Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm not sure if this is the right website to ask this but I'm giving it a shot. I got the following message in an email today: (it's translated so sorry for the typo's/mistakes)

This e-mail and it's attachments are confidential and only meant for the addressee. If this e-mail would end up in your inbox by accident please notify the sender and remove it and it's contents from your hard disk drive. Reading, publishing, adapting, forwarding, copying or distributing an e-mail that is not addressed to you is illegal.

Is this true? I get that this is the case when regular mail ends up in your mailbox. That makes sense because addressed person on the envelope is probably not you. But if an e-mail is sent to my e-mail address that would make me the addressee, no? I don't see how this could be hard.

share|improve this question
2  
[IANAL] maybe there is no relation between the different parts of the statement. You are the addressee, but only by accident, yet reading it is therefore not illegal. –  beetstra May 31 '11 at 9:06
10  
Please tell me this message was at the very bottom of the email body –  Ormis Jun 1 '11 at 19:13
add comment

7 Answers

up vote 31 down vote accepted

http://www.economist.com/node/18529895 "Spare us the e-mail yada-yada Automatic e-mail footers are not just annoying. They are legally useless"

At least in the EU. And no case has ever succeeded in the US either.

share|improve this answer
2  
Disclaimers in mails are not legally binding, but they are considered a good practice. In court a company has to show that it has 'taken steps' and put effort into protecting customers/infrastructure/data, and disclaimers is just one of those steps. It's not legally binding, but good to have anyway in a court case. At least this is how this exact thing was described to me by a wellknow e-lawyer in the UK. –  john May 31 '11 at 12:46
    
The same is true in the Netherlands, they are not legally binding, but not having them can hinder a case is some situations. –  Jacco May 31 '11 at 13:33
    
This applies specifically to the footer. That doesn't create new obligations. However, that doesn't answer the original question, i.e. is it legal to read any such mail? And similarly, is it legal to forward such a message? Many legal systems recognize the concept of wilful infringement, which supposes the infringer was aware he was breaking the rules. If an action on such a mail was illegal, adding the footer can make that particular action a knowing and wilful infringement. –  MSalters May 31 '11 at 14:28
    
@all thnx guys! –  Gen May 31 '11 at 14:42
    
That article made me so happy. –  boehj Jun 16 '11 at 17:43
add comment

Annoying email footer:

Reading, publishing, adapting, forwarding, copying or distributing an e-mail that is not addressed to you is illegal.

As they says at the end of Itchy and Scratchy:

The following program contained scenes of extreme violence and should not have been viewed by young children.

If lawyers who insist on the annoying email footer were at least half-serious about information leaks, they would at least put the annoying text first (maybe they just do not know that, at least in the US, most people write and read top to bottom, not bottom to top?) and indicate clearly who is the intended recipient:

The following message is meant to be only read by Joe William, head of Computer Science Lab of Joe Computing.

How do they think I can determine if the message was intended to me if I cannot read it?

If they did it properly, at least they might be able to show that they tried to prevent people from reading the message if it was sent to them by mistake - if the recipient email was mistyped for example.

By :

  • writing at the end of a message "you shall not be reading this"
  • not mentioning the name of intended recipient, or even the slightest hint of that might be
  • adding the same message to every outgoing email, even emails to public mailing lists

they prove without doubt that they are just trying to protect their a** if there is an information leak and it goes to court, rather than actually trying to prevent information leaks.

My guess is that could be used to show that the company who add such "legal" wording is not behaving honestly, but that may be because I am a normal person who believes that the DO NOT ENTER sign should be visible when you are about to enter, before you do. (Maybe the job of lawyers is to argue that DO NOT ENTER signs to not have to be visible at all to have legal standing.)

Of course, IANAL.

share|improve this answer
add comment

Just to throw some logs into the fire, a set of laws that you'd need to consider is Postal laws.
At least in the U.S., email is considered personal mail, and is covered under U.S. postal laws, specifically the illegality of stealing someone else's mail. Federal laws, at that.

However, I dont think this has ever been successfully prosecuted... And, for that matter, an argument could be made that it was your mail, since it was addressed to you. (BCC might block that argument, though...)

In short, as many said, if it becomes relevant you'll need to talk to a lawyer with experience in computer / internet laws.
Otherwise, just avoid it - in most cases, they'd have no way of knowing you didn't delete it before reading it.

share|improve this answer
1  
Whoa! Why do you think e-mail is covered by the same protections as postal mail? That is certainly not the case in the United States, and for very good reason. The USPS is not involved in the delivery of the messages. Also, most of the "postal laws" are actually Federal Regulations rather than laws. (Although there would still the the enacting law that gives legal force to the Regulations, changing the Regulations does not involve Congress, unlike chaning laws.) –  Kevin Cathcart Jul 14 '11 at 21:32
    
@Kevin you're correct, these are not "real laws", but federal regulations. I dont know if there is any practical difference though, aside from changing them as you state... –  AviD Jul 15 '11 at 6:52
add comment

This falls under contract law. If you haven't agreed to the contract, then it isn't binding. Substitute "remove it from your hard drive" with "pay me a million dollars." Sounds ridiculous, right?

IIRC, forwarding the email could constitute copyright infringement, since you aren't licensed to distribute a copyrighted work.

share|improve this answer
4  
This is it, in a nutshell: You can't be contractually bound to something you haven't agreed to. –  Robert Harvey Jun 1 '11 at 22:56
    
This is not accurate, U.S. postal law is not about contractual agreements. –  AviD Jun 5 '11 at 19:34
1  
Postal law? Postal law only covers objects sent over the USPS or directly concerning the USPS. –  rox0r Jun 12 '11 at 21:09
1  
Receipt of Unsolicited Merchandise - if a company sends you an unsolicitied package, "by law, you have no obligation to the sender", and can keep it or throw it away (US Postal Service). Of course, if it's classified information like Wikileaks, then all bets are off. :) –  John C Sep 30 '11 at 22:23
add comment

Those notes are not really intended for the use case you present. They are mainly for cases in which someone hacks into the email system, or knowingly forwards confidential emails. It's kind of like the legal notices on logins, it's mainly to prevent a hacker from using the "I thought this was a public system defense". In any case it's legal weaksauce. It is a generally accepted best practice because it's better to safe than sorry.

share|improve this answer
add comment

The following is information found here: http://www.out-law.com/page-5536 and is based on UK law, written by a lawyer specialised in internet law. I believe it fully answers your question.

Email confidentiality notices

The confidentiality notice is an attempt to say that the content of the email is confidential and that it should not be read by anyone other than the intended recipient. Common sense dictates that adding this notice to the foot of the email is too late: if the notice is read at all, it will be read after the message. The email system used by your organisation may or may not facilitate the automatic posting of a confidentiality notice above the text of all messages being sent externally. If it does, this is the best practice to follow. If it does not or you consider the message unsightly, you are not breaking any rules; you are simply taking a slightly higher risk.

The following wording would be appropriate above the message text:

* Email confidentiality notice *

This message is private and confidential. If you have received this message in error, please notify us and remove it from your system.

Some confidentiality notices begin, "This message is intended for the addressee only". This is misguided because any person who receives the email will likely only receive it because he is an addressee, albeit the sender may misspell the intended recipient's email address.

Do not take it for granted that your confidentiality notice can be relied upon, however much care goes into its preparation. There is no legal authority on the value of these notices in email communications. When the notice is added automatically to every external communication, there is a risk that a court would consider that the venom in your warning has been diluted.

The value of the notice is that, if the disclosure of the content of an email becomes a subject of dispute, it would be possible to point a court to the existence of the confidentiality notice and argue that the recipient should have known to not disclose the contents of the message.

If your organisation decides that it is worth including such a notice, just be aware that it will be in a court's discretion to ignore it.

share|improve this answer
2  
I've seen a talk a few years ago by someone in a governmental organisation working on a project to help companies monitor when they send confidential data outside, and when it's leaked by mistake. I can't remember the details, but there was a point about the fact the word "confidential" added in every e-mail by such a notice wasn't actually helpful, since tools that looked for the word confidential were flagging everything up, including a large number of false positives. Some people also add that automatically to messages that are neither private nor confidential (e.g. public mailing lists). –  Bruno May 31 '11 at 17:25
    
did you receive permission from out-law.com to copy this text? According to out-law.com/page-292, freely copying a single paragraph is permitted, but more than that requires permission. Dont wanna mess with 'em, they be lawyers! –  AviD Jun 5 '11 at 19:32
    
@AviD No I did not, but I read their disclaimer first. I think the quoted text is not much bigger than a paragraph, and it's clearly linked and attributed to, which I guess is what they care most about. They say that "Substantial copying of these pages in any form is prohibited" but the quote is not so substantial when compared to the length of the text of the page I copied it from. If you think otherwise you are free to flag it :-) –  john Jun 5 '11 at 21:19
    
I guess that's subjective... which is defensible enough, IMO. Either way, you seem to have followed their guidelines :) –  AviD Jun 7 '11 at 0:29
add comment

Common sense says you are right however the law isn't generally common sense. You'll need to ask a lawyer:-)

share|improve this answer
    
for a simple question I'm not going to take it that far, tahnks for the answer though –  Gen May 31 '11 at 9:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.