And fax machines are easy to use.
Securing document exchange by email is a PITA for 99.9% users. Explain to your mother how to use PGP/GPG to encrypt the email she have to send to financial institutions, government, ... And imagine the government employee receiving the encrypted email. He will probably just delete it. :)
Fax-to-fax is completely vulnerable to all kinds of attacks (even before considering situations where what seems to be fax-to-fax involves one end or the other actually being a gateway to some insecure system that pretends to be a fax machine), because:
(1) phone number hijacking is a thing,
(2) phone lines can be eavesdropped on,
(3) fax lacks authentication between endpoints,
(4) fax lacks encryption.
OTOH, in HIPAA environments it's often preferred because fax is not considered “electronic media”, so it is not covered by either the transaction standards or security standards that apply to transactions conducted via electronic media.
Great in theory, until you realize that most people don't have fax machines, so they use some online fax service that's probably less secure than sending email.
Turns out the reason is rather simple: the law explicitly requires phone lines to be confidential in terms of eavesdropping. (You need a warrant, else it‘s illegal). While all other means of transport are not covered by this. So everyone who wants to legally cover his ass, would rather use the legally privileged, but technically wide open phone line over technically sound solutions missing such a legal framework.
However, POTS these days commonly uses VoIP as an intermediary. I don't know if the law covers the same phone call during its passage through a VoIP segment.
What about VOIP? Cell phones? WIFI calling?
If it's not on a phone line, then it's not afforded those legal protections. None of those communication media you just mentioned are using a phone line as a transport mechanism. (They're also not similar to fax from a UX standpoint.)
I was asking whether those protections applied to only landlines, or all telephone conversations (eg. cellphones).
>If it's not on a phone line, then it's not afforded those legal protections.
This sounds problematic considering that for PSTN, "phone lines" only cover the last few miles of transport[1]. Does that mean you can't tap outside someone's house (where it's a phone line), but you could tap outside the CO, where it's fiber or even public internet?
[1] https://en.wikipedia.org/wiki/Public_switched_telephone_netw...
(And it was illegal, although now, in the USA, I don't think it would be anymore.) Largely depends on what TLA you are, and whether or which secret court you derive your authority from / are required to report to for renewal of your secret warrant.
Of course the GP was about doctors in Germany, and this 641a business was about an NSA facility operated on an AT&T switching office in San Francisco, USA (so this does not also preclude that.)
I think based on what I know about Germany and privacy laws, the court would use a favorable liberal interpretation of "phone line" to mean, say, any connection that begins and ends with a phone line, and terminates with a dial-tone. I don't know much about German courts though, so take that only for what it's worth.
HOWEVER doing that is a hardcore crime. You can be sent to federal prison for years for doing that. So the USPS is not secure in any sort of mathematical sense, but in practice most people trust it most of the time, because security isn't just about technical implementation details like encryption.
Similarly wiretapping telephone lines may be straight forward, but you'd have to be exceptionally daring or stupid to actually do it.
But if your data is such that it would be a “hardcore crime” to seek access to it fraudulently, or the main reason people would do so is to commit a “hardcore crime”, using an information channel that is only considered secure because of the social safeguard that breaching it's trivial protection is itself a “hardcore crime” is probably foolhardy, since engaging in such a crime is cost already accepted by the attackers you are concerned about.
So, for example, doctors using faxes makes a lot of sense. Maybe not for doctors with high profile celebrity or politician clients who value their privacy, but for the most part.
(1) Don't assume you know all potential criminals’ utility functions (especially, don't assume all of their utility is financial), and, more important
(2) Don't presume crime is usually rational, in the first place.
You can only pull off something like this in the analog world a couple of times max, before you are caught and sentenced. And the average expected outcome (expressed in some financial unit) is probably quite small. Alternatively, the (financial) costs in the analog world are higher than the expected gains, so no sane persons would bother trying.
It is probably equally small for doing similar things digital (like over the internet) BUT you can expect to be able to perform it multi times over AND if you choose your country of residence sensibly, you will not go to jail - ever.
We can probably model this something like this:
Expected Outcome:
(1 - propabilityOfGettingCaught)^timesExecuted * timesExecuted * money
The more often executed, the more likely to be caught
Analog:
(1 - .1)^10 + 10 * 10,000 ~= 35k
Digital:
(1 - .00001)^100,000 + 100,000 * 10 ~= 370k
Digital, save location:
(1-0)^100,000 + 100,00 * 10 ~= 1mNot even close.
I can think of a lot of advantages to using old-school faxes, but security is not one of them. In fact, the complete lack of security is a big disadvantage to using old-school faxes.