<\/p>\n
\t![\"Why](\"http:\/\/main.makeuseoflimited.netdna-cdn.com\/wp-content\/uploads\/2013\/08\/email-840x420.jpg\")
<\/p>\n
\tNow, let\u2019s look at why email is a poor choice for secure communications, and how it\u2019s an easy target for government snooping.<\/p>\n
\tMetadata Can\u2019t Be Encrypted and XKEYSCORE Can Intercept It<\/h2>\n
\tAn email isn\u2019t really a single piece of data. It\u2019s multiple pieces of data: There\u2019s the message body, the subject line, the From field, the To\/CC\/BCC fields, and other metadata that includes the location you\u2019re sending the email from.<\/p>\n
\tEven if you use the best email encryption technology possible, you can only encrypt the message body of the email. Anyone monitoring the connection you\u2019re using can view the subject of the email, who you\u2019re communicating with, and where you\u2019re emailing from. Under the\u00a0XKEYSCORE<\/a>\u00a0program that essentially allows the US government to capture most of the traffic flowing over the Internet by intercepting it at large backbone routers and gateways, the government can build up quite a picture of who you\u2019re communicating with, when you\u2019re communicating with them, where you\u2019re each communicating from, and what the subject lines of your emails are, which gives them an idea of what you\u2019re talking about. They may find the fact that you\u2019re encrypting the contents of your emails suspicious and target you for further, more in-depth surveillance of everything else you do.<\/p>\n \tThe US government\u00a0collected US email records in bulk until 2011<\/a>. According to the NSA, this program was discontinued because it wasn\u2019t effective \u2014 but they\u2019re still gathering metadata under XKEYSCORE, so they\u2019re likely intercepting all the email metadata they can get their hands on. They\u2019ll get lots of information from you even if you encrypt your emails.<\/p>\n \tFor more information, read about\u00a0the things you can learn from an email\u2019s \u201cheader\u201d, or metadata<\/a>.<\/p>\n \t \tEncrypting and decrypting emails is complicated. In theory, you\u2019d\u00a0use something like PGP or GPG on your local computer to decrypt emails<\/a>. In practice, the setup can be complicated and confusing, even for more tech-savvy users. This also makes it impossible to access the encrypted emails via a browser or lightweight mobile client.<\/p>\n \tIn practice, many secure email providers have dealt with this by holding the encryption keys at their end, decrypting emails when you access them. This is how Silent Circle\u2019s secure email service worked \u2014 they had the encryption keys so they could easily decrypt emails and offer a good user experience. In practice, this means that the government could demand all the encryption keys \u2014 or just the ones they needed \u2014 and decrypt all the emails they wanted to. If the provider has the keys, they could hand them over. The only way to securely encrypt and decrypt email bodies is with complicated desktop software. Even all this effort leaves the metadata exposed.<\/p>\n \tCanada-based Hushmail is one of the most popular and widely-known encrypted email services. In 2007,\u00a0Canadian courts compelled Hushmail to hand over the emails of one of their users<\/a>. The emails were then passed to U.S. courts under a mutual legal assistance treaty between Canada and the USA.<\/p>\n \tHushmail theoretically couldn\u2019t do this. They didn\u2019t keep users\u2019 encryption keys on their servers. They recommended users use PGP or similar software to decrypt the emails on their computers for maximum privacy. However, many people thought this was too inconvenient, so Hushmail also offered a downloadable Java applet located on a web page that allowed you to access your email. When you accessed the web page, the latest version of the Java applet would download to your computer, you\u2019d enter your encryption key, and the applet would download and locally decrypt your email without Hushmail gaining access to your encryption key.<\/p>\n \tHushmail was compelled to serve a version of the\u00a0Java<\/a>\u00a0applet with a built-in backdoor to the user in question. The modified Java applet sent the user\u2019s encryption key to Hushmail after it was entered and Hushmail gained access to the user\u2019s emails, which they handed over to the courts.<\/p>\n \tIf you do use secure email, the provider can be forced to acquire your key in any way possible. Even if they couldn\u2019t gain access to your key, the provider could hand over your encrypted emails themselves, which would show the government who you\u2019re communicating with, when, and about what (via the email subject line).<\/p>\n \t \tEven if the government can\u2019t get or intercept the encryption key, they may be able to decrypt your emails anyway. Your encrypted email messages are stored on a server \u2014 that\u2019s just how email works. If the government were to demand this data, the hosting provider would have to hand it over in encrypted form. The government could then try to break the encryption \u2014 new hardware regularly makes current encryption mechanisms much weaker, and the US government may be storing such encrypted communications in the hopes of breaking them in the future.<\/p>\n \tIn contrast, instant message-style communications are harder to archive. An encrypted message can be sent directly to the recipient and not stored on a server where it can be accessed in the future. The government would have to install a monitoring device and capture all the communications in real time. If they failed to do so and didn\u2019t have all the encrypted data, they wouldn\u2019t be able to go get it years later \u2014 but they can often do this with email.<\/p>\n \tEmail just wasn\u2019t designed with encryption in mind. It\u2019s been bolted on after-the-fact, and it shows. Even the most careful of secure email service users can\u2019t hide who they\u2019re communicating with and when. If you really want to avoid government surveillance, you\u2019re better off using different secure messaging services instead of relying on email.<\/p>\n \tThat\u2019s why Silent Circle still offers a\u00a0secure messaging service<\/a>\u00a0that they\u2019re confident in the security of. It\u2019s not the only option either \u2014\u00a0Cryptocat<\/a>\u00a0is another. Cryptocat\u00a0had a recently publicized vulnerability<\/a>\u00a0and other services may have their own problems that we\u2019ll hear about in the future, but these services are on the right track \u2014 they\u2019re not fundamentally insecure by design the way email is.<\/p>\n \tOf course, encrypted email isn\u2019t necessarily worthless. For example, if you want to secure important business communications against eavesdropping, it can be useful. But encrypted email isn\u2019t going to slow down the government very much \u2014 it\u2019s not the ideal communications tool when you\u2019re trying to talk without the NSA hearing.<\/p>\n \t \tDo you agree with the principles behind Lavabit\u2019s and Silent Circle\u2019s shutdown?\u00a0Do you use a secure messaging service to communicate without your conversations being stored in a massive government database? \u00a0Leave a comment and let us know which email-alternative you prefer.<\/p>\n \tImage Credits:\u00a0Metal detector<\/a>\u00a0Via Shutterstock<\/small><\/p>\n![\"xkeyscore-metadata-slide\"](\"http:\/\/main.makeuseoflimited.netdna-cdn.com\/wp-content\/uploads\/2013\/08\/xkeyscore-metadata-slide.png\")
<\/p>\n \tMany \u201cSecure\u201d Email Providers Have the Encryption Keys For Convenience<\/h2>\n
\tThe Government Can Demand Backdoors: See Hushmail<\/h2>\n
![\"hushmail-legal-warning\"](\"http:\/\/main.makeuseoflimited.netdna-cdn.com\/wp-content\/uploads\/2013\/08\/hushmail-legal-warning.png\")
<\/p>\n \tEmail Messages Are Stored on a Server, Instant Messages Are Not<\/h2>\n
\tOther Types of Communication Can Be Secured<\/h2>\n
![\"encrypt](\"http:\/\/main.makeuseoflimited.netdna-cdn.com\/wp-content\/uploads\/2012\/11\/start-cryptocat-chat.png\")
<\/p>\n
\n