internet e-mail is not secure

From time to time I have moaned and groaned about the lack of secur­ity regard­ing e-mail. Oddly enough, many people who use e-mail on a daily basis for sens­it­ive busi­ness com­mu­nic­a­tions don’t real­ize that, gen­er­ally speak­ing, e-mail is, by default, not secure. Noth­ing is magic­ally encryp­ted when you send or receive e-mails and, to the extent someone can inter­cept an e-mail, it can be read very eas­ily. I don’t recall who said it, but I do remem­ber the phrase that e-mail should be con­sidered no dif­fer­ent than send­ing a post­card — any­one along the way will be able to read it.

Oddly enough, for some reason, most folks in the busi­ness world — includ­ing law­yers, bankers, VCs, as well as very smart tech­no­logy folks — either are not aware of this issue or, if they are, don’t con­sider it to be much of a risk. To illus­trate — I was talk­ing with someone the other day about the mar­vels of Black­ber­ries. One reason, I was told, that Black­ber­ries have gained such wide­spread accept­ance is their bul­let­proof secur­ity. From what I under­stand, trans­mis­sions to and from the devices is encryp­ted using some very ser­i­ous, very heavy duty tech­no­logy. I poin­ted out, how­ever, that the encryp­ted com­mu­nic­a­tion was only between the Enter­prise Server and the device. So, while it was great that no one could pick up the wireles sig­nal and eaves­drop that way, it would be quite pos­sible once the e-mail made it back on to their mail server and was trans­mit­ted via SMTP, at which point it would no longer be encryp­ted at all (unless other meas­ures had been taken) between their mail server and to the recip­i­ents mail server. So although it might be quite secure for e-mails within the organ­iz­a­tion, for external e-mails, not so much. That being the case, I ques­tioned the value of a par­tial encryp­tion path for external e-mails. To me, it seemed like armor plat­ing your body, except for your head and chest. I rumin­ated that it is a ques­tion of when, not if, law­suit or some other form of liab­il­ity would attach due to someone exploit­ing this lack of security.

So I read with interest an art­icle on reportonbusiness.com about insider trad­ing as a res­ult of IT folks hack­ing e-mail:

Reg­u­lat­ors revealed yes­ter­day that an inform­a­tion tech­no­logy ana­lyst work­ing at TD Secur­it­ies Inc. in Cal­gary was read­ing the per­sonal e-mails of invest­ment bankers work­ing on the deal, and bought Syn­enco secur­it­ies using undis­closed inform­a­tion about a pending offer from French energy giant Total SA.

…

While it appears no senior offi­cials involved in any of the recent cases knew their com­pan­ies’ con­fid­en­tial inform­a­tion had been breached, reg­u­lat­ors say firms are respons­ible for ensur­ing crit­ical e-mail is not intercepted.

I didn’t see any­thing in the art­icle about the con­sequences for the com­pan­ies. It will be inter­est­ing to see what hap­pens. Then again, accord­ing to the art­icle, this isn’t the first time this sort of thing happens.

All that being said, there are tools to ensure that e-mails and other com­mu­nic­a­tions are made secur­ity. There are built-in encryp­tion tools in Out­look. There is PGP. There are ser­vices offer­ing encryp­ted e-mail and other com­mu­nic­a­tions through access to secure web­sites. The fact of the mat­ter, how­ever, is that they’re all an incred­ible pain in the ass to use. You need to securely exchange pub­lic keys. You need to sign up for the web ser­vice. You need to go to the web­site to read and reply. And so on. So, in the mean­time, not much is done and mil­lions of unen­cryp­ted, eas­ily read e-mails with highly sens­it­ive and con­fid­en­tial inform­a­tion con­tinue to flow through the ether. I ima­gine at some point some­thing on a much lar­ger scale will occur, and at that point, the imper­at­ive will be much stronger to imple­ment secur­ity meas­ures for e-mail (at least sensitive/confidential e-mails) or to replace it with some­thing stronger alto­gether. My sug­ges­tion would be that firms exchan­ging sens­it­ive inform­a­tion by e-mail ser­i­ously think about adopt­ing such meas­ures before that. Or run the risk of being the poster-boy for that imperative.

related:

1. Don’t Say What You Don’t Mean