Secure Your E-Mail Against Governmental Surveillance

[Guest Ethan]

Secure Your E-Mail Against Governmental Surveillance

In light of our recent article, we’ve searched the web in order to find out the best way to counter your government’s surveillance techniques (where the case applies). Fortunately for us and for our readers, we’ve stumbled upon such information. Before explaining how to best protect your e-mail(s) and IM messages, a big “thank you!” goes to the Electronic Frontier Foundation for putting up together an impressive amount of useful tips.

“The Electronic Frontier Foundation (EFF) has created this Surveillance Self-Defense site to educate the American public about the law and technology of government surveillance in the United States, providing the information and tools necessary to evaluate the threat of surveillance and take appropriate steps to defend against it,” the report’s introduction notes.

In order to understand how your e-mail service works, one needs to know that the data is transferred between the sender and the receiver “through the wire.” Simply put, the information you send reaches the receiver via other nodes/servers. You can see an explanatory diagram here.

Now, there is more than one way to protect your privacy, and we shall explain them all, step by step.

End-To-End Encryption Of Specified E-Mails

Making your e-mail secure was never an easy task, but worry not. Technology has always been our friend, and programs that aid you achieving end-to-end encryption exist. Such pieces of software are PGP (aka Pretty Good Privacy) and the GNU Privacy Guard (GnuPG). Both the PGP and the GnuPG will protect your transiting e-mails, while also securing stored data.

The advantages of using end-to-end encryption are quite a few: this counter-surveillance technique ensures the privacy of your e-mail(s) not just through the wire, but also of the e-mail’s copies that are stored on your personal computer or third party machines.

Before using one of the two programs, be reminded of two important things: one – they work only if the receiver is having GnuPG/PGP installed as well. The second thing is that you need to find and verify the receiver’s public keys (you can ask the receiver for the key). This step is of the most importance since it prevents others to fool you into using a wrong key (the attack is known as “man in the middle”). The two popular e-mail clients are Microsoft Outlook and Mozilla Thunderbird (we recommend installing either of them).

Let’s say you use Mozilla Thunderbird as your favorite e-mail manager. You need to install GnuPG and the Enigmail plugin. A quick guide on how to install and configure Enigmail can be seen here.

Server-To-Server Encrypted Transit

Once you press that “Send” button, the content of your e-mail is usually passed through a chain of SMTP mail servers before reaching its destination. The really cool thing is that you can check an e-mail’s headers to see the chain of servers it passed through. While most free e-mail providers do not encrypt your messages as they pass the SMTP servers, there is a way to secure your content as it transits these servers – and it’s called TLS (Transport Layer Security), SSL’s bigger, meaner brother. Before using such encryption, however, you need to make sure that your e-mail provider supports this kind of encryption.

Client-To-Mail Server Encryption

Whether you make the best of POP or IMAP to read you messages, be sure that your service provider supports POP or IMAP encryption. For others, who use webmail services, check and double-check if the e-mail provider is using the HTTPS protocol. A good service is Hushmail.com as it always uses HTTPS, while also providing with end-to-end encryption (though this will not save you if law enforcement agencies have a warrant to read your e-mail).

Although most webmail services use HTTPS to their login page, as soon as you log in they go back to HTTP. To counter this inconvenience, look for a configuration option or a browser plugin that keeps the secure protocol enabled at all times. Gmail (for example) is another good e-mail service that enables the HTTPS security protocol.

Data Stored On Other Computers

We here approach all the other machines, except yours, that store and/or have access to the data you send via e-mail. So, unless you have your own private mail server, a third-party computer gets (and way too often stores) your e-mails. Either it’s your internet service provider or a webmail provider, those sent texts are traceable and can be used/accessed by third-parties. If you use Thunderbird or Outlook, be sure to set the platforms to delete messages from your ISP mail server after they get downloaded. If instead you use webmail or IMAP, delete all messages after you finished reading them. This last method, however, will not 100% ensure that those mail are forever gone.

The best way is to use PGP/GnuPG encrypted e-mails to be completely sure that third-parties keep their nose out of your private messages, or run your own mail server.

Note: E-mail headers are still visible.

Last but not least, the EFF points to Bruce Schneier’s book “Email Security: How to Keep You Electronic Messages Private“.

Stay tuned for yet another chapter, where we’re going to explain how to secure your IM conversations.