Misfired e-mail was never viewed by Gmail user
A sensitive e-mail mistakenly sent by a bank to a Gmail address that prompted a court to order Google to deactivate the account was not viewed by the recipient and has been deleted, the bank said on Tuesday.
The e-mail, sent by an employee of Jackson, Wyo.-based Rocky Mountain Bank on August 12, contained names, addresses, Social Security numbers, and loan information of more than 1,300 bank customers.
The bank sent another e-mail asking that the data be destroyed and went to court to get Google to intervene on its behalf. Last week, a judge in U.S. District Court in San Jose, Calif., ordered Google to deactivate the Gmail account and Google complied. Google and the bank quickly resolved the matter and the court granted their motion to dismiss the case and allowed Google to reactivate the Gmail account.
"Rocky Mountain Bank, working with Google (through court order), confirmed on Thursday of last week that the e-mail containing client information was never opened and has now been permanently destroyed by Google's system," Tina Martinez, general counsel for Rocky Mountain Capital, wrote in an e-mail response to questions.
"As a result, no customer data of any sort has been viewed or used by any inappropriate user during this data lapse," Martinez wrote. "Rocky Mountain Bank acted to protect its customer's confidential information. That objective was accomplished. The matter is now closed and the TRO (temporary restraining order) entered on September 23, 2009 is now vacated."
Asked for comment, a Google spokesman said: "To protect the privacy of our users, we do not comment on their use of Google services."
The case poses some interesting questions. For instance, should the person who registered the e-mail address lose access to the account or have items deleted without his or her permission, particularly through no fault of their own?
And what recourse would the bank have if the data had been sent via regular mail to the wrong address? The U.S. Postal Office certainly doesn't have the ability to see the envelope sitting on the recipient's desk and vaporize it.
Update 4:35 p.m. PDT:The bank did not take any action against the worker who sent the e-mail, the bank's lawyer said.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
Did this account go offline for 6 days? Good grief that's a long time.
Dude, half a day is too long for me some times.
I'm living on extreme mode every day.
My braincells end up running around in circles.
I bet you all that your bodies would continue to process oxygen if your emails went away for 6 days. Golly, we all might some work done!
Would Google have argued that the bank's ownership or control of that data ceased as soon as the copy was made onto Google's systems? Would they have had a chance with that argument?
Sounds like a lot of "when does life begin?" questions to me. Yuk. Very messy, no?
I would consider legal action against the bank if I were the unintended recipient of such an email and it caused my account to be locked. This should never have happened in the first place.
So long any business is run and managed by people the possibilities of mistakes will always exists. All the security in the world won't change that. Do we sue for every mistake or accident that happens? This lawsuit happy society has already made the court system a joke as it is.
As for the bankers? You worthless worms, what is wrong with you to be so reckless with such sensitive information? The banks should be facing prosecution here, the fact that no damage was done is down to luck, customers information was put as perilous risk, and somebody should take the fall.
Actually a court can order a letter returned unopened. A court can order a marshall or officer of the court to go to a person's home and retrieve the snail mail letter. The court acted appropriately as the email was not intended for the recipient. Locking the email account was appropriate. We see this when money is incorrectly transferred into a bank account too - the recipient account is locked until the matter is resolved. There are no grounds for compensation and this is a bank account where you may not have any alternatives and may face financial or other hardship as a result (eg not get paid your salary or not pay a bill on time and get your power cut!), not just something as mundane as email where it could be easily argued other communication devices (phone, face to face) or a temporary email account would mitigate the impact.
As for compensation from the bank for the person whose account was locked, it really depends on the impact on the person whose account was locked. If they were running their own business using that account, it could be argued that 6 days without email cost them financially making the bank responsible for those losses. But as I outlined above, it is unlikely a court would even hear the case. The bank would need to be generous and settle - unlikely.
If it was a personal account or an account that was not impacted significantly there would be no grounds to litigate against the bank - you cannot sue for mere inconvenience (particularly due to a court order, court order's generally provide immunity against litigation). I'd say in this case it would be merely inconvenience, not costly to the person whose account was locked, but those details were not in the article.
LOL - shopping now... ;)
Wow. They tried to spin their horrendous internal policies as an example of how they protect customer information.
I don't even understand how this garbage is legal. You can take a company to court because you sent them an email by mistake. Who ever does business with this bank needs to get out asap. I'm not saying other banks don't do similar things, but this is just too obvious. Also this judge sounds very incompetent and incapable of dealing with these issues. I wish Google would have taken this further because this sets a bad precedence. If this situation doesn't define how to promote stupidity, I don't know what does.
I'm willing to bet that if you're one of the 1,300 you wouldn't be concerned by the privacy of some guy, you'd be more concerned that Igor from Kazakhstan hasn't just taken out a $20,000 loan using your identity.
Most theoretical arguments, especially overtly liberal ones (I'm not using this word as a synonym for Democrat, but the dictionary definition) tend to fly out the window when you're personally involved.
Nobody was hurt here. Albinos are getting chopped up in Africa to make healing potions, and we're outraged how it this happened to us we might not have access to our e-mail for a few days. Better hire a lawyer and sue!!!!
Consider the following scenarios using this precedent:
1) I "accidently" send the bank some type of sensitive e-mail from my home account, then go to the judge and demand a TRO against ALL of the bank's e-mail while we sift through each and every message looking for mine? Do you realistically think a judge would issue such an order? Why is it alright against an individual then?
2) I use my work account to send an offending message to a client? Can the judge expand this ruling to cover abusive and/or potentially abusive e-mails? Would the judge have the right to shut down the receiving e-mail systems to prevent delivery of obscene or otherwise abusive mail?
I think the judge really, really messed up here. No way should the user's account have been suspended. If Google can safely identify the message and delete just that one, fine delete just that one. Suspending the entire account could have DRASTIC consequences for the acount holder. Remember, they've done nothing wrong and are being harmed by the attempt to recover "misplaced" property. Who would be liable if the account holder missed some financing deadline / opportunity due to their account suspension?
A more thoughtful course of action would have been to notify the account holder of the issue, then issue a TRO against the account holder from taking any action with the data. Think of this as a reminder from the court that the wallet on the ground ISN'T lost, and that they shouldn't pick it up. The user could do whatever they wished, so long as it didn't involve any use of the data.
Simply puts too much power in the hands of the bank (plaintif)... Like the internet "Take-Down" notices, the needs of the bank need to be balanced against the needs of the e-mail account holder. I don't think this was a good call.
This was not the case of someone firing off an inappropriate (eg abusive) email. The bank and the court were acting in the public interest of those 1300 customers whose financial records were sent in error.
The issue here people should be outraged about is not the bank's response in acting to have the recipient account suspended - they should be applauded for that. If my account was one of those in the email i'd be thrilled at the response. The judge too acted in the public interest - this is the mandate of the courts. This is how we get case law and precedence. The issue was that there was no recourse against the employee who sent the information, nor any review of their policies, process, security etc to allow such a breach to occur in the first place.
Most theoretical arguments, especially overtly liberal ones (I'm not using this word as a synonym for Democrat, but the dictionary definition) tend to fly out the window when you're personally involved. "
Not really. If this happened to me I would not support it for a number of reasons. You're also making a theoretical argument that is extremely flawed. If this were a life and death situation your theory might make sense, but this is actually a scenario that many people don't take seriously.
1) Something similar (without the gmail and court involvement) happened to me with my credit union and I didn't freak out. In fact I was more annoyed that the bank deactivated my debit card as a result. I think where your assumption took a wrong turn is when you assumed that every customer would be so freaked out in this situation that they would support anything as a result.
2) Also you are assuming that any action taken would make me feel safer. I wouldn't be relieved by this token gesture of safety. It wouldn't make me feel any better.
3) There was no indication that the recipient was a threat, but in contrast the bank had already demonstrated that it was. I would be too busy worry about the bank having information.
4) This judge just reinforced the banks policies so well that the bank and you claim that the customer's confidential information was protected. You logic and no harm done attitude is part of the reason why the bank can get away with this.
Also this is cnet. If I want to make this argument I am in the proper place. If you want to talk Albinos in Africa then you are the one that probably shouldn't be posting.
Never send my e-mail something you wouldn't write on a postcard.
If I were at Google I think I'd have wanted to fight this a little harder. Perhaps redacting the attachment, to protect other innocent parties, but even this seems morally blurry. Quite frankly, the Bank should have take the fall on this one.
Point is if you report lax security your the bad guy no matter if it was intentional or not. It's never the banks fault or big company's crappy security remember that. Always they'll find a scapegoat to make them look good.
Does the FBI qualify?
However, this case seems to suggest that the court was rather too quick to act as the bank's "best friend" - that should make everyone feel a little less safe.
And Jeremy, I agree re your concerns however I don't think the court acted as the bank's best friend, rather it acted in the public interest of the 1300 people identified in the email.
This sounds like a poor security policy for the bank. Even if nobody read the email at GMail, there are copies of it on various SMTP routing servers and people with access to that SMTP server data can read the cache for a copy of the email. Emails don't go from the sender's IP address to the receiver's IP address, the Internet works via a node system and there might be seven or more nodes the email passed through including different ISPs and servers. Not only that but if on one of those systems someone was running a packet sniffer they could have captured the data if it sniffes out social security numbers, credit card numbers, and bank accounts. Usually a hacker/cracker does that and then does identity theft on the sniffed information. But if the data is encrypted, then nobody but the person with the private key and passphrase the message that was created with their public key can read it.
The issue is that one you raised regarding the bank's incompetency - this shouldn't have been able to happen. It is one thing to want to blame the employee at the bank, but it shouldn't have been possible for him to do this without malicious intent (in which case the State would've prosecuted him). The fact that an "accident" of this magnitude could happen at all is unacceptable.
The bank, however, as you've pointed out, is of major concern. Great that it acted quickly to remedy the situation but what is being done to ensure there is no repeat?
Google MUSt not interfere with the mail, They MUST let mail be mail. Regardless of the circumstance.
Fear the cloud
Google is within their rights of doing what they did. The scary thing here is just how dependent we are on Google for things Internet-based.
But I learned a lesson from my Yahoo Photos experience. I loved Yahoo's Photo service. I thought it was awesome. Now, Yahoo photos has gone away. I think gggg ssss is right. Cloud, while incredibly convenient, has a cost.
First it was Amazon and the Kindle. Now it's Google and gMail. What is next? And what will be the cost?
I still do not understand why the account was disabled, since they knew the exact email address of the sender, it should have taken less than 5 seconds to search the mail store, using that address, then just delete it... or at least striped the attachment (ie as if it was a virus/malware attachment) I even have a free gmail account and i know for a fact it should take about 5 seconds or so to find a specific email from a specific email address. Then notify the Gmail account user, what had happened and why. i would be tolerable of that vs having no access to my account for 6 days.
Now with all this said, i agree with the others comments... Why is a bank sending anyones info like that via email? Who were they sending it too? Another branch? Another Bank? Why would you need to send peoples personal information via email? Like the laptops being stolen with thousands of peoples personal info..stolen from a person trunk or somewhere else in the car. Not only did the banks get bailed out (most of them used that money to buy there competitors...so now they are even more powerful and bigger {remember "too big to fail"},.... than before the bail out) but apparently they are "still" so irresponsible, they can not even send and "important" email to the right person. Anyway you all get the idea. The Banks blow. Sorry for rambling LOL
Google is trying to convince the City of Los Angeles to move to Gmail. The contract is valued at $7.25 million. Google has other corporate and government customers (they tend to shy away from publicizing them).
Each and every snafu that Google suffers concerning its cloud computing services is a black eye on the whole notion of cloud computing, not just Google.
So for those of you who think that when Gmail goes down, it's not a big deal, think again.
The fact of the matter is that Google is fumbling quite badly with recent service outages. They are doing a p*ss poor job at convincing the world that cloud computing is ready for primetime. It's not.
You Google guys need to get your sh*t together. Don't talk the talk until you can walk the walk. And right now you keep tripping over your own shoelaces every few months.
If the city of Los Angeles needs a strong enough e-mail server, why not set up on their own? Too expensive? $7.25 million is a heavy price tag. How long would the contract run before having to renew it? With that money, I would set up their OWN e-mail server. Then all they need to worry about is to have an active Internet connection (which they most-probably already have).
As a business, I would never rely on any external web services (HTTP, FTP, e-mail, etc.). On the long run it is more expensive than having some "mobile" administrator look after your own server every week/month or on demand to maintain, update/upgrade or fix things.
- by loose_screw September 29, 2009 8:40 PM PDT
- This is stupid. What if the Gmail user had forwarding rules in place, or a POP client that retrieved the email before the bank could get Google to act? They got extremely lucky this time. The problem is with the bank's IT policies and employees, not Google and its users.
- Like this Reply to this comment
-
-
- by Jeremy Chappell September 30, 2009 3:03 AM PDT
- While a agree in part, I think I'd like to have seen Google fight a little harder, personally I think the most they should have done is redact the attachment. But the real blame here is with the court (which might be the most troubling of all) and the bank (how anyone can be so incompetent is beyond me).
- Like this
-
- by gggg sssss September 30, 2009 7:43 PM PDT
- same as the kindle Animal Farm fiasco
- Like this
-
Showing 1 of 2 pages (65 Comments)