Fuck encrypting the email itself -- it should only contain a link to an https site that the intended recipient has credentials to log into (preferably with multi-factor auth). This is what real, grownup banks do!
My understanding is they were breaking regulation by not. The company I work for does customer opinion surveys. We occasionally do some for a large national bank. When we send data, of any form to the bank we are required to encrypt the email before we send it. This is just for something like random customer surveys not even at the level of actual account data.
Comments
And why all emails were not strongly encrypted?
Fuck encrypting the email itself -- it should only contain a link to an https site that the intended recipient has credentials to log into (preferably with multi-factor auth). This is what real, grownup banks do!
My understanding is they were breaking regulation by not. The company I work for does customer opinion surveys. We occasionally do some for a large national bank. When we send data, of any form to the bank we are required to encrypt the email before we send it. This is just for something like random customer surveys not even at the level of actual account data.
Have you ever seen an encrypted email sent to a wide audience?
Hopefully they weren't sending social security numbers and account info to a wide audience.
Did I say its easy?
The point is that there is an organisation. And some people are responsible for security.
And yes, it will cost.
Why do it right when the legal system is perfectly happy to violate the rights of innocent people at no cost to you? "It's the economy, stupid."