6

This is the best place in SE I can find to post this.

We have an ex employee who created a gmail account for work purposes that looks like [email protected]

He left the company and refuses to surrender the password to the account. Do we, the company, have the legal rights to stop him from using the account? Or do we have to wait until he actually intentionally misrepresent our company before we can take action against him?

EDIT:

This email account came about because he is one guy who travels around. At one time when he needed to send an important email, he could not access his [email protected] email. So he went ahead to create that gmail account to finish the job. Since it was an important email that had to go out, nobody frowned upon that and the gmail account continues to be in use. Now that things turned sour, we realized we could not do anything.

Maybe the moral of story is: His dedication to service excellence was admirable, but we should not allow it to happen at the expense of IT security.

Improve this question
15
  • 3
    Could you please add to your question which country you're in? Laws vary by jurisdiction. Thanks :)
    – user185
    May 27, 2011 at 8:00
  • 4
    I don't think you can prevent misrepresentation by having him give up this account. Another similar account is easily created. Make sure his clients know he has left your company, so they won't be confused when receiving e-mail from him.
    – beetstra
    May 27, 2011 at 10:32
  • I know i'm not directly talking on the point but just wanted people to make note of. This is one of the few very good reasons why small corporates(who cannot afford email servers) can use google apps(gmail to be specific). which can easily tackle these kind of annoying problems. if you do not want the employee to use the email, you can take him down with a click of a button.
    – Karthik
    May 27, 2011 at 11:41
  • @Graham, the OP appears to be from Singapore. I would be presumptuous though in stating that the laws of Singapore would apply to this case.
    – Vineet Reynolds
    May 27, 2011 at 12:36
  • 2
    Is that email naming pattern standard practice at your company? It might make a difference. Though it would be hardly be a "best practice" as The Learner notes.
    – nealmcb
    May 27, 2011 at 13:20

7 Answers 7

Reset to default
8

Do we, the company, have the legal rights to stop him from using the account?

(Sigh) I'm beginning to recommend lawyers a lot, but this is one of the scenarios where they will help. [Disclaimer: I am not a Lawyer, and this is not legal advice] I'm not sure what the laws are in your jurisdiction, but this appears to be a case of withholding one of the following

  • access to the account; this point is not cut and dry. If the employee created this account for a one-off scenario, then it depends on the laws of the land (and the interpretation) of the courts, as to how this account could be treated as belonging to the company due to its prolonged use.
  • work created for hire or any other materials that belong to the company (if it is resident in that account). If you do have an employment agreement that stipulates how the company owns any material created on company time, along with an agreement that also stipulates how such materials ought to be relinquished by employees on resignation, then a lawyer would be able to aid in your next course of action.

Ultimately there ought to be applicable laws for this scenario and my advice in earnest, is to speak to your lawyer on this.

More importantly, I think you ought to establish procedures for handling termination of employment. If they do not exist, establish them. But stating what measures ought to be established, is probably beyond the scope of IT Security or Application Security.

However, there are few points where your IT department (if it exists) can help. Critical accounts (e-mail accounts, NTLM/Kerberos accounts and others like your accounts with Domain Registrars) should ideally have a fail-safe mechanism to ensure that you can regain control of the account, or terminate access to the account if no longer required. In some cases, this would mean that you would have to run your own software (like an Outlook Exchange or Postfix/SendMail server, instead of relying on GMail). In other cases, it would mean that you should have access to a human being on the other side, who can immediately revoke/expire access to compromised accounts or reset passwords to them (to prevent further access by unauthorized people).

Improve this answer
24
  • 2
    Sure, worth asking, but nothing in the original question comes under the company or IT remit. Gmail is entirely external to the company, the domain name is just gmail.com etc.
    – Rory Alsop ♦
    May 27, 2011 at 8:21
  • 2
    @Rory, I think you're missing the point that it's not the domain, but the account that could be considered company property (in the same way an account with a Domain Registrar is), and it is up to the courts to determine whether they are company property or not. I haven't seen any caselaw similar to this, and I don't think I'm interested in debating this either. However, I would admit, that this is poor practice to have company accounts on what is essentially an uninterested third-party server.
    – Vineet Reynolds
    May 27, 2011 at 8:31
  • 2
    @Vineet, Email addresses are not property. This answer is probably bad advice. I suspect trademark or fraud are more likely to be the relevant areas of law.
    – D.W.
    May 27, 2011 at 16:13
  • 3
    @Vineet, I think you're being sloppy or imprecise in your wording. Precision matters in the law. There might be IP rights implicated, but that is different: IP is not property, in the same way as a tangible physical item. Talking about IP as if it were property is sloppy and tends to trigger people's intuition in a misleading way. The legal rights that apply to IP are very different from the legal rights that apply to property. To the original question-asker, I do not recommend relying upon @Vineet's answer.
    – D.W.
    May 28, 2011 at 19:40
  • 2
    Email addresses are much more like ordinary property than intellectual property. They're not IP just because they're intangible -- a bank account is intangible, just numbers in a computer, and it's property. Email addresses are something that can only be used by one person and all other uses are conflicting. This is the touchstone of property and the very opposite of IP -- copyrights, patents, and trademarks are all capable of non-conflicting, multi-party use, an email address is not.
    – David Schwartz
    Sep 29, 2011 at 13:09
5

Currently he is not breaking any laws. You can legally register any name @ gmail.com (barring some offensive ones and a few others - those are prohibited by Google's ToS though, not by law).

Depending on your country, you are likely to have no legal rights to the account either, but would need to rely on local defamation legislation to prosecute if he does misuse the name.

I am not a lawyer, but the above looks valid in most regions.

Edit: after reading again subsequent to Vineet's comment, I think it is not quite so cut and dried.

  • If you created the account for him then it should be yours, but of course you should have admin access anyway.
  • If you asked him to create it to use while working for you, it may be debatable.
  • If he created it personally then my original point stands.

But as everyone says - talk to a lawyer!

Improve this answer
6
  • The other side of this is the question of whether or not company owned data exists on the account. The question about how to handle misrepresentation of affiliation is worth thinking of, but not a pot that I want to stir.
    – Scott Pack
    May 27, 2011 at 12:11
  • @scott pack in fact we are very keen to come up with a way to monitor this gmail account. but it's bleak at the moment. we still want to think the company owns the gmail account. (see @Vineet above)
    – Jake
    May 27, 2011 at 17:21
  • "breaking any laws" is not the question. He might not be breaking any criminal laws, but the company might still have a cause of action against him nonetheless. I think your bottom line is right -- talk to a lawyer -- but I'd question whether the beginning part of your post is good advice. What matters is not how plausible the argument sounds to a non-expert in the law; what matters is what the law says, and what the practical courses of action available to the company may be.
    – D.W.
    May 28, 2011 at 19:46
  • @DW - but that's the problem. I could register [email protected] if I wanted. Gmail jurisdiction for the .com domain is US. The OP is in Singapore - they can't do anything until the guy misuses the email address (fraud or misrepresentation) - as far as I am aware. But I am not a lawyer - I have just been involved in the fallout of a lot of legal cases and follow these things closely.
    – Rory Alsop ♦
    May 28, 2011 at 20:13
  • 1
    If the right to use "[email protected]" is a legal right, then it has a legal owner. Since the right was created/obtained by an employee for company business, presumably while on the company payroll, the owner cannot be the employee personally. It would be property of the company, and refusing to turn over company property after dismissal should be sufficient ground for a civil suit.
    – MSalters
    May 31, 2011 at 14:40
4

Does anyone besides Google "own" this Gmail account? An email's author retains the copyright, but effectively issues irrevocable licenses when sending the email. But afaik Google own the account itself.

Case 1. Do you need access to the account's contents? If so, you are screwed. Google does not hand over accounts easily. For all Google knows, you might be doing all manor of illegal or immoral things, like exposing a whistle blower, attacking a critic, etc. You could earn yourselves a dishonorable mention on Chilling Effects or Google's Transparency Report for even asking.

Google fought China over Gmail hacking. Google's Transparency Report probably makes the CIA and NSA nervous. Google refuses 7% of law enforcement requests for user data in the U.S. In Singapore, Google refuses fully one quarter of government requests for user data. Isn't happening man.

Case 2. Do you merely need the account terminated? If so, you might convince Google that the account violates their terms of service. I'd consider this too risky myself because they might still post your emails to Chilling Effects. You might be trying to silence a critic after all.

A priori, you're concerned with the ex-employee sending official looking emails, but the employee is concerned with receiving emails from personal correspondences who know that email address. If so, ask him to create another gmail account, forward his emails form this one to that one, so no emails come from this account.

If he still says no, you could search Gmail's Terms of Service for any violations. If you find one, you must still take care when contacting Google. Tell them you just want the account renamed or closed with forwarding to another account. Attach his letter of resignation and post employment correspondences. If they see he left by choice, you'll look less like you're trying to silence a whistle blower or critic.

Just remember that a lawyer cannot help you if a Google search for your company shows this dispute with an ex-employee over their effectively personal email address.

Improve this answer
3
  • +1 It is not not separate/isolated euther cases Case 1 or Case 2, they are unseparably fused both 1 and 2 and more. From practical pov, the only sound advice is searching for infringement of GMail's ToS. There is no sense to consult lawyers, as Google itself sabotages laws and law enforcement that Google considers to violate its own ToS and p.o.v.s
    – Gennady Vanin Геннадий Ванин
    Jan 20, 2012 at 17:14
  • 1
    Google has good reasons for worrying about such things because the world is full of repressive regimes and employers violating laws. "Don't Be Evil" has proven to be quite a commitment, even if they're slack about it.
    – Jeff Burdges
    Jan 20, 2012 at 18:45
  • Well, this point of view is subjective (IMO, this practice is subversive, agitating and destabilizing) and probably should be avoided in this thread. It's not Google's practice There are other reasons and practices when laws are being ignored. Read, e.g.. wiki's de facto vs. de jure, etc.
    – Gennady Vanin Геннадий Ванин
    Jan 21, 2012 at 4:28
2

You need to talk to a lawyer. The folks here probably don't know, and don't have experience. Neither do I. You wouldn't ask a lawyer for advice about a technical subject; you shouldn't ask a technologist for advice about the law.

My guess would be that lawyers might look into the areas of trademark (if your company name is trademarked and the ex-employee is using that company name) and fraud (if the ex-employee's continued use the email address is considered deceptive and unfair). But I don't know, and I suspect others here don't know.

In short, talk to a lawyer.

Improve this answer
3
  • I was hoping to find a "Courtroom" or something on SE initially, but this place is second best like I said in the post.
    – Jake
    May 27, 2011 at 17:25
  • 3
    @Jake, note that you need to talk to a lawyer with experience on this topic (e.g. there are many who focus on internet law), as this will probably be quite niche, and most lawyers would not be familiar with this.
    – AviD ♦
    Jun 5, 2011 at 10:35
  • 1
    I hate the answers "talk to a lawyer". Lawyers are morons! Besides, I would advice you to read the wiki's definitions of de-facto en.wikipedia.org/wiki/De_facto and de-jure en.wikipedia.org/wiki/De_jure
    – Gennady Vanin Геннадий Ванин
    Jan 20, 2012 at 17:03
1

If all else fails, have your lawyers make an offer to buy the account from the account holder. A price tag on the account (the one you put on it) determines how valuable it ultimately is to you.

Improve this answer
2
  • And tell me about. I'll create a few [email protected] addresses too. If to speak seriously, I doubt that it is legal to sell GMail addresses since it is not the property of its holder
    – Gennady Vanin Геннадий Ванин
    Jan 21, 2012 at 6:16
  • We've had cybersquatting for DNS for many many years. However, if inflation of email addresses happens the way you suggest, both the price will drop rapidly and this kind of email addresses will not be considered as possibly legitimate by the mail recipients. Or so I hope.
    – adamo
    Jan 21, 2012 at 6:50
1

Gmail accounts belong to Google. Not to you, not to your ex-employee.

You can ask Google nicely and see what they say. You can also ask Google in a threatening way and see what they say. You can send angry lawyers to ask Google and see what they say.

I'd imagine your best angle is probably to take the trademark confusion route and say that by using your company name in his email address he's confusing people into thinking he represents your company. Though Google may just respond by suspending the account; I doubt they'd turn over to you all of his email.

In the future you can avoid this problem by using Google Apps. It's like Gmail, but your company controls all the accounts.

Improve this answer
0

The answer lies in "who created a gmail account".

Were your company created the account (for use by employer), then, IMO, it would have owned it as well as had all the data permitting to identify the original owner permitting to easily (automatically) reclaim the account

Update:
My opinionated synopsis:

  • the ownership of an address has nothing to do what with ownership and/or authorship of what is under it - content and communication
  • ownership (economic rights) is unrelated to author's rights. The latter are:
    • perpetual,
    • inalienable,
    • imprescriptible,
    • unseizable
  • Generally, there were and always be differences between

The existing Google's practice is not governed by laws, so there is no point to send to lawyers.
The GMail account belongs to the one who created it.
The only viable non-criminal way to expropriate it is to contest infringement of GMail's ToS

P.S.
After commenting all posts in this thread, I decided to collect all my comments here in one place:

  • My comments to original question:
    • @Jake, the Questioner, by your logic, If I create [email protected] account then my account belongs to Russian Federation???? and if [email protected] then to Putin?
    • "@Jeff-Burdges, I've read article you linked but it does not tell that "Gmail accounts are property of Google". It tells that GMail addresses are property of GMail what is IMO banality since gmail.com is probably owned or rented by Google"
  • My comments to the answer by @Vineet Reynolds :
    • "@David-Schwartz, I wish I could understand what you meant under "Email addresses are something that can only be used by one person". I worked in a public library where all the staff sent and received Emails from the one library public webEmail"
    • "Besides, property (ownership, economic rights), there are also (inalienable/moral) author's rights. The writings, work, etc. can be (owned) property of someone/something else which does not exclude author's rights that are perpetual, inalienable, imprescriptible, unseizable "
  • My comments to the answer by Rory Alsop:
    • "@MSalters, your logic is fallacy. My private house address bears the name of the city. Then, as soon as I am employed by the city, my house would become the property of the city? Addresses and identifications have nothing to do with property and ownership"
  • My comments to answer by @D.W.:
    • @D.W., I hate the answers "talk to a lawyer". Lawyers are morons! Besides, I would advice you to read the wiki's definitions of de-facto en.wikipedia.org/wiki/De_facto and de-jure en.wikipedia.org/wiki/De_jure
  • My comments to answer by Jeff Burdges:
    • "+1 It is not not separate/isolated euther cases Case 1 or Case 2, they are unseparably fused both 1 and 2 and more. From practical pov, the only sound advice is searching for infringement of GMail's ToS. There is no sense to consult lawyers, as Google itself sabotages laws and law enforcement that Google considers to violate its own ToS and p.o.v.s"
Improve this answer

Not the answer you're looking for? Browse other questions tagged .