I agree. In my opinion, the number one thing that needs to be done is to ensure that email can only be sent encrypted. I have had the following information sent unencrypted over email in recent years: 1. medical/health information. 2. sensitive personal financial information. 3. HR related information. 4. Billing information. 5. payrol information. I basically refuse to give out email to health care providers or any corporate entity because I can't be sure what they will put in plain text email. I have to carefully explain to them that email is not encrypted and I have to explain what encryption is, some get it some don't. I am also trying to get friends and family to encrypt because I am also concerned that they will put health/medical etc into the email, so far no takers on encrypting. It takes like 15-30 minutes to do it the first time and 5-10 minutes for each contact (just need to send and verify fingerprint). Email is great in that it is federated and not centrally controled, the encryption needs to get fixed. I would suggest somebody create an SMTP server that will only accept encrypted connections and will scan and reject any received email that is plain text; i.e. will not store the plain text and will issue appropriate SMTP code indicating that it is not encrypted.