In enacting the ECPA, Congress concluded that customers may not retain a “reasonable expectation of privacy” in information sent to network providers. . . [I]f the contents of an unopened message are kept beyond six months or stored on behalf of the customer after the e-mail has been received or opened, it should be treated the same as a business record in the hands of a third party, such as an accountant or attorney. In that case, the government may subpoena the records from the third party without running afoul of either the Fourth or Fifth Amendment.

If nothing else, these records show that federal policy around access to the contents of our electronic communications is in a state of chaos. The FBI, the Executive Office for U.S. Attorneys, and DOJ Criminal Division should clarify whether they believe warrants are required across the board when accessing people’s email. It has been clear since 1877 that the government needs a warrant to read letters sent via postal mail. The government should formally amend its policies to require law enforcement agents to obtain warrants when seeking the contents of all emails too.

More importantly, Congress also needs to reform ECPA to make clear that a warrant is required for access to all electronic communications. Reform legislation is making its way through the Senate now, and the documents released by the U.S. Attorney in Illinois illustrate that the law can be fixed without harming law enforcement goals. If you agree that your email and other electronic communications should be private, you can urge Congress to take action here.

This puts firms in a bind. Either invest time and energy teaching basic Internet skills to their employees — lessons like, “don’t open attachments from unknown email addresses” — that most of us learned when we still had Prodigy emails, or condescendingly cut off access to a modern necessity because the employees are too hopeless to understand the rules.

Yesterday, a major law firm chose the latter route…

King & Spalding dropped this nugget on their employees yesterday:

The firm’s internal security experts, as well as our outside security experts, have advised us that accessing Personal Email Accounts from firm computers creates a significant security risk. Therefore, effective May 1, 2013, access to Personal Email Accounts (i.e., anything other than your kslaw.com email, including, but not limited, to personal email accounts like Gmail, Yahoo, Hotmail, cable company, etc.) from King & Spalding computers will no longer be permitted.

Most personal email sites will be blocked while you are on the firm’s network. However, you should not access Personal Email Accounts from a firm computer, even if you are not automatically blocked when trying to do so.

Yes, this policy was announced yesterday at approximately 4 p.m. Eastern time. So while the whole country was conversing over personal email (and its companion chat systems) about the latest news updates surrounding a national tragedy, King & Spalding was announcing that it would be cutting off this access. Perhaps less than savvy timing. Someone in a position of authority may have wanted to hold off for a week or so.

Employees can continue to check email on their phones not connected to the main network (a new “ksmobile” network has been set up for this purpose). This means all their employees will now spend an order of magnitude longer every day cruising their inboxes on 3.5-inch screens and typing detailed responses with their touchpads. EFFICIENCY!

King & Spalding isn’t wrong to recognize that third-party email services constitute a threat to the firm network. But the actual threat is entirely between the keyboard and the chair if you will. Gmail isn’t threatening the network, Donny Dips**t clicking on a link sent by a Nigerian Prince is threatening the firm network. In the estimation of King & Spalding, its firm email system can better guard against phishing and thus minimize the opportunity of its employees to expose the firm to harm. However, Internet users are getting smarter every year, and with the decline in these “user errors,” the whole phenomenon of phishing is in decline.

So after years of exposing the firm’s computers to risk, King & Spalding has opted now, while the risk is in decline, to take the drastic step of blocking personal email accounts. Perhaps this explains why King & Spalding didn’t survive the first round of the “Which Firm Has The Brightest Future?” bracket.

Full email below.

The documents the ACLU obtained make clear that, before Warshak, it was the policy of the IRS to read people’s email without getting a warrant. Not only that, but the IRS believed that the Fourth Amendment did not apply to email at all. A 2009 “Search Warrant Handbook” from the IRS Criminal Tax Division’s Office of Chief Counsel baldly asserts that “the Fourth Amendment does not protect communications held in electronic storage, such as email messages stored on a server, because internet users do not have a reasonable expectation of privacy in such communications.” Again in 2010, a presentation by the IRS Office of Chief Counsel asserts that the “4^th Amendment Does Not Protect Emails Stored on Server” and there is “No Privacy Expectation” in those emails.

Other older documents corroborate that the IRS did not get warrants across the board. For example, the 2009 edition of the Internal Revenue Manual (the official compilation of IRS policies and procedures) explains that “the government may obtain the contents of electronic communication that has been in storage for more than 180 days” without a warrant.

Then came Warshak, decided on December 14, 2010. The key question our FOIA request seeks to answer is whether the IRS’s policy changed after Warshak, which should have put the agency on notice that the Fourth Amendment does in fact protect the contents of emails. The first indication of the IRS’s position, from an email exchange in mid-January 2011, does not bode well. In an email titled “US v. Warshak,” an employee of the IRS Criminal Investigation unit asks two lawyers in the IRS Criminal Tax Division whether Warshak will have any effect on the IRS’s work. A Special Counsel in the Criminal Tax Division replies: “I have not heard anything related to this opinion. We have always taken the position that a warrant is necessary when retrieving e-mails that are less than 180 days old.” But that’s just the ECPA standard. The real question is whether the IRS is obtaining warrants for emails more than 180 days old. Shortly after Warshak, apparently it still was not

The IRS had an opportunity to officially reconsider its position when it issued edits to the Internal Revenue Manual in March 2011. But its policy stayed the same: the Manual explained that under ECPA, “Investigators can obtain everything in an account except for unopened e-mail or voice mail stored with a provider for 180 days or less using a [relevant-and-material-standard] court order” instead of a warrant. Again, no suggestion that the Fourth Amendment might require more.

Consequently, with the approval of the Dean of FAS and the University General Counsel, and the support of the Dean of Harvard College, a very narrow, careful, and precise subject-line search was conducted by the University's IT Department. It was limited to the Administrative accounts for the Resident Deans — in other words, the accounts through which their official university business is conducted, as distinct from their individual Harvard email accounts. The search did not involve a review of email content; it was limited to a search of the subject line of the email that had been inappropriately forwarded. To be clear: No one's emails were opened and the contents of no one's emails were searched by human or machine. The subject-line search turned up two emails with the queried phrase, both from one sender. Even then, the emails were not opened, nor were they forwarded or otherwise shared with anyone in IT, the administration, or the board. Only a partial log of the 'metadata' — the name of the sender and the time the emails were sent — was returned.

"The Resident Dean whose account had been identified was asked about the incident and voluntarily reviewed his/her own sent items and confirmed that she/he had indeed forwarded the message to two students. Although the Resident Dean's actions violated the expectations of confidentiality surrounding the Administrative Board process, those involved in the review and the conversation with the individual were sufficiently convinced that it was an inadvertent error and not an intentional breach. The judgment was made not to take further action.

Wozniak told the council: "There should be something like a bit tax. I mean a bit tax could be a cent per gigabit and they would still make, probably, billions of dollars a year… And there should be, also, a very tiny tax on email," perhaps one-hundredth of a cent. He said this would discourage spam and not have much impact on the typical Internet user. Wozniak went on to suggest a sales tax on internet transactions that could help, in part, fund "vital functions that the post office serves."

"To the extent that the cheap flow of flat rate first class mail has positive effects for society at large, the insistence that the Post Office be revenue-neutral may not make sense," Zittrain said. "Taxing email as an alternative, however, is a terrible idea: bad in theory and truly unworkable in practice. There have been proposals to see fees imposed on email by service providers — or recipients themselves — as a way of minimizing spam, but to impose an external tax on it when there are ready substitutes (Facebook messaging, anyone?), and when collection would be a nightmare, seems a non-starter. There is no reason to tax electronic mail users in particular to save the Post Office, any more than it would make sense to tax coffee drinkers to do it."

Google is in an ideal position to overcome these difficulties, and finally make strong e-mail encryption a mass phenomenon. Their Gmail service—the one David Petraeus was using to exchange steamy messages with his biographer and lover, Paula Broadwell—has some 425 million active users by last count. Many of those users access the service through a Web interface, which Google can change and update for all users simultaneously. That means we could all wake up tomorrow to find a handy new “Encrypt Message” button included in the familiar Gmail interface we're already using. Meanwhile, Google (along with Facebook) has rapidly become a kind of universal Internet identity provider, with the Google Account used as a key not only to access Google’s own myriad offerings, but many other independent online services as well.

Because truly strong encryption is “end to end”—meaning the end-users generate, store, and have sole access to their own private encryption keys—a robust content encryption system may require users to have appropriate client software installed on their own machines. Here, too, Google is well positioned to provide a solution: They already make a widely-used browser, Chrome, and a popular operating system for mobile devices, Android, which could be updated with the necessary functionality built-in, eliminating the need for a separate browser plug-in.

Meanwhile, Google would garner enormous goodwill from privacy advocates, reams of free press coverage, and an attractive new selling point, not only for Gmail but for Chrome and Android as well. Encryption would likely be a particularly appealing feature for Google's paying enterprise customers, whose messages may contain information that is not only private but highly valuable. At the very least, it's worth running the numbers again to see whether offering strong encryption might now be a net boon to the company's bottom line.

Because people are loss-averse, taking away something people already have and value can be all but impossible—while preventing them from getting it in the first place is far easier. By rolling out e-mail encryption now, Google can ensure that ordinary users see myopic efforts to regulate secure communications infrastructure as something that affects all of our privacy and security—not just that of faceless crooks or terrorists.

...lots of cloud services that offer encryption let the user choose whether or not to let the provider keep a backup copy of the user's keys. The more paranoid could sacrifice some mobility and convenience—and risk losing access to some of their messages if their local copies of the key are destroyed—by opting not to let Google keep even an encrypted copy of their key. Or, as a middle ground, a user could always store an encrypted backup copy of her key with a different cloud provider, like Dropbox, which need not even be known to Google. That provides all of the advantages of storing the key with Google at a relatively minor cost in added hassle, but substantially raises costs for any attacker, who now must not only crack the passphrase protecting the key, but figure out where in the cloud that key is located. Assuming it's accessed relatively infrequently (most of us read our e-mail on the same handful of devices most of the time) even a governmental attacker with subpoena power and access to IP logs is likely to be stymied, especially if the user is also employing traffic-masking tools like Tor

It was always questionable for the FBI to pursue a cyberstalking investigation against Broadwell, who used an anonymous email account, “kelleypatrol,” to tell Florida-based military officers like Marine Gen. John Allen that socialite Kelley was bad news. One former federal prosecutor told Danger Room that it was “highly irregular” for the FBI to take up such cases.

Leahy's rewritten bill would allow more than 22 agencies -- including the Securities and Exchange Commission and the Federal Communications Commission -- to access Americans' e-mail, Google Docs files, Facebook wall posts, and Twitter direct messages without a search warrant. It also would give the FBI and Homeland Security more authority, in some circumstances, to gain full access to Internet accounts without notifying either the owner or a judge.

"Why is my grandson trying to help me find love? I'm 200 years old."
Image source: CC BY 2.0

Well, funny story: it turns out that one of the few things we freedom-loving folks in the States have in common with our Taliban enemies is an amusing incapacity to check to whom we're sending our emails. Take a look at the oops Taliban spokesperson, Qari Yousef Ahmedi, made when he accidentally CC'd, rather than BCC'd, the Taliban's mailing list on a press release email this past Saturday.

In a Dilbert-esque faux pas, a Taliban spokesperson sent out a routine email last week with one notable difference. He publicly CC'd the names of everyone on his mailing list. The names were disclosed in an email by Qari Yousuf Ahmedi, an official Taliban spokesperson, on Saturday. The email was a press release he received from the account of Zabihullah Mujahid, another Taliban spokesperson. Ahmedi then forwarded Mujahid's email to the full Taliban mailing list, but rather than using the BCC function, or blind carbon copy which keeps email addresses private, Ahmedi made the addresses public.

[The list] also includes an address appearing to belong to a provincial governor, an Afghan legislator, several academics and activists, an l Afghan consultative committee, and a representative of Gulbuddein Hekmatar, an Afghan warlord whose outlawed group Hezb-i-Islami is believed to be behind several attacks against coalition troops.

Under the 1986 Electronic Communications Privacy Act, federal authorities need only a subpoena approved by a federal prosecutor — not a judge — to obtain electronic messages that are six months old or older. To get more recent communications, a warrant from a judge is required. This is a higher standard that requires proof of probable cause that a crime is being committed.

Aware of the problems with the official e-mail system, Essex County Clerk Christopher Durkin suggested an alternative option: "Displaced voters can email a request for a ballot at cj_durkin@hotmail.com," according to a post on the Facebook page of the town of West Orange, NJ. Interestingly, security researcher Ashkan Soltani notes that Durkin's Hotmail address has his mother's maiden name as a "password recovery" question. This means that anyone who can figure out Durkin's mother's maiden name could seize control of his Hotmail account and intercept voters' official ballot requests.

“electronic storage” means--
(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and
(B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication;

As Mastro played a series of outtakes for Judge Kaplan, Donziger’s outspokenness was on full display. He riffed, indignantly, about the inadequacies of the Ecuadoran legal system. “They’re all corrupt,” he says of Ecuadoran judges in one clip. “It’s their birthright to be corrupt.”

... In one scene, a scientific expert for the plaintiffs tells him that one measurement of groundwater contamination was not as strong as he had thought. “This is Ecuador, O.K.?” Donziger says. “At the end of the day, if there’s a thousand people around the courthouse you’re going to get what you want.” As for the scientific data, he adds, it’s “just a bunch of smoke and mirrors and bullshit.”

[...] In another scene that Mastro showed to the court, Donziger chats with associates over dinner at a restaurant. Someone at the table, referring to the popular antipathy toward Chevron in Ecuador, suggests that if the judge in Lago Agrio ruled against the plaintiffs he might be killed.

“He might not be,” Donziger replies, cradling a glass of red wine. “But he thinks he will. Which is just as good.”

I will likely never know why Chevron subpoenaed me. But I do know that it is unacceptable for a party to litigation to try to obtain private information from a blogger-journalist who has criticized its tactics. This is not about my journalistic freedom; it is about the journalistic freedom of all bloggers. And it is not about Chevron; it is about any party that thinks it is acceptable to subpoena a blogger’s private information. I would be no less critical of an attempt by Greenpeace to subpoena Glenn Reynolds. Tactics like this need to be exposed and resisted, no matter who uses them or whom they target; passive acquiescence is simply an invitation to further abuses.

I also think that Google needs to do far more to protect the privacy of its users.  Twitter has been very active in resisting attempts to obtain its users’ private information.  Google has also done so in the past, but it did nothing to help me, even after I informed it via email that I was a law professor and a blogger-journalist.  But again, this isn’t about me.  It’s about all the other bloggers who might find themselves facing a similar subpoena.  I’m lucky: I have friends like Glenn Greenwald to ask for help. I’m sure that the ACLU would assist anyone in my position — but not everyone knows that the ACLU is out there, much less that no case is seemingly too small or too unimportant for them to be concerned.  More importantly, the ACLU should not have to get involved in every case like this one (and again, I am but one of 44 people named in the subpoena); Google itself — and all other service providers in similar situations — need to be the first line of defense.

Regardless of whether or not the block on Gmail was intentional, the obstruction to one of the world’s most popular email services resulted in many complaints from Iran officials. Legislator Hossein Garousi reportedly threatened to summon Iran’s telecommunications minister Reza Taqipour for parliamentary questioning if the service was not unblocked.

Iran continues to block any site or network that expresses “anti-government views,” including sites like Twitter, Facebook and YouTube, which helped rally citizens and circularize the massive protests following the questionable re-election of President Mahmoud Ahmadinejad.

Even though YouTube was previously blocked in Iran before the film was released and Gmail access was barred, Reuters reports on the ability of Iranian citizens to “circumvent Internet restrictions” using virtual private network (VPN) software, which makes it appear as if the computer accessing the content is located in another country.

Homeland Security Secretary Janet Napolitano, who is a key player in national cybersecurity efforts, said on Friday she doesn't use e-mail.

"Don't laugh, but I just don't use e-mail at all," she said during a discussion at a Cybersecurity Summit hosted by National Journal and Government Executive. She didn't explain what communications tools she does use.

President Obama, who appointed Napolitano, broke precedent by carrying his own BlackBerry device. But in response to a question about her personal cybersecurity practices, Napolitano said she avoids many online services. "I don't have any of my own accounts. Some would call me a Luddite," she said.

Sponsored by

This is the first of a series of posts looking at how email has changed over the past decade-plus. These posts are sponsored by Outlook.com. As always with sponsored posts, the sponsor has no editorial say in the actual content of the post.

Ah, the bad old days...

I'm of course happy to abide by Twitter's rules, now and forever. But I don't see how I broke them in this case: I didn't publish a private email address. Just a corporate one, which is widely available to anyone with access to Google, and is identical to one that all of the tens of thousands of NBC Universal employees share.

It's no more "private" than the address I'm emailing you from right now.

Either way, quite worrying that NBC, whose parent company are an Olympic sponsor, are apparently trying (and, in this case, succeeding) in shutting down the Twitter accounts of journliasts who are critical of their Olympic coverage.

Such claims look the most ridiculous when you consider the fundamental technologies of the digital world. The high user counts of the latest web startups are nothing compared to the underlying communication protocols that make them and every other online service possible. A big part of the reason these technologies have become so widespread, and created a reliable foundation on which others can build, is that they were free to use. Last year, after the 20th anniversary of Tim Berners-Lee's invention of the world wide web, we wondered what the online world would look like today if he had locked the technology up behind a patent. A similar question is raised this month as we mark another 20th anniversary: that of the Multipurpose Internet Mail Extension protocol, better known as MIME, the technology that powers every single email attachment.

TechWeekEurope spoke to Nathaniel Borenstein, MIME's creator, about why he built the technology and what he thinks of its massive adoption. Like Berners-Lee, and indeed most "old-guard" internet engineers, Borenstein's attitude is one of openness and genuine, useful problem solving:

Mostly, [MIME] was a natural continuation of things I was pursuing. I wanted to live in a world where certain functionality existed.

When people asked me, "why do you work so hard on this?" I used to say that someday I'm going to have grandchildren, and I wanted to get their pictures by e-mail. A lot of people laughed, because it was inconceivable back then. No one even thought of digital cameras, so people pictured taking a print and scanning it in, and then transmitting it over their 1200 baud modem, and even that was expensive equipment.

Borenstein notes that the real challenge of developing MIME wasn't the engineering aspect, but the difficulty of getting everyone to agree to a single standard. By coming up with a clever solution and making it free and open-source, he succeeded, and now the entire world of email relies on MIME. Some might see his situation and think he got a raw deal, and that if he had patented MIME he could be pulling fat checks—but he knows it doesn't work that way:

The most common question I get about MIME is, "have you ever imagined what it would be like if you got a penny every time MIME was used?" And the answer is oh yeah, I imagined that (laughs). I did some checking up, and there's an estimate that MIME is used a trillion times every day. So if I got a penny every time, my annual income would be roughly equal to the GDP of Germany. But of course, that's just a silly fantasy. If there was any money involved, it would never have succeeded. Somebody would have been motivated to develop a similar thing for free.

This is the attitude of a true innovator. Borenstein developed MIME because he saw a problem that he wanted to solve—and he knew his solution wouldn't be of much use to anyone if he demanded an ongoing monopoly on it. Contrast that with trolls who obtain patents on abstract ideas and demand a cut from companies that are actually implementing them, and you see why the very nature of technology patents is opposed to their stated goal of promoting innovation. Today's true innovators recognize this, but the broken system forces them to pursue patents anyway, lest someone else try to patent their idea out from under them and use it to hold them back.

As we mark the anniversaries of fundamental online technologies like MIME, which have benefited the world and driven innovation by remaining free and open, maybe it's time to look at today's patent system, and update it to reflect the way technological progress really happens.

Can you imagine how we would jump down the throat of any real-world business that tried that shit? Imagine ordering your lunch at McDonald's, but when they got to the "fries" question, they phrased it as, "Don't you not want to not have fries with that?" Then, no matter how you answered that ridiculous triple negative, they told you, "By pulling forward to the next window, you are agreeing to buy fries" and shoved them into your car anyway, claiming, "No, you said you wanted them, so now you have to pay for them. No take-backs!" Also, the fries are poison.

It also takes on the fact that most web users ignore virtually all advertising, since so much of it is untrustworthy to a degree that old media rarely reached:

On TV, even if the ad is laced with misleading information (no, Axe Body Spray probably won't lead to instant female-on-male street rape), at least we know that the product is real. Toyota isn't selling you a cardboard car. If you order one of those stupid robe/blanket things, they're going to deliver that retarded, sex-repellant monstrosity to your house. The few ads that do reek of scam are the late night commercials (Enzyte, bullshit diet scams, one-year online colleges), and at least you know when they're coming. You can separate them from the legitimate products. On the net, you just have to assume that everything you see is out to screw you, the only exceptions being brands that you already know.

It's an entertaining read, and one that underlines one of the biggest ways online advertising is different from traditional advertising. When space was limited, the battle was for exposure; when space is unlimited, the battle is for trust and relevance in an increasingly uncertain and noisy world.

Clarification: A number of readers have accurately pointed out that electronic messaging predates V. A. Shiva Ayyadurai’s work in 1978. However, Ayyadurai holds the copyright to the computer program called "email," establishing him as the creator of the “computer program for [an] electronic mail system” with that name, according to the U.S. Copyright Office.