GPG, Enigmail, Thunderbird and Gmail

Although not new, CNET has a great overview of getting set up with GPG, Enigmail, Thunderbird and Gmail to start encrypting your Gmail messages.

Of course this will work with other web-based email, like Hotmail, Yahoo! and AOL, you just have to use the right configuration options to link your web-based mail to Thunderbird (with POP or IMAP.)

Why are Secure Personal Communications so Important?

Why is it so important that individuals be free to communicate privately without the ability for government of law enforcement to intercept, even with a warrant or subpoena?

To begin with, it's important to understand how digital wire-tapping is evolving.  It is moving away from the traditional process where communication is targeted on an individual basis, to a more wholesale or data mining approach.  In this approach, huge volumes of digital communication are aggregated, and sophisticated data processing techniques are used to "discover" patterns or connections.  In turn, these discoveries can be used to either predict potential malicious activity or be used after the fact to corroborate other existing evidence.

In short, law enforcement (in particular at the federal level) are finding these types of aggregated approaches to be extremely effective, resulting in unprecedented investments by the FBI and Defense Department to collect and analyze data in this fashion.

The first lesson to be drawn from this trend is that going forward, the government will be very keen on blocking personal communication from being end-to-end encrypted and thus outside of this kind of general data collection.  In fact, they are already pressuring major ISP's to somehow block this kind of communication (see for example this recent initiative from the FBI.)  The question here is, do they have a legitimate position?  Is there a legitimate argument to be made that the government should be able to collect this kind of personal communication for the purposes of national security and law enforcement?

The second important consideration is the track record government and law enforcement have in restricting interception activities to those specifically associated with an ongoing investigation or legitimate threat.  That is, if we do hand over this kind of wholesale access to the government, do we have reason to trust that they will use this data for legitimate purposes only?  This is a complicated question.  For one initial perspective, see this overview regarding NSA activities along these lines from the EFF.

Finally, it is important to consider what might be called a "cooling effect".  That is, if you knew or had reason to believe that the government was intercepting or monitoring your personal communication would it have an effect on the manner in which you communicate?  Personal communication, or really, how we communicate with other people, is a foundation of who and what we are as human beings.  For many, it is a foundation of how we define quality of life.  The question here is:  if we had reason to believe that the government was pervasively monitoring our communication, would it have the potential to adversely effect that communication and thus effect our quality of life?

Obama and the Erosion of Civil Liberties

Conor Friedersdorf, writer for The Atlantic, has an excellent article on Obama's abysmal record on civil rights.  From the article:

The whole liberal conceit that Obama is a good, enlightened man, while his opponent is a malign, hard-hearted cretin, depends on constructing a reality where the lives of non-Americans -- along with the lives of some American Muslims and whistleblowers -- just aren't valued. Alternatively, the less savory parts of Obama's tenure can just be repeatedly disappeared from the narrative of his first term, as so many left-leaning journalists, uncomfortable confronting the depths of the man's transgressions, have done over and over again.

Privacy and the Presumption of Innocence

There are many arguments that can be made arguing for the right to privacy of digital communications.  One I find particularly compelling is the tying of privacy rights to the presumption of innocence.

As it relates to digital privacy, we might say that the presumption of innocence implies that the government cannot collect or monitor digital communication without compelling reason to believe that the target is guilty of a crime.  In practice this would mean that law enforcement has taken charges to the court and that warrants have been made with respect to suspicion of guilt.

One clear example in the U.S. of the violation of these basic rights is the so-called FISA Amendments Act of 2008 which retroactively made legal the warrentless wiretapping of U.S. citizens done during the Bush administration, and has seen continued support to date from the U.S. Congress and the Obama administration.

Privacy and the "Nothing to Hide" Argument

Daniel J. Solove, author of The Digital Person, some time ago published an excellent article on privacy and the fallacy of the "nothing to hide" argument.  Here is an excerpt:

Commentators often attempt to refute the nothing-to-hide argument by pointing to things people want to hide. But the problem with the nothing-to-hide argument is the underlying assumption that privacy is about hiding bad things. By accepting this assumption, we concede far too much ground and invite an unproductive discussion about information that people would very likely want to hide. As the computer-security specialist Schneier aptly notes, the nothing-to-hide argument stems from a faulty "premise that privacy is about hiding a wrong." Surveillance, for example, can inhibit such lawful activities as free speech, free association, and other First Amendment rights essential for democracy.

The deeper problem with the nothing-to-hide argument is that it myopically views privacy as a form of secrecy. In contrast, understanding privacy as a plurality of related issues demonstrates that the disclosure of bad things is just one among many difficulties caused by government security measures. To return to my discussion of literary metaphors, the problems are not just Orwellian but Kafkaesque. Government information-gathering programs are problematic even if no information that people want to hide is uncovered. In The Trial, the problem is not inhibited behavior but rather a suffocating powerlessness and vulnerability created by the court system's use of personal data and its denial to the protagonist of any knowledge of or participation in the process. The harms are bureaucratic ones—indifference, error, abuse, frustration, and lack of transparency and accountability.

Encrypting Email

There are two (interoperable) standards for encrypting email, OpenPGP and S/MIME.  In what follows, I will walk through the process for OpenPGP.

Step 1.  Install OpenPGP software tools.

Although many implementations exist, one good option is using the Gnu Privacy Guard (or GnuPG) implementation.  This software will allow you to create credentials, manage their distribution, and encrypt documents.  Binaries are provided for Windows and Mac OS X.  Binaries for various Linux flavors are typically provided through the associated distribution.

Step 2.  Create credentials.

Users participating in encrypted email identify themselves via their public key.  The public key is encoded into a "certificate".  The tools installed in step 1 can be used to create these credentials.  For example, if you are using GnuPG on Windows (that is, Gpg4win), you can:

  a. launch the Kleopatra tool
  b. go to File -> New Certificate
  c. select "Create an personal OpenPGP key pair"
  d. enter your full name and email address associated with this certificate
  e. enter a strong passphrase

A few notes on this process.  You should create one and only one public key for each email address you will be using for secure communication.  The process will create both a private and a public key.  The private key should be kept in a secure location.  It does need to reside on the machine that will be used to encrypt or read secure email, but otherwise should not be copied unnecessarily to other machines.  It should however be backed up in a secure location, for example a USB flash drive or equivalent.

Step 3.  Publish public key to public key server.

Your public key should be posted to a public PGP key server.  See for example the open director project for a list of key servers.  For example, I have uploaded my key to the MIT PGP Key Server.  You can find my various keys by searching for "hotes".

Step 4.  Install a plugin for your email client.

OK, this can be trickier.  Here are a few options:

  - Outlook Privacy Plugin (Outlook 2010, free, on Google Code)
  - GpgOL GnuPG Outlook Extension (Outlook 2003+, free)
  - Symantec PGP Desktop Home (Outlook 2003+, $99 for 1 yr. license)
  - The EnigMail Project (Thunderbird, free)

Also see this list of plugins.

If you are using web-based email (like Hotmail or GMail), OpenPGP extensions have been made for Firefox and Chrome, but I don't know how well they have been supported.  For example, the once popular FireGPG Firefox extension providing PGP support for GMail is now defunct.  Your best option here is to use POP/IMAP and a native email client.

Conspiracy Theory

I am not a conspiracy theorist.

I feel compelled to say this upfront, only because of the nature of this topic, and the (at least cursory) proximity it may have to areas of discussion that can certainly delve into conspiracy.

By way of background (we all bring some context into a discussion), I am a technology professional, having spent nearly 20 years in the software and mobile technology field.  I have worked both in industry and in the government (both at the Department of Energy and the Department of Defense.)  I have a Ph.D. in Particle Physics from U.C. Berkeley and began my career as a research scientist.

Do I think there is a "conspiracy" happening in regards to digital privacy?  To be honest, I don't think this question really has much merit.  Maybe it is just that the word itself is too politically loaded.  Do I think there is some backroom somewhere in Washington where power players rub there hands together and laugh diabolically about the systematic stripping of personal rights?  No, probably not.  But what I do think is that market forces (and by "market" I include government interests) have created an environment in which effectively at least the outcome is the same.  These rights are in serious jeopardy and long lasting steps are being taken.