Confidential Email
Aug 13th, 2009 by Alex
There is no such thing as confidential email. Or privileged. Or anything of the sort, despite the sentences or paragraphs that appear below many professionals’ signature blocks.
Google Apps has been in the news — and by news I mean Slashdot — lately. Apparently there are people concerned that law offices and medical practitioners are migrating their email services to Google Apps and that their personal data is somehow more vulnerable as a result. The argument seems to be that such professionals should run their own email servers, so that your data isn’t floating around on Google’s servers.
This is a garbage argument. There are lots of reasons, but the big one is: most all email is unsecure.
True, many of us login to our email provider using a secured web site (e.g. the “https” in the URL bar and the little lock icon). So the email that you’re reading online is encrypted from the provider to your computer. And if you’re sending mail within your provider (e.g. from gmail.com to gmail.com) you’re probably okay. But most times when email is sent from one provider to another, it’s done in clear text without any protection at all.
Okay, technically speaking there are ways to protect email. Encryption methods are widely available to protect an email’s contents while in transit. Other methods are widely available to insure that the desired recipient is the only person able to read the email. However, despite the availability the number of people who utilize these methods is shockingly low. The reasons are varied, but many times the reason is “it’s too complicated.” Adding encryption does require additional work and time on behalf of the user.
Which brings me back to the point. The question isn’t whether your attorney or doctor should be using Google Apps for their email. The question remains why would they be using email at all for confidential matters?
Ignorance — though perhaps the reason — is not an excuse.
+1 - I couldn’t agree more. I’ve got a PGP key setup and easily usable with my e-mail configuration, but I don’t think anyone has ever bothered to use it to send me an encrypted message except the first time I set it up and asked someone to help me test it out.
Ignorance + Laziness + Indifference = Security Failures.
I’ve been watching the banter on Slashdot myself and have thought about posting just such an analysis on that site, but I can’t bring myself to try to inject signal in that noise.
You are 100% correct that the real issue here is not using an outsourced mail system (in fact I’d be surprised if most law/doctor offices weren’t already outsourcing - just not to Google) but rather using any electronic communicaiton system to transmit communications without using encryption.
There are two issues, data in transit and data at rest, and most people just don’t grasp either concept well enough to appreciate the real risks of unencrypted data communications as well as unencrypted data in storage.
Steven: I still have my PGP key. Gave up on signing each message long ago, since no one I know ever uses it. Then I outsourced myself.
Damien: I try to keep SNR from plummeting; part of the reason that people don’t grasp the concepts is that it all works without a lot of effort, so there’s no reason to learn more about the specifics.
You’re doing a good job, and you like good food! Both are good reasons for me to keep coming back to your blog.