Opinion

Felix Salmon

Did the NYT hack Fabrice Tourre’s email?

By Felix Salmon
June 1, 2011

Louise Story and Gretchen Morgenson have a long and rambling story about the court case against Goldman’s Fabrice Tourre, which is mainly interesting for how it was sourced:

These legal replies, which are not public, were provided to The New York Times by Nancy Cohen, an artist and filmmaker in New York also known as Nancy Koan, who says she found the materials in a laptop she had been given by a friend in 2006.

The friend told her he had happened upon the laptop discarded in a garbage area in a downtown apartment building. E-mail messages for Mr. Tourre continued streaming into the device, but Ms. Cohen said she had ignored them until she heard Mr. Tourre’s name in news reports about the S.E.C. case. She then provided the material to The Times. Mr. Tourre’s lawyer did not respond to an inquiry for comment.

I’m sure this was extremely carefully formulated, but it does raise a lot of questions without answering them. Tourre’s name was splashed over the newspapers in April 2010, so it stands to reason that the NYT has had some kind of access to Tourre’s private, password-protected email account — not to mention archives going back at least to 2006 — for a good year at this point. I’d also guess that the NYT is going public with its source now because Tourre finally got around to changing his password, and the stream of emails then dried up.

Was the NYT, then, hacking into Tourre’s private emails in much the same way as the News of the World was hacking into private voicemails? The NYT certainly didn’t think much of that activity, even when it was done through an outside contractor rather than a newsroom employee. So I don’t think it makes a lot of difference whether the computer was in the possession of Cohen or of the NYT.

The NYT quotes one email from October 10*, long after Tourre was all over the news in April. So it seems reasonable to assume the NYT was accessing Tourre’s emails even after the reporters were initially approached by Nancy Cohen. In order to do access Tourre’s emails, they would need Tourre’s password, or a computer with the password on it.

I understand that the computer was found in a garbage area, and that there’s a long tradition of investigative reporters using information found in the trash. But if Tourre left a key to his apartment in the trash, that wouldn’t give reporters the right to use that key to enter his apartment and snoop around. The laptop was essentially a key to Tourre’s email account — which held highly confidential correspondence between Tourre and his lawyers. An email account, these days, is arguably more private than an apartment, and breaking into a password-protected email account is clearly wrong.

How is what the NYT did not hacking into a private email account? I can think of three defenses, only one of which has any real merit.

The first defense is that it’s only hacking if you somehow type in the password: if all you have to do is open up the email application and the emails just stream in automatically, then there’s no hacking involved. I don’t buy this defense at all. If Cohen found Tourre’s password on his computer and gave it to the NYT, they could then build an identical laptop for themselves — and doing so would clearly be hacking. It just doesn’t make sense that if you’re looking at two identical computers, using one to snoop through emails is ethically fine, but using the other is beyond the pale. The laptop is essentially the physical manifestation of the password, and using it is the same as using the password. Using someone else’s password to access their email is wrong, even if you found that password in the trash.

The second defense is that it wasn’t the NYT reporters who were snooping through Tourre’s emails, but rather Nancy Cohen. Again, I don’t buy this one — Cohen was clearly delivering to the reporters exactly what they asked her for. If she was doing their bidding and acting as their agent, then they bear responsibility for her actions.

The third possible defense is that Cohen waited for a good six months* after Tourre was in the news before dumping all of his emails onto some kind of drive and delivering it to the NYT in a one-shot deal. The NYT, with a trove of data in its lap, then combed through the emails and wrote its story, without asking Cohen to keep further tabs on Tourre’s email or give them any further data. That I think would come closest to the we-found-this-in-the-trash scenario, and doesn’t involve the NYT taking advantage of having password-protected access to Tourre’s email account. But it’s also pretty improbable.

It goes without saying that Tourre is extremely upset right now, and feels violated by the NYT. He’s not wrong to feel that way. The question is whether the NYT was wrong to snoop around his emails while fishing for a story — even if doing so meant hacking into his private account.

Update: The Stored Communications Act of 1986 makes it a crime to “intentionally accesses without authorization a facility through which an electronic communication service is provided”.

Update 2: The NYT has released a statement:

As we disclosed in our story, certain documents were provided to us by a named source. The Times did not “hack” any email accounts or ask anyone to do so.  We are confident that our receipt and use of those documents was in keeping with our journalistic standards and complied with the law.

Update 3: John Cook has a very smart take on all this, and some more information from the NYT:

Murphy also strongly suggested that the laptop at issue didn’t belong to Tourre: “All but one [emails referenced in the story] came from the Senate report and are public and none came from Mr. Tourre’s email system.” If it didn’t come from Tourre’s email system, it’s hard to see how it came from his laptop.

As Choire Sicha has noted, Goldman is quite the professional organization when it comes to information security, and emails don’t just “stream” unbidden to Goldman-authorized devices. So it’s likely that it was a computer belonging to one of his attorneys—if the laptop’s “Sent Items” mailbox was synced via IMAP or Microsoft Exchange, for instance, with Tourre’s attorney’s email account, then “messages for Mr. Tourre” would have continued streaming to it.

I like the idea that it wasn’t Tourre’s laptop, but rather a laptop belonging to someone who was emailing Tourre. But that would imply that Cohen was not only reading a stream of emails, but was keeping close tabs on the “sent items” folder as it updated, and noticed Tourre’s name popping up in that folder periodically. Anything’s possible, I guess.

*Update 4: Nick Rizzo points out that the October email quoted by the NYT actually looks as though it dates from October 2009, rather than October 2010. Here’s the NYT story:

In the fall of 2009, when Mr. Tourre learned that he had become a target of investigators for helping to sell a mortgage security called Abacus, he protested that he had not acted alone.

That fall, his lawyers drafted private responses to the S.E.C., maintaining that Mr. Tourre was part of a “collaborative effort” at Goldman, according to documents obtained by The New York Times…

<snip 961 words>

…In their Oct. 10 response to the S.E.C., Mr. Tourre’s lawyers, including Pamela Chepiga of Allen & Overy, made an argument that they have not emphasized publicly.

If the NYT only obtained emails to Tourre dating from before they were contacted by Cohen, then as I say, that would absolve them of hacking charges. I read the NYT’s reference to October as meaning last October, since the SEC case against Tourre only became public in 2010, and because if people mean two Octobers ago they normally say so. But revisiting the article, it seems more likely that the email in question was sent in 2009, a good six months before the SEC case against Tourre was made public. In that case, it’s no longer prima facie evidence that the NYT was hacking into anybody’s email.  Although it’s still very unclear why the NYT waited more than a year between being given the emails and publishing this story. If it’s because they were still monitoring email to Tourre up until recently, then the hacking allegations don’t go away.

Update 5: This just gets weirder. The NYT emails Rizzo to say that none of the emails cited in the NYT story “came from Mr. Tourre’s email system on the computer”. Which implies that the NYT was reading Tourre’s emails on the computer, but for some reason didn’t use any of those emails in its story. Of course, as far as hacking into email systems is concerned, I can’t see that it makes any difference whether you print them or not.

Update 6: Nancy Cohen has a spokesman! His name is Curtis Ellis, and Nick Rizzo has spoken to him. Ellis’s story goes like this: Cohen was given Tourre’s laptop in 2006, from a friend who had found it in the garbage section of the basement of a luxury downtown building. Four years later, when Tourre is in in the news, Cohen realizes it’s the same person who’s name is on the computer. She opens up Outlook, and it starts downloading a bunch of his emails, which she doesn’t read. She tries to get in touch with various media outlets, but none of them is interested, until, eventually, a couple of months ago — almost a year after first making the connection and downloading Tourre’s emails — Cohen finds someone at the NYT (neither Story nor Morgenson, it seems, but someone else) who says they’ll take a look and see if there’s anything there. She then delivered the emails on an external hard drive to the NYT.

If this story is true, then it does pretty much exonerate the NYT from allegations of hacking — Cohen really did simply deliver all of Tourre’s emails to the NYT, long after he was in the news, in a one-shot deal. It sounds pretty crazy, to be sure. But weirder things happen in New York every day.

Comments
18 comments so far | RSS Comments RSS

As Zero Hedge says, this story stinks to the high heavens. There are a lot more questions than answers. How were they able to access these emails for four years, despite Toure then having to access them on a different computer/terminal. Were these emails from Toure’s work account? If so, how much access did this computer have to Goldman Sach’s corporate network? As much as I’d like to see Goldman Sachs go out of business and everyone at GS reduced to living on food stamps, this all just smells too funny for me to believe just what is written.

Posted by PhilPerspective | Report as abusive
 

The finding of this laptop seems about as convenient as the finding that only one junior guy was responsible for the whole GS mortgage mess.

If I was Tourre, I would be oh so incredibly upset that the Times just pointed out that Goldman threw the junior guy on the team to the wolves.

Posted by TwasBrillig | Report as abusive
 

Dunno Felix it feels like you are fishing here. If this wild story is true than Toure threw a fully functioning, non password protected laptop in the trash. Do something that idiotic and you deserve what you get. It’s not even remotely close to hacking. Hacking would involve actively attempting to crack the password. It’s not a trespassing/key thing, it’s a looking in a open window thing. You can’t complain if someone sees you when you are the one who actively opened the blinds. Toure apparently threw the blinds in the trash!

Posted by AbeB | Report as abusive
 

It’s true. I am always finding sweet bulge bracket investment banker laptops in dumpsters. The amazing thing is how the laptops are always functional, the passwords are there and the emails just keep streaming right to the laptop. What do you think they do with old laptops anyway? They get new ones all the time. These guys are so loaded, they don’t think twice about just tossing perfectly good technology.

Try it for yourself. Just bring a bottle of Febreze and spray it on yourself after you climb out. It covers the odors whether you get them from the dumpster, or even from working at the public relations department of the company.

http://tradewithdave.com/?p=6650

Dave Harrison
http://www.tradewithdave.com

Posted by daveharrison | Report as abusive
 

Looks like misdirection to me. I think Toure got tired of getting the big Goldman up the wazoo, and decided to start making Goldman take it up the wazoo. C’mon, the whole story is how innocent Toure is and how he was getting screwed by Goldman. Toure naviely (according to Toure’s own self portrait) thought the evidence was overwhelming (that he was a small cog and what was going on CDO’s was due to Goldman, not Toure.
Considering how long this has been going on, the only real question is: Did Toure play naive to lure Goldman into making on the record statements in court?

Posted by fresnodan | Report as abusive
 

FresnoDan:
Even if you are right about Tourre, the NYT explanation makes no sense. There is a lot missing from the NYT story.

Posted by PhilPerspective | Report as abusive
 

What corporate laptop isn’t password protected when you open the lid, nevermind the Outlook account. And what IT deptartment (presumably) issued Toure a new laptop without remotely wiping his old one?

And if it wasn’t a corporate laptop, what’s Toure got to say about how the laptop ended up in the ‘trash area’ of a building?

This makes zero sense.

Posted by tom_o | Report as abusive
 

@FresnoDan: +1

This has got “false-flag op” written all over it.

Ring. “Hello?”

“Nancy, this is Fabulous Fab. There’s going to be a laptop in the dumpster in exactly one hour. Go get it and hold onto it for me for a while, would you?”

Posted by EricVincent | Report as abusive
 

“These legal replies, which are not public, were provided to The New York Times by Nancy Cohen, an artist and filmmaker in New York also known as Nancy Koan,”

Interesting duality. Covering opposite ends of the continent of Asia, so to speak.

(Not that there’s anything wrong with that….)

“What is the sound of one hand clapping?”

“Oh, gee, what a profound Cohen!”

Posted by Christofurio | Report as abusive
 

Everything about this story is sketchy-from GS letting a key employee throw out a work laptop without “wiping it” to the claim the laptop kept getting emails. But being a lawyer I know that the legal issue is whether Tourre had aa “reasonable expectation of privacy” in his emails. The argument would be that if he threw his laptop in the trash, he no longer expected it to be private. I hate to think of the Times making up a cover story but you know they lawyered up and this is a lawyer’s defense. But the underlying facts are so unworthy of belief that you have to wonder.

Posted by marcelliott | Report as abusive
 

First thing my huge company did was issue laptops to each department. Second thing they did was add security and match each one to an owner for inventory… oops. They did manage to match up quite a few… surprisingly, as many were honest and a few Dept heads did their own inventory.

Who said this was a work laptop? The newer emails are between he and lawyers no? The older condemning ones were in the releases dumped on SEC, no?

Also, one more thing. If you read Tourre’s emails, he is a loud mouthed narcissistic blowhard who said some pretty odd and damning things in emails. Does he sound like the kind of guy who was interested in security?

Posted by hsvkitty | Report as abusive
 

It’s certainly possible to autoforward emails to any mail account, on a computer without security. You’ll even get company emails automatically sent to a smartphone, and not need a password. If either device is lost or stolen, you would have to change your email account password on the mail server, something that might not occur to everyone.

However, if I were given a laptop with software from any source, the first thing I would do is delete any existing accounts in the email client, to make room for my own accounts. In any case, knowingly receiving email addressed to others, even unintentionally, can be a crime.

Posted by Curmudgeon | Report as abusive
 

Felix’s “update” views on the SCA/hacking are correct. If Cohen/Koan just dumped emails on the NYTimes, they have nothing to worry about. If, instead, the NYTimes was at any point monitoring his email — or, really, anyone’s email — then they were intentionally accessing an electronic communication service without authorization. It is irrelevant to the SCA if they published the emails or not.

Posted by MaxKennerly | Report as abusive
 

Update 5 makes no sense. How does the statement that none of the emails cited in the NYT story “came from Mr. Tourre’s email system on the computer” mean that they knew exactly what was on the computer. Can’t that statement merely mean that they came from an alternate source? It didn’t say “those emails were never accessible or on the computer”. Seems very accusatory.

Posted by mwolfe | Report as abusive
 

mwolfe: Maybe they initially got them from another source, but used the computer to confirm that the emails were genuine?

Posted by guanix | Report as abusive
 

Maybe the laptop was stolen… It is possible some petty thief thought they could unload it easily but they realized it had a name on it. The guy in the John Cook link says it is Tourre’s computer but NYT insists that it isn’t. Either way, it is hugely unethical. Wouldn’t you just try and contact Tourre’s lawyers (whom you could find via a quick Google search on your free laptop) and let them know you have his emails instead of giving someone’s private emails to a reporter? If all of this is true (I am skeptical) then Tourre may be the world’s unluckiest email user.

Posted by DCos | Report as abusive
 

DCos:
This still doesn’t explain away why emails were still going to the old computer. And why would Tourre send work emails to a personal computer. There are still many unanswered questions.

Posted by PhilPerspective | Report as abusive
 

Even more interesting than what this all says about the Times is what is illustrates about the shortcomings of blogs: Idle speculation (emphasis on “idle,” as in “not bothering to do the work of reporting”) spawns rumors that beget more idle speculation that beget more rumors. Asking questions is easy. Getting the right answers is hard.

Posted by MBS83 | Report as abusive
 

Post Your Comment

We welcome comments that advance the story through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can flag it to our editors by using the report abuse links. Views expressed in the comments do not represent those of Reuters. For more information on our comment policy, see http://blogs.reuters.com/fulldisclosure/2010/09/27/toward-a-more-thoughtful-conversation-on-stories/
  •