Death By Email Blog

Merrill Lynch Sues to Stop Racist Emails

They don't know who is sending these emails.  But, Merrill-Lynch is filing suit anyway.  They hope that the law suit will force the release of the identity of the Hotmail user posing as a Merrill Lynch manager to send racist emails.

Merrill Lynch says that since September some of its black employees and civil rights activist Rev. Al Sharpton have been subjected to racist emails sent by someone posing as one of the company's managers, according to the Associated Press. They cast the Merrill Lynch employee whose name has been used in a negative light, and has tarnished the company's reputation as well, Merrill says. The emails actually came from a Hotmail account.

By filing suit in U.S. District Court in Manhattan on Tuesday, Merrill will seek a court order to require Microsoft, the owner of Hotmail, to unmask the email sender by obtaining information about the email account.   Currently, the man is identified as "John Doe" and it is suspected that he lives somewhere in the Midwest.

Clever Email Virus Received Yesterday

Yesterday, I received a very cunning, virus-causing email that almost beat me.  As the CEO of InBoxer, a company that sells anti-spam and email archiving products, I am pretty clever about spotting these things.  But, this email jolted me and almost fooled me. 

FROM:  Federal Trade Commission [frauddep@ftc.gov]
SUBJ:   Complaint Update for Roger Matus   (Case id : #6263)

Gulp.  It got my attention.  What made the email cunning is that it contained specifics.  It named a customer and a date of the complaint, which made me want to rush to our ordering system and see what happened.  It even had a specific form-like area:

Complaint was filled against :
Name : Roger Matus
Company : - InBoxer

I almost clicked on the link, which said: http://ftc.gov/fraud/complaints/24_oct_2007_george_hanson.doc

Then, my mental alarm bells went off.  A word document from the government?  I placed my mouse over the link and waited for the tool-tip box to appear.  (In case you don't know, if you hover your mouse pointer over any link, it will show you the true destination.)  The little yellow box appeared and showed a site named babywieberg.  Mischief found!

"Simply opening the e-mail does not appear to cause harm," said the FTC. "However, it is likely that anyone who has opened the e-mail's attachment or clicked on the links has downloaded the virus on their computer, and should run an anti-virus program. The virus appears to install a 'key logger' that could potentially grab passwords and account numbers."

BE CAREFUL!  If you got one of these emails, (1) run a virus scan, (2) forward the message with the headers to spam@uce.gov, and (3) delete the original message so it won't cause damage later.

Dallas Must Provide Messages from Personal Accounts

Email correspondence from public officials in Texas is public, even if they are using private email accounts or hand held devices.  This is the first major ruling on private email accounts and the Texas Public Information Act and is the result of a 22-month battle led by the Dallas News.

This ruling, which applies only in Texas, may have national impact because many states have similar laws.  I can see several issues:

• While this ruling is specific to Freedom of Information Act legislation, it will likely impact private companies involved in electronic discovery.  This ruling clearly indicates that use of private email does not relieve the employer of his obligation to search for and release information.
• Employers will need to put in place a plan for obtaining information from private accounts.
• ISPs like Google and Yahoo! must now respond to public information release requests. 
• Employees may be obligated to allow their employers to search personal accounts, unless there is some legally-binding method of stating that there is absolutely no business conducted on the private accounts.  (Could employees face fines and jail if they ask a business associate to a dinner using personal mail and then claim under oath that they had no business correspondence?  Watch this space.)

Back to this case.  In late 2005, two News reporters requested access to emails from several Dallas officials, including City Manager Mary Suhm, former Mayor Laura Miller and housing director Jerry Killingsworth.  While the city did release several boxes of documents in response to the requests, reporters found unexplained gaps of time in the correspondence. Also, according to court documents, some information was redacted, or marked out.

Government Leaks Email Addresses of 150 Whistleblowers

For an entity that is so hell-bent on keeping secrets, the U.S. government seems to keep making email gaffes.  Friday, the House Judiciary Committee sent the email addresses of would-be whistleblowers to everyone who had written in to the committee's Justice Department web tip line, according to the TPM Muckracker blog.  There are more than 150 recipient addresses revealed in the email.

All of the addresses were included in the "to:" field -- instead of concealing those addresses with a so-called blind carbon copy or "bcc:".  A substantial number of the addresses included portions of individuals' real names.  Also included in the list was the public e-mail address of Vice President Dick Cheney, as well as some apparently fictitious individuals, according to a statement released yesterday by the Judiciary Committee and reported in Computerworld.

Compounding the mistake, the committee later sent out a second email attempting to recall the original email. It also contained all recipients in the "to:" field, according to a recipient of the emails, according to TPM Muckraker.  So, if you missed it the first time, you surely got a chance to look it over the second time.

I sure hope that the government can get its act together.  With everything that is happening in Washington, a confidential tip line is really important.  These blunders can only cause people to lose confidence in their ability to be protected.

Ironically, the purpose of the email was to announce careful new procedures for reviewing tips.  Here is the content of the email (courtesy of TPM Muckracker):

Senate OKs 7 Years of No Email Tax

A bill that would prohibit state and local governments from taxing any service that enables users to connect to the Internet and some related services through 2014 was passed by the Senate on Thursday.  It must go to the House and then to the President for signature.  Hopefully, it will all be finished when the current ban expires on November 1st.

Prior to the change, a loophole would have allowed a tax on email from hosted services, such as Google and Yahoo.  ISP providers would have been exempted from the tax as part of a tax break for Internet access.  The modified Senate bill now says states can't tax "home page electronic mail and instant messaging (including voice--and video--capable electronic mail and instant messaging), video clips, and personal electronic storage capacity, that are provided independently or not packaged with Internet access."

I Didn't Really Mean It When I Said Blow Up The Pipeline

An opponent of the TransCanada Keystone Pipeline said it was a joke when he wrote: “blow them up with several sacks of fertilizer and a gallon of diesel fuel.”  Funny, the FBI wasn't laughing.

"I'm not a violent person. I'm an old man," said Richard Starke, 76, of Burlington, N.D., who owns land along the proposed Keystone pipeline route, in the Canadian Press. 

The email was sent Monday to other opponents of the line, with a copy to Public Service Commissioner Susan Wefald.  She turned the email over to the state Highway Patrol. Lt. Mike Gerhart, a patrol spokesman, said they made Capitol security staff aware of it, “and the information was forwarded to federal authorities” — that is, the FBI, according to the Jamestown Sun.

PSC Commissioner Kevin Cramer considered the threat “rhetorical and not literal,” from “a passionate opponent (who) expresses himself with strong rhetoric, but is a faithful patriot and good citizen.”

Red Sox Nation - Love That Dirty Water!

Sometimes, a text message can be understated.  Just past midnight, with automated efficiency, I received a message on my cell phone: "Game Ended. Red Sox won! MLB BOS 4 COL 3 F."  The text just did not capture the essence of a championship win.   You see, I signed up for a free text messaging service that sent me a message like this after each Red Sox game.  So the message is always similar.(You can try it at http://www.4info.net/.) 

For Boston sports fans, this is an amazing autumn.  (Go Pats, too.) 

For Red Sox fans, last night proved that winning the World Series in 2004 was not just a fluke that would lead to heartache for another 86 years.  We see the future with our own home grown team members -- Youk, Papelbon, and now Ellsbury. (Please read this article on Jacoby Ellsbury from March 11th, during Spring Training, before he hit the major league stage.)  Somebody get me an Ellsbury T-shirt!    He will be Rookie of the Year in 2008.  Amazingly, he will have a World Series ring and will still qualify as a rookie.

My congratulations to the Colorado Rockies.  I am totally impressed with this team.  They have a small fraction of the payroll of the Red Sox and pulled off an incredible come from behind story.  I am looking forward to the re-match next year.

Mistake Leads To Release of 700 Email Addresses

As a result of a BCS customer service satisfaction survey, 700 members of the British Computer Society (BCS) will be getting more spam soon.  You see, they sent the email with all of the addresses in the TO: or CC: fields, not the BCC: field or to a disguised list.  So, all 700 members received the confidential information about the other members.

It was also reported that "outraged recipients" were sending unsubscribe messages that copied all the other names on the list.

"This is a simple case of human error. We did send this out to several hundred members. Anyone could make the same mistake. We have sent an email apology to all those concerned and we're very sorry for any inconvenience caused," a spokesperson for the BCS told the Register.

I wonder if this mistake will have any impact on the customer satisfaction survey results?

(Thank you to Mark Santa Ana, who alerted me to this news.)

Attorneys Request For Email Records Too Broad

New York State Supreme Court Justice Anthony Shaheen decided yesterday that attorneys for suspended Utica (N.Y.) Schools Superintendent of Buildings and Grounds Craig Fehlhaber can’t examine Superintendent Marilyn Skermont’s email records to determine if she deliberately deleted emails related to the Fehlhaber's performance, reported the Utica Observer-Dispatch.

Fehlhaber is fighting for his job and his attorneys want to find email records to defend his performance.  Their review the emails released by Skermont raised questions about whether Skermont failed to retain key messages.  They noticed gaps in her email usage that occurred shortly after she sent a Jan. 31 email to Board members asking them to weigh in on Fehlhaber’s future with the district, said the Observer-Dispatch.  Some messages that showed up other school officials’ email did not appear Skermont’s.

Did Skermont deliberately delete these messages?  Was it after the suit was filed?  Or, were the messages routinely and legally deleted?  To find out, Fehlhaber's attorneys wanted to examine two years of the superintendent's email records so that they can see if the lack of emails is typical or something unusual.  They also sought a list of email addresses, public or private, used by board members for public business.

In their response, the school district’s attorneys say that the request was a “fishing expedition,” calling the request “harassing and libelous,” according to the Observer-Dispatch.

Shaheen agreed that the request was overly broad.  He also said that the district has no control over private email accounts.  (This is a different opinion than we have seen in other states.)

Fehlhaber's attorneys say that they will appeal.  In New York, the Supreme Court is not the highest court.

Supervalu Sends $10-million To Fraudulent Bank Accounts in Email Scam

Most of us aren't fooled by email scams asking you to send money to Nigeria.  But, what if one of your vendors asked you to send money to a new bank account?  Would you fall for a scam when somebody specifically targets you with knowledge of your business?

Supervalu Inc., the Minnesota-based grocer, fell prey to an email scam this year, sending more than $10-million to two fraudulent bank accounts, according to federal court filings.   Supervalu owns such chains as Albertson's, Farm Fresh, Shaw's, Star Markets, Lucky Stores, Jewel-Osco, Hornbacher's, and Bigg's.

The Associated Press reports:

The company said it received two emails -- one from someone purporting to be an employee of American Greetings Corp. and another from someone claiming to be with Frito-Lay, according to the documents. Both emails claimed that the companies wanted payments sent to new bank account numbers.

Supervalu sent more than $6.5-million in nine payments between Feb. 28 and March 6 to the phony American Greetings account at HSBC Bank in Miami Beach. The company also sent nearly $3.6-million during the same period to the phony Frito-Lay account in Arkansas.

Fortunately, the clever criminals were not clever enough to withdraw the money before somebody questioned the payments.  Perhaps American Greetings and Frito-Lay asked about late payments.  The company reported the crime to the FBI and the money has been recovered.  The court now needs to decide who gets the money since Supervalu, American Greetings, and Frito-Lay are all claiming a part of it.