Goldman Sachs Demands Google Unsend One of Its E-mails 346
rudy_wayne (414635) writes A Goldman Sachs contractor was testing internal changes made to Goldman Sachs system and prepared a report with sensitive client information, including details on brokerage accounts. The report was accidentally e-mailed to a 'gmail.com' address rather than the correct 'gs.com' address. Google told Goldman Sachs on June 26 that it couldn't just reach into Gmail and delete the e-mail without a court order. Goldman Sachs filed with the New York Supreme Court, requesting "emergency relief" to avoid a privacy violation and "avoid the risk of unnecessary reputational damage to Goldman Sachs."
Reputational Damage (Score:5, Funny)
Re: (Score:2, Informative)
Re:Reputational Damage (Score:5, Funny)
Re:Reputational Damage (Score:5, Insightful)
What this also indicates is that "Joeblow@gmail.com" was already in the employee's address book, which means it is someone they correspond with. Given this, did the employee then contact that person and ask them to delete the previous email? I presume they did, and got a "fat chance" in reply. And if THIS was the case, you can rest assured that "Joeblow@gmail.com" has already saved the email elsewhere and likely forwarded it to other email addresses; so this attempt at a court order, while it may show that the employee was attempting to do the right thing (so protecting their job), won't actually accomplish anything in the name of privacy or "name polishing".
It's like Barbara Streisand has suddenly requested the world forget about her... and they have.
Re:Reputational Damage (Score:5, Funny)
Re: Reputational Damage (Score:4, Informative)
Or, he just mistakenly typed '@gmail.com' instead of '@gs.com'
Before autocorrect, people used to make this kind of mistake all the time, it was so common we had a name for it - we called it a 'typo', and we were forced to take ownership of the mistake.
Now we either call it txt-speak or we blame it on auto-correct.
Re: (Score:3)
Google: we can't do that without a court order
Bank: here is your court order
Google: WHAAAA?? Can't believe you just gave us a court order!
Bank:
Email Insecure (Score:5, Insightful)
Through a combination of carelessness and cluelessness, this employee managed to put hundreds of millions if not billions of dollars of customer funds at risk.
Sending information like this via email is where the mistake happened, not mistyping the address. Email is not secure even if it is sent to the right address you have no control over how it gets there and it could be easily intercepted and read enroute. Their reputation loss has already occurred by admitting that they use email for highly sensitive information like this.
Re: (Score:3)
Re: (Score:2)
Not that I care a hoot about bad things happening to GS... not that I believe this should have been emailed...
But I wish it weren't so easy to send a message to an unknown address, particularly one on a different server. I'd almost rather have a separate protocol for sending to known/safe addresses than for unknown addresses.
Re: (Score:2)
That's why there are TLD's [wikipedia.org] just for that purpose.
Re: (Score:2)
I don't see how that would help this situation. The "testing" was an internal business process, not an email system test. The email was a report related to testing.
Re: Reputational Damage (Score:3, Informative)
Re: (Score:3, Funny)
Re: (Score:3)
Re: (Score:3)
Come on, can't you just let someone be condescending without replying with a perfectly reasonable explanation?
He gets to feel superior, you get to mumble something about idiots and reading comprehension, it's a win-win in my book.
Non-story. (Score:5, Informative)
Re:Non-story. (Score:5, Insightful)
Just because an issue was quickly resolved doesn't make it a non-story.
If Goldman Sachs uses the insecure SMTP protocol to transmit highly sensitive unencrypted data, they deserve the reputation damage (and a security audit).
Re:Non-story. (Score:5, Insightful)
Assuming the data was in some attachment (of could have been easily put in an attachment), how about just encrypting the attachment if it contains information so incredibly sensitive that it warrants a court order if it ever leaks out.
You don't need PGP, IMAP or any specific OS, just a small bit of common sense.
Re: (Score:3)
You don't need PGP, IMAP or any specific OS, just a small bit of common sense.
Who needs common sense when you can hire an army of lawyers to clog up the courts with your idiocy?
Re: (Score:2)
That doesn't make this a non-story, only a slightly out-of-date one.
Re: (Score:2)
Already blocked [reuters.com]
Yea no, the idea that blocking the email relieved the privacy concern is a joke. They sent that "massive privacy leak" or whatever, over the open internet. In fact, it sounds like they are routinely doing this, and their only concern is that they sent it to the wrong address. The real story here is that Goldman Sachs is sending this kind of info via email!!! In my job, if I were to send even your name and address via email outside our corporate network I'd be fired on the spot. The email traversed dozens of
Re: (Score:2)
Now I want this interesting new gmail feature for my own personal use too! Call it beta if you want, go ahead, it seems to be working well enough already.
Who should I address my own Feature Request to at the GOOG? Maybe Fat Chance?
Too late now (Score:4, Insightful)
Re:Too late now (Score:4, Informative)
No -- according to the updated article, the account hasn't been accessed between the mail was sent and Google breached it to comply with Goldman Sachs' demand.
Yeah (Score:5, Funny)
Barbara Striesand never returns my e-mails either.
E-mail? (Score:5, Insightful)
Massive privacy breach....e-mailed a report...containing sensitive details...e-mailed...
The problem here isn't that it was sent to the wrong account. It's that it was e-mailed AT ALL.
Re:E-mail? (Score:5, Insightful)
Good luck explaining this to companies ... I'm still working over people who insist on sending confidential Excel spreadsheets by E-mail.
Re: (Score:2)
Don't put anything in an email that you wouldn't put on a postcard. If you MUST email sensitive information, encrypt it before sending -- the encryption is the envelope.
Re:E-mail? (Score:4, Insightful)
Don't put anything in an email that you wouldn't put on a postcard. If you MUST email sensitive information, encrypt it before sending -- the encryption is the envelope.
No... encryption doesn't work either. If the data is only sensitive in the short term then you can encrypt it. So, for example, a configure file that wont matter in a month when you change it. But if the data is actually sensitive, like your financial records, eventually that encryption will be worthless and if anyone saved that file, they'll be able to decrypt it.
Re:E-mail? (Score:5, Insightful)
"testing internal changes... with sensitive client information"
Should violate all security policies right there.
No "sensitive data" filtering? (Score:3)
There are more than a few email filtering products, some designed specifically to prevent sensitive data from being emailed at will via heuristics designed to detect sensitive information.
You would think as heavily regulated as Goldman is they would have these kinds of systems in place to prevent this kind of thing from happening.
Re: (Score:3)
You would think as heavily regulated as Goldman is supposed to be they would have these kinds of systems in place to prevent this kind of thing from happening.
FTFY.
Regulations only work if they are actually enforced.
Re: (Score:2)
Re: (Score:2)
First, they don't understand it's not secure. Second, if the thought did cross their mind, then they wouldn't know who to ask for a secure solution or be patient enough to take the time to implement it.
Did companies learn nothing from Target?
Re: (Score:3)
Re: (Score:2)
Massive privacy breach....e-mailed a report...containing sensitive details...e-mailed...
The problem here isn't that it was sent to the wrong account. It's that it was e-mailed AT ALL.
Right, the breach occurred the second the guy hit "Send"
There is no "Fixing" this. The fact that Goldman Sachs doesn't have any security controls to block the sending of spreadsheets outside their network is eyebrow raising to say the least.
Too late (Score:5, Funny)
Disclaimer? (Score:3)
At least every lawyer type e-mail I get has a giant disclaimer at the end if you are NOT the intended recipient. Perhaps GS should have considered using that? Over paid dopes.
Re:Disclaimer? (Score:5, Insightful)
The problem with that is, is if was sent to your email address, you are the intended recipient.
Re: (Score:2)
No you're not, when the email was sent by mistake.
Re: (Score:3, Informative)
You are incorrect. The email may be mis-addressed, but you are still the intended recipient of that email, as given by the fact the email envelope has you as the recipient. You therefore have a legally acceptable record that that individual email was sent directly to you.
Re: (Score:2)
>The problem with that is, is if was sent to your email address, you are the intended recipient. No you're not, when the email was sent by mistake.
I'm having trouble figuring out where to begin explaining how incorrect this statement is. Your argument is intent? OK, let's start there. The users intent was to send an Email. This user intentionally entered real world confidential information into the body of this Email message. Then this user intentionally entered a fully qualified and valid Email address into the "TO:" field of the Emails header and finally they intentionally sent this message to the previously mentioned Email address. Tripping over a
Re:Disclaimer? (Score:4)
This is incorrect, and yet, the error does not matter.
Intent is known only by the sender. From the recipient's point of view, it does make sense to assume that an email addressed to you, is intended for you. That asumption is sometimes wrong, but it's a rare occurance. And whenever you're wrong, you won't know until you've already read some of the email. This really is the best any recipient can be reasonably expected to do.
The sender has all the power here (they get to decide whether or not to encrypt, for example, and which key to use (typically looked up by intended-recipient's name!!)) so I think they should have all the responsibility.
Re:Disclaimer? (Score:5, Insightful)
Re:Disclaimer? (Score:5, Insightful)
I've also seen a creditable argument that because the disclaimer is at the end of the email, and you would have to read the email and therefore all of it's content before reading the disclaimer that warns you not to, that they are particularly worthless.
Re:Disclaimer? (Score:5, Funny)
Re:Disclaimer? (Score:5, Funny)
Re: (Score:2)
What good is a disclaimer going to do? Are any instructions within legally, or in another way, enforceable?
Re:Disclaimer? (Score:5, Informative)
At least every lawyer type e-mail I get has a giant disclaimer at the end if you are NOT the intended recipient. Perhaps GS should have considered using that? Over paid dopes.
Every time I see one of those worthless disclaimers, I crack up. You can't unring a bell and I am under NO obligation to delete any email that was sent to me if it was addressed to my email account. If you typed the wrong address, that's your problem, not mine.
Re: (Score:2)
***** IMPORTANT INFORMATION/DISCLAIMER *****
This document should be read only by those persons to whom it is addressed. If you have received this message it was obviously addressed to you and therefore you can read it, even it we didnt mean to send it to you. However, if the contents of this email make no sense whatsoever then you probably were not the intended recipient, or, you are a mindless cretin; either way, you should immediately delete yourself & destroy your computer! Once you have taken this a
Re: (Score:2)
Can't image those disclaimers are enforceable...Plus I have a disclaimer on my email server that states that "any email received by this system is subject to full public disclosure at the sole discretion of the recipient. If you do not accept these terms do not transmit your email and disconnect now"
Goldman Sachs is one of the most dangerous... (Score:3, Interesting)
This is a test case for them, it's all about control and it's all about the money.
Do you guys remember this: "Give me control of a nation's money and I care not who makes the laws."?
Well, you better remember it - and understand what it means, because your FREEDOM is at stake!
Cryptic to you?
READ BETWEEN THE LINES!
Minor inconvenience (Score:2)
"By contrast, Google faces little more than the minor inconvenience of intercepting a single email - an email that was indisputably sent in error," it added.
Losing a few thousand dollar is little more than a minor inconvenience for GS.
So how about it GS... send me a few thousand dollars.
Google is abso-fucking-lutely right to require a court order. If they don't, it'll just open the flood gates for other companies and people to "retract" damaging e-mails. The news here isn't that Google required proper legal procedures before violating it's users rights, it's that GS sends highly sensitive data by e-mail.
Re: (Score:3)
Re: (Score:3)
google locked THIS EMAIL.
big difference.
Re:Minor inconvenience (Score:5, Interesting)
As disturbing is that the threat of "reputational damage" is enough to get a court on your side.
The United States government should not be helping people or business protect their reputation from their own mistakes. It opens a floodgate to potential abuses. This request should have been laughed out of court. "You screwed up, bub; you deal with the consequences."
I can see this ruling being used as a precedent in many future law cases.
This is Google's fault...why, exactly? (Score:2)
Should have filed in Nevada (Score:3)
...and used Microsoft's legal team. They would have gotten the gmail.com and google.com domains and then it would just have been a matter to use Microsoft name servers to commit a DoS attack against gmail's hackers, erm, users.
The Federal judges in Nevada are suckers for a good story, I hear, even if it's blatantly false.
How the fuck? (Score:4, Interesting)
How the fuck did they reach anyone at Google to get that response?!
Re: (Score:3)
It's the "they have lots of money" effect that ensures their requests are read and acted upon, rather than automatically filtered out and discarded.
Re: (Score:2)
But what about the email footer???? (Score:3)
Aren't these legally binding? :-)
So can I (Score:5, Insightful)
make the same request when I accidentally reply-all to save myself 'reputational damage'? Or does this only work for large companies with lots of money?
Cannot unsend an email (Score:3)
Someone should tell Goldman Sachs that you cannot unsend an email. Usenet articles can be cancelled, even though most servers ignore cancels, but like snail mail, once email is posted it cannot be recalled.
Recourse for the blocked email? (Score:3)
What I'm wondering is whether or not the person whose email account was blocked because they received an email from Goldman Sachs has any form of legal recourse against Goldman Sachs.
What's with the outrage? (Score:2)
They DESERVE the reputational damage (Score:2, Interesting)
Everyone makes mistakes. I understand that. I make mistakes too.
But here's what I don't get. I am sending an email to dude@gs.com and accidentally type dude@gmail.com. But I also I just happen to have dude@gmail.com's PGP key and a sufficient trust path to know the key is correct, for the confidential information in question? That's the part I simply don't believe. All of Goldman Sachs' protestations that the sender just happened to also know dude@gmail.com and that they key was verified, ring hollow.
After 2008, Greek crisis etc what damage will this (Score:3)
What law? (Score:3)
My question is, what law gives a court the right to do such thing? While there may well be laws that compel companies to keep their own data private, I find it hard to believe there is a law that gives a court the right to undelete stuff in a scenario like this. Courts don't tend to do stuff no matter how reasonable unless there is some law that says they should.
The disturbing thing about this is that the real owner of that mail box, whoever he may be, doesn't get to show up in court and put forward his viewpoint.
Google could say that, but negligence suit allows (Score:3)
I can see one way that the court is authorized by law to do that. Under common law, we each have a duty to not be reckless about doing things that might cause harm to another. Had Google chosen to deliver the email after having been notified that it could bring harm to Goldman _and_its_customers, Goldman could then file a suit for negligence. The judge or jury would then decide if Google failed to exercise ordinary care in preventing the leak, or if they did all that a reasonable person would do to protect
Unsending E-mail (Score:5, Interesting)
The ancient Roman Horace (65-8 bce) said: "Once a word has been allowed to escape, it cannot be recalled."
More recently, Omar, the Tentmaker (died ca 1123 ce) said:
"The moving finger writes; and, having writ,
Moves on: nor all your Piety or Wit
Shall lure it back to cancel half a Line,
Nor all your Tears wash out a Word of it."
Treat it like regular mail. (Score:4, Informative)
Did Goldman read the EULA? (Score:3)
Re:why? (Score:5, Insightful)
This all seems fairly reasonable to me.
You have enough people doing enough things, eventually someone is going to make a stupid mistake. In hindsight there is probably plenty of stuff that could have or should have been in place to prevent this, but then there always is when looking back at a problem.
Google seems to be acting reasonably. Putting a process in place where companies can quickly and conveniently "take back" emails seems like a bad idea. Requiring a court order ensures that this goes through a strict process and is well documented. Google doesn't seem to be "fighting" this so much as saying "get a court to tell us to and we'll happily do it for you".
And I don't get the impression that Goldman Sachs is pounding their fists on the desk here either. They are doing everything they can to repair or prevent damage caused by a mistake they made. They are seeking out the court order and probably other stuff internally.
Re:why? (Score:5, Insightful)
Think Potsy, think.
Re:why? (Score:5, Insightful)
Well, that's what the court is for. They get to decide if deleting this email is the right thing to do or not.
Who else would you suggest? Goldman Sachs is out, obviously. Would you rather Google be the one to decide?
Re:why? (Score:5, Insightful)
Or what if this email was going to be evidence in a case against Goldman Sachs.
This is exactly why this goes through the courts. Sorting stuff like this out is kinda why courts exist.
Re: (Score:2)
Re: (Score:3)
And then do it again using something other than Gmail just in case they put up a filter to prevent that.
As far as I'm concerned, Goldman Sachs totally screwed up by sending confidential information to a member of the public in the first place. Their error is not sufficient reason for Google to panic or violate the trust of their entire user bas
Re:why? (Score:5, Insightful)
Analogy alert: GS mistakenly sends me a letter by physical mail, then asks the post office (or asks a judge to order the post office) to send a mailman round, break into my house, and retrieve the letter. That clearly won't happen; worst case is that the judge would order me to surrender the letter. In case of email, is Google (under their terms & conditions and the letter of the law) allowed to "break into" my mailbox and remove the offending letter? And should they be?
Re: (Score:3, Interesting)
Not an entirely accurate analogy. You own the house (and even if you didn't, the *mailbox* from which you retrieved the letter is distinct from the dwelling where you're likely to store it afterwards).
In gmail's case, google *owns* everything, and they just let you use the storage and mailbox assigned to you. So given a court order, they could remove the email without technically accessing anything that's actually yours.
Now, if the recipient makes a local copy, then your "break into my house" analogy would
Re: (Score:3)
I disagree with your disagreement of the analogy. What if your house is rented or you have put the physical letter is in a safety deposit box in the bank? In both these cases the physical location is owned by someone else and you are just renting the space. Is this any different from you renting the e-mailbox space on the google (or other ISP) servers?
Re: (Score:3)
Is this any different from you renting the e-mailbox space on the google (or other ISP) servers?
Yes. It's called "Contractual Terms" or "EULA".
Re: (Score:3)
I agree. I think the most reasonable action is to try to contact the owner of this email address and explain the situation.
Maybe give him $1000 to sign a retroactive non-disclosure agreement. Odds are it's just a random normal person
that would gladly take $1000 to keep quiet. I get confidential emails for a large company that has a similiar domain
to one I own all the time. I probably average about 20 a day. I sometimes notify them but I mostly just delete them
and move on with my day. I sometimes feel
Re: (Score:3)
If the email contained credit card numbers and such and you don't want to go to jail then $1000 is fairly generous.
You could possibly figure out how to sell it on the black market but most people are not willing to break the law and
risk jail time especially if their identity is already known. Now, on the other hand, if it's stuff that I could sell to a
newspaper about corruption then I would probably be willng to sell it to the highest bidder.
Re: (Score:3)
my brother, who works in finance, has a favorite expression for when he gets the extreme upper hand in a deal. "ripping their faces off".
Re:why? (Score:5, Insightful)
As always, the analogy is flawed.
If the court ordered someone to break into your house and delete the attachment you saved locally, your analogy would hold. As it is, what GS is asking would be analogous to the court ordering the post office to remove the letter from your PO Box. Seems much more reasonable to me.
Re: (Score:3)
How would you feel if the postman was just supposed to check to see if it was still in your box, and take it if it was?
I'd be fine with that, provided a court was the one to decide it should be done.
Your gmail account is your mailbox, not your house. If you were to save the contents of that message somewhere else, that would be akin to bringing the letter inside from the mailbox.
Re:why? (Score:5, Insightful)
Re:why? (Score:4, Interesting)
Maybe. The GP raises an interesting point though.
Is the "address" (johndoe123@example.com) the same as its user (Mike Somehow who uses the previously mentioned e-mail address)?
Real life example: I rent an apartment which was previously occupied by a foreign citizen. I receive snail mail addressed to:
- The owner
- Previous renter
- Me
- My wife
- Unspecified recipient (SPAM)
- Others (named people who don't live at my address).
I am legally entitled to open mail addressed to me and "unspecified recipient". Now, in case of an e-mail address, the same could apply. The actual recipient might not be the one who "lives" there, and there might be elements that specifically mention a different recipient than me. Since an e-mail is a non-physical item, I can't really "return without opening" but I could destroy it (after or instead of reading its contents).
Is this covered by the GMail EULA? I confess I've never read the whole damn thing.
Re: (Score:2)
Ah, but by definition, the email that the unmentioned gmail.com user has is addressed to him or her. GS may have made a mistake in the address they sent it to, but it IS addressed to that gmail.com user.
Re: (Score:3)
"Some states do in-fact, prohibit a person from opening mail that is not addressed to them, in which case it would still be a crime to open your wife's mail."
It IS addressed to him, that's sorta the point.
Re: (Score:2)
It makes sense if the email hasn't been retrieved yet. GS wants SMTP to have a Recall Unread Message feature which it doesn't. So in the meantime, they expect Google (or the postman) to do the retrieval for them. Should this be possible? Sure, for a fee until SMTP (or another protocol) will let users recall their own messages.
FWIW - You can recall internal messages with Outlook/Exchange. I'm sure others do it too.
Re:why? (Score:4, Insightful)
Sure they can, but how do you think every user of Google products will think if any company out there can say, "oops, didn't mean to send that, google, go fix my screw up and delete that from peoples inboxs."?
Should they do it? Maybe, but again, at this point we only have Goldman Sachs word that they 'should'. Maybe their entire story was fabricated and it was proof sent out by a whistleblower. Maybe it wasn't sent by a whistleblower, but it is proof of illegal activity that should be turned over to the appropriate legal or regulatory agency. We only have the companies word for it, and do companies ever lie about stuff like that?
So Google is going with "Will only due so with a valid court order" on this. Good choice. You won't piss off the customers because a court made you do it, and you won't get yourself in legal trouble because a court made you do it. Yep, this is the right choice if they have any functioning brain cells at all.
There's also a fourth option of just plain refuse. Claim the mail system is sacrosanct and it won't be messed with. Of course there are two big problems with this. First is almost nobody will believe you. Second is you are then looking at a big as legal battle you probably won't win because you are not the federal government. That's why I didn't list this one in the beginning, though I did mention it at the end to avoid having a million responses pointing this one out.
That's my say, disagree or whatever
Re: (Score:2)
Re:why? (Score:4, Insightful)
Is google gonna have to run tech support everytime someone mistakenly sends an email?
Should the USPS intercept a letter upon request everytime someone made a mistake in sending it out?
No, it's not doggone reasonable. In fact, it's so unreasonable, that only a company with the pull of Goldman Sachs can demand it.
Do you think you go to google with the same request, they'll bow down to you? Do you think the courts would have granted it so fast?
Of course not, because it's a drain on their resource to help some dumbass rectify his own damn mistake.
Re: (Score:2, Insightful)
Here is a lesson from this:
This is why divisions with critical info use some form of IRM/RMS. A mistake with a document being sent results in an encrypted document landing in the destination mailbox. Not a good thing, as the name and length of the file is readable... but not a complete leak either -- damage is mitigated. Plus, in Outlook this is as simple as clicking "do not forward" when attaching a document.
The parent has it right. These are two companies doing proper process/procedure to deal with a
Re: (Score:2)
By about a decade.
Re: (Score:3, Interesting)
You get what you pay for.
Yes, Goldman Sachs bought themselves a nice compliant government. I would say they got a bargain.