Industry


Ads by TechWords

See your link here


Martin McKeay's picture
Martin McKeay

Security Matters

Is your email private?

The government doesn't believe the email you store at your ISP or online mail services like Gmail deserve the same right to privacy as your phone records or postal mail.  The Electronic Freedom Frontier disagrees and believes we should enjoy the same Fourth Amendment rights against illegal search and seizure for email that we do for other methods of communications.

I hadn't realized that the government had been allowed to use the Stored Communication Act (SCA) to view our email for nearly 20 years, but given the inclination of many ISP's to simply turn over records without requiring warrants, I'd always assumed  my email could be read by anyone with sufficient desire.  Given the permanence of electronic communications and the ease of searching through such documents, it's always been safer to plan that someone will have the ability to read the emails later, whether it's the government or someone who was forwarded mycommunications .  I always try to reread any email before hitting send, personal or professional, because I never know who will end up reading it.

The government should have the right to read my email if they believe they need to.  But I want to see that ability treated with the same oversight as any other governmental search process: court oversight, official records and notification of the process.  Being able to walk into any ISP and ask for my records without any other due process is more power than I'm comfortable with the government having.  Think back over the emails you've sent over the last six months and tell me if it doesn't make you a little uncomfortable?

What People Are Saying

Anyone on this blog ever

Anyone on this blog ever heard of Hushmail ? I am not tech savy but the service offered by this company is free encrypted email.

The only alternative is to

The only alternative is to encrypt private communications before they are submitted to the ISP. This is quite feasible but everyone will have to have the software, and standards must be established.

I don't think it matters whether the "save on server" box is checked. The government simply takes the backup tape of their choice from the ISP.

Agreed. The PGP product

Agreed. The PGP product works just fine. And Thawte's Web of Trust (also free) is easily integrated into many popular email clients, making it possible for non-techies to handle encrypted communications. (These solutions leave out the use of Web-based email, and so don't solve everything!)

Not that the government couldn't crack a given message if they tried, but it is so computer time intensive that (practically speaking) you needn't worry about your encrypted communications being compromised if you use PGP or Thawte's x.509 certs.

The government knows only

The government knows only stuff worth encrypting will be worth going after. Too computer intensive to decrypt? Don't kid yourself. Read The Cookoo's Egg.

Martin McKeay indicated that

Martin McKeay indicated that our phone record files are private.

It seems that I recall during this past year the phone companies were giving the Bush government our phone records wholesale without any warrants or court approval.

And as for snail mail....all any government agents have to do is speak to the postal inspectors and as the saying goes...one hand washes the other.

Martin, what you have said

Martin, what you have said isn't true. For starters the SCA requires the government to get a warrant if the e-mail has not yet been read by the user. The SCA does not apply at all once the mail has been read. The reason the government can get read e-mail without a warrant is because the ISPs generally tell the user in the fine print of their service that the ISP will not guarentee privacy of anything saved on their service. In other words, the user isn't paying the ISP to keep something private they choose to store on the server, they are paying the ISP to supply mail services. The problem is that most users assume that "mail services" implies that the ISP has a responsibility to keep their stored stuff private.
As an ISP employee it continually amazes me that people expect the same level of privacy from a $9.95 a month dialup account that comes with a disclaimer that you aren't going to get privacy, that they get when they walk into the doctors office and lay out $200 to take off their clothes and get examined, after signing 5 forms that acknowledge the doctor is going to swear on a stack of Bibles a mile high to not disclose anything they find.
Frankly ISP's generally don't want users storing mail on their servers anyway, it consumes expensive disk space for one thing. And the solution to all of this is extremely simple - use POP3 as a mail protocol, download your mail to your PC via Outlook or other mail client, and don't check the "leave messages on the server" button in your Outlook settings (which in any case isn't checked by default)

It would be more correct to

It would be more correct to say that stored communications less than 180 days old require a warrant. Communications in storage longer require either a warrant or a subpoena. The subpoena process shifts the burden to the subpoena recipient to oppose or quash the government's demand for information. There isn't much incentive for the ISP to go to the mat and opose a subpoena. And, of course, there is no constitutional warrant requirement if the requestor isn't the government.

You wrote: "...ISP's

You wrote: "...ISP's generally don't want users storing mail on their servers anyway, it consumes expensive disk space..."

Are you saying that ISPs do not (generally) back up email onto other storage media? If they do, then your method of deleting from the server would not work.

If they do not generally back up files, then I still have a question: Does my 'deleting from server' on a POP3 account actually cause the file to be deleted and overwritten, or is it just a flag for deletion? Thx.

Martin- good to see you

Martin- good to see you writing again. I agree with you, right or wrong, we should realize that we have no expectation of privacy in our emails. Whether it be from an employer, the government or someone else, if you write it, someone can get it. I have written further on this at my blog here

Not just email. I use a

Not just email. I use a computer for my taxes, but not a web site. I doubt I'll ever use a web-based word processor or spreadsheet (except as a toy). And the only way I would ever use a public web-based remote bulk storage site to keep anything sensitive would be if my files were at least PGP encrypted before they left my machine -- and maybe not even then.

More of my personal information than I like is already out on the web; but I have tried since its earliest times to treat the Internet as public or semi-public space as much as possible.