Goldman Sachs Asks Court To Have Google Delete An Email With Client Info; Google Blocks Access To The Email

from the this-again dept

Five years ago, we wrote a story about how Rockey Mountain Bank in Wyoming accidentally sent a bunch of confidential information to the wrong Gmail account, then took Google to court to try to find out who received the email. Google demanded a court order first, leading a judge to (ridiculously) order the company to shut down the entire email account. It appears that something somewhat similar may have just happened with a more recognizable bank name: Wall Street giant Goldman Sachs went to court recently to order Google to delete an errant email containing confidential client information. According to the filing (which most news sites haven't posted, for reasons unknown):

On June 23, 2014, an employee of the consulting firm was testing changes to Goldman Sachs’s internal reporting and validation process. The employee intended to send a copy of the internal report to the email address provided to her by Goldman Sachs, which is in the form “[first name].[last name]@gs.com,” but instead mistakenly sent a copy of the internal report to an address in the form “[first name].[last name]@gmail.com.” She is not the owner of the gmail address.

The mistakenly sent email contains certain account and client related information (the “Confidential Client Information”). Goldman Sachs’s clients have a right to maintain the confidentiality of the Confidential Client Information. Furthermore, Goldman Sachs has an obligation to protect the privacy of its customers’ confidential information.

Goldman Sachs has made efforts to retrieve, have deleted or otherwise protect the mistakenly sent Confidential Client Information. As part of those efforts, on June 26, 2014, Goldman Sachs sent an email to the gmail address to which the information was mistakenly sent requesting that it be promptly deleted and that the recipient confirm in writing that s/he had done so. There has been no response.

Goldman also contacted Google directly, and as in the Rocky Mountain case, Google told Goldman to go to court first. Late yesterday, Goldman Sachs noted that Google has told the company that it has blocked access to that particular email and that the email in question had not yet been accessed by anyone. It appears that Google did this despite the lack of a court order, which may seem a bit questionable. Given the nature of the situation, and the fact that Goldman has actually gone to court and requested this, it does seem a bit more reasonable that Google agreed to at least temporarily block access to that particular email until a court decides if it needs to continue blocking it permanently.

Filed Under: confidential info, court order, email, gmail
Companies: goldman sachs, google

The NSA's Lockbox Has No Lock

from the like-that-won't-be-abused? dept

One of the key points that officials have been making in defense of the NSA surveillance is this idea that even if they're collecting all this data on your communications, they can't actually do anything with it, because they keep it safely locked up in a lockbox, and only check it if they have some bit of data they want to find out about later. That was the crux of the claims made by former NSA/CIA boss Michael Hayden who seemed to think that "data mining" and "asking the database questions" were two different things. However, as William Saletan is pointing out at Slate, the lockbox is a lie. There is no lockbox. He quotes officials including NSA boss Keith Alexander and Congress's number one NSA apologist, Rep. Mike Rogers, both suggesting strongly that even if the NSA is collecting all your data, it's safe because it can't be explored without a "very specific court-ordered approval process."

Except... what they conveniently left out, is that the court doesn't review any of this. It appears that it probably set some very basic rules up front when it gave the okay on collecting the data, which no one else gets to know about, and no one carefully checks up on the NSA later to see if they really follow any of those rules. What the claims most certainly do not mean, is that the NSA needs to get a court order to search the database. Senator Dianne Feinstein admitted as much directly:

Q:  Is a court order necessary to query the metadata database?
Feinstein:  Is a court order necessary to query—
Q: The metadata database under 215. An individual court order for each query.
Feinstein: A court order—well, I don't know what you mean by a query. A court order—
Q: To search the database.
Feinstein: To search the database, you have to have reasonable, articulable cause—
Q: Certified by a judge?
Feinstein: —to believe that that individual is connected to a terrorist group. You cannot—
Q: But does that have to be determined by a judge?
Feinstein: Could I answer? You may not like it, but I'll answer. Then you can query the numbers. The only numbers you have—there's no content. You have the name and the number called, whether it's one number or two numbers. That's all you have. Then you can get the numbers. If you want to collect content, then you get a court order.
Q: So you don't need a court order for the query itself.
Feinstein: That's my understanding.

And yet, as the article notes, most of the defenders of the program strongly imply otherwise, highlighting the "court-approved" process that people need to go through to query the database. But if there's no real oversight, and no court reviewing each query, then, as Saletan points out, there is no lockbox.

There's no lock on the lockbox.

That hasn't stopped current and former government officials from repeating the lockbox line. Yesterday Rogers used it again on Face the Nation. Dick Cheney, appearing on Fox News Sunday, backed him up. On Meet the Press, Michael Hayden, the guy who ran the NSA when it began collecting phone records, assured Rep. Bobby Scott, (D-Va.,) "The only way you can access the metadata is through a terrorist predicate." When Scott asked, "Where is that written?" Hayden replied: "It's in the court order." Really? Where's the court order? When is it applied, and how?

If the court isn't screening data requests, that leaves two possibilities. One is that nobody's screening them. The other is that some other, unknown entity is doing it in a way that nobody has explained. Either way, the answers we're getting are unacceptable. They betray privacy, public trust, and national security.

If there's no public standard, and no official oversight or review process, then the probability that the database is being abused approaches one very, very quickly.

Filed Under: court order, lockbox, nsa, nsa surveillance, oversight

Appeals Court Wants To Know Why TSA Is Ignoring Court Order Over Public Hearings On Naked Scanners

from the we're-the-gov't,-we-can-ignore-stuff dept

About a year ago, we wrote about a court ruling that the TSA's naked scanners were legal (they didn't violate the 4th Amendment's restriction on "unreasonable" searches), but that the TSA failed to hold the proper public hearings before buying and deploying them. The TSA appears to have only paid attention to the first part. After a bunch of folks asked why the TSA was ignoring the order for public hearings, now an appeals court has officially weighed in and demanded to know why the TSA has failed to hold public hearings more than a year after that court ruling. The order is pretty straightforward:

ORDERED that the Department of Homeland Security, et al., respond to the petition on or before August 30, 2012.

The TSA has said that it would hold hearings "next year" (or two years after it was ordered to do so). You would think that it wouldn't take the TSA two years to set up basic hearings -- especially while it has continued to roll out a variety of new scanning machines...

Filed Under: court order, privacy, public hearings, scanners, tsa

Google Taken To Court To Explain Why It Shut Down Someone's Gmail Over Missent Email

from the explanation-please dept

Paul Alan Levy writes "Last month, you wrote about the travesty perpetrated by Rocky Mountain Bank when it sued Google to shut down the gmail account of a Google customer to whom the bank had mistakenly emailed a pile of customer records. Equally disturbing was the way that Google -- which is usually pretty good about standing up to subpoenas for customer identity -- just rolled over and obeyed the court's order even though a second's review of the company's ex parte arguments to the court showed both that the bank never explained what the Gmail customer did wrong, never explained how Google could be sued in the face of 47 USC 230, and never showed that there was diversity jurisdiction.

So we have gone back to court, representing MediaPost Communications, arguing that Google's report to the Court, showing its compliance, is a judicial record that should have been, and now must be, filed publicly. We agree of course that any actual customer identification in the compliance report should be redacted."

This is a tricky issue. After all, Google, as a private company, has the right to shut down an email account on its own. But, seeing as this was all a part of a legal case, with a number of questionable elements, it does seem like the information that led to the account being shut down should be a part of the public record.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Google Destroyed Missent Bank Info Email Unopened... As More Legal Questions Are Raised

from the still-doesn't-make-sense dept

Last week, Google was ordered to deactivate someone's Gmail account, because Rocky Mountain Bank had totally screwed up and sent the Gmail account holder an email by accident, which contained all sorts of confidential information. It's still not at all clear how Rocky Mountain Bank made such a monumental screw up, but we'll leave that aside for now. On Monday, the two companies asked the judge for permission to restore the email, after they realized that the email in question had never been opened, and Google had deleted it from its servers. Case closed?

Well... not so fast. Paul Alan Levy, from Public Citizen, sees a number of serious problems with the whole episode, starting with the legal complaint in the first place -- which offered no opportunity for the email account user to speak up and argue for his or her own rights, against having the account deactivated. But just the legal proceedings themselves suffered from some serious problems:

First, the complaint. Rocky's complaint is based on the contention that, having botched its obligation to keep its own customers information secret, it was obligated under various state and federal banking regulations to seek to recover the information and prevent its further dissemination. The complaint further alleges that regulatory officials expressed their endorsement of efforts by the Bank to protect the confidentiality of the information. The complaint sought a declaratory judgment that Rocky Mountain was entitled to information about the account holder, and that Google was obligated to prevent use of the information sent to the account. It sought an injunction enjoining Google and the account holder from accessing or distributing the information mistakenly sent to the email account, and compelling Google to identify the account holder. But curiously absent from the complaint was any allegation about how either Google or the owner of the gmail account had violated the plaintiff's rights, or any assertion of a cause of action against either Google or the anonymous account holder, that would form the basis for granting relief against either. Nor did Rocky Mountain's papers explain why section 230 of the Communications Decency Act entitled it to bring an action against Google, or to obtain any relief against Google, even assuming that it had a claim against the gmail account holder. Without a cause of action and without a violation of the plaintiff's rights, why was Rocky Mountain entitled to relief, and why should the defendants be subjected to an injunction? Neither the complaint, nor the brief in support of the TRO, explains this.

Second, the lack of federal court jurisdiction. Although the complaint identified only Google as a defendant, Rocky Mountain asked for relief against the anonymous gmail account holder, which is obviously, therefore, a defendant just as Google was. Indeed, if either Google or the account holder was the right defendant here, it is the account holder. But this poses a serious problem, because the law is clear that a Doe defendant cannot be sued under diversity jurisdiction. If there had been any party with any incentive to protect the Doe's rights in this case, that party could have pointed this jurisdictional defect out to the Court, which would therefore have been obligated to dismiss the case instead of issuing a TRO.

Oops. And, from there, Levy also wonders why Google was so quick to roll over without trying to defend the user's rights:

Rocky Mountain's papers recount that it asked Google for help freezing the account and identifying the account holder but that Google refused to do so without "a valid third party subpoena or other appropriate legal process." Yet despite the filing of plainly defective papers, there is no indication in the publicly filed papers that Google either opposed the requested order or insisted that it be given the opportunity to notify the Doe gmail user so that he or she could obtain counsel and oppose the requested order. Nor do the papers contain any discussion of efforts to notify either Google or the anonymous user about the requested order, even though Rule 65(b)(1) of the Federal Rules of Civil Procedure requires either notice to the parties sought to be enjoined, or a compelling explanation of why notice was not possible. (Because the Bank noticed the problem on August 13, and waited until September 17 to file its suit, it is hard to believe that a few more days' delay to give proper notice would have been catastrophic). And within a day of the issuance of the order (one day before the compliance deadline), Google provided the court with a document explaining how it had complied with the TRO and asked, jointly with Rocky Mountain, that the TRO be vacated.

Indeed. It's certainly understandable why everyone wanted to make sure the data was not compromised, and in this case, it sounds like the account in question was probably inactive or rarely used (or the email went to spam). So everything may have ended up okay. But that's no excuse for potential violations of an individual's rights in trying to correct a mistake by the bank.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Google, Rocky Mountain Bank Ask Judge To Restore Deactivated Gmail Account

from the bring-'er-back dept

Last week, we noted that a court had ordered Google to shut down a Gmail account of a user who had accidentally been emailed confidential information by Rocky Mountain Bank. The two companies have now both asked the judge to reinstate the Gmail account, saying that the original request is now "moot." The article notes that the judge has adjourned the case until next week, so the account will remain deactivated until then. Still, it's not at all clear why the issue is now "moot." Did Google delete the email in question? Was it determined that the account itself was dormant? It would seem like these details are relevant, and not anything that would need to be hidden.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Google Ordered To Shut Down Gmail Account Of User Who Received Unsolicited Banking Info

from the well-that-sucks dept

Yesterday, we wrote about Google being taken to court because Rocky Mountain Bank screwed up and sent confidential information to the wrong person's gmail account. It's still not clear why they were sending confidential info to anyone's gmail account, let alone to the wrong person's. The bank tried to contact the person at the email address, but had no luck. They asked Google about who it was, but Google refused without a court order. However, the court has gone even further, and ordered Google to deactivate the entire account. While you can absolutely understand why the bank wants the account shut down, to protect that info, it's quite troubling that someone's email account just gets deactivated, despite them doing absolutely nothing wrong. Especially in an era when people rely on their email accounts for all sorts of important things, having a judge deactivate the account of someone who did nothing wrong seems quite problematic. Yes, the bank screwed up. And yes, lots of information was potentially exposed, but that should be the bank's problem -- and not the email recipient's.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Record Labels Disobey Court Order On How Student Info Can Be Used

from the this-is-a-surprise? dept

Ray Beckermann points us to the news that in a lawsuit involving various record labels against some USC students, the record labels asked the court to help identify the students -- which the court granted on the condition that the only use of the student info would be to seek injunctive relief (i.e., get them to stop file sharing) rather than monetary relief. However, as LAist is reporting, it only took a few months for the record labels to, instead, demand money via a typical pre-settlement letter, that demands thousands of dollars to get the RIAA and labels to not sue you. This certainly appears to be contempt of court, going in direct contrast to the judge's order.

Filed Under: court order, injunctive relief, riaa, usc