hushmail and cyber-rights, no longer safe???

[hulk_hogan]

anyone esle hear that????


was told by someone dea is actually wacthing hushmail, anyone esle here this????

[staggerlee]

This was posted by BE1 on another forum!

Appeals Court Says Feds Need Warrants to Search E-Mail
By Luke O'Brien EmailJune 18, 2007 | 1:22:17 PMCategories: Privacy, Surveillance, The Courts

Images A federal appeals court on Monday issued a landmark decision (.pdf) that holds that e-mail has similar constitutional privacy protections as telephone communications, meaning that federal investigators who search and seize emails without obtaining probable cause warrants will now have to do so.

"This decision is of inestimable importance in a world where most of us have webmail accounts," said Kevin Bankston, a staff attorney for the Electronic Frontier Foundation.

The ruling by the Sixth U.S. Circuit Court of Appeals in Ohio upheld a lower court ruling that placed a temporary injunction on e-mail searches in a fraud investigation against Steven Warshak, who runs a supplements company best known for a male enhancement product called Enzyte. Warshak hawks Enzyte using "Smiling Bob" ads that have gained some notoriety.

The case boiled down to a Fourth Amendment argument, in which Warshak contended that the government overstepped its constitutional reach when it demanded e-mail records from his internet service providers. Under the 1986 federal Stored Communications Act (SCA), the government has regularly obtained e-mail from third parties without getting warrants and without letting targets of an investigation know (ergo, no opportunity to contest).



But a district court held that the SCA violates the Fourth Amendment by allowing the feds to secretly seize e-mail without probable cause warrants. Under the SCA, the government is required to get warrants for any e-mails that have been stored on third-party servers for less than 180 days. (the SCA came into effect long before the days of eternal Gmail storage.) After that, it can use an administrative subpoena or a different court order, provided it notified the target of the investigation. (the feds missed their legally mandated deadline for notifying Warshak by nearly a year.) To make matters more complicated, the government argued that the definition of "electronic storage" in the statute meant the feds only needed warrants when e-mail had yet to be opened or downloaded.

"The DOJ reading of the statue in practical terms is that any e-mail you have opened it can obtain without a warrant," Bankston said. But the district court ruled that the Fourth Amendment holds otherwise. And the appellate court affirmed the lower court's decision, agreeing that e-mail users have a reasonable expectation of privacy, regardless of how old their correspondence is and where it is stored. From the decision:

"In considering the factors for a preliminary injunction, the district court reasoned that e-mails held by an ISP were roughly analogous to sealed letters, in which the sender maintains an expectation of privacy. This privacy interest requires that law enforcement officials warrant, based on a showing of probable cause, as a prerequisite to a search of the e-mails."

To reach its decision, the court relied on two amici curiae that presented compelling arguments for shoring up current privacy law with respect to e-mail. Both the Electronic Frontier Foundation (together with the ACLU and the Center for Democracy and Technology) and a coalition of internet law professors argued that e-mail is a vital form of communication in today's world and its privacy must be safeguarded under the constitution lest society's ability to engage in unfettered debate and discussion be eroded.

From the EFF amicus brief (.pdf):

"This case must be considered in the context of one overriding fact: millions of Americans use email every day for practically every type of personal business. Private messages and conversations that once would have been communicated via postal mail or telephone now occur through email, the most popular mode of Internet communication. Love letters, family photos, requests for (and offerings of) personal advice, personal financial documents, trade secrets, privileged legal and medical information—all are exchanged over email, and often stored with email providers after they are sent or received. These myriad private uses of email demonstrate society’s expectation that the personal emails sent and received over the Internet and stored with email providers are as private as a sealed letter, a telephone call, or even papers that are kept in the home."

From the internet professors' brief:

"E-mail has become so indispensable that it must be reasonable for us to expect that it is private. One who looks at our e-mails obtains a detailed view into our innermost thoughts; no previous mode of surveillance exposes more. When we compose private and professional e-mails, embed links to Internet sites in some, and attach documents, pictures, sound files and videos to others, we rely on the privacy of the medium. Society does not make us rely at our peril but rather accepts as reasonable our expectations of privacy in e-mail."

Because of the secrecy in which SCA investigations have been conducted, it's impossible to say how widespread this kind of government snooping into e-mail has been. "We don't know how often [it's happened]," said Susan Freiwald, a law professor at the University of San Francisco who submitted one of the briefs. "The only way to find this out is if the ISPs told us or the government told us. The information is not reported to Congress."

Bankston suggested that the practice was widespread: "It is absolutely routine. It is and has been the Department of Justice and presumably local law enforcement's standard practice for obtaining e-mails over the last 20 years."

There have been no previous constitutional challenges of the SCA, likely because ISPs don't want to cause trouble and targets of investigations don't know that their e-mail is being read. "This demonstrates the importance of judicial review," Freiwald said. "You don't ask an agency to set its own governing rules."

[cpt316]

i thought hush would be ok because the servers are in British Columbia, Canada and therefore out of the jurisdiction of American LE... they specifically state that any LE would need a warrant from Canadian government before they could actually let LE get information.... I could be wrong though. I don't know about cyber-rights.

[ctrl]

most of us here use that type of service so this could be bad.

[manimal299]

Is anything safe anymore, can anyone recommend an alternate service provider?

[tekki9]

Cyber - runs on the Hush platform - - if your emails are with in the two services, that should provide good security - --

Ecrpyt then send - - -

But keep in mind - if they want it they will get it! - -

Our taxes pay for rooms of techs to sit and debug the shit out systems - -

[swede74]

I'm convinced that there really is no safe way to communicate through emails. If the government puts enough pressure on other countries and email companies, they will get the info they want. I fail to see how we can direct a machine to mars, land it, drive the damn thing around the surface for over a year, get samples, analyze them yet when it comes to deciphering an email, they stand around it like a group of cavemen

Those that think it's safe, I guess keep using it...as for me, I'll keep trying to tie a note to my dog's leg and give him directions as to where to deliver it

[purkinje]

tough to know what's safe now...right now i have to not only worry if the guy i'm emailing is LE, but i also have to worry about someone intercepting the email with my personal info...scary times

[wucrew420]

if you read the dea write up it says canada was one of the co-operating countries in this operation but who knows, i think we have all be compromised and should switch providers, someone said they had they encryption key on somehting on OLM, but no proof to that, just be smart and stay safe everyone

[gottogetbig]

on another board someone was on about using PGP,i dont know what it is i never really bothered to look into it, but they were sayig it was safe. Anyone have any idea what PGP is?

[MaxRep]

PGP is an encryption method. It stands for "pretty good privacy". It is debatable as to whether it can be broken. Contrary to popular myth, there is no "back door" to PGP. It is conceivable it could be broken but the time and effort required would be enormous. Not likely for an individual or small time distributor.

For those that want to encrypt their entire hard drive, PGP has an excellent product out that will do that. It is reasonably priced for this type of technology and without a passphrase nobody will be able to access the info on your harddrive. You can get it at: www.pgp.com

Keep in mind, your passphrase is what will determine the security of your hard drive. I suggest a very long, nonsensical passphrase along the lines of the following:

liueRTcnm2290765lrAWDCGUjinepp8276318MN74zkBIENUme icw9G

Since nobody can remember such a passphrase, you'll have to write it down and keep it well hidden. One way is to randomly highlight letters and numbers out of a book. They you'll use all highlights from page 46-77. Only you will know what pages to use and with every page in a 200 page book with highlights, it would be basically impossible for someone to break your code. If you do this, highlight the same number of characters on every page so you don't give anything away that way.

Is this a hassle to do and input everytime you sign on to your computer, yes. Is it virtually unbreakable? Yes. Your choice. Be aware that a random group of words isn't a good choice for a passphrase. There are brute force dictionary based software programs that can break them.

Good luck,
MaxRep

[AnAboliKPiKe]

Good post MaxRep. I have done some reading on PGP and it is indeed a good idea for those that are as paranoid as I.

[Strateg0s]

Originally Posted by MaxRep

Is this a hassle to do and input everytime you sign on to your computer, yes. Is it virtually unbreakable? Yes. Your choice. Be aware that a random group of words isn't a good choice for a passphrase. There are brute force dictionary based software programs that can break them.

You need more than just a password. A hardware key + a password is a way to go. If you just have a password, it can be brute force cracked in a few days, no matter if it is 64 characters of gibberish. It's like putting the combination in a strongbox in front of a vault door. As soon as the strongbox is compromised, so is the vault. Adding in a hardware key would be sort of like adding a retina scanner. sorta.

[MaxRep]

Originally Posted by Strateg0s

You need more than just a password. A hardware key + a password is a way to go. If you just have a password, it can be brute force cracked in a few days, no matter if it is 64 characters of gibberish. It's like putting the combination in a strongbox in front of a vault door. As soon as the strongbox is compromised, so is the vault. Adding in a hardware key would be sort of like adding a retina scanner. sorta.

Sorry Strat but that's not true according to the computer geeks I've talked with. Breaking a password can't be done like in the movies where they can break one letter at a time. Here's why:

A 30 character (the lowest the computer geeks recommend) nonsensical password would have over a Nonillion possible combinations. See below for what a Nonillion is.

The time required by a supercomputer like a Cray to do this would stretch into the months. It's just not going to happen except in the most extreme cases.

Here's how to determine the possible number of combinations a computer would have to search to come up with the correct password:

A 5 number password...
5x4x3x2 = 120 possible combinations... extremely easy

A 8 number password...
8x7x6x5x4x3x2 = 40,320 possible combinations, a little difficult

A 20 number password...
20x19x18x...x2 = 2,432,902,008,176,640,000 possible combinations... almost impossible.
For those of you who don't know what this number is, it is 2.4 Quintillion, and one Quintillion is a thousand, thousand, Trillion.

Strat, by the time we get to the recommended 30 character passwords, we're talking about the number of possible passwords being a Nonillion. Which most people have never heard of because it's basically an incomprehensible number and essentially a password of this length is unbreakable. Unless someone wants to put a Cray supercomputer to the task for several months, which unless you're bin laden, probably won't happen.

Best regards,
MaxRep

[007martin]

Originally Posted by Strateg0s

You need more than just a password. A hardware key + a password is a way to go. If you just have a password, it can be brute force cracked in a few days, no matter if it is 64 characters of gibberish. It's like putting the combination in a strongbox in front of a vault door. As soon as the strongbox is compromised, so is the vault. Adding in a hardware key would be sort of like adding a retina scanner. sorta.

hey my friend !would you translate this !!! iam a complete dum ass in computer what i should do again