4. Email Tapping, Digital Signatures, and Encryption: Protection for Your Electronic Communications

For most of us, e-mail has quickly become a part of our daily interaction with the world. And yet, in the course of our normal routine, we rarely give thought to the security of these transactions. When we call someone or send a postal letter, we are secure in our expectations of privacy. Yet, most people do not stop to consider whether their electronic communications are afforded the same level of protection. Do we have an expectation of privacy in our electronic communications? If so, is that expectation unfounded?

The law protects us to an extent, making it a federal offense to intercept or disclose the contents of electronic communications, either in the course of transmission or while in storage on a remote computer system. However, a number of uncertainties in the federal statute, widely known as the Electronic Communications Privacy Act, have not yet been hammered out by the courts. Who will be deemed to be a electronic service provider? Under what conditions may a service provider tap into your electronic communications? Under what terms will you be considered to have consented to the interception of your email?

Technological protections, such as encryption technology, are available, but they are also restrained by the law. As encryption technology grows stronger, the government grows more concerned about their inability to "tap" such communications and the ability of organized crime rings, drug traffickers and terrorist organizations to communicate undetected over the borderless realm of cyberspace. To this end, the U.S. government has placed a number of export controls on strong encryption technologies. The SAFE Act, in its latest form, which recently passed the House of Representatives, has several major provisions which enhance consumer privacy and reduce export controls.

The SAFE Act seems to address some of the major issues in email tapping as well as encryption, by setting a minimum to the standard required by law enforcement in order to invade privacy, and limiting their technical ability to do so. However, the harm it would do to law enforcement is unclear. It would be extremely difficult to accurately determine empirically how often encryption interferes with law enforcement since law enforcement may not be aware of many of those occurrences.

What do you think US policy on exporting encryption programs should be? What about law enforcement and private access "keys" and encrypted emails? What standard of cause or suspicion should be necessary to infringe on privacy interests? Should we be more worried about a potential terrorist's communication going undetected in cyberspace or about the security of our own online transactions? If people shouldn't have a reasonable expectation of privacy in their email, should they be afforded this expectation when they employ encryption technology to safeguard their messages?

As you go through the readings, think about these questions and what your model policies would be notwithstanding the current law.

First, however, please read this week's hypothetical.

• Electronic Communications Privacy Act
  You may choose to read all sections of the statute, or you may choose instead to read only those sections most relevant to the questions posed in the hypothectical.
  

  Abstract: 1986 federal statute describing the conditions under which oral, wire, and electronic communications can be intercepted or disclosed.

  Note: individual states often have supplemental statutes regarding the interception and use of electronic communications.

  Please make sure you skim the following sections:

  § 2511. Interception and disclosure of wire, oral, or electronic communications prohibited
  § 2515. Prohibition of use as evidence of intercepted wire or oral
  communications
  § 2516. Authorization for interception of wire, oral, or electronic communications
  § 2517. Authorization for disclosure and use of intercepted wire, oral, or electronic communications
  § 2520. Recovery of civil damages authorized
  § 2701. Unlawful access to stored communications
  § 2702. Disclosure of contents
  § 2703. Requirements for governmental access
  § 2707. Civil action
  

  (details)
• Good Sysops Should Build Good Fences, David R. Johnson

  Abstract: Nice analysis of the ECPA and what it might mean for system and network administrators.

  (details)
• Examination of User E-Mail Files, Lucien Capone III
  Please read section 2, "Examination of User E-Mail Files." The full text of the article is also available.

  Abstract: Analysis of statutory and common law claims which may be brought against a service administrator for unauthorized interception of electronic communications.

  (details)
• Steve Jackson Games, Inc. v. United States Secret Service
  This case is probably the most well-known attempt by the courts to interpret and apply the ECPA to the confiscation of electronic communications, including email. (details)
• How is cryptography applied?, RSA Labs
  This page provides short explanations of the basic uses of cyptography online. (details)
• PGP International: Customer Briefing on International Availability of PGP, PGP International
  Just to show you how some companies have easily bypassed US Export regulations. (details)
• Crypto Panelists Square Off, Alex Lash
  This article about an RSA conference highlights the opposing view on government access to encryption source codes for law enforcement purposes. (details)
• Center for Democracy and Technology Cryptography page., Center for Democracy and Technology
  Provides a brief description of the legislative and judicial decisions on the field of encryption. (details)
• RSA Frequently Asked Questions, RSA Labs
  For a more detailed explanation of how encrypion products work, this is the site to explore. (details)
  [top]

• : Lesson Four Hypothetical
  

  Start: April 12, 1999 - 12:00:00 AM (midnight Sunday),
  End: April 19, 1999 - 12:00:00 AM (midnight Sunday)

  (details)
  [top]