Petraeus’s emails weren’t private, and neither are yours. That should be the biggest takeaway from the Petraeus affair scandal, uncovered through a trail that circled back to a Gmail account that Petraeus and his mistress, Paula Broadwell, shared. People are saying Petraeus wasn’t a good CIA director because he couldn’t keep his emails secret, but the reality is that almost no one can under current laws.
We’ll start out with our 5 tech tips for more private email, then explain underneath how the whole salacious story unfolded and how the law made it possible.
5 Tips for more private email
Free email services may be easy, but they aren’t private. If you want more private email, it’ll take a little effort.
1. Hide your IP address by using a VPN whenever you log into your email account
VPN stands for “virtual private network.” It creates a secure tunnel between your computer and the site you’re visiting, allowing you to use public wifi networks at places like cafes and airports without worrying about others accessing your connection.
Make sure that the VPN you select anonymizes your IP address (that’s what identified Petraeus!) and doesn’t just secure your wifi connection. It’s also important that the VPN company uses strong privacy protections, like not storing unnecessary user data that could be tied back to you. Some good, easy-to-use VPNs to try are Hot Spot Shield and Private Wifi.
2. Use masked email software
A masked email is a fully functioning email address that forwards to your real email inbox. Masked email software lets you create an unlimited number of these emails. For example, you could generate a masked email (like “firstname.lastname@example.org”) when you’re signing up for an account on a shopping site, which will forward your confirmation and shipping messages to your real account (like “email@example.com”) so you still them. Then if you later start getting spam, you can simply delete the masked email. Because most email providers require a backup email address in case you lose access, you can use a masked email that won’t give away your identity.
3. Consider paying for a truly private email service
Stay away from email services that make their money by collecting user data: it’s a business model that’s bad for privacy. You may have to pay a few dollars a month to a private email service that encrypts and securely stores your data. Some examples are Unspyable, Countermail, Silent Circle, Shazzle, or Lavabit.
4. Don’t put any sensitive data in subject lines
This might seem obvious, but if your email is hacked or accessed, emails with eye-catching subject lines will be the first ones opened. Save the details for the body of the email, and even then, avoid sending sensitive info like bank account numbers or credit card numbers through email.
5. Don’t associate any of your personal info with your email account
When you sign up for any email account, don’t provide your real name, phone number, or other identifying information. Don’t link it up to your social networks, either. All these things tie the account back to you.
The timeline behind the Petraeus affair
An event planner in Tampa named Jill Kelley got a few anonymous, allegedly threatening emails from someone who’d later turn out to be Paula Broadwell, accusing her of sleeping with Petraeus. Kelley knew both Petraeus and General Allen personally. Kelley took the emails to an agent she knew at the FBI, who’s still anonymous at this point. Investigators at the FBI’s Tampa office opened a cyberstalking inquiry that’s still pending and examined Kelley’s computer. They found thousands of “inappropriate” emails with General Allen, which they passed on to the Defense Department.
They also gained access, probably using a search warrant, to Paula Broadwell’s Gmail account, where they found that the account sending the emails also had access to a Gmail account that Petraeus used. The FBI matched up the locations from where emails had been sent with Broadwell’s known locations, including hotel rooms where she’d stayed, to get a warrant to actively monitor her email accounts. They found that Broadwell and Petraeus had a shared Gmail account and were communicating using email drafts: one person would log in; write a draft; and log out; the other person would log in and respond.
IP is the key
Although Petraeus was using a pseudonym, which made him harder to identify, the FBI eventually linked the shared email back to both of them through their IP addresses. An IP address is a unique number associated with the device you use to connect to the Internet. It also broadcasts the geographic area where you’re logging in, usually the city, state, and country. Your Internet service provider and almost every website you visit keeps logs of IP addresses for years, if not forever. Despite these companies’ claims that IP addresses aren’t personally identifiable info, the Petraeus incident makes clear that IP addresses can easily lead to identification of individuals.
How does the FBI have access to so many months of Petraeus’s email?
Under the Electronic Communications Privacy Act (specifically the Stored Communications Act part), law enforcement can access any stored emails older than 180 days without a warrant. All they have to do is ask in the form of a subpoena, which doesn’t require a neutral judge’s approval, or a Sec. 2703(d) order, which is just an administrative request with an easy-to-meet burden of proof: just show that there are grounds to believe the emails are relevant to the investigation. They can also get “non-content” information, the metadata associated with an email but not the body content, through various orders or a National Security Letter. The law offers far less protections for emails than it does for hard copy letters you send in the mail, so although the FBI would always need a warrant to open a letter, they rarely need one for an email.
Most people simply archive their emails so they can find them later, so they’re never deleted. And even if you do click “delete,” Google stores your emails in full for 30 days and in redacted forms for far longer than that, archiving backups of backups so nothing’s truly gone. They also store your login records for more than a year, if not longer.
When law enforcement agents ask service providers, like Gmail and Comcast, for their users’ emails, the companies have to turn them over. Google releases a transparency report every 6 months showing how many government requests it receives for its users’ data: it got 16,281 requests in the first half of 2012 and complied with 90% of them. The number of requests has increased by 25% since 2011. The user information they provide is used in court cases (a famous example is the Casey Anthony record of her Googling “chloroform“) and investigations, like Petraeus’s. Email records make their way into more mundane cases too, like using a person’s search history to argue they’re a bad parent in a child custody hearing, or using text records to show who’s at fault for a divorce.
If the FBI can access your email, who else can?
Almost any state or federal law enforcement agency could get it. Your email provider, like Google or Microsoft, obviously has it. So does your email provider’s partners and affiliates in many cases, especially for advertising. Some email services scan & analyze the content of your email–both what you send and receive–in order to target you with ads, which can appear both in your email window itself and on other sites you visit online. Your ISP has it. Sometimes your employer does, too, if they’re monitoring at-work communications. Anyone you’ve given your login info can access your email, and if you have a weak or reused password, so might hackers. Bottom line: it’s hardly private.
More and more, law enforcement uses social networks and other private companies to gather evidence
Despite the FBI having an entire wing of the Bureau dedicated to cyber crime, it’s very common for law enforcement to use information from private companies in its surveillance and investigations. For example, Facebook actively scans the photos you upload and what you write in private messages and wall posts to look for “risk words” and pass them on to law enforcement. The “free but pay with your data” model that email providers like Gmail and Yahoo Mail use is fundamentally at odds with user privacy: these companies collect as much data as they can to monetize it later, but if they collect it, they have to give it to law enforcement. They don’t just store what’s in your emails and who’s sending and receiving them, but information like IP address, which email providers don’t have to log (but most do).
Even though the FBI can easily access emails through subpoenas and other administrative requests we mentioned above, they’re pushing to make it even easier by asking service providers like Google and Facebook to build in back doors where they could come in and monitor user activity. These currently exist for phone companies, but not all web companies. Additionally, the FBI, the Department of Homeland Security, and various other government agencies collaborate with private companies like ISPs for fusion centers, surveillance offices that monitor everything from private security cameras to online comments to try to prevent crime before it happens. There are 70 of them across the country, and a senate report found they haven’t detected a single threat.
So there you have it: how to use email more privately, how the Petraeus scandal unfolded, and the messy state of email privacy law. Privacy advocates and companies like Google have been pushing for updates to the Electronic Communications Privacy Act to bring it in line with modern technology, and the Petraeus investigation may be the catalyst that pushes reform.