Trying to Keep Your E-Mails Secret When the C.I.A. Chief Couldn’t


If David H. Petraeus couldn’t keep his affair from prying eyes as director of the Central Intelligence Agency, then how is the average American to keep a secret?

In the past, a spymaster might have placed a flower pot with a red flag on his balcony or drawn a mark on page 20 of his mistress’s newspaper. Instead, Mr. Petraeus used Gmail. And he got caught.

Granted, most people don’t have the Federal Bureau of Investigation sifting through their personal e-mails, but privacy experts say people grossly underestimate how transparent their digital communications have become.

“What people don’t realize is that hacking and spying went mainstream a decade ago,” said Dan Kaminsky, an Internet security researcher. “They think hacking is some difficult thing. Meanwhile, everyone is reading everyone else’s e-mails — girlfriends are reading boyfriends’, bosses are reading employees’ — because it’s just so easy to do.”

Face it: no matter what you are trying to hide in your e-mail in-box or text message folder — be it an extramarital affair or company trade secrets — it is possible that someone will find out. If it involves criminal activity or litigation, the odds increase because the government has search and subpoena powers that can be used to get any and all information, whether it is stored on your computer or, as is more likely these days, stored in the cloud. And lawyers for the other side in a lawsuit can get reams of documents in court-sanctioned discovery.

Still determined? Thought so. You certainly are not alone, as there are legitimate reasons that people want to keep private all types of information and communications that are not suspicious (like the contents of your will, for example, or a chronic illness). In that case, here are your best shots at hiding the skeletons in your digital closet.

KNOW YOUR ADVERSARY. Technically speaking, the undoing of Mr. Petraeus was not the extramarital affair, per se, it was that he misunderstood the threat. He and his mistress/biographer, Paula Broadwell, may have thought the threat was their spouses snooping through their e-mails, not the F.B.I. looking through Google’s e-mail servers.

“Understanding the threat is always the most difficult part of security technology,” said Matthew Blaze, an associate professor of computer and information science at the University of Pennsylvania and a security and cryptography specialist. “If they believed the threat to be a government with the ability to get their login records from a service provider, not just their spouse, they might have acted differently.”

To hide their affair from their spouses, the two reportedly limited their digital communications to a shared Gmail account. They did not send e-mails, but saved messages to the draft folder instead, ostensibly to avoid a digital trail. It is unlikely either of their spouses would have seen it.

But neither took necessary steps to hide their computers’ I.P. addresses. According to published accounts of the affair, Ms. Broadwell exposed the subterfuge when she used the same computer to send harassing e-mails to a woman in Florida, Jill Kelley, who sent them to a friend at the F.B.I.

Authorities matched the digital trail from Ms. Kelley’s e-mails — some had been sent via hotel Wi-Fi networks — to hotel guest lists. In crosschecking lists of hotel guests, they arrived at Ms. Broadwell and her computer, which led them to more e-mail accounts, including the one she shared with Mr. Petraeus.

HIDE YOUR LOCATION The two could have masked their I.P. addresses using Tor, a popular privacy tool that allows anonymous Web browsing. They could have also used a virtual private network, which adds a layer of security to public Wi-Fi networks like the one in your hotel room.

By not doing so, Mr. Blaze said, “they made a fairly elementary mistake.” E-mail providers like Google and Yahoo keep login records, which reveal I.P. addresses, for 18 months, during which they can easily be subpoenaed. The Fourth Amendment requires the authorities to get a warrant from a judge to search physical property. Rules governing e-mail searches are far more lax: Under the 1986 Electronic Communications Privacy Act, a warrant is not required for e-mails six months old or older. Even if e-mails are more recent, the federal government needs a search warrant only for “unopened” e-mail, according to the Department of Justice’s manual for electronic searches. The rest requires only a subpoena.

Google reported that United States law enforcement agencies requested data for 16,281 accounts from January to June of this year, and it complied in 90 percent of cases.

GO OFF THE RECORD At bare minimum, choose the “off the record” feature on Google Talk, Google’s instant messaging client, which ensures that nothing typed is saved or searchable in either person’s Gmail account.

ENCRYPT YOUR MESSAGES E-mail encryption services, like GPG, help protect digital secrets from eavesdroppers. Without an encryption key, any message stored in an in-box, or reached from the cloud, will look like gibberish. The intended recipient must get a key from the sender to read the message. The drawback is that managing those keys — which often involves writing them down — can be cumbersome. And ultimately, even though a message’s contents are unreadable, the frequency of communication is not. That is bound to arouse suspicions.

Wickr, a mobile app, performs a similar service for smartphones, encrypting video, photos and text and erasing deleted files for good. Typically, metadata for deleted files remains on a phone’s hard drive, where forensics specialists and skilled hackers can piece it back together. Wickr erases those files by writing gibberish over the metadata.

SET YOUR SELF-DESTRUCT TIMER Services like 10 Minute Mail allow users to open an e-mail address and send a message, and the address self-destructs 10 minutes later. Wickr also allows users to set a self-destruct timer for mobile communications so they can control how long a recipient can view a file before it disappears. But there is always the chance that your recipient captured screenshots.

DROP THE DRAFT FOLDER IDEA It may sound clever, but saving e-mails in a shared draft folder is no safer than transmitting them. Christopher Soghoian, a policy analyst at the American Civil Liberties Union, noted that this tactic had long been used by terrorists — Khaled Sheikh Mohammed, the mastermind of the 9/11 attacks, and Richard Reid, “the shoe bomber,” among them — and it doesn’t work. E-mails saved to the draft folder are still stored in the cloud. Even if they are deleted, e-mail service providers can be compelled to provide copies.

USE ONLY A DESIGNATED DEVICE Security experts suggest using a separate, designated device for sensitive communications. Of course, few things say philanderer, or meth dealer for that matter, like a second cellphone. (Watch “Breaking Bad.”)

GET AN ALIBI Then there is the obvious problem of having to explain to someone why you are carrying a pager or suddenly so knowledgeable about encryption technologies. “The sneakier you are, the weirder you look,” said Mr. Kaminsky.

DON’T MESS UP It is hard to pull off one of these steps, let alone all of them all the time. It takes just one mistake — forgetting to use Tor, leaving your encryption keys where someone can find them, connecting to an airport Wi-Fi just once — to ruin you.

“Robust tools for privacy and anonymity exist, but they are not integrated in a way that makes them easy to use,” Mr. Blaze warned. “We’ve all made the mistake of accidentally hitting ‘Reply All.’ Well, if you’re trying to hide your e-mails or account or I.P. address, there are a thousand other mistakes you can make.”

In the end, Mr. Kaminsky noted, if the F.B.I. is after your e-mails, it will find a way to read them. In that case, any attempt to stand in their way may just lull you into a false sense of security.

Some people think that if something is difficult to do, “it has security benefits, but that’s all fake — everything is logged,” said Mr. Kaminsky. “The reality is if you don’t want something to show up on the front page of The New York Times, then don’t say it.”

via Trying to Keep Your E-Mails Secret When the C.I.A. Chief Couldn’t – NYTimes.com.

via Trying to Keep Your E-Mails Secret When the C.I.A. Chief Couldn’t – NYTimes.com.

About Old Boy

Love the past and the future but live in the present

Posted on November 17, 2012, in Crime, Government, International affairs, USA and tagged , , , , , , . Bookmark the permalink. Leave a comment.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Writing Suzanne

A Life Lived In Front Of The Screen. Just Another Film Blog (...and other tales)

ming movie reviews

in about 100 words or less

1001 Film Reviews

Working my way through the 1001 Movies You Must See Before You Die

1000 Films Blog

Two sisters attempt to watch all 1000 films recommended by Edgar Wright in his EVER CHANGING list

Balladeer's Blog

Singing the praises of things that slip through the cultural cracks

Sonia en Route

Photography and travels of Sonia Malysz

the m0vie blog

an Irish nerd's eye look at the world of film

In The Good Old Days Of Classic Hollywood.

Celebrating the golden age of Hollywood

Sofi's Corner

lifestyle and fashion lover

Once upon a screen...

...a classic film and TV blog

Natalia Antonova

The sky is high. The Czar is far.

50 Westerns From The 50s.

Riding the long, dusty trail through 50s Westerns.

Vienna's Classic Hollywood

Vintage Hollywood films and stars

emmakwall (explains it all)

Film & soundtrack reviews, good humour and lists

It Rains... You Get Wet

Still more lazy thoughts from this one...

Forgotten Films

A look at the movies forgotten by time

The Immortal Jukebox

A Blog about Music and Popular Culture

Movies Silently

Celebrate Silent Film

shadowsandsatin

. . where the worlds of film noir and pre-code collide . .

Comet Over Hollywood

Home for classic movie lovers

OLD HOLLYWOOD IN COLOR

...because it was never black & white

Lateral Love

"The time is always right to do what is right" ~ Martin Luther King Jr

Silent London

A place for people who love silent film

Cinema Parrot Disco

Musings on Mainly Movies from a Table 9 Mutant

White City Cinema

A Film Blog with a Chicago Perspective

VocareMentor.com

Walk With the Wise and Become Wise - Prov. 13:20

Noirish

The annex to John Grant's *A Comprehensive Encyclopedia of Film Noir*

4 Star Films

Looking deeper at the best classic movies

Criterion Close-Up

A Criterion Podcast

janterrirocks

One mile of road...two miles of ditch.

wolffian classics movies digest

classic movie reviews

Let's Go To The Movies

I spend a lot of time at either the cinema or theatre. You will then find reviews from these films and shows!

Wannabe Comic

A photographer who wants to be a comedian

Movies

movies

Movies From The Silent Era

A repository for movies from the silent era

Old Timers

Music , Movies , audio

The Slog.

The antidote to ideologies

Political People Blog

Progressive News & Opinion

Irish Left Review

Joined up thinking for the Irish Left

Royal Dutch Shell plc .com

News and information on Royal Dutch Shell Plc.

Irish Politics Forum

A PSAI blog for discussion of politics, policy and political reform

%d bloggers like this: