May 15, 2006 E-Mail as Protection M. J. McKeown, MD, FACOG, FACS

Documentation of communication with others has been a need since the written word. This has progressed from chisels and stone, to papyrus and ink, to moveable type on paper to the electronic communications of the current day.

Electronic communication and its documentation has progressed from simple analog recording of the oral sounds of airwave or wired communication to the rapid transfer of the current electronic mail.

E-Mail as it is called has been used in many forensic investigations and all have seen this in some of the more popular forensic television programs. It is likely that the majority of the users of this very useful method of communication do not know all the twists and turns the message takes once the send is done. A casual conversation with many who use this method of communication will reveal a general impression it is equivalent to a letter mailed in the Postal Service except it is in electronic form. It was actually quite clever of the early designers and users of this system to call it mail. If the casual user of this system understood the convoluted path these messages take and how easily they can be intercepted and copied they would be astounded. That little title, mail, just gives it that illusion of the same privacy as a letter in the Postal Service.

The documentation of communications has usually been done to maintain a record for future reference. This saved message can be a crucial piece of evidence to refer to in many types of disputes. It is however a two edged sword and one must always remember that any message sent may be saved and later referred to. Since that is the case the following simple legal advice pertains; Never Write Down Anything You Don't Want To Defend In Court!

A closer look at the types of messages sent by an individual or organization gives a simple initial classification.

1. Simple chatty messages that have no risk if viewed by others.
2. Messages that contain specific information that has a limited intended audience and should be protected from snooping It seems reasonable to lump all the spam, general information and advertising messages to category 1. The subject of pornography associated messages is complex and it should be remembered that a good forensic investigator can likely read anything that has happened in a system.

Those messages with specific sensitive information can take on even more significance if business or legal reference is made to them in any future time. This leads to the following advice: E-Mail Can Be A Protection And A Tool. To fully use these functions of E-Mail a system must be able to protect the message from being snooped and it must be able to prove receipt of the message of the message and have a file of these for future proof as needed..

Snooping Protection:
The basic concept of protection from snooping involves making the message unreadable by anyone who does not have the secret of being able to read it.

This short article is not a comprehensive discussion of the techniques of such protection. Simply put the message is hidden within a system that requires a key to read the real message. Message coding and decoding techniques have been around for centuries.

However the more complex techniques can be so difficult they will not be discussed. The simple concept is to encrypt or code the message such that it requires the reader to enter a key that presumably only the reader knows.

If one looks at the options on commonly used E-Mail programs, an option to code the message is seen. There are other more complex methods that need to reside on message servers and are within large systems used by business and governments. The simplest general system is called PGP (Pretty Good Privacy) and is available to anyone. The concept is for a public key known to all who communicate with an individual and a private key known only to the individuals sharing a particular system. The specified reader needs to use the private key to open and read the message. It is a simple system and likely adequate for all but the most secure information. The more comprehensive, secure systems will not be discussed but they can be so difficult that even the most skilled code breakers have trouble reading the message.

The general concept to protect against snooping is some form of coding the message so only the intended reader can see the actual contents of the message.

Proof of Receipt:
This concept is discussed as proof of receipt is chosen because the cold fact is that someone other than the intended recipient could have obtained the key and be able to read the message. In these days of increasing problems with identity theft the possibility that another person than the intended recipient can read the message has increased. The keeping safe a password is an ongoing problem.

When an email is received in most of the current systems it is possible for the sender to request a read receipt. This is a switch that can be set on when the message is sent. However to call it a read receipt only tells the sender the message was read and the read receipt return request that the reader saw was checked yes. This never tells the sender that only the intended recipient has opened and read the message. Most of theses read receipt systems also give the reader the option of answering no and thus the sender may not get a read receipt.

The more secure way of telling if the message was opened is to have the particular communication program send a confirmation of that to the sender in the background such that the reader does not even know it is occurring. The more ethical communications programs that do this will inform the readers that this will occur when they install the program. With such a system the sender at least knows the location of the intended recipient has opened the message.

The United States Postal Service has a product called Certified Mail with Return Receipt. This means when the letter is sent the sender fills out two forms and one of these is a postcard that comes back to the sender. The postcard is signed by whoever took receipt of the letter and signed the form the Postal Service employee gave them to sign. Once again this does not mean the intended recipient actually got or read the letter! This system only tells the sender the letter was received by someone at the intended address. However an important legal principle has been set. If the postcard is returned to the sender at least the person who signed the Postal Service form and the postcard is accepted as actually receiving the letter. The law now assumes that the sender has fulfilled any legal obligation required to inform the supposed recipient of some particular information. Most recipients of such letters know this and respond as having received the message. It is, of course, possible for someone other than the intended recipient to sign for the letter. There is an option to have the intended recipient only to sign for the letter but unless the Postal Service employee knows and can identify that person it would still be possible for someone else to sign.

Two systems that tell the sender the message got to the location of the intended recipient have been discussed. Each has problems of actually telling the sender that the intended recipient actually read the message. The legal system, however, will likely recognize the sender has done all possible to notify the specified recipient of some specific information and thus absolve them of any legal responsibility for delivering the message.

Record Retention:

These proof of receipt of a message will do no good unless this proof is kept safe.

Most E-Mail programs have the option of placing certain messages in certain folders. These keep copies of the messages in these folders. However since any system can fail the usual admonition to backup the system applies here also. The multiple choices for such backup will not be discussed here. There are many sources of backup systems and programs. A good rule of thumb is to backup frequently and to make enough copies of sensitive information that one can be kept at a secure location away from the location of the primary computer. If the system is a large one of an organization or government it is likely that large, secure backup mechanisms are in place. In such systems the type of read receipt that is sent in the background to the sending system could go directly to such an archiving backup system and that system notify the sender of the receipt.

The Three Principles:
The three principles of using E-Mail as a protection are simple:

1. Prevent snooping with some form of encryption.
2. Obtain proof of receipt of the message.
3. Keep secure backup copies for future reference.

E-Mail can be a simple, pleasant, convenient method of communicating with friend and business associates. It is most generally used in this fashion. It can be used for secure, sensitive, limited recipient messages and have proof of receipt of the message. The use of E-Mail for sensitive communications and proof of such communication has some simple principles and these have been discussed in general. If it is intended to use E-Mail for such it is wise to consult with specialists in designing and implementing such systems.

Remember … backup, backup, backup.

---

You are welcome to share this © article with friends, but do not forget to include the author name and web address. Permission needed to use articles on commercial and non commercial websites. Thank you. CancerLynx.com What do you think?