This begs the question, what was the bank doing emailing bulk sensitive data in an insecure fashion?<p>It seems like the bank needs better security policies and thinks that it is acceptable to go after innocent people rather than admit that they don't take data security seriously. I understand getting caught in a situation like this. It happens and while it might be a sign of bad policies, it might also just be unlucky. What matters is how one handles these situations - and the bank isn't handling it well. You have a data breech. Do you notify account holders affected, help them change their account numbers, take responsibility, and put in place policies that will prevent it from happening again? Or do you yell at Google and go after some innocent Gmail user trying to hide yourself from responsibility?<p>Heck, they even wanted their lawsuit to be confidential: <a href="http://www.informationweek.com/news/internet/google/showArticle.jhtml?articleID=220100410" rel="nofollow">http://www.informationweek.com/news/internet/google/showArti...</a><p>At least the judge decided that their embarrassment wasn't cause to keep the lawsuit private.
I actually have a similar story.
As it turns out, I share a first initial and last name with an incumbent congressman's campaign manager.<p>During their last campaign, I received quite a bit of wholly unsolicited email bound for the manager. Despite a couple "I'm not the guy you're looking for" emails, (i even sent one directly to his 'official' address on the campaign website) I continued to receive the emails.<p>Most were fairly benign. Some were harmless, but definitely from the sausage-making side of politics.
Quite a few were... very personal. I can easily imagine they'd leverage this precedent if they realized what I was getting.<p>So this whole topic hits pretty close to home when I wonder about what extents these rulings might go to.<p>Would they turn over my account itself? Would they scour my outgoing messages to see if I forwarded it? Would they pop open every archive I emailed to see if that might contain the information? Would I be compelled to turn over passwords and keys for secured archives? (violating my client's privacy as well) Would they supply a list of IP addresses where I viewed the messages (and might have made copies)? Would they demand access to those machines?<p>Exactly how much of mine (and thereby my associates) privacy would these courts be willing to violate due no fault of my own?
Imagine that you are the owner of jgc.org and that there's a popular web site called igc.org. Now imagine that amount of email you receive daily misdirected to jgc.org.<p>A lot of this mail is mailing lists that didn't do double opt-in and hence *@jgc.org got added to the list. But quite a lot is just personal mail.<p>For a while I used to receive the itineraries for the private jet of a famous entrepreneur because they were meant to be CC:ed to someone at igc.org but came to me instead.
Wouldn't it make more sense to link to the source?<p><a href="http://www.theregister.co.uk/2009/09/23/google_sued_for_gmail_user_identity/" rel="nofollow">http://www.theregister.co.uk/2009/09/23/google_sued_for_gmai...</a>
Maybe they should be sending secure links to sensitive files rather than the files themselves. At least they could regenerate the links rather than just hope that the files get to the correct place.
This makes sense. The bank is doing what it should be doing, by bringing the matter through proper legal channels. If Google just handed over the information, they would be liable to the account holder. I personally hope that the legal system finds the bank was negligent and denies access to the guy's personal information.<p>Also, what are the 1,300 bank customers doing about this? I'm sure that a class-action suit will be filed against the bank.
I had this fun idea of registering an email address with an username being a common noun. Although I found it strange that the address was still available, but I didn't care too much about it, I was happy to have the account. (You know, new inbox smell).<p>And then emails started to arrive to the address. Of course, lots of them were spam-spam-spam-spam. But there were also some personal letters. For a while I thought it was some mistake, and replied nicely to them pointing it out, and tried to inquire about what could be the reason behind the confusion, but never really figured out.<p>The mails kept coming, and I realized that they weren't even addressed to the same person. Up to now I have at least 30 alteregos, giving out my email address to their friends, relatives, and using it in an attempt to register on web sites. Most of them seem to be female, so I get many mails trying to hit on "me" after that talk on im or seeing my profile on some website, etc. Also pictures of nieces, invitations to bbqs, and questions about my iron and if I can bring it to "the club" next Tuesday.<p>I just hope I won't get sued one day.
So in order to find out who's behind a (Gmail) email address, all I have to do is send an email and then claim that I didn't want to send it to that person.
My gmail account happens to be my first initial and last name. I get more mail addressed to other P. Welch's than I get addressed to me, but probably because I don't really use the account (I foolishly got it back when gmail accounts were considered a status symbol and used it for online file storage).
There has to be some sort of precedent for this with physical mail.<p>On the other hand, I don't think that the bank is being unreasonable when you consider that Google said, "Sorry, no, you'll have to file a suit about this and proceed through legal channels."
If anything, I think the identities of the bank employees should be revealed just so this nightmare gets put on their permanent records (the internet).