The Knicks' Fake Ring Email Was Legal. New York Requires Notice, Not Consent.

The Knicks won the 2026 NBA title, their first in 53 years. In late September, Madison Square Garden emailed a long list of employees with a graphic of two ring designs and a message: Congratulations, your Employee Championship Ring is here. It offered a complimentary ring and asked recipients to choose a style. It was a phishing test. Employees who clicked were sent to a mandatory cybersecurity class. Reports say the test was meant to address owner James Dolan's concerns about cybersecurity.

The timing made it worse. At Tuesday's ring ceremony, assistant coaches reportedly did not receive their rings, and The Athletic reported that many longtime MSG employees, including some in the Knicks' business operations, will not receive rings at all.

Two questions decide whether the test was lawful. The first is monitoring. New York Civil Rights Law section 52-c, in effect since May 2022, requires an employer that monitors or intercepts employees' email or internet use to give written notice at hiring, acknowledged by the employee, and to post that notice where employees can see it. The state attorney general enforces it. Tracking which employees click a test link is monitoring their email and internet use.

The second is the promise. The email said a complimentary ring was here. A promise to give something for free is a gift, and under ordinary contract law a promise to make a gift is not enforceable unless the person receiving it gave something in return or relied on it to their detriment.

The argument that the test was lawful because employees consented to it in their employment agreements gets the right answer for the wrong reason. New York does not require consent to monitor work email. It requires notice. A company the size of MSG almost certainly gives that notice at hiring and posts it, which is what makes a click-tracking test lawful, with or without anything in an employment agreement.

The more interesting question is whether an email that says your ring is here, on the house, from your own employer's account, is a promise MSG has to keep. It is not, and not because MSG secretly meant it as a test. Contract law judges an offer by what a reasonable reader would understand, not by the sender's hidden intent, and a reasonable employee would read that email as a real offer. The problem for the employees is consideration. A free ring is a gift, and a promised gift is not a contract. Clicking a link to choose a style gives MSG nothing, and no one reasonably relied on the email by spending money or giving something up. The promise was never enforceable, whether it was real or a test.

That leaves the cost where the law does not reach. Phishing tests that dangle money or rewards, a fake bonus or a fake gift, are standard practice precisely because they work. They also land badly. GoDaddy drew public backlash in 2020 for a fake holiday-bonus test. MSG's version arrived the same season many of its own longtime employees learned they would not get real rings. Nothing in that is unlawful. All of it is a lesson in how a lawful program can still cost an employer something the law does not measure.

MSG, completely, on the law: monitoring with notice is lawful in New York, and rings are discretionary gifts. The employees' only leverage is public pressure, and stories like this one are how they use it.

New York doesn't require consent to test employees with fake emails. It requires notice. And a promised free ring is a gift, not a contract. The Knicks broke no law. They spent goodwill instead.

Watch whether MSG expands the ring list for longtime staff and assistant coaches. Legally, nothing has to change.