E-Mail Security in the Wake of Petraeus
schneier.com
schneier.com
This reminds me of an experience I had several years ago. My sweet grandma fell prey to a scam where someone called her, impersonating me, and said I was in trouble in a foreign country and needed money. She sent some money via Western Union (or a comparable service, I don't remember which one) to my name, and the scammer picked the money up. To do this the scammer needed ID under my name. I called up the company and asked to see a copy of the ID that was used, since I wanted to know if any of my documents had been compromised.
The company said they wouldn't release that information without a subpoena, which seemed reasonable to me (for all they knew, I was an attacker trying to steal someone else's ID). But I couldn't find any way of getting a court order of any kind. It seemed reasonable to me that I should have standing to see what ID was used to impersonate me and steal money from my grandmother, but I couldn't find any options for actually obtaining it.
In this situation, I would have loved a way to obtain a court order for this information.
Typically, they are used to establish facts needed to support a search warrant. For example, the police may subpoena a utility to obtain electricity usage when investigating a marijuana grower. Using that information, they can obtain phone data and eventually get a search warrant to search the physical location.
Not to mention, it was leaked to the media, everyone already knows about it. How exactly could that be used to blackmail someone if the entire world already knows about it?
I suppose you think Clinton should have resigned (instead of lying about the affair, which made everything worse)?
Now, maybe you think those rules are stupid. Frankly, I think some of them don't make a lot of sense (or at least fail a cost/benefit analysis), but I don't make the rules. Petreus agreed to follow those rules. If he didn't like them, he could have refused the job. Or he could have worked to change them. But he didn't. So he has to live by them. And he failed to do that.
Also, the people involved have probably learned from painful experience that traditional institutional rules are usually better guides than they sometimes appear to be at the moment of decision.
If anything I would guess that he was fired for allowing his secret to leak (which means incompetency).
Realistically though, all that scandal is just a cover for real reason why Petraeus was fired - probably something like policy disagreement with superiors.
Actually leaving the military, if you're an officer, requires resigning your commission. For enlisted, one generally signs up for a limited term of enlistment, and is out of the military at the end of that enlistment unless they choose to reenlist. Once an enlisted servicemember reaches 20 years of service, they become eligible to retire at their current rank as well.
So it would be a double standard for management, etc., and he would have been known to have broken the code of conduct. Not broken it with the affair, but broken it by not disclosing a compromising situation.
This is common in many democracies across the world.
The fact that someone in your government is forced to step down over something as basic as having an affair (our president has had a number of them over the last 4 years) shows that USA is still pretty high up as far as government morals go. Bravo!
I'm not an American and I don't live in the States, but from what I can tell a bigger f*ck-up was that Mrs. Broadwell gained access to Petraeus's personal email account. God only knows (or in this case the FBI) what was in there, but I suspect it was not only about baseball newsletters and photos with Petraeus's nephews and kids. This coming from the man that heads the CIA is a major no-no, IMHO.
It is one hundred times more expensive than industrial hosting but, if you know what you want there is only one way to get it.
At the end of the day Men With Guns(TM) may still come to your colo facility and just take the equipment, but even in that edge scenario, you would know something was up in a way you wouldn't with gmail.
In non edge cases, you are the provider and the owner of the equipment, and it is you who will be given the court order - you'll see what is going on and have the opportunity to respond as YOU see fit, not as google sees fit. Furthermore, depending on your practices and countermeasures, you may have actions available to you with your own assets that, of course, you wouldn't have with gmail.
In fact, the advantages of running your own mail server are so great, that over the past few years I've decided it's probably time to start self-providing my own dialtone and voicemail the same way I self-provide my own email. For all of the same reasons.
Some people are not able to keep up with best current practice to ensure that email from their server is deliverable.
Running your own email server is for many people a sub-optimal solution. Sure, for a small number of people it's a great idea.
Not "encryption" since that's not the problem we are trying to solve - you can do that with gmail right now. I'm talking about the "I woke up this morning and my email was delivered to the local DA and I had no idea and played no part in it" problem ...
- It is located in France, which makes it difficult for the US government. Easy for the French government though.
- It is a mom & pop ISP, who will tell me if someone forces them to yield access to he hardware.
- I will notice if the server goes offline.
That said, a competent, motivated and well endowed intruder will probably find a way through one of the other services on the same host - if intrusion occurs, I guess it will be through a Wordpress plugin. But if I wanted elevated security, a host with just sshd, courrier, postfix and the afferent mail processing is a pretty tough nut to crack.
But this case was pretty horrible to begin with. It seems FBI was only doing this as a "favor" to someone, and it wasn't about finding evidence about Petraeus having an affair, that enemies could've exploited, because they weren't aware about this, and they only found it by mistake.
All I'm saying is that the Government having this kind of power doesn't represent the "land of the free" very well, that US is supposed to be, and it has a lot more in common with a dictatorship/totalitarian state than with a true democratic republic.
It seems to me that technology is making it irresistible for Governments all over the world, whether democratic or not, to want to spy on their citizens and know everything about them. The lure of absolute and all-knowing power is very tempting, the easier it gets with new technology.
If this doesn't become a real political issue, and is not stopped, I could easily envision how 30-40 years from now, when technology will make it possible for people to interact with technology through mind control, it will also be very easy technologically wise to see what people are thinking, and the Governments will no doubt want to easily access that, too.
There's already another scary trend starting to show-up - that of pre-crime recognition, although it's still in its very early stages. But imagine when we'll start to use quantum computers. Those computers could easily create all the needed statistics and possibilities to show how likely someone is to commit a crime in the near future, and I could see the government and law enforcement agencies wanting to use that. I think we've all read the reports of NYPD police raiding the OWS leaders a night before the protests were supposed to happen. This is not mere unlikely theory. It's already happening, just on a much smaller scale.
It would simply be irresistible to them at the time, just like they love being able to obtain all the data about you without a warrant right now, and they'd love if it they could do even more without a warrant, and are lobbying for these types of laws in Congress. The only way to stop these sort of trends is for people to take a stand, and vote for people who are against them.
An interesting thought springs to mind. Being free, and the government knowing what you are up to, are not inherently at odds. This is a good thing, as hiding things is only going to get more difficult as technology progresses. Rather than fighting to keep one's deeds (or misdeeds) secret, perhaps we should be fighting to make it such that it doesn't matter if the government knows?
To me, it IS "inherently at odds".
edit: to expand on this - information easily leaks from government employees who have been authorized to access it. Especially when it is so easy to get, and is so broad, then a private investigator is likely to find a government employee who would copy the files about person-of-interest-X in return for $1000, for almost every X.
For just one additional lookup a week, that employee can make an additional $50,000 tax free with negligible chance of getting caught (with today's nonexistent oversight) except if the resulting leak happens to become a news item.
So, realistically also replace "government" with "any willing person with $2000 to spare" (the private investigator will also take a cut :) )
Yes, there's the privacy issue, but I'd bet that could be handled.
Remember, the government doesn't know anything, people working for the government know things, and the more people that know a secret, the harder it is to keep.
Unless the system is significantly improved, yes, it probably entails some increased risk to your personal secrets. But to immediately shut down any suggestions of increasing government application of tech on those grounds seems short-sighted and selfish. There are positive outcomes, too! I'm not saying "forget about privacy, it doesn't matter", but rather "shouldn't we try to work a compromise?". Find a balance, where any increase in risk to personal privacy is counterbalanced by a respectable improvement in the capabilities of government to operate effectively. If we are stoic and immovable on the issue, we just impair our own government when we limit them to 20th century technology.
Could you actually give examples where more government knowledge is helpful? Strike "crime fighting" out, because e.g. London's MET police, and the FBI already have almost-all-knowing access to data, and all reports say it doesn't help at all.
In the 2nd half of the 20th century, Eastern Europe and the Soviet Union, are full of examples of why government knowledge of everything is bad.
Assume government knows everything you do, all is fine, and then one day, Hollywood gets a law that says you can't watch a DVD with friends (you each have to own an independent copy, so that they get paid). Bam, instant enforcement the next day, because the government knows everything. An almost-as-ridiculous law was almost passed (the recent ACTA treaty), and it's not a coincidence that demonstrations in Europe (especially former eastern block, who have actual experience with that) were far more numerous and vocal than in the US.