What if Petraeus was a hacker? Email privacy for the rest of us

August 1, 2013
What if Petraeus was
a hacker?
https://en.wikipedia.org/wiki/David_Petraeus
Email privacy for the rest of us
Phil Cryer / @fak3r
Las Vegas, NV
v1.02

better known online as...
@fak3r
Phil Cryer

@fak3r
Phil Cryer
Open Source Technologist

@fak3r
Phil Cryer
Infosec Researcher+Speaker

@fak3r
Phil Cryer
Infosec Researcher+Speaker
Privacy Advocate

l
https://secure.ﬂickr.com/photos/katmere/62954848/sizes/o/

Documents should generally not be read by anyone other than the
addressee; for instance, in the United States of America it is a
violation of federal law for anyone other than the addressee [...] to
open mail. There are exceptions though: executives often delegate
to secretaries or assistants the task of dealing with their mail; and
postcards do not require opening and can be read by anybody. For
mail contained within an envelope, there are legal provisions in
some jurisdictions allowing the recording of identities of sender
and recipient.
https://en.wikipedia.org/wiki/Mail

The privacy of correspondence is guaranteed by the constitutions
of Mexico and Brazil, and is alluded to in the European Convention
of Human Rights and the Universal Declaration of Human Rights. The
control of the contents inside private citizens' mail is censorship
and concerns social, political, and legal aspects of civil rights.
International mail and packages are subject to customs control,
with the mail and packages are often surveyed and their contents
sometimes are edited out (or even in).

There have been cases over the millennia of governments opening
and copying or photographing the contents of private mail. Subject
to the laws in the relevant jurisdiction, correspondence may be
openly or covertly opened, or the contents determined via some
other method, by the police or other authorities in some cases
relating to a suspected criminal conspiracy, although Black
Chambers (largely in the past, though there is apparently some
continuance of their use today) opened and open letters
extralegally.

http://tinyurl.com/3cuqpdm

“...Computers, “they were totally local, and they were totally
different from all these shared network machines,” he said. “Now
we’re all on the Internet. The funny thing is, you had to mail a
letter in an envelope and you had legal guarantees, except in the
case of court orders and warrants, that it couldn’t be opened on
the way there. It was sealed. And now we don’t have any guarantee
about email anymore.”

“When the Internet first came, I thought it was just the beacon of
freedom. People could communicate with anyone, anywhere, and
nobody could stop it…Now it turns out that every single thing we
send as email counts as publicly viewable and it’s totally open and
exposed, and can be taken for whatever reason. That wasn’t
supposed to be. That wasn’t where we thought the Internet was
going to go. We thought it was going to elevate the really average
people over huge, big, controlling governments and protect us from
tyrants.”

He suggested the two top technology companies, Microsoft and
Apple, missed an opportunity by not incorporating PGP (for “pretty
good privacy) Encryption software into their products. “If two
companies, Microsoft and Apple, and built in PGP Encryption,”
Wozniak said, “every email would have been encrypted and
uncrackable.”

http://tinyurl.com/3cuqpdmhttp://tinyurl.com/3cuqpdm

http://www.ﬂickr.com/photos/limaoscarjuliet/225249268/sizes/o/

https://secure.runbox.com/why-runbox/email-privacy-offshore-email/
In the United States, there is no constitutional guarantee on email
privacy or correspondence in general. The secrecy of
correspondence is derived from the Fourth Amendment to the
United States Constitution and an 1877 U.S. Supreme Court case.
However, like all rights that have been derived through litigation,
this is subject to interpretations and is limited by the legal
requirement of a “reasonable expectation of privacy” which may be
either subjective (the opinion of the person in question) or objective
(as recognized by society).

In the United States [...] Email is also protected by the Electronic
Communications Privacy Act (ECPA) of 1986 which was enacted to
extend government restrictions to include transmissions of
electronic data. The ECPA has been criticized because an agency
doesn’t need judicial review in order to demand consumer data from
service providers.
Furthermore, after 6 months, email messages lose their status as
protected communication under the ECPA and become a regular
database record. This means that just a subpoena instead of
a warrant is required for a government agency to force email
providers to produce a copy of a record.

email providers [can] screen email communication in order to
display targeted advertisements to the user, or store message
contents and personal data in order to extract information that
may be shared with third parties for commercial gain (“data
mining“)
Also, email messages sent over company computers are generally
considered to be company property and are therefore accessible by
the company’s management.
Intelligence agencies may utilize surveillance software to monitor
email messages to combat espionage, facilitate political
eavesdropping, or carry out other types of screening in the
perceived interest of national security.

While some countries see their email privacy regulations attacked
or breached, offshore email services in European countries can
generally offer stronger email privacy to both individuals and
companies worldwide.
Some countries, especially in Europe, have a constitutional
guarantee of secrecy of correspondence, wherein email is equated
with letters and therefore protected from all types of screening
and surveillance. In electronic communication, this principle
protects not only the message contents but also the logs of when
and from/to whom messages have been sent.

https://secure.ﬂickr.com/photos/dno1967b/8187252705/sizes/h/in/photolist-dttNZp

David
https://en.wikipedia.org/wiki/File:Paula_Broadwell.jpg
http://militaryinsignia.blogspot.com/2011_05_01_archive.html
http://www.theatlanticwire.com/national/2012/11/what-we-know-about-petraeus-affair/58909/
http://www.hindustantimes.com/Brunch/Brunch-Stories/Spectator-Sexism-Rules-OK/Article1-963692.aspx

Paula
David

Paula
David
Jill

Paula
David
Jill
http://www.globalpost.com/dispatch/news/regions/americas/united-states/121112/jill-kelley-who-she

Rather than transmitting e-mails to the other's inbox, they composed at
least some messages and left them in a draft folder or in an electronic
"drop box," the AP reported. Then the other person could log onto the same
account and read the draft e-mails, avoiding the creation of an e-mail trail
that might be easier to trace.
http://www.usatoday.com/story/tech/2012/11/13/petraeus-broadwell-email/1702057/

http://www.usatoday.com/story/tech/2012/11/13/petraeus-broadwell-email/1702057/

http://www.schneier.com/blog/archives/2012/11/e-mail_security.html
in the Petraeus case [...] FBI obtained subpoenas for Internet Protocol logs,
allowing them to connect the sender’s anonymous Google Mail account to
others accessed from the same computers, accounts that belonged to
Petraeus biographer Paula Broadwell.
From there they subpoenaed guest records from hotels, tracking the WiFi
networks, and confirm that they matched Broadwell’s travel history.
None of this required judicial approval let alone a Fourth Amendment
search warrant based on probable cause.

The guest lists from hotels, IP login records, as well as the creative
request to email providers for "information about other accounts that
have logged in from this IP address" are all forms of data that the
government can obtain with a subpoena. There is no independent review, no
check against abuse, and further, the target of the subpoena will often
never learn that the government obtained data (unless charges are filed,
or, as in this particular case, government officials eagerly leak details of
the investigation to the press). Unfortunately, our existing surveillance
laws really only protect the "what" being communicated; the
government's powers to determine "who" communicated remain largely
unchecked.

Had the FBI chosen to pursue this investigation as a counterintelligence
inquiry rather than a cyberstalking case, much of that data could have
been obtained without even a subpoena. National Security Letters, secret
tools for obtaining sensitive financial and telecommunications records,
require only the say-so of an FBI field office chief.

Marc Rotenberg, executive director of the Electronic Privacy Information
Center (EPIC) in Washington, said the chain of unexpected disclosures was
not unusual in computer-centric cases. "It's a particular problem with
cyber investigations they rapidly become open-ended because there’s such
a huge quantity of information available and it’s so easily searchable," he
said, adding, "If the C.I.A. director can get caught, it’s pretty much open
season on everyone else."

https://secure.ﬂickr.com/photos/98137931@N02/9161328604/sizes/o/

https://secure.ﬂickr.com/photos/98137931@N02/9161328604/s

http://mashable.com/2013/07/08/emails-facebook-nsa/
http://news.cnet.com/8301-13578_3-57590389-38/how-web-mail-providers-leave-door-open-for-nsa-surveillance/
In the lengthy Q&A carried out over encrypted emails, Snowden said that
one can be targeted because of his her emails and Facebook profile, but
didn't include any precise details of the inner workings. When asked what
happens to targets, though, he revealed a bit more.
"They're just owned. An analyst will get a daily (or scheduled based on
exfiltration summary) report on what changed on the system, PCAPS
[abbreviation of the term "packet capture"] of leftover data that wasn't
understood by the automated dissectors, and so forth," Snowden wrote. "
It's up to the analyst to do whatever they want at that point— the
target's machine doesn't belong to them anymore, it belongs to the US
government."

The NSA leaker also revealed how the NSA "wants to be at the point where
at least all of the metadata is permanently stored," emphasizing the
importance of metadata. "In most cases, content isn't as valuable as
metadata because you can either re-fetch content based on the metadata
or, if not, simply task all future communications of interest for
permanent collection since the metadata tells you what out of their data
stream you actually want," he explained.

http://www.theverge.com/2013/7/31/4574532/xkeyscore-data-tracking-program-detailed-in-documents
XKeyscore

program called XKeyscore, which acts as a central interface for email,
Facebook chat, web browsing history, and more. According to The Guardian,
XKeyscore is available not only to members of the NSA but to outside
analysts like Edward Snowden, who worked as a contractor for Booz Allen
before his flight to Hong Kong, and its vast database allows users to find
people by email address, name, phone number, type of browser, language
used, IP address, or specific keywords.

The Guardian reports that in 2012, 41 billion individual records were
stored in XKeyscore over one thirty-day period. actual content like email
text is also included in the database. Because of the high volume of
incoming records, however, the content of things like emails is stored for
only three to five days, with metadata stored for thirty days. If content is
deemed "interesting," though, it's moved to other databases, where it can
be stored for up to five years.

The NSA isn't the only surveillance power that netizens should be worried
about. Snowden explained in the interview that its allied counterparts
from the UK, Australia, New Zealand and Canada — part of the so-called
Five-Eyes — "go beyond what NSA itself does."
The British spy agency GCHQ secretly taps fiber-optic cables through a
surveillance program called Project Tempora, a report in The Guardian
revealed. That procedure "snarfs everything, in a rolling buffer to allow
retroactive investigation without missing a single bit," Snowden wrote. "If
you send a single ICMP packet 5 [referring to all data packets sent to or
from Britain] and it routes through the UK, we get it.

https://www.schneier.com/blog/archives/2013/07/nsa_e-mail_eave.html
https://secure.ﬂickr.com/photos/villoks/492857088/sizes/l/in/photostream/

More Snowden documents analyzed by the "Guardian" discuss how
the NSA collected e-mails and data on Internet activity of both
Americans and foreigners. The program might have ended in 2011,
or it might have continued under a different name.

What's interesting is that the NSA collected this data under one
legal pretense. When that justification evaporated, they searched
around until they found another pretense. This story is being
picked up a bit more than the previous story, but it's obvious that
the press is fatiguing of this whole thing.

(Meanwhile) Web Mail Providers Leave Door Open for NSA Surveillance
Protecting users' e-mail privacy from the National Security Agency and
other intelligence services means using encryption. But with the exception
of Google, few companies do everything they can.

(initial) Security is provided via HTTPs - But during the next step, when
those e-mail messages are transferred from one company's servers to
another's, they're rarely encrypted. An e-mail message that a Facebook
user addresses to a Yahoo Mail user, for instance, will be delivered in an
unencrypted form through a server-to-server connection that provides no
protection against surveillance.

How Web mail providers
leave door open for NSA
surveillance

The potential privacy risks of server-to-server e-mail deliveries
have been thrown into sharp relief by surveillance-related
disclosures over the last two weeks from Edward Snowden,
theformer NSA contractor, and U.S. government officials.
Billions of supposedly private e-mail messages a day flow through
unsecured links, (lacking SMTP-TLS) where they can be snared in
digital dragnets operated by the National Security Agency and
other intelligence services.
Snowden said [...] "Americans' communications are collected and
viewed on a daily basis on the certification of an analyst rather
than a warrant."

A leaked NSA slide talking about "upstream" data collection from
"fiber cables and infrastructure as data flows past" suggests that
those companies are telling the truth: the NSA instead is tapping
into Internet backbone links operated by companies such as AT&T,
CenturyLink, XO Communications, Verizon, and Level 3
Communications -- and using that passive access to vacuum up
unencrypted communications. Additional evidence comes from the
classified directives released Thursday that discuss surveillance
procedures and were signed by Attorney General Eric Holder.

http://www.guardian.co.uk/world/2013/jun/27/nsa-data-mining-authorised-obama l

https://www.net-security.org/secworld.php?id=15159
http://www.guardian.co.uk/world/2013/jun/27/nsa-data-mining-authorised-obama l
the Obama administration had allowed for the continuation of an
NSA data collection program For Two Years started during
President George W. Bush's first mandate in 2001.

http://www.mattbors.com/blog/2013/06/27/spy-vs-spy/

http://www.salon.com/2013/06/15/half_of_the_senate_skipped_this_weeks_classiﬁed_nsa_brieﬁng/

The NSA leaks just keep on coming, and the latest one is a big one.
It's concerning the NSA is about the Stellar Wind program -- which
had been revealed before, and which former NSA whistleblower
Bill Binney has discussed in the past -- but Binney left the NSA in
2001. The latest document is a report from the Inspector General
that confirms some of the claims Binney has made in the past,
showing that the NSA collected "bulk metadata" on emails of US
persons. The program started as only being about non-US persons,
but was later expanded by the DOJ in 2007 to cover US persons as
well.
https://www.techdirt.com/articles/20130627/09455923637/latest-leak-nsa-collected-bulk-email-metadata-americans.shtml

Eventually, the NSA gained authority to "analyze communications
metadata associated with United States persons and persons
believed to be in the United States", according to a 2007 Justice
Department memo, which is marked secret.
So, remember all that stuff the NSA and the President and various
elected officials were saying about how they're not collecting
internet data on Americans? And how they have minimization
procedures and all of that?

Of course, the defenders of the program will say that this is okay
because it was "just metadata," rather than the contents of email,
but that's a huge cop out, since metadata can tell you an awful lot:
The internet metadata of the sort NSA collected for at least a
decade details the accounts to which Americans sent emails and
from which they received emails. It also details the internet
protocol addresses (IP) used by people inside the United States
when sending emails – information which can reflect their
physical location. It did not include the content of emails.

http://www.t3.com/news/mit-tool-uses-gmail-metadata-to-give-you-a-people-centric-view-of-your-email-life
MIT Media Lab has developed a new online project,
called Immersion, which takes your Gmail metadata
and turns it into a map linking together people in
your life.

http://www.forbes.com/sites/kashmirhill/2013/07/10/heres-a-tool-to-see-what-your-email-metadata-reveals-about-you/
http://www.salon.com/2013/06/15/half_of_the_senate_skipped_this_weeks_classiﬁed_nsa_brieﬁng

http://www.forbes.com/sites/kashmirhill/2013/07/10/heres-a-tool-to-see-what-your-email-metadata-reveals-about-you/
http://www.salon.com/2013/06/15/half_of_the_senate_skipped_this_weeks_classiﬁed_nsa_brieﬁng
Hidalgo goes on to express that for him, metadata is an emotional
issue. A users metadata is all about interactions between people
and those interactions are associated with our emotions.

https://www.techdirt.com/articles/20130620/15390323549/nsa-has-convinced-ﬁsa-court-that-if-your-data-is-encrypted-you-
might-be-terrorist-so-itll-hang-onto-your-data.shtml
If Your Data Is Encrypted, You Might Be Evil, So We'll
Keep It Until We're Sure from the say-what-now? dept

if your data is encrypted, the NSA can keep it. Specifically, the
minimization procedures say that the NSA has to destroy the
communication it receives once it's determined as domestic unless
they can demonstrate a few facts about it. As part of this, the
rules note:
In the context of a cryptanalytic effort, maintenance of technical
data bases requires retention of all communications that are
enciphered or reasonably believed to contain secret meaning, and
sufficient duration may consist of any period of time during which
encrypted material is subject to, or of use in, cryptanalysis. the
default is if the NSA isn't sure about anything, it can keep your
data.

if it discovers anything at all remotely potentially criminal about
your data, it can keep it, even if it didn't collect it for that purpose.
As Kevin Bankston points out to Andy Greenberg in the link above:
The default is that your communications are unprotected. That's
the exact opposite of how it's supposed to be under the
Constitution. The default is supposed to be that your
communications are protected, and if the government wants to see
it, it needs to go to court to get a specific warrant for that
information.

Sens. Ron Wyden (D-OR) and Mark Udall (D-CO) want the American
public to know that the NSA has been lying to them about their
protections under the Patriot Act, and they want the NSA To Know
that we all know they're lying. The senators sent a letter to NSA
asking them to correct the public information used in talking
points and on a fact sheet that talks about how your privacy is
being protected, specifically under Sec. 702—that's the part
relevant to the PRISM internet surveillance program.
http://www.dailykos.com/story/2013/06/25/1218763/-What-does-the-NSA-have-to-hide-nbsp-now

[The nSA] just took down the whole public page. Which was sort of
pointless, because there are Archives of it. We don't know what on
that page Wyden and Udall think is misleading. That's because that
part has to remain classified, and the senators couldn't reveal
that in the part of the letter they made public. So these senators
who know as much about the NSA programs as anyone say that
we're not nearly as protected as the government is telling us, but
they can't tell us how. So the NSA wipes out everything. Problem
solved.

http://web.archive.org/web/20130625004125/http://www.nsa.gov/public_info/_ﬁles/press_releases/section_702_protections.pdf
Sens. Ron Wyden (D-OR) and Mark Udall (D-CO) want the American public to know that the NSA has
been lying to them about their protections under the Patriot Act, and they want the NSA To Know
that we all know they're lying. The senators sent a letter to NSA asking them to correct the public
information used in talking points and on a fact sheet that talks about how your privacy is being
protected, specifically under Sec. 702—that's the part relevant to the PRISM internet surveillance
program.
Yep, they just took down the whole public page. Which was sort of pointless, because there are
Archives of it. We don't know what on that page Wyden and Udall think is misleading. That's because
that part has to remain classified, and the senators couldn't reveal that in the part of the letter
they made public. So these senators who know as much about the NSA programs as anyone say that
we're not nearly as protected as the government is telling us, but they can't tell us how. So the NSA
wipes out everything. Problem solved.
http://web.archive.org/web/20130625004125/http://www.nsa.gov/public...

http://www.dailykos.com/story/2013/06/28/1219618/-Under-Obama-NSA-Continues-Bush-Era-Datamining-on-Americans
With each new disclosure, it becomes more clear that the
government has deliberately concealed its massive domestic spying
operation and misled the public about the extent to which the NSA
uses its surveillance tactics against innocent Americans.

http://www.usatoday.com/story/news/politics/2013/06/16/snowden-whistleblower-nsa-ofﬁcials-roundtable/2428809/
http://www.dailykos.com/story/2013/06/28/1219618/-Under-Obama-NSA-Continues-Bush-Era-Datamining-on-Americans
It is thanks to whistleblowers like Thomas Drake, William Binney,
Kirk Wiebe, and Snowden that the public can now have a more open
debate about the wisdom and efficacy of these spying powers and
that the Courts and Congress are afforded an opportunity to
engage in more aggressive and badly needed oversight.

http://nerdbusiness.com/blog/google-nsa-prism

http://nsa.gov1.info/utah-data-center/

https://www.muckrock.com/news/archives/2013/jul/11/nsas-utah-data-center-ribbon-cutting-emphasis-priv/
[From FOI Requests] At NSA's Utah data center ribbon cutting, an
emphasis on private partnerships and claimed that it would be
"100% COMMITTED TO PROTECTING THE CIVIL LIBERTIES AND PRIVACY
RIGHTS OF THE AMERICAN PEOPLE"
delivered months before recent leaks by former NSA contractor
Edward Snowden showed a PowerPoint document detailing an NSA
program, dubbed PRISM, that collected, analyzed and stored data
from a number of private Internet companies.

The facility is 1 million square feet of space, with a price tag well
above $1 billion; and it will have an appetite for electricity that
would embarrass Godzilla. Computers and cooling systems at the
NSA's Utah Data Center will reportedly consume $40 million worth
of power each year. The power company won't say if that widely
reported estimate is valid.
Officials in Washington won't say what the data center is for, but
the NSA did issue a vague statement saying it will "strengthen and
protect the nation's cyber-security." That's a critical mission,
according to NSA director General Keith Alexander.

"The entire facility is heavily fortified by a robust security
perimeter, its own police force, intrusion-detection systems,
backup generators with three days of fuel storage and a structure
designed to withstand major physical attack."
"It will need an average of 65 megawatts of electricity to run what
several NSA equipment suppliers say will be among the most
sophisticated supercomputers and largest reserves of data
storage on the planet."

This top-secret data warehouse could hold as many as 1.25 million
4-terabyte hard drives, built into some 5,000 servers to store the
trillions upon trillions of ones and zeroes that make up your
digital fingerprint.
Some reports have suggested the data center could hold as much as
5 zetabytes, an astronomical sum equivalent to 62 billion stacked
iPhone 5s. King called that number "difficult, if not impossible to
conceive.”

5 Zettabytes (ZB)
=
5,000,000,000,000
Gigabytes (GB)

http://wlcentral.org/node/2834

http://wlcentral.org/node/2834
Development of the XC30 series was financed in part by the US
Department of Defense (DARPA) to meet the demanding needs of the
Intelligence Community. Speeds are up to 100 petaflops, one
thousand trillion calculations per second, or three times faster
than the world's currently fastest computers. This is enough
computer power to track the movements of every human on Earth in
real time and also enough to break advanced encryption
algorithms, according to NSA whistleblower William Binney.

We can make inferences about the NSA’s Utah facility based on the
theoretical amount of data from various sources, the cost of
computation, and the power requirements from the facility, but
those are rough guesses at best. For a lot of this, we’re completely
in the dark.[...]
THe U.S. government is on a secrecy binge. It overclassifies more
information than ever. And we learn, again and again, that our
government regularly classifies things not because they need to be
secret, but because their release would be embarrassing.
Our government is putting its own self-interest ahead of the
interests of the country. That needs to change.
Bruce Schneier

0
20.0
40.0
60.0
80.0
2001 2008 2010
Number of Documents Classiﬁed (in millions)
8.6m
23.4m
76.7m
This Machine Kills Secrets by Andy Geenbert

0
20.0
40.0
60.0
80.0
2001 2008 2010
Number of Documents Classiﬁed (in millions)
8.6m
23.4m
76.7m
This Machine Kills Secrets by Andy Greenberg (p. 5)
estimate of 5x the documents being classified
versus
not classifed

Privacy And anonymity is a RIGHT

`https://secure.ﬂickr.com/photos/28096801@N05/4727775848/sizes/l/

https://secure.ﬂickr.com/photos/shstrng/2728127370/sizes/o/

https://secure.ﬂickr.com/photos/doegox/8016617207/sizes/o/

https://eff.org

https://www.eff.org/issues/anonymity
These long-standing rights to anonymity and the protections it affords
are critically important for the Internet. As the Supreme Court has
recognized, the Internet offers a new and powerful democratic forum in
which anyone can become a "pamphleteer" or "a town crier with a voice
that resonates farther than it could from any soapbox."
The Electronic Frontier Foundation has been involved in the fight to
protect the rights of anonymous speakers online. As one court observed, in
a case handled by EFF along with the ACLU of Washington, "[T]he free
exchange of ideas on the Internet is driven in large part by the ability of
Internet users to communicate anonymously."

https://www.eff.org/issues/anonymity
Anonymous communications have an important place in our political and
social discourse. The Supreme Court has ruled repeatedly that the right to
anonymous free speech is protected by the First Amendment. A much-cited
1995 Supreme Court ruling in McIntyre v. Ohio Elections Commission reads:
Protections for anonymous speech are vital to democratic discourse.
Allowing dissenters to shield their identities frees them to express
critical minority views . . . Anonymity is a shield from the tyranny of the
majority. . . . It thus exemplifies the purpose behind the Bill of Rights and of
the First Amendment in particular: to protect unpopular individuals from
retaliation . . . at the hand of an intolerant society.

https://secure.ﬂickr.com/photos/pagedooley/3742023871/sizes/l/

https://crypto.cat/
encrypted chat

https://silentcircle.com/
GLOBAL ENCRYPTED COMMUNICATIONS

https://en.wikipedia.org/wiki/File:PRZ_closeup_cropped.jpg

From the creator of PGP (Pretty Good Privacy)

Silent Circle is a suite of products offering: Encrypted email, Encrypted video
chat, Encrypted phone calls, Encrypted text messaging

https://startmail.com/
“world’s most private email”

http://www.ibtimes.com/alternatives-google-gmail-private-search-email-services-promise-online-anonymity-wake-nsa-1317983
This month, in fact, Ixquick began beta testing StartMail, an email service that
Albrecht said will offer a private alternative to data-collecting services
such as Gmail and Yahoo. Albrecht said the ultimate goal for Ixquick is to offer
an entire suite of completely private Web products. Convincing people to use
them? That’s another story.
... Jaron Lanier argues that that the Internet’s ever-growing “Culture of Free”
has had devastating effects on not just our privacy but also our economy,
disseminating the middle class and funneling power into a few monopolistic
companies.

http://www.ibtimes.com/alternatives-google-gmail-private-search-email-services-promise-online-anonymity-wake-nsa-1317983
The question, then, becomes whether or not consumers will ever wrap their
heads around the idea of paying for email. Albrecht acknowledges the
challenge, but she said it’s ultimately a matter of paying with your wallet or
with your data.

NSA-proof Messenger App
http://bestseedbox.net/2013/07/10/pirate-bay-founder-to-launch-nsa-proof-messenger-app/

“In this day and age we can’t do without encryption”

“Who runs the infrastructure? How do you know the intentions of those
people? Which jurisdiction has which rules? “We know these things just as
well as the technology. Today’s internet is more and more politicized so it
needs to be dealt with that way as well.”

Spy-proof Messenging
https://torrentfreak.com/dotcoms-mega-debuts-spy-proof-messaging-this-summer-email-follows-130711/

https://en.wikipedia.org/wiki/Kim_dotcom

https://en.wikipedia.org/wiki/Kim_dotcom
“We expect to have [Private] messaging within Mega in four to six weeks, and
within apps in two to three months A full-scale encrypted email service is
expected to be released in six to nine months”

http://news.cnet.com/8301-17938_105-57591562-1/this-e-mail-will-self-destruct-in-ﬁve-seconds/
This e-mail will self-destruct in five seconds

AT&T [...] applied for a patent for self-deleting e-mail. Once sent, these
missives won't hang around in some inbox waiting for someone to do what he
pleases with them. They'll disintegrate, so to speak.
"Method, System, and Apparatus for Providing Self-Destructing Electronic
Mail Messages" is U.S. patent application number 20130159436 and was
recently made public. [E-mails could be set to delete themselves,

"The inability to control the number and type of operations that may be
subsequently performed on a sent e-mail message makes conventional e-mail
systems unsuitable for sending confidential information for which absolute
control of distribution is a necessity," the application states.
The application describes how the client and application will destroy the
message at a set time, with the option to do so regardless of whether it's been
read or not. [and prevent forwarding or copying].
"All instances of the e-mail message are deleted from the recipient's
computer."

https://riseup.net/en
PrivacY focused ORganizations

https://riseup.net/en
Riseup provides online communication tools for people and groups working on
liberatory social change. We are a project to create democratic alternatives
and practice self-determination by controlling our own secure means of
communications.

http://www.autistici.org/

http://www.autistici.org/
Our fundamental aim is to provide free communication tools on a wide basis,
while pushing people to choose free rather than commercial communication
modes.
We would like to arouse people's awareness about the need to protect their
privacy and to escape the looting which is indiscriminately perpetrated by
governments and corporations alike on both data and personalities.

https://prism-break.org/
PrivacY focused Tools

http://www.newyorker.com/strongbox/
Purpose built PrivacY Tools

http://www.newyorker.com/strongbox/
Strongbox is [...] designed to provide you with a greater degree of anonymity
and security than afforded by conventional e-mail.
To help protect your anonymity, Strongbox is only accessible using the Tor
network. When using Strongbox, The New Yorker will not record your I.P.
address or information about your browser, computer, or operating system,
nor will we embed third-party content or deliver cookies to your browser.

http://deaddrop.github.io/

http://deaddrop.github.io/
In operation, every source is given a unique "codename." The codename lets the
source establish a relationship with the news organization without revealing
her real identity or resorting to e-mail. She can enter the code name on a
future visit to read any messages sent back from the journalist

https://secure.ﬂickr.com/photos/getbutterﬂy/6317955134/sizes/l/

https://pressfreedomfoundation.org/encryption-works h
ttps://secure.ﬂickr.com/photos/getbutterﬂy/6317955134/sizes/l/
Encryption works. Properly Implemented
strong crypto systems are one of the few
things that you can rely on.
Edward Snowden

https://ssd.eff.org/tech/email

https://pressfreedomfoundation.org/encryption-works

https://help.riseup.net/en/message-security

http://www.cryptoparty.in

http://www.cryptoparty.in
@Asher_Wolf

http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours

Email Security ConsiderAtions

1. Security of the connection between you and your
email service (https, SSL)
2. Security of the connection used between the Your
email service and other email services (SMTP-TLS)
3. Securing the content of your email (PGP (Pretty
Good Privacy), Enigmail)
4. Securing the Storage of your email (Disk Encryption,
Offshore Hosting)

http://www.ﬂickr.com/photos/bibbit/5497431771/sizes/l/

While some countries see their email privacy regulations attacked or
breached, offshore email services in European countries (Asia and Elsewhere)
can generally offer stronger email privacy to both individuals and companies
worldwide.

Some countries, especially in Europe, have a constitutional guarantee
of secrecy of correspondence, wherein email is equated with letters and
therefore protected from all types of screening and surveillance. In
electronic communication, this principle protects not only the message
contents but also the logs of when and from/to whom messages have been
sent.
In Norway, freedom of expression and privacy of correspondence is governed
by Article 100 and 102 of the Constitution and the implementation of
the European Convention on Human Rights in the Norwegian Human Rights Act,
especially Article 8: Right to respect for private and family life.

An offshore email account is not free, though the fees are
generally reasonable, and you’re not paying for it with
your Private data!

Personal data must only be collected by private entities when consent
from the user has been obtained.
Personal data must not be used for purposes inconsistent with the initial
purpose of collection except with consent from the user.
Personal data must not be stored longer than required by the purpose of
collection.
Personal data must be kept confidential unless required by law.
do not sell or pass on any information about our users to any third party.
OpenPGP encryption, digital signatures.

http://www.shinjiru.com/web_hosting/email_hosting/private-email-hosting.php

Shinjiru is HUSHMAIL's Official Partner & Reseller in Malaysia.
Hushtools, our encryption toolkit, uses using Open PGP (2048 bit
encryption) standard algorithms.
Messages [between users] are encrypted before leaving the sender's
computer and remain encrypted until after they arrive on the recipient's.
Digital signatures for email and attachments, end-to-end encryption for
email and files.
Hush Messenger for secure instant messaging.
File storage & sharing with other Hushmail users.
IP address is removed from all outgoing emails.
Uses Microsoft Exchange servers (o’rly?)
http://www.shinjiru.com/web_hosting/email_hosting/private-email-hosting.php
Malaysia
Singapore
Holland

http://mutemail.com//

http://mutemail.com//
Bahamas
servers Are offshore in Bahamas, a country with strict privacy laws.
All traffic is transferred through an SSL encrypted connection between
customer's email software and our secure email servers.
messages cannot be intercepted by ISP staff or other authorities.
Additional non-standard SMTP port for clients, which may be of use if
client's ISP or company firewall blocks remote email account access.
IP address and host name (the originating country and internet
connections details), is not shown in the message headers.
They do not keep these any records of IP addresses associated with any
received emails.
They do not log anything related to the client's activity/identity, So They
have nothing to produce even if we are requested to do so.

http://www.trilightzone.org/securemail.html

Netherlands
Luxembourg
Hong Kong
Malaysia
Server Systems are completely realtime encrypted including your email.
Your IP is never visible and communication is SSL/TLS encrypted.
Webmail has PGP Support with up to 4096 bits keys.
Webmail features a Virtual Keyboard, Calendar, Notes, Bookmarks.
No logs kept - No java or javascript required.
Email from/to accountholders is automatically encrypted.
Available Offshore SSH Privacy Tunnel & TriShell jurisdictions.
Payment options: Pecunix, Bitcoin, Paypal, Creditcard, Cash, Litecoin,
Bankwire, Moneyorder.
They blog, post articles covering online privacy and anonymity.
They list their public key on the site.
http://www.trilightzone.org/securemail.html

http://www.neomailbox.com/services/secure-email

They believe that this traditional respect for privacy, makes Switzerland
an ideal location for premium private email hosting.
IP Anonymization, Internet address and geographical location is not
revealed to recipients of your emails (IP hiding).
Alternate ports available for use from behind corporate / ISP firewalls.
Unlimited disposable email addresses, Virus blocking with ClamAV.
EMAIL TRAFFIC logs ARE KEPT FOR 7 days for performance analysis and abuse
prevention. (USER’S IP address is anonymized before any information is
saved to the logs).
Also offers Anonymous Surfing, Anonymous surfing logs are deleted every
10 minutes.
Switzerland

Switzerland
two-factor authentication for e-mail access with an optional hardware
token.
Secure OpenBSD server infrastructure, the most secure operating system
available, kept up to date with the latest security patches.
Hardware-accelerated SSL encryption provides fast access to secure
services.
Does NOT request or require any identifiable personal information when
you create an account, although credit cards do reveal personal
information to validate the purchase.
Offers the option of payment in digital gold currencies for increased
customer privacy - so you don't have to reveal any personal details when
paying for a Neomailbox account.

https://secure.ﬂickr.com/photos/hyku/368912557/sizes/l/
https://secure.ﬂickr.com/photos/91027340@N03/8980097949/sizes/h/in/photolist-
eFxmfZ-cbtJhN-7YodnZ-cKPf55-a1AiZb-8gFv6Y-8gCefR-aihGz1-ai7a1o-9baJKp-dR5UqJ/

https://secure.ﬂickr.com/photos/wiertz/6092000030/sizes/l/

contact:
philcryer.com / @fak3r
slides:
bit.ly/pc-slides
thanks:

What if Petraeus was a hacker? Email privacy for the rest of us

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to What if Petraeus was a hacker? Email privacy for the rest of us (20)

More from Phil Cryer (19)

Recently uploaded (20)

What if Petraeus was a hacker? Email privacy for the rest of us