For your eyes only

When the director of the CIA could not keep his emails private, can an average person do it? Nicole Perlroth has a few ideas to keep your emails confidential.

In the past, a spymaster might have placed a flower pot with a red flag on his balcony or drawn a mark on Page 20 of his mistress’ newspaper. Instead, David H. Petraeus, the former director of the CIA, used Gmail. And he got caught.

Granted, most people don’t have the FBI sifting through their personal emails, but privacy experts say people grossly underestimate how transparent their digital communications have become.

“What people don’t realize is that hacking and spying went mainstream a decade ago,” said Dan Kaminsky, an Internet security researcher. “They think hacking is some difficult thing. Meanwhile, everyone is reading everyone else’s emails – girlfriends are reading boyfriends’, bosses are reading employees’ – because it’s just so easy to do.”

Face it: No matter what you are trying to hide in your email inbox or text message folder – be it an extramarital affair or company trade secrets – it is possible that someone will find out.

If it involves criminal activity or litigation, the odds increase because the government has search and subpoena powers that can be used to get any and all information, whether it is stored on your computer or, as is more likely these days, stored in the cloud.

Still determined? Thought so. You certainly are not alone, as there are legitimate reasons that people want to keep private all types of information and communications that are not suspicious. In that case, here are your best shots at hiding the skeletons in your digital closet.

Hide your location

To hide their affair from their spouses, Petraeus and his mistress Paula Broadwell  limited their digital communications to a shared Gmail account. They did not send emails, but saved messages to the draft folder instead, ostensibly to avoid a digital trail. It is unlikely either of their spouses would have seen it.

But neither took necessary steps to hide their computers’ IP addresses. According to published accounts of the affair, Broadwell exposed the subterfuge when she used the same computer to send harassing emails to a woman in Florida, Jill Kelley, who sent them to a friend at the FBI.

Authorities matched the digital trail from Kelley’s emails – some had been sent via hotel Wi-Fi networks – to hotel guest lists. In crosschecking lists of hotel guests, they arrived at Broadwell and her computer, which led them to more email accounts, including the one she shared with Petraeus.

The two could have masked their IP addresses using Tor, a popular privacy tool that allows anonymous Web browsing. They could have also used a virtual private network, which adds a layer of security to public Wi-Fi networks like the one in your hotel room.

By not doing so, Mathew Blaze, a security expert, said, “they made a fairly elementary mistake.” Email providers like Google and Yahoo keep login records, which reveal IP addresses, for 18 months, during which they can easily be subpoenaed.

At bare minimum, choose the “off the record” feature on Google Talk, Google’s instant messaging client, which ensures that nothing typed is saved or searchable in either person’s Gmail account.

Encrypt your messages

Email encryption services, like GPG, help protect digital secrets from eavesdroppers. Without an encryption key, any message stored in an inbox, or reached from the cloud, will look like gibberish. The intended recipient must get a key from the sender to read the message. The drawback is that managing those keys – which often involves writing them down – can be cumbersome.

And ultimately, even though a message’s contents are unreadable, the frequency of communication is not. That is bound to arouse suspicions.

Wickr, a mobile app, performs a similar service for smartphones, encrypting video, photos and text and erasing deleted files for good. Typically, metadata for deleted files remains on a phone’s hard drive, where forensics specialists and skilled hackers can piece it back together. Wickr erases those files by writing gibberish over the metadata.

Set your self-destruct timer

Services like 10 Minute Mail allow users to open an email address and send a message, and the address self-destructs 10 minutes later. Wickr also allows users to set a self-destruct timer for mobile communications so they can control how long a recipient can view a file before it disappears. But there is always the chance that your recipient captured screenshots.

Drop the draft folder idea

It may sound clever, but saving emails in a shared draft folder is no safer than transmitting them. Christopher Soghoian, a policy analyst at the American Civil Liberties Union, noted that this tactic has long been used by terrorists – Khaled Sheikh Mohammed, the mastermind of the 9/11 attacks, and Richard Reid, “the shoe bomber,” among them – and it doesn’t work. Emails saved to the draft folder are still stored in the cloud. Even if they are deleted, email service providers can be compelled to provide copies.

Don’t mess up

It is hard to pull off one of these steps, let alone all of them all the time. It takes just one mistake – forgetting to use Tor, leaving your encryption keys where someone can find them, connecting to an airport Wi-Fi just once – to ruin you.

“Robust tools for privacy and anonymity exist, but they are not integrated in a way that makes them easy to use,” Blaze warned. “We’ve all made the mistake of accidentally hitting ‘Reply All.’ Well, if you’re trying to hide your emails or account or IP address, there are a thousand other mistakes you can make.”

“If the FBI is after your emails, it will find a way to read them. In that case, any attempt to stand in their way may just lull you into a false sense of security,” said Kaminsky.