E-Mail Encryption Rare in Everyday Use
RENEE MONTAGNE, host:
Here's something that often gets overlooked in the debate over government eavesdropping. You can increase the chance that your emails stay private, you just have to use encryption; essentially, sending your messages in code.
NPR's David Kestenbaum reports on why hardly anybody does.
DAVID KESTENBAUM reporting:
If you buy something online and type in your credit card number, it's usually encoded to protect it as it winds its way across the internet. When you send email out, typically it's essentially naked.
Ari Schwartz works in a cluttered office at the Center for Democracy and Technology, a civil liberties group based in Washington, D.C.
Mr. ARI SCHWARTZ (Center for Democracy and Technology, Washington, D.C.): In some ways, it's the golden age of wiretapping. We're putting tons of information through the computer systems. It's easy to sort through, its easy to find. They can use so much more information than they ever have had in the past.
KESTENBAUM: From a law enforcement perspective that's good news, but in theory, criminals or a sophisticated snooper might be able to see your emails as well.
Schwartz's organization sees protecting privacy on the internet as a key civil liberties issue. If you're worried, you can encrypt your email. It's completely legal, and Schwartz says, relatively easy.
Mr. SCHWARTZ: So I've got my laptop, and I'm going to hushmail.com.
KESTENBAUM: Hushmail is a web-based email service like hotmail or G-mail or yahoomail. You can use it for free. But hushmail encrypts your email.
Schwartz types a short message to a colleague across the room.
(Soundbite of typing on keyboard)
Mr. SCHWARTZ: Okay, secret message...
KESTENBAUM: Before hushmail sends the e-mail it puts it through a mathematical meat grinder. Schwartz's message, when it goes out, reads wcfoa/gsk9. It's total gibberish. A second later the e-mail arrives at his colleague's computer.
Ms. ALISA COOPER(ph) (Employee, Center for Democracy and Technology, Washington, D.C.): I'm Alisa Cooper.
KESTENBAUM: She also has a hushmail account which translates it back into English.
Ms. COOPER: And I can see his secret message which is loose lips sink ships (laughs) Nice message.
KESTENBAUM: It turns out that even though the Center for Democracy and Technology encourages people to use encryption and has fought to get it put in commercial products, most of the people in the organization do not use it -- not Schwartz, not Cooper, not the guy down the hall...
(Soundbite of knocking)
Mr. JOHN MORRIS (Staff Counsel, Center for Democracy and Technology, Washington, D.C.): (Laughs) Yeah?
KESTENBAUM: Can we come in?
Mr. MORRIS: Sure.
KESTENBAUM: What's your name?
Mr. JOHN MORRIS: John Morris. I'm a staff counsel; an attorney here.
KESTENBAUM: And do you encrypt your e-mail?
Mr. MORRIS: I don't believe I've ever encrypted my e-mail. I have encrypted attachments before sending them.
KESTENBAUM: But for the most part? ...
Mr. MORRIS: No.
KESTENBAUM: You work for the Center for Democracy and Technology!
Mr. MORRIS: (Laughs) You know, if it's built into the system it would happen and right now it's a little bit more of a pain than it's probably worth for me.
KESTENBAUM: E-mailing from one hushmail account to another is pretty easy, but if you're sending to someone who's using a different e-mail program, it gets more complicated. You have to give them a numerical key that tells their computer how to encode e-mail for you. Handling those keys has been a major stumbling block for encryption. Brian Smith is chief technology officer with Hush Communications Corporation which makes hushmail.
Mr. BRIAN SMITH (Chief Technology Officer, Hush Communications Corporation): It still hasn't taken off as much as we hope that it will. There's no reason really that a lot more of the e-mail traffic out there shouldn't be encrypted.
KESTENBAUM: On any given day he says tens of thousands of people use hushmail, but that's not many in the world of e-mail. There are potential downsides to encryption. If the key to unlocking your encrypted e-mails gets lost, you're in trouble. Each person's key is different and it would take a computer something like the lifetime of the universe to try all the possibilities. Philip Zimmermann is famous in the on-line world for having written a piece of encryption software called Pretty Good Privacy.
Mr. PHILIP ZIMMERMANN (Software Creator and Engineer; Cryptographer; Computer Consultant): I occasionally get e-mails from people who forgot their pass-phrase and they come begging for help with tear-streaked faces and I tell them to call psychic friends (laughs) cause I can't help them. Encryption is a powerful technology.
KESTENBAUM: Even Zimmermann, who works as a computer consultant, says he only uses encryption occasionally. One of the most popular e-mail programs, Microsoft Outlook, does offer encryption. Will Kennedy manages the product but he doesn't encrypt his e-mails either.
Mr. WILLIAM KENNEDY (General Manager, Office Communication Services Team, Microsoft Corporation; Manager, Product Development Team, Microsoft Outlook): If I'm sending mail to my wife about what time to pick up my son at soccer practice, for example, it's not really something that needs to be encrypted; it's not a particularly, you know, important secret.
KESTENBAUM: Kennedy says most of the people who do use the encryption feature on Outlook, aren't individuals worried about someone spying on them. The biggest user, he says, is the government. David Kestenbaum, NPR News.