Did the NYT hack Fabrice Tourre’s email?

By Felix Salmon
June 1, 2011
Louise Story and Gretchen Morgenson have a long and rambling story about the court case against Goldman's Fabrice Tourre, which is mainly interesting for how it was sourced:

" data-share-img="" data-share="twitter,facebook,linkedin,reddit,google" data-share-count="true">

Louise Story and Gretchen Morgenson have a long and rambling story about the court case against Goldman’s Fabrice Tourre, which is mainly interesting for how it was sourced:

These legal replies, which are not public, were provided to The New York Times by Nancy Cohen, an artist and filmmaker in New York also known as Nancy Koan, who says she found the materials in a laptop she had been given by a friend in 2006.

The friend told her he had happened upon the laptop discarded in a garbage area in a downtown apartment building. E-mail messages for Mr. Tourre continued streaming into the device, but Ms. Cohen said she had ignored them until she heard Mr. Tourre’s name in news reports about the S.E.C. case. She then provided the material to The Times. Mr. Tourre’s lawyer did not respond to an inquiry for comment.

I’m sure this was extremely carefully formulated, but it does raise a lot of questions without answering them. Tourre’s name was splashed over the newspapers in April 2010, so it stands to reason that the NYT has had some kind of access to Tourre’s private, password-protected email account — not to mention archives going back at least to 2006 — for a good year at this point. I’d also guess that the NYT is going public with its source now because Tourre finally got around to changing his password, and the stream of emails then dried up.

Was the NYT, then, hacking into Tourre’s private emails in much the same way as the News of the World was hacking into private voicemails? The NYT certainly didn’t think much of that activity, even when it was done through an outside contractor rather than a newsroom employee. So I don’t think it makes a lot of difference whether the computer was in the possession of Cohen or of the NYT.

The NYT quotes one email from October 10*, long after Tourre was all over the news in April. So it seems reasonable to assume the NYT was accessing Tourre’s emails even after the reporters were initially approached by Nancy Cohen. In order to do access Tourre’s emails, they would need Tourre’s password, or a computer with the password on it.

I understand that the computer was found in a garbage area, and that there’s a long tradition of investigative reporters using information found in the trash. But if Tourre left a key to his apartment in the trash, that wouldn’t give reporters the right to use that key to enter his apartment and snoop around. The laptop was essentially a key to Tourre’s email account — which held highly confidential correspondence between Tourre and his lawyers. An email account, these days, is arguably more private than an apartment, and breaking into a password-protected email account is clearly wrong.

How is what the NYT did not hacking into a private email account? I can think of three defenses, only one of which has any real merit.

The first defense is that it’s only hacking if you somehow type in the password: if all you have to do is open up the email application and the emails just stream in automatically, then there’s no hacking involved. I don’t buy this defense at all. If Cohen found Tourre’s password on his computer and gave it to the NYT, they could then build an identical laptop for themselves — and doing so would clearly be hacking. It just doesn’t make sense that if you’re looking at two identical computers, using one to snoop through emails is ethically fine, but using the other is beyond the pale. The laptop is essentially the physical manifestation of the password, and using it is the same as using the password. Using someone else’s password to access their email is wrong, even if you found that password in the trash.

The second defense is that it wasn’t the NYT reporters who were snooping through Tourre’s emails, but rather Nancy Cohen. Again, I don’t buy this one — Cohen was clearly delivering to the reporters exactly what they asked her for. If she was doing their bidding and acting as their agent, then they bear responsibility for her actions.

The third possible defense is that Cohen waited for a good six months* after Tourre was in the news before dumping all of his emails onto some kind of drive and delivering it to the NYT in a one-shot deal. The NYT, with a trove of data in its lap, then combed through the emails and wrote its story, without asking Cohen to keep further tabs on Tourre’s email or give them any further data. That I think would come closest to the we-found-this-in-the-trash scenario, and doesn’t involve the NYT taking advantage of having password-protected access to Tourre’s email account. But it’s also pretty improbable.

It goes without saying that Tourre is extremely upset right now, and feels violated by the NYT. He’s not wrong to feel that way. The question is whether the NYT was wrong to snoop around his emails while fishing for a story — even if doing so meant hacking into his private account.

Update: The Stored Communications Act of 1986 makes it a crime to “intentionally accesses without authorization a facility through which an electronic communication service is provided”.

Update 2: The NYT has released a statement:

As we disclosed in our story, certain documents were provided to us by a named source. The Times did not “hack” any email accounts or ask anyone to do so.  We are confident that our receipt and use of those documents was in keeping with our journalistic standards and complied with the law.

Update 3: John Cook has a very smart take on all this, and some more information from the NYT:

Murphy also strongly suggested that the laptop at issue didn’t belong to Tourre: “All but one [emails referenced in the story] came from the Senate report and are public and none came from Mr. Tourre’s email system.” If it didn’t come from Tourre’s email system, it’s hard to see how it came from his laptop.

As Choire Sicha has noted, Goldman is quite the professional organization when it comes to information security, and emails don’t just “stream” unbidden to Goldman-authorized devices. So it’s likely that it was a computer belonging to one of his attorneys—if the laptop’s “Sent Items” mailbox was synced via IMAP or Microsoft Exchange, for instance, with Tourre’s attorney’s email account, then “messages for Mr. Tourre” would have continued streaming to it.

I like the idea that it wasn’t Tourre’s laptop, but rather a laptop belonging to someone who was emailing Tourre. But that would imply that Cohen was not only reading a stream of emails, but was keeping close tabs on the “sent items” folder as it updated, and noticed Tourre’s name popping up in that folder periodically. Anything’s possible, I guess.

*Update 4: Nick Rizzo points out that the October email quoted by the NYT actually looks as though it dates from October 2009, rather than October 2010. Here’s the NYT story:

In the fall of 2009, when Mr. Tourre learned that he had become a target of investigators for helping to sell a mortgage security called Abacus, he protested that he had not acted alone.

That fall, his lawyers drafted private responses to the S.E.C., maintaining that Mr. Tourre was part of a “collaborative effort” at Goldman, according to documents obtained by The New York Times…

<snip 961 words>

…In their Oct. 10 response to the S.E.C., Mr. Tourre’s lawyers, including Pamela Chepiga of Allen & Overy, made an argument that they have not emphasized publicly.

If the NYT only obtained emails to Tourre dating from before they were contacted by Cohen, then as I say, that would absolve them of hacking charges. I read the NYT’s reference to October as meaning last October, since the SEC case against Tourre only became public in 2010, and because if people mean two Octobers ago they normally say so. But revisiting the article, it seems more likely that the email in question was sent in 2009, a good six months before the SEC case against Tourre was made public. In that case, it’s no longer prima facie evidence that the NYT was hacking into anybody’s email.  Although it’s still very unclear why the NYT waited more than a year between being given the emails and publishing this story. If it’s because they were still monitoring email to Tourre up until recently, then the hacking allegations don’t go away.

Update 5: This just gets weirder. The NYT emails Rizzo to say that none of the emails cited in the NYT story “came from Mr. Tourre’s email system on the computer”. Which implies that the NYT was reading Tourre’s emails on the computer, but for some reason didn’t use any of those emails in its story. Of course, as far as hacking into email systems is concerned, I can’t see that it makes any difference whether you print them or not.

Update 6: Nancy Cohen has a spokesman! His name is Curtis Ellis, and Nick Rizzo has spoken to him. Ellis’s story goes like this: Cohen was given Tourre’s laptop in 2006, from a friend who had found it in the garbage section of the basement of a luxury downtown building. Four years later, when Tourre is in in the news, Cohen realizes it’s the same person who’s name is on the computer. She opens up Outlook, and it starts downloading a bunch of his emails, which she doesn’t read. She tries to get in touch with various media outlets, but none of them is interested, until, eventually, a couple of months ago — almost a year after first making the connection and downloading Tourre’s emails — Cohen finds someone at the NYT (neither Story nor Morgenson, it seems, but someone else) who says they’ll take a look and see if there’s anything there. She then delivered the emails on an external hard drive to the NYT.

If this story is true, then it does pretty much exonerate the NYT from allegations of hacking — Cohen really did simply deliver all of Tourre’s emails to the NYT, long after he was in the news, in a one-shot deal. It sounds pretty crazy, to be sure. But weirder things happen in New York every day.

18 comments

Comments are closed.