and implement it. Then you wouldnt be able to send out sensative crap you weak minded fools.

Unsending E-mail

[DERoss]

The ancient Roman Horace (65-8 bce) said: "Once a word has been allowed to escape, it cannot be recalled."

More recently, Omar, the Tentmaker (died ca 1123 ce) said:
"The moving finger writes; and, having writ,
Moves on: nor all your Piety or Wit
Shall lure it back to cancel half a Line,
Nor all your Tears wash out a Word of it."

mur-ca

[Anonymous Coward]

America where you can force a company to erase your mistake if you have enough money for a crack legal team.

Shitbirds.

[Anonymous Coward]

Fuck you Goldman Sachs. No, Really Fuck you.

Comment removed

[account_deleted]

Comment removed based on user account deletion

DLP

[Frankie70]

Kind of stuff having DLP software in place would prevent.

Charge them

[andy_spoo]

Personally I think Google should be able to charge them for wasting there time. How many people are they expected to employee to wipe up other peoples stupidity.

Hey JPMorgan Chase

[Anonymous Coward]

I hear Barbara Streisand wants her effect back.

Google should charge them for it

[ThomasBHardy]

Google has no fault in this scenario. GS has the problem, they want Google to help them out.

Instead of stating no, Google should have asked :"whats it worth to you?"

Google is a business, this is a service that they do not offer. you want a custom one-time service offering? Sure thing. Let me run some numbers on that and check your credit score and I'll get back to you.

If GS gets a court order and Google has to do this and they get nothing for it, then the situation is even more screwed up.

Treat it like regular mail.

[140Mandak262Jamuna]

If the mail has not yet been delivered, then Google can stop the deliver and bill Goldman for the cost of stopping the delivery. If it has already been delivered, it is the property of the recipient. You can't do anything about it. At best Goldman can go after the recipient and get a gag order from the court. But Google is out of the picture.

Re:Treat it like regular mail.

[Anonymous Coward]

The thing about e-mail vs snail-mail is that delivery is almost instant as soon as the receiving MTA queue processes it. (total time within seconds to minutes from send to deliver)

Re:Treat it like regular mail.

[mdielmann]

The difference is, this isn't a mailbox on your house. It's more like a post office box from Mailboxes Etc. So going to the person who controls the mailbox is a reasonable attempt to stop the mail from being delivered, as long as the person hasn't already removed the mail from their box. It would also be akin to going to the postal service if there is a letter in the mail that hasn't yet left their care and been delivered to the recipient (the single biggest difference being that it takes email seconds vs. the days for snail mail).

Hello, My name is Mr Burns...

[Anonymous Coward]

I believe you have a letter for me

Google could say that, but negligence suit allows

[raymorris]

I can see one way that the court is authorized by law to do that. Under common law, we each have a duty to not be reckless about doing things that might cause harm to another. Had Google chosen to deliver the email after having been notified that it could bring harm to Goldman _and_its_customers, Goldman could then file a suit for negligence. The judge or jury would then decide if Google failed to exercise ordinary care in preventing the leak, or if they did all that a reasonable person would do to protect the customers.

If Goldman intended to file such a suit, the normal and proper legal procedure would be for them to request a temporary injunction ordering Google not to release the information until the suit was settled. That is well and good because if Goldman were to win, Google can't very well take back the information they've already released.

Since Google didn't object to the request, why make Goldman formally declare their intent to file a suit for negligence if Google doesn't comply? Everybody knew that was result in an injunction, and a perfectly proper one, so why not save time and just go straight to the injunction hearing? The court can issue an injunction in the end, and I don't know of any common law or statutory requirement for pointless rounds of paperwork when everybody agrees it'll end up as an injunction hearing.

Really?

[Anonymous Coward]

Hmm...We screwed up (Goldman) and now you (Google) have to fix it so we don't look like bigger dumbasses than we already do. I don't really see how this is Google's problem.

Waiting for the other shoe

[jchoyt]

I'm going to weep when they get this power. Because it's Goldman Sachs and you know they will.

No, that makes it a BIGGER story!

[mrchaotica]

Because now Google is censoring people's emails without a court order if the entity demanding the censorship is rich and powerful enough!

Re:precedent in many future law cases.

[TaoPhoenix]

You're almost the only one addressing the legal-theory side.

Stepping aside from the technics, what becomes the theory for this?

"Material that is believed to be owned by the recipient but is in fact leased or rented may be removed by the lessor/provider if it causes reputational damage from the sender (and maybe to other parties?)"

Lawyers have a fun job. (Things to do with a 170 IQ). Take can take one word and use it to create billions of client dollars. There was that one other article in Rolling Stone about how Goldman Sachs borrowed one paragraph from their federal government bailout, jammed it into a 15 year old finance bill, and now they get to run oil pipelines while bidding on oil futures and stuff.

Or the one from earlier today where that review board authorized the NSA to keep spying by abusing the words "adequate" and "reasonable".

Can't unring a bell

[WinstonWolfIT]

The mail is probably sitting in someone's pop3 inbox. Plus, when he received something obviously in mistake it probably got deleted. Either way, wouldn't it make more sense to contact the addressee and stress that the mail is proprietary and disclosing it would rain down a whole heap of trouble on the guy?

Secure email near impossible

[tquasar]

Wired had a story about what they thought you would need to send a message that could not be read if intercepted or I guess in this case misdirected. You would have to know a lot about encryption, use the deep web and more. The recipient would need to use the same methods.

If this was the post

[Anonymous Coward]

If this was the post (at least in the UK) they'd be SOL. Once you've consigned something to the mail you have no right to get it back and it must be delivered to the addressee. I don't see why email should be any different. This is very much their problem, not google's or anyone else's. And now the Streisand effect will probably come into force and I bet all the juicy stuff has been copied anyway.

better translation

[John_Sauter]

A better translation of Rubiat 51 is:

The Moving Finger writes; and, having writ,
Moves on: nor all thy Piety nor Wit
Shall lure it back to cancel half a Line,
Nor all thy Tears wash out a Word of it.

Notice "Piety nor Wit". See http://www.gutenberg.org/files...

Re:better translation

[DERoss]

My source was http://nepenthes.lycaeum.org/M..., an 1859 translation by Edward FitzGerald and transcribed onto the Web by Dave Gross.

Re:better translation

[John_Sauter]

My Gutenberg reference was to the fifth edition of Edward Fitcgerand's translation, which gives a different number to the verse. Nonetheless, your reference uses "nor" and "thy", just like mine does.

Did Goldman read the EULA?

[140Mandak262Jamuna]

I am very sure Google lawyers will be pointing out to Goldman lawyers the exact clause and paragraph where Goldman pledged the everlasting life and soul of all the board of directors to Google when they clicked on the "accept" button of the EULA agreement of the Gmail.

I demand you erase the recipient's memory!

[FuzzNugget]

Google could comply all they want, but it's laughably pointless if the unintended recipient has already read the email, possibly even downloaded it to their device via POP access or IMAP caching.

Can't wait for the forthcoming lawsuit where they try to make this unwitting recipient sign an NDA.

Today's Slashdot Quote

[FuzzNugget]

"To err is human, to forgive, beyond the scope of the Operating System."

Apparently not

Re:After 2008, Greek crisis etc what damage will t

[cheesybagel]

It probably states in which shell account their CEO is storing his non-taxed gains or something like that.

Wouldn't it be SMART

[CharlieG]

If GS and anyone else for that matter who was going to send data that could result in ""needless and massive" breach of privacy." start insisting on encryption? I know my wife's company basically sends an email with a link, and you have to go log in to see the data.

They are sending this stuff over the internet where anyone along the line can read it

MAYBE, just maybe, if the financial companies started insisting on say a public key encryption method to send confidential data, ALL of us would be much better off (GPG anyone?)

Re:Wouldn't it be SMART

[Shados]

Well, the thing is, they were sending it internally, which would have had the encryption and all the security around it. They sent it to a non-encrypted medium by accident.

The only issue is that the client tool to send via secure channels is the same as the one to send via unsecured ones.

When I worked for one of the big financials a few years ago, we had a mail client add-in on all machines that would check if you sent anything to anyone outside of the company. If you did, it first would warn you and ask you to confirm, and if you had attachments or if the content of your mail contained some data beyond a few sentences, it would make you convert it to a link, just as you described.

The thing is, it wasn't fool-proof and there were ways around it. Its probably what happened here.

Re:Wouldn't it be SMART

[CharlieG]

You are correct - they should be looking at the outgoing mail stream, and if outgoing, insist on encryption.

    Of course, they could also insist on encryption even internally, but there might be backlash

Fuck 'em

[sam0vi]

Fuck 'em. No sympathy for the devil.

Email Insecure

[Roger W Moore]

Through a combination of carelessness and cluelessness, this employee managed to put hundreds of millions if not billions of dollars of customer funds at risk.

Sending information like this via email is where the mistake happened, not mistyping the address. Email is not secure even if it is sent to the right address you have no control over how it gets there and it could be easily intercepted and read enroute. Their reputation loss has already occurred by admitting that they use email for highly sensitive information like this.

Re: Email Insecure

[zeigerpuppy]

Actually email intradomain is relatively secure. If it's send from a gs.com to gs.com address from an internal computer, the email should never leave the building (assuming they have their SMTP server onsite). This is one of the main advantages of a federated protocol

Re:Email Insecure

[Anonymous Coward]

Email is not secure even if it is sent to the right address you have no control over how it gets there and it could be easily intercepted and read enroute

Once upon a time the quickest way for an email to get from Seattle to Boca Raton was via Cupertino. Yes they were the companies involved.

Re: Email Insecure

[Roger W Moore]

Unless someone has email forwarding set up.

Re:Email Insecure

[Anonymous Coward]

You are wrong. email can be any level of security you want. You can arrange that all email sent is one-time pad encrypted and routed over a quantum encrypted network. Good luck on ever decoding that. Or, you can copy all in-bound/out-bound email to a public web server that's indexed by google, that is likely the ultimate in no-security.

Re:Email Insecure

[Anonymous Coward]

Email is not secure even if it is sent to the right address you have no control over how it gets there and it could be easily intercepted and read enroute.

If it's internal email then they have total control over how it gets there (assuming it's addressed right).

Re:Email Insecure

[Anonymous Coward]

The problem is not sending information via email, it's sending information via SMTP email over the internet. And more importantly, not having comprehensive compartmentalised security labelling implemented in their communication and office systems.

If you use SMTP-TLS or Exchange to your corporate email server and IMAP-TLS or Exchange to read your emails, then your email is secure as your mail server. So had they sent their email to the right recipient, they would have been secure.

The real failing here is not using security labelling to prevent confidential labelled documents being sent to a correspondent under a different label (or no label). Compartmentalised security labelling was designed precisely to prevent these sort of accidental leaks (at best it slows down intentional leaks, as one could always relabell, photograph, print or copy by hand whatever document they want to steal).

It has been possible in various computer systems, since the 1970s to apply compartmentalised labelling to document and email systems. That it is still not widely deployed 40 years on is a major failing of IT security.

Re:Email Insecure

[red crab]

Compartmentalized Security - one of those more than a hundred buzzwords that sound good on IT security workshops and exam curricula, but which nobody knows how to put into practice.

Re:Email Insecure

[L4t3r4lu5]

Email could be secure, but PGP is still too complex for the average user. Key pair generation and storage within AD / Exchange during account creation might help with this in the enterprise, but there needs to be an easy key management scheme for the SME as well. You'd think it would be baked in by now. Public key sharing could be as easy as automatically attaching a small XML formatted file when emailing a new contact, parsed seamlessly by the recipients email server / client.

Someone with programming knowledge get on it.

Re:Email Insecure

[loccohombre]

I can't speak for GS but, in my own industry, this type of email must be encrypted by law.

Re:Email Insecure

[Roger W Moore]

You are wrong. email can be any level of security you want.

Only if you control the entire network and all the servers used. This is not really practical in 99.9% of the use cases of email since it means you need to form a separate email network, isolated from the outside world to prevent any forwarding over insecure networks or to insecure servers.

Re:Email Insecure

[Anonymous Coward]

you are one of the criminals!!!! it is you who is in error. __we__ made this and it is perfect save you!!! it is you who wants this to be imperfect and cannot admit it is technical solutions what we need. nothing, nothing, nothing, nothing can be made more crime-resistance than _____email___. no exc rement color anthropoids in between, do you understand? no one, direct, straight. try mail not being intercepted, eh? cretin. phones cannot have anyone in between hearing? you have the interest to keep email unsafe and mythified. ... danilo j bonsignore

Undo reputational damage?

[BitZtream]

'Undo reputational damage' ? Exactly how is it undo? It would seem to me that this is EXACTLY the kind of repetitional damage they deserve.

Why the fuck do companies think that when they fuck up they don't have to take the associated hit that goes with it?

I didn't know Goldman Sachs still had a reputation

[Anonymous Coward]

(no text)

It isn't about you, guys.

[Anonymous Coward]

It's about the company being able to say, "But we've got this nice boilerplate asking the unintended recipient to deal with it. *shrug* We can't do anything more than that, right?"

Goldman Sachs is one of the most dangerous...

[Anonymous Coward]

Goldman-Sachs doesn't have "control of a nation's money"; the federal reserve does. Whatever negative consequences control of the money supply has, the control derives ultimately from Congress and the president and the voters who put them there. Congress and the president are clearly influenced by companies like that, but ultimately, the power to decide, and the responsibility lies without our politicians and the voters who keep putting them there.

In particular, given how much money Obama shoved into the hands of G-S, anybody who voted for Obama is ultimately responsible for this.

Re:Google could say that, but negligence suit allo

[countach]

Yeah but... if it could be considered negligence of Google not to do a certain thing because it is their responsibility to do such a thing, then they wouldn't wait for the court to tell them to do it. They'd just do it. The very fact that they refuse point blank to do it without a court compelling them to do it, seems to indicate they don't think fiddling with people's mail boxes in any circumstances is "exercising ordinary care". And rightly so, I think.

Nothing in the story I saw said that Google disabled the email account until the court could rule on it. Maybe they did, but I didn't see it. The story said GS tried to contact the owner but they didn't reply. Presumably if they'd been listening they could have read the offending email, and then you'd be at their mercy of good will.

Google isn't the jury, but allows a judge to decid

[raymorris]

> if it could be considered negligence of Google not to do a certain thing because it is their responsibility to do such a thing, then they wouldn't wait for the court to tell them to do it. They'd just do it.

Nobody knows what a jury will decide. A judge or jury could nail them either way. If the information caused millions of dollars inlosses tfor thousands of Goldman customers, a jury could certainly decide that Google should have taken five minutes to prevent that from happening. Google is safe either way if they do as ordered by a court. Lacking a court order or knowledge of the future, they decided it was better to leave the email alone. That doesn't mean they were certain that they'd not be sued - just that doing nothing was not as bad as doing what Goldman asked.

Do you hate hosts files, Mr. Advertiser?

[Anonymous Coward]

Makes sense you try to put hosts down then after I saw your bullshit resume here http://www.linkedin.com/in/ray... (you do nothing but work for advertisers) and apk tearing you a new asshole confronting you to disprove points he states about hosts files value to users in more speed, security, reliability, and anonymity which you ran from it after your technical blunders shown here as well http://it.slashdot.org/comment... so I doubt your buzzwords filled resume is real or that you really know how to program.

What do Clickbank & Vertis do raymorris?

[Anonymous Coward]

They're advertisers you work for (or did): It's why you ran from disproving apk's points on hosts http://it.slashdot.org/comment... and you also made large technical blunders so your resume is pure bullshit obviously and you know nothing. Hosts files are a huge threat to scumbags like you is why you attempt to put them down. Cat's outta the bag on you, scumbag.

What do Clickbank & Vertis do raymorris?

[Anonymous Coward]

They're advertisers you work for: It's why you ran from disproving apk's points on hosts http://it.slashdot.org/comment... and you also made large technical blunders so your resume is pure bullshit obviously and you know nothing. Hosts files are a huge threat to scumbags like you is why you attempt to put them down and fail (running like a scared weasel you are since you can't validly do so). Cat's outta the bag on you, scumbag.

Stupid idiot

[JasonGoatcher]

(1) The guy who received it probably said,"Wtf is this?" and promptly deleted it
(2)The account might not even be active, be better to ask Google the last time that email account was contacted before they start in with court orders.
(3) The words,"The email was sent in error, please delete all instances of it from your files," can be very effective if they're stated in a non-threatening manner.
(4) Going to the Supreme Court when you haven't at least investigated the possibilities above is just stupid.

Great

[netsurfer912]

Then I demand Goldman Sachs to undo the financial crisis to avoid unneccessary reputational damage to myself.

In other news

[MichaelSmith]

There is an ad for gmail business on this page.

The correct resolution for every other company.

[danknight48]

Sack the incompetent staff member who sent the email, instead of "cheating" your way out of it?

Ah, its Goldman Sachs. Carry on cheating the system.

PGP Encryption?

[Anonymous Coward]

Why was this sensitive material not sent using PGP encryption?

As long as they dont send the contractor to jail!

[Anonymous Coward]

http://en.wikipedia.org/wiki/Sergey_Aleynikov

maybe it went directly to the spam folder?

[wildcopper]

It is very likely that if the unsuspecting recipient were to have logged onto their Gmail account and checked for new e-mail that it would have already been in the Spam/Junk folder due to Google's awesome filters! I mean who in their right mind would think even if that e-mail was not marked as SPAM that it was not a forged Goldman Sachs e-mail. That and the fact that it had confidential client information. In this day and age with privacy and encryption, no one would have suspected this to be a legit Goldman Sachs e-mail.

Goldman Sachs core business data/info ....

[OldHawk777]

Goldman Sachs core business data/info ..., looks like they don't own a/o act responsible for the data. Goldman Sachs should be fined for the core-business data breach by their contractor, and rehab their core-business model. Goldman Sachs has become just another brand-name that contracts out their core-business requirements ... much like many others in the .Gov, .Mil, .Com domains. They are in name only an institution without actual substance. IMO