Self-Shredding E-Mail

yoink! writes: "I just read an article on CNN.com describing a self-shredding e-mail system. With all the persistent e-mail documents gathered by the Government in the MS Anti-Trust case, and the massive shredding of paper documents by parties in the Enron fiasco, it's no wonder people have been looking for an electronic solution to a material problem solved years ago with some cutting tools, a motor, and a garbage bag." One of the companies highlighted here was called Disappearing, Inc. when it was mentioned a few years ago, but now several others have joined the fray.

Comments

Where does it end?

[StruyS]

It might end at computer shredding software it doesn't like. ;)

Re:Where does it end?

[ackthpt]

It might end at computer shredding software it doesn't like. ;)

Oh come on now! Don't beat around the bush, we know which software company you're refering to. If you're going to say it, say it. Oh, and by the way, it seems as many have noted the ballyhooed security program is mostly PR anyway.

I'd like self terminating spam, but we know we can trust spammers. Maybe the direct mailers assn. would adopt something like that, just to attempt to hold something even glancingly respectable.

Meanwhile, in the 50-off-your-next-freedom-of-speech-suit dept. this site is threatened with the C&D letter, give 'em your support.

Common sense?

[Em Emalb]

How bout not sending anything that could get you in trouble? Common sense should prevail here. But in the wake on Enron, I am sure they will do well.

One thing I did not see in the article, what happens if the person on the other end saves the email as an attachment, or saves it? I doubt it would be able to "shred" that. This is a very niche market item imo. Once again, DON'T SEND IT IF IT COULD GET YOU IN TROUBLE.

Re:Common sense?

[sql*kitten]

How bout not sending anything that could get you in trouble? Common sense should prevail here. But in the wake on Enron, I am sure they will do well.

There's a scene in Cryptonomicon in which Avi (I think) explains that important discussions have to take place between only two people at a time, so there is plausible deniability and nothing to subpoena.

This is why, even when email, videoconferencing and even faxes are widespread, nothing will ever replace face to face meetings for serious business.

Re:Common sense?

[blibbleblobble]

"Two people can keep a secret... but only if one of them is dead"

Re:Common sense?

[Anonymous Coward]

Obviously this is a comment from someone who's never worked in the real world. The problem is that for every case like Enron where an organization's activities are obviously illegal (or at least "wrong") you can find dozens of other cases where the people involved and their advisors are completely sure that their actions are fine, only to have the rules of the game changed later.

Re:Common sense?

[saridder]

Not according to modern forensics.

Re:Common sense?

[Anonymous Coward]

You're advice is good for as far as it goes, but that' not too far. For personal correspondence it works OK, but certainly not in business.

First, you might not think it could get you in trouble, but in a court case that's not for you to determine. Lawyers spend a lot of time determining this reviewing as many possibly relevant documents as they can.

Second, even with the best of common sense, you can't always judge will someday be construed as important to another party.

Re:Common sense?

[lawyamike]

In most cases, one is not able to contemplate whether the content of an e-mail will cause trouble for the sender.

Sure, there are easy cases: Bill Gates should not have sent e-mails about destroying Netscape, and all corporate officials should receive training in which buzzwords will always set off antitrust alarm bells.

That said, what about the cubicle monkey who sends pricing information that is unwittingly the focus of a Patman Act claim? Or the secretary who sends along an agenda and participants at a meeting between competitors? The point is, almost anything can be identified as worrisome ex poste. An auto-shredding system -- properly implemented -- is a good fail-safe.

Re:Common sense?

[Anonymous Coward]

...but what about server backups? Do you backup e-mail mail boxes separately from the rest of the systems, so that those backups can be destroyed after N days?

Re:Common sense?

[Rogerborg]

• that important discussions have to take place between only two people at a time, so there is plausible deniability and nothing to subpoena

Here's an anecdote to back that up. I used to work for a company that did CGI, mostly for games. They were informed by a man-who-knew-a-man that Paramount needed some CGI for a some Star Trek game. Tiny problem:

• Paramount are savagely protective of their IP.
• They are pathologically opposed to licensing any reproduction of their IP, in even the most limited form. They especially do not want to give even temporary licenses to little "wannabe" subcontractors.
• To protect their trademarks, they have to be seen to be prosecuting any violations.

So, farcically, the whole thing was carried out by cryptic phone calls (from home numbers, more often than not) or face to face. No email, nothing in writing, no hard requirements, no direct references to any contract, expressed or implied, on the phone, in case the other side was recording it. Paramount needed plausible deniability that they even knew my employer was producing this stuff, as they would have to be seen to prosecute them, even though they (as represented by a middle manager) were informally soliciting the work.

So my employer put about a man year of work into producing a test sequence based on a guess of what Paramount might want (made for some happy animators, mind you), then it was taken by hand to Paramount to be viewed by a mid level peon, without even so much as a record of the appointment or meeting.

My employer lost the "bid". It was made clear to them (face to face) that they should under no circumstances account for the work as being to do with Paramount or Star Trek. They gambled a man year of work, lost, and then had to scam their own shareholders by cooking the books to cover it up.

With my hand on my heart, this is the honest truth. It's probably not even the whole truth, I only heard the stuff that got filtered through our bid manager.

So, yes, even legitimate businesses have a desire for self destructing messages. I won't say a "need", because the whole process was a farce. But just because it's dumb doesn't mean they aren't begging for it like a drunk soaped up cheerleader in a post-football shower (sorry, I just needed to get the bad taste out of my head).

Re:Common sense?

[Anonymous Coward]

Yes.

ah

[SigmundK]

just send them to /dev/null

Lessons Learned

[pizen]

I think that instead of devising ways to destroy damaging emails that you send we should instead focus on not sending damaging emails. Bill Gates sent out memos that the DOJ is now using against him. That'll teach him. If you have something that important to say it's probably best said in person.

Re:Lessons Learned

[Anonymous Coward]

Too bad the lesson learned wasn't "Don't break the law."

Re:Lessons Learned

[rarose]

My very first manager at my first real corporate job drilled into my head that you assume every email you write will be published in the paper... if you aren't comfortable with that then it shouldn't be said in email. It's a rule that's served me well...

Re:Lessons Learned

[karlm]

I think that instead of devising ways to destroy damaging emails that you send we should instead focus on not sending damaging emails. Bill Gates sent out memos that the DOJ is now using against him. That'll teach him. If you have something that important to say it's probably best said in person.

I think we should concentrate on writing invulnerable clients and servers instead of wastng all this effort on designing anddeploying firewalls. Ideally each machine, each OS, each client, and each server would be bulletproof so you shouldn't need firewalls.

Unfortunately, the world isn't perfect. Flaws will creap into software and emails. Shredding emails reduce damage from bad email writers just like firewalls minimize damage from bad software designers/coders.

Also, it's not a matter of concentrating on this or that. Your company should educate their own people about safe email practices. These people devising email shredding schemes don't waste the energy of YOUR company. These cryptographers and coders wouldn't do much good if instead of working in their cubicles, they came over to your company and lectured everyone on good emal practices. It's called division of labor. Do what you're good at and pay others to do what you aren't good at. They're good at cryptography and coding, your managers and corporate educators are much better at getting things through your employees heads. These cryptographers and coders aren't wasting energy any more than you're wasting energy at your job instead of working on an AIDS vaccine/cure for cancer/eliminating hunger/whatever people feel the most pressing NEEDS of mankind are.

It won't work...

[jnievele]

People still will be able to print out messages, or make screenshots of their MUA - ESPECIALLY when they know that the mail is going to self-destruct. So these expensive systems still won't guarantee against a copy surviving (especially if it's something hot that could be used to blackmail somebody, such as the order to shred all records...).

In short: Why waste money on a system that prevents Email from getting read by Law-enforcement-officers? Why not simply do nothing illegal? ;-)

Re:It won't work...

[Amarok.Org]

Sure it'll work. I'm just look at Adobe - you can protect PDF documents from being copied, printed, used in other applications... er... wait a minute. Nevermind.

Re:It won't work...

[InsaneGeek]

You need to look at what this is targeted at. It's not really for hiding anything illegal, most large companies would have used some form of crypto (having used PGP's Outlook plugin, you can't get much easier). But more for everyday things that really appear harmless, that come back and bite you. Best example off the top of my head:

Microsoft subpoenaed Netscape for all those internal message board documents, saying how much better IE was than Netscape. Nothing illegal, but would have been great to be killed automatically, look at how much damage *legal* posts did.

Now, someone actually subpoenaing a couple emails of printed off is probably very little of a concern, when compared to possibly gigs & gigs of emails laying around that can be subpoenaed and gone through, that would not only include the couple of printed emails already, but possibly even more.

I look at it like security, just because the only truely safe system from network hackers is a unplugged system, doesn't mean I shouldn't throw in the towel and not secure the systems that are plugged in.

Re:It won't work...

[Hooya]

fill up your companys toner cartridges with disappearing ink. problem solved.

Maybe i need to sell that idea to Dissapearing Inc. anyone reading this that works for that company? just don't want them to pay me with bills that were printed after the treasury starts using those toner cartridges. ;)

Re:It won't work...

[Anonymous Coward]

because it will probably be argued that without the original electronic document to back it up, that the paper document's existence is suspect.

What an odd twist of affairs THAT would be...a physical document that can't be authenticated against an electronic source version of the document?

Re:It won't work...

[sphealey]

You need to look at what this is targeted at. It's not really for hiding anything illegal, most large companies would have used some form of crypto (having used PGP's Outlook plugin, you can't get much easier).

Most large organizations handle the illegal stuff face-to-face among a limited group, usually off-site (there's a reason for all those "athletic club" memberships you know). It never gets put on paper.

sPh

Re:It won't work...

[Siobhan Hansas]

What an odd twist of affairs THAT would be...a physical document that can't be authenticated against an electronic source version of the document?

It's not simply linking it to the source document that's the key, it's the logs that tie the source document to a person and show that the document presented is consistent with those logs.

That's why you're supposed to initial memo's that you send out, so that there is something linking that piece of paper, in its original form, to you.

Several years ago my long distance phone company, Working Assets, asked if I'd like to help the environment by receiving my bill electronically. "Why yes" I cried. They started emailing a text version, it wasn't pretty but it was all I needed. After several months they started sending me a URL to a web page instead. At which point I told them to return to killing trees and mailing me stuff.

In the case of a dispute I'm don't want to have to rely on information that they have control over, even though I think they're an honest company. I don't even want to be in the situation where I'm sure the statement said one thing when I first read it then, when I go back, it says another and I have no way of being sure that I wasn't just too tired/distracted/drunk when I first looked.

Generally companies are much more interested in accountability than they are in trying to hide things. This type of system becoming common place would put digital signatures back off the agenda for a long time because people will come to think of email and electronic communication only as multimedia versions of chatting.

Using a system like "shreddable email" isn't the same as sending a letter, fax, non shreddable email or anything else traceable. You won't be able to get people to take the same sort of action on an email you're not prepared to stand behind than you would an email your are.

Ever been in one of those meetings where someone says "That sounds good, why don't you put it on paper and we'll take it from there"? It's not simply a matter of them not being able to remember what was said.

Re:It won't work...

[sckeener]

I do tech support in a legal department. I find that on average 15% of the users have a pst that's a gig. Of that 15%, 33% are over 2 gigs. It's a given that everyone has an email storage problem because the average number of people that delete incomming mail after being read is less that 5%.

shredding is a very legit concern. So many things are effected by storing email besides the 'bad' emails....increased storage, support, backup, etc....costs.

Hmmm

[yatest5]

Many of these services can also restrict what recipients do with messages -- such as bar them from forwarding, copying or printing e-mail.

Can it stop them taking a screenshot? I find it very hard to believe that once you have something decrypted on your computer someone can stop you copying it in some way...

Re:Hmmm

[tchuladdiass]

No, but company policy can... "Printing or copying a secure email document will result in a Class 1 infraction resulting in employee termination"

Outlook

[Orre]

Why not use outlook. It does that whenever it wants on my Unverity (randomly).

Re:Outlook

[Orre]

Hmmmm university

Snake Oil ?

[CaptainZapp]

I'm sure many corporate bigwigs would sure be happy, if some of their e-mails sent/received might have self destructed. (Kenny Boy and his Anderson crownies come to mind).

I fear however that they might be in for a surprise when the apparently "self shredded" messages pop up at all those likely and unlikely places like backup tapes, swap files, printouts and the like.

It's probably safer to employ a clean and transparent corporate culture, then getting kicked in the but by embarassing messages popping up on ol' backup tapes.

Once again, doesn't make sense

[tuukkah]

You give someone info, they have that info. Who cares for "remote cryptography keys" if you can keep the key. Or simply take a screenshot of the message.

I see a point in digital shredding, and it's to not leak information by human mistake. But then if they're willingly keeping the info safe and not trying to copy it, wouldn't sending a URL suffice? When the document isn't needed anymore, you change the URL content to "Not here anymore, sorry."

Re:Once again, doesn't make sense

[underpaidISPtech]

>When the document isn't needed anymore, you change the URL content to "Not here anymore, sorry."

wayback machine
google
proxy caches

Re:Once again, doesn't make sense

[m95lah]

One word: Cache.

Re:Once again, doesn't make sense

[Anonymous Coward]

wayback machine

I know what you mean.

Re:Once again, doesn't make sense

[Leliel]

Though the effect of those would be greatly lessened if we assume the company is using an intranet. Putting content-sensitive documents in publicly-accessible locations probably isn't a good idea to begin with.

I have in the past put documents in a temporary space on a company fileserver, then emailed the link. The entire space is wiped weekly without backup (hence the "temporary" bit - clever naming, eh?). I was actually using the space because the documents were so large, but a similar system might could be implemented for sensitive documents.

Regardless, the weakest link will always be the human one.

Can there ever be a perfect digital shredder?

[phil_atk]

Document destruction is very topical at the moment - but the question must ultimately be whether it is possible to destroy digital documents as easily as their paper counterparts?

With a traditional document (esp. in the case of sensitive items) versioning is kept to a minimum, and hence the total destruction of a 'mail chain' would be possible. With digital documents it is too easy for multiple versions to exist - using the email example you could have multiple vendors and multiple sysadmins with mailbox backups, many of which could be unknown to the individuals concerned.

With digital documents there will always be an tension between the desire to be able to fix a system that breaks (using backups) and to digitally shred sensitive items. This will probably mean that there will never be as much certainty with digital shredding as traditional shredding.

Re:Can there ever be a perfect digital shredder?

[mpsmps]

I have been looking at the Authentica. It appears to me that Authentica's product (prominently mentioned in the article) has a lot of powerful access control features that address the issues in the above email, but offer no protection against a court-ordered review of email. In particular, Bill Gates can't use such systems to protect himself from legal review. Backups do not defeat the system because the emails are encrypted and can only be viewed using a secure viewer. According to a review:

On the viewer side, recipients need Authentica's plug-in to Netscape and Microsoft browsers for viewing protected content....Authentica's plug-in...decrypts into protected memory, so that recipients never have direct access to decrypted content.

The "mail chain" is not destroyed, but instead is made more explicit. Again, from the review:

The "recall" name also refers to the user's ability to see what's been done with a specific piece of content. The system keeps a complete audit trail of all access and changes to rights and permissions.

The person in charge of granting rights can apparently change them anytime in the future to either "unshred" a message or make an existing message unreadable even in the viewers mailbox:

The person granting rights can change-and even revoke-privileges after content has been delivered.

What I conclude from this is that even if the system works as designed (a big if), it is at most useful for protecting your documents against people who cannot influence the "person granting rights". In particular, this wouldn't seem to protect documents in a court fight. The judge could require that the person granting rights unshred the document and cough up the audit chain to see exactly who viewed it and when.

Re:Can there ever be a perfect digital shredder?

[Skorpion]

There may be not a pefect e-shredder (sigh, what a name).

All the shredding schemes I saw involved trusted client software - a piece of software that tle client computer uses to show the information to the recipient. And this software every time would check if the sender still want the recipient to access the information. If not, it would deny the access and the information would be 'shredded'.

This approach has two disadvantages:

• It requires the recipient to run the software. This may be not an issue in a standardized corporate Outlook-only environment, but it IS a problem. But wait, there is more:
• It trusts the client software.

  There is no fundamental law of universe that prevents anyone from reverse engineering what the trusted piece of software does and reimplementing it, but without the limitations and permission checking. This was done in the past and will be done tin the future. This is one of reasons why Free Software/Open Source gets a lot less of business attention - because it is much harder to seal some piece of software there, and make the user unable to bypass the limitations of the software. usually the business model relies on those limitations. If you want to do this on proprietary OS 9and you have resources) you may approach the OS makers and make them help you in making your software a trusted, sealed agent that will do what you want and won't do what user wants. This helps such technologies (sarcasm intended) much.

Companies who produce such schemes again and again aren't really interested in perfect protection. They are interested in making a sealable product for a corporate environment. They probably know it is imprefect, but is enough good for the intended customer (20/80 principle).

Alex

Honest men

[xenocide2]

have nothing to hide. I don't think shareholders would see an email shredder as good news. Sure, you've reduced "liability," but you could further reduce it by having a higher set of moral codes. If I was a shareholder, I'd probably dump the company if news that the company needed to protect itself from itself.

Its too bad that company execs won't see things that way. I guess the most valuable thing then to have as an investor is the list of Dissapearing, Inc's clients.

Re:Honest men

[zangdesign]

Then explain why we have cryptography, steganography, spy agencies, wiretaps, etc.

That's the same horsecrap argument right-wing Republicans have been using for years.

Re:Honest men

[Anonymous Coward]

have nothing to hide.

OK, what is the URL of the page that lists your upcoming vacation days and locations, tells if you house is going to be empty for the duration, etc.

What about the page listing your bank account details. bank, branch, account number, balance, etc?

What about the page where you list for the world your entire medical history?

There are many things that an honest man needs to hide.

A Nony Mouse.

Re:Honest men

[jnievele]

No, it's not.

It's perfectly understandable that people want their privacy and therefore encrypt their mails.

It's NOT understandable if people want to destroy the mail they sent and that is in other peoples mailboxes.

Re:Honest men

[Carmody]

"Honest men have nothing to hide."

Not only is this statement false; it is dangerous.

If an honest man comes up with a new, beautiful, invention, shouldn't he hide it until the patent forms come out?

If an honest man writes a personal email to an honest woman, thanking her in detail for the honest sex they had last night, would he be suddenly dishonest if he didn't want those details accessible to any snoop a few years later?

If an honest man writes an email to his honest colleague, and makes some honest fun about the way that his honest customer dresses, just the way that colleagues often jest and jape, is it that big a stretch that he wouldn't want that email to surface years later in some lawsuit?

If you are living your life in such a way that you never write or say anything that you would like to keep private, I wouldn't call you "honest," I would probably call you "bland." And I don't believe that being bland is a virtue to which we should aspire.

Re:Honest men

[0xdeadbeef]

I think you're missing the point. Privacy is one thing. Hiding your lawbreaking behavior from the government and your shareholders is a whole different ballgame.

The real dangerous thing is the way many people advocate privacy while their intent is to shield criminal activity. That is what causes "if you're not a criminal, you've got nothing to hide" mentality in law-n-order types.

Re:Honest men

[DrSkwid]

as KRS-one noted:

Everything you do in private is illegal,
Everything is legal
If the government can see you.

Re:Honest men

[Carmody]

I think you're missing the point. Privacy is one thing. Hiding your lawbreaking behavior from the government and your shareholders is a whole different ballgame.

I am not missing the point. The original posting was about software that purports to do to electronic documents what a paper-shredder does to printed documents. The response was "Honest men have nothing to hide." And I was responding to that, correctly calling it a dangerous attitude, demonstratably false. (Another respondent mentioned that people don't put their credit-card information on the web, even Honest Men)

The software CAN be used to hide lawbreaking behavior from the government and shareholders. But that is not its sole purpose. And when someone says something ridiculous like "Honest men have nothing to hide," in response to an article about a self-shredding email system, it is clear that THEY are missing the point.

Re:Honest men

[Anonymous Coward]

"have nothing to hide. "

Baloney.

What if your boss asks you to write an email outlining what's wrong with your product and how you could improve it.

Being "honest" you say:

1) Our product in your opinion is too close to your competitors products

2) The marketing department has wasted every opportunity to properly present our product to the customers.

3) A few senior VP's don't seem very concerned with losing market share, and in fact, a few of them have quit and are working for your competitor where a couple of products are very close to your products.

4) You've noticed some of the best employees in your department, all women, have left after working with a particular male employee.

***** WHY WOULD YOU NOT SEND THIS EMAIL????******

***** ISN'T IT HONEST? *****

***** Or could it get you fired, and put your company in a significant legal bind if it was released? *******

Think man, think!

Re:Honest men

[xenocide2]

My apologies for using an overblunt quote. I mean that if you desire to hide something, the first step in hiding it is not publishing it. In all these things you have mentioned, the thing one desires to 'cover up' are actions, not thoughts. As for patents, some will argue that they're a bad thing nowadays; I will simply mention that 'patent pending' is an important phrase to inventors. How honest are these people that desire to hide their actions? Is there something wrong with them? It appears so. You can be honest without being "bland," it just takes more courage than these hypothetical examples apparently exhibit(Although I ponder the kind of man that thanks the woman the day after, in an email, no less).

Perhaps a better phrasing would be "Men of honor are not afraid of the truth." But then, they say that men of honor are horribly out of fashion these days.

Re:Honest men

[xenocide2]

So your solution is to hide the evidence rather than not send it?

Re:Honest men

[Anonymous Coward]

Not necessarily bland, how about "voyeur"? (and I guess you'd need a bit of "socialist" or something, beh)

Re:Honest men

[sphealey]

Honest men have nothing to hide...

I try avoid being a toady for big corporate interests, even when they are signing my paycheck. However, this statement ignores three basic facts: (a) in the United States, anyone can be sued at any time for anything (b) in the United States, anyone can be indicted at any time for anything a District Attorney thinks it worthwhile to indict him for (and I guarantee that even you, Mr. Honest, broke 50-100 federal laws already this morning) (c) a good lawyer can take any conversation, even the most innocent, and twist it into evidence of a sinister conspiracy.

(b) and (c) are the most dangerous when combined, because the usual Fed tactic is to bring a massive prosecution against someone, use that prosecution to dig up charges of "obstruction of justice", then actually convict on the "obstruction" charges. And absolutely anything you say can be twisted into evidence of "obstruction".

So it is not so black and white as you would have it appear.

sPh

Re:Honest men

[mpe]

...have nothing to hide.

Not even from the dishonest?

Re:Honest men

[mpe]

The software CAN be used to hide lawbreaking behavior from the government and shareholders. But that is not its sole purpose.

Just about any tool can be used for criminal activities. In the past the way of doing things was to have laws against the crime, rather than (as we are seeing now) laws against various tools.

And when someone says something ridiculous like "Honest men have nothing to hide," in response to an article about a self-shredding email system, it is clear that THEY are missing the point.

Let alone that "Honest men" pose no risk by hiding things, since they are honest in the first place...

Re:Honest men

[edp]

"Honest men have nothing to hide."

The most obvious and American counterexample to that is the voting booth. It has a privacy curtain, and I bet you use it.

Honest people have things to hide from dishonest people. Hiding your vote protects you from being threatened or rewarded for your vote. Hiding your business plans prevents your competitor from beating you to the punch. Hiding your homework prevents other students from cheating. Hiding your phone number prevents some telemarketers from bothering you. Hiding your home address prevents customers from bothering you after business hours. Hiding an embarrassing (but ethical) hobby provides enjoyment of life while protecting from harassment. Hiding your religion protects you from persecution.

Re:Honest men

[Anonymous Coward]

Honest men have everything to fear from dishonest men and their lawyers.

You don't need to have done anything questionable, just that selective bits can be reassembled by unfriendlies into any story they want.

Re:Honest men

[jnievele]

If a honest man invents something, why should he want to automatically destroy knowledge about his invention?

If the honest man having sex with the honest woman was really honest and not cheating on somebody, why should he want to destroy the mail? Do you destroy the loveletters you sent to your girlfriends?

Re:Honest men

[Carmody]

If a honest man invents something, why should he want to automatically destroy knowledge about his invention?

If the honest man having sex with the honest woman was really honest and not cheating on somebody, why should he want to destroy the mail? Do you destroy the loveletters you sent to your girlfriends?

These are very good points, and deserve a thoughtful response.

To the first question: It is a question of timing. He may not want the knowledge of the invention to exist until it is in a form he is proud to take credit for and patent. If I have come up with a new type of GUI, for example, I wouldn't want Microsoft or Apple to look at it until I was ready to have it marketed. Otherwise, if they thought it was a good idea, they might use their superior resources to make a copy and get the copy on the market first.

Also, philosophically, if I have invented something, or written something, I may want to destroy it for many reasons. I may believe that the invention would be a Bad thing for my society, or I may believe that my writing has not acheived what I want it to achieve. I can therefore choose to destroy what I have created, even if I am an Honest Man. (And one could even argue that the Honest Man probably destroys more of his work than the Dishonest Man who is happy to just get another publication/patent on the ol' C.V.)

To the second point: There are many reasons an Honest Man would want to delete graphic email he has sent to a girlfriend. In this context, one main reason is that his emails to her are between the two of them. He may not want future internet-snoopers reading graphic descriptions of their private life. You can think of other reasons.

Re:Honest men

[xenocide2]

As for point A, theres this thing called "countersuit for frivilous lawsuits." It allows you to sue the plantiff when the suit is obviously wrong, and a waste of everyone's time involved.

And for B, I guarantee, you Mr. Conspiracy Theorist, that I have not broken 50-100 laws this morning, unless Congress has passed a law against skipping breakfast. We (at least I presume you do as well) live in the United States of America, not Communist Russia, where anything worth doing was illegal.

Nobody said that honor was an easy task. But if the DA wants you proscecuted so bad that he is going to stoop to interpretations and gray area misrepresentation, there's nothing that will stop him from proscecuting you. Your best hope is compliance, unless you happened to have actually broken some laws.

Re:Honest men

[sphealey]

And for B, I guarantee, you Mr. Conspiracy Theorist, that I have not broken 50-100 laws this morning, unless Congress has passed a law against skipping breakfast. We (at least I presume you do as well) live in the United States of America, not Communist Russia, where anything worth doing was illegal

I don't go in for conspiracy theories much, myself. Although there clearly are powerful groups of people in the world who enjoy power/money for its own sake.

As for your comment about not breaking any federal laws, clearly you haven't read the US Code (or the Federal Register, since the Supreme Court ruled that administrative regulations have the force of law) lately. Flush the leftover pills from a prescription down the toilet and and the question is not if you have broken FDA and EPA regulations but how many. ill you be prosecuted for that? Probably not - unless someone decides you have something they need. What's that? One of the customers for your database consultancy is the local mosque? Hmmm...

Before you flame back, please spend a few hours at your local library scanning through a couple weeks' Federal Registers.

To you other points: countersuits are a nice idea, unless you are facing an opponent with 100,000 times your resources. Then you are screwed, because even if you win your $10,000 award will not cover your $500,000 in legal fees. And it is nice to think that the feds only go after "bad guys", but the definition of "bad guy" can change quite rapidly. Just ask Mr. Ashcroft.

sPh

Re:Honest men

[Lumpy]

Excellent! what's you address so I can come over and look throught your dresser drawers.. Better yet what's you IP address and your Root password so I can look around in your computer.. and while we are at it, you bank account numbers and credit card numbers.

IF you have nothing to hide, you have no problem giving up this information.

do you see the point now?

Re:Honest men

[jnievele]

As for the inventor: He would want to prevent others from seeing it too soon - that's what encryption is for. Self-destructing emails however are designed to delete themself AFTER a certain time, unless I missed something in the concept.

As for the man with the girlfriend, if he writes loveletters to her, then the loveletters are HER property, and she can do with them what she wants, just like with loveletters in paper form. Maybe she wants to keep them as a keepsake even after they split up... who gives the man the right to destroy them?

Morale: Don't send (e)mail to somebody you don't trust.

Re:Honest men

[Anonymous Coward]

If an honest man writes a personal email to an honest woman, thanking her in detail for the honest sex they had last night, would he be suddenly dishonest if he didn't want those details accessible to any snoop a few years later?

Eew. Ick. An email as thanks for sex? What happened to flowers, a heartfelt (handwritten) note, or any other form of communication that's more personal?

Worse is if it's written from the honest man's corporate email account. Especially if they've got a legal department that requires a disclaimer tagged on to each outgoing email.

Ie: "That sure was good sex last night, honest woman. *nudge nudge* *wink wink* *say no more*
* This is proprietary information, blah blah, legal disclaimer. *

How romantic!

Re:Honest men

[Anonymous Coward]

Nothing is illegal, unless you are caught.

Re:Honest men

[jbf]

Honest men have nothing to hide. I don't think shareholders would see an email shredder as good news. Sure, you've reduced "liability," but you could further reduce it by having a higher set of moral codes.

xenocide2, what's your social security number, mother's maiden name, and which credit cards do you carry? Can you give me their numbers, or do you have something to hide? How about your home address, and phone number? Passwords to computer accounts? A list of all your purchases, including those you made in cash, over the last year? A list of all the web pages you've hit, ever? Your income history, and tax returns, for the last 7 years (you know the IRS wants you to keep those for that long, right?) All school transcripts?

Why don't you post those all to slashdot, as proof that you're an honest man, and that you're following your set of "moral codes."

Re:Honest men

[stonecypher]

> I think you're missing the point. Privacy is
> one thing. Hiding your lawbreaking behavior
> from the government and your shareholders is a
> whole different ballgame.

Oh, and obviously, email that's been hidden is law-breaking. That's why we're taking your TiVo - we don't care what's actually *on* the harddrive - we know it's for illegally duplicating movies.

God, this gets old. But, then again, so does whining about the signal to noise ratio of the slashdot community declining. Maybe it's the species?

> The real dangerous thing is the way many people
> advocate privacy while their intent is to
> shield criminal activity.

Arguably, the real danger is those who try to infer illegal behavior from the desire for privacy. Wait until you see the red hands, there, Chachi.

Re:Honest men

[Tony-A]

Voting booth. That's the point.
Even if everybody knows how I will vote, I close the curtain, vote, and do not tell anyone how I voted. As much to protect my neighbor's right to a secret ballot as anything.
Honest men hide things to discourage the snoops. The snoops can cause a lot of mischief for honest people.
Trust me. (Always trust me. ???) Sounds like the beginning of a con.

Re:Honest men

[Anonymous Coward]

> honest men have nothing to hide. I don't think shareholders would see an email shredder as good news. Sure, you've reduced "liability," but you could further reduce it by having a higher set of moral codes. If I was a shareholder, I'd probably dump the company if news that the company needed to protect itself from itself.

The following comment was made by another poster elsewhere, and I think it's relevant here, too:

Perfectly honest people and companies can want to destroy emails after a set period of time, as policy, to limit the scope of discovery investigations during a lawsuit - especially if the company's hones, since the expense of going through alll those emails saved up over the last decade, as part of a harassment or other such lawsuit, would be _very_ costly to the company, and they won't get those costs paid back until the end of the suit - a looooooong time to wait for such an outlay.

A policy of "all emails destroyed after X months" would be legal, defensible, and limit the scope of such discovery proceedings.

Re:Honest men

[Anonymous Coward]

Honest men don't cheat, however.
Especially on thier wives.

PGP can be a substitute

[SomethingOrOther]

When encrypting a message with PGP you can use the -m option (or sellect the 'secure viewer' if you are using one of the windoze versions) Doing this prevents the recipiant from saving a plain text version on their disks

No, it isn't as good as "shreading" and there are ways to cercumvent this if the recipiant was so incliend, but it is a good substitute providing you trust the recipiant.

If you dont trust the recipiant then WTF are you doing sending them such an e-mail in the first place!

Re:PGP can be a substitute

[jnievele]

The trouble with PGP is: Once it becomes so widespread that the government has to fear loss of face in front of a court, other countries will do the same as the UK: Pass a law that requires you to hand over the key, or else...

Besides, with PGP you still can't control if the RECIPIENTS of the mail keep it - the point of these new systems was to delete the mail after you sent it.

Re:PGP can be a substitute

[Cerebus]

/me chortles.

'man xwd' Enjoy.

Wanna buy a bridge?

Re:PGP can be a substitute

[Anonymous Coward]

'man xwd'

Eh?
And whats to stop you doing that with any shreding system. Icluding paper

Re:PGP can be a substitute

[CatherineCornelius]

When encrypting a message with PGP you can use the -m option (or sellect the 'secure viewer' if you are using one of the windoze versions)

Doing this prevents the recipiant from saving a plain text version on their disks

I hope nobody reading this will rely on "pgp -m" for security--it's just a convenience that tries to ensure that your recipient doesn't do something insecure such as saving plaintext to disk, but if he wants to he can probably still do that with a couple of keypresses.

Re:PGP can be a substitute

[Anonymous Coward]

Thanks, that's really useful to know!

Re:PGP can be a substitute

[Mr. Slippery]

Doing this prevents the recipiant from saving a plain text version on their disks

...providing you trust the recipiant.

If I trust the recipient, all I need do is write "Please to not save a plain-text version of this document." Which, essentially, is all that this option can do - ask. Not prevent.

Re:PGP can be a substitute

[mosch]

What is xwd, other than a file format?

Re:PGP can be a substitute

[broody]

It dumps an image of an X window.

Re:PGP can be a substitute

[Anonymous Coward]

And I'm sure gpg bypasses this (but in the off chance it doesn't, could be easily hacked up to do so).

This "pseudo-secure" bullshit is awful, because it creates a false sense of security...and from someone respectable like PGP, too.

Re:PGP can be a substitute

[mpe]

When encrypting a message with PGP you can use the -m option (or sellect the 'secure viewer' if you are using one of the windoze versions) Doing this prevents the recipiant from saving a plain text version on their disks

This basically asuming that the recipient is using a known "cypher machine". Which is only viable in a closed environment where there is no way for the end user to change software or install their own. (Which rules out even thinking about using Windows.)

Re:PGP can be a substitute

[Anonymous Coward]

It's worse than that -- send 'em a normal email, and there's no proof that it came from you and wasn't forged or something.

Send 'em one of these cryptographically signed emails...and you've got a bit more explaining to do if you want deniability.

Has anyone realized that the *real* use of this system is not "auto-shredding" or all this bullshit that the people pushing this are trying to claim that their system can do, but a *reliable* form of the "has the recipient read this letter yet" system?

Re:PGP can be a substitute

[mesocyclone]

The trouble with PGP is: Once it becomes so widespread that the government has to fear loss of face in front of a court, other countries will do the same as the UK: Pass a law that requires you to hand over the key, or else...

IANAL, but in the US, if the message is part of an investigation, they could get a warrant requiring you to turn over the key. No new law needed.

Re:PGP can be a substitute

[Anarchofascist]

Deniable encryption is the subject of the "rubberhose" project

From the website (for the lazy or bandwidth impaired):

Rubberhose transparently and deniably encrypts disk data, minimising the effectiveness of warrants, coersive interrogations and other compulsive mechanims, such as U.K RIP legislation. Rubberhose differs from conventional disk encryption systems in that it has an advanced modular architecture, self-test suite, is more secure, portable, utilises information hiding (steganography / deniable cryptography), works with any file system and has source freely available. Currently supported ciphers are DES, 3DES, IDEA, RC5, RC6, Blowfish, Twofish and CAST.

Currently alpha, but has a cool graphic, cool idea and cool name :)

Re:PGP can be a substitute

[Captn Pepe]

IANAL, but in the US, if the message is part of an investigation, they could get a warrant requiring you to turn over the key. No new law needed.

True, but if you can plausibly claim that you no longer have the key in question, you're off the hook in the U.S. Under the U.K.'s RIP act, you can be jailed for not turning over the key, even if you have legitimately lost it (if law enforcement feels like making an example of you, anyway).

Re:PGP can be a substitute

[mini me]

Are there any encryption algorithms that can change the content based on the key used? There is the real key, and a fake key. If the government forces you to decrypt the file then you use the fake key turning up a fake file.

An e-mail example:
Real Message: "Lets do some illegal activity"
Fake Message: "How are you today?"

Encrypt both, the first using the real key, and the second using the fake key. If the real key is used to decrypt the file then the first message is returned. If the fake key is used then the second message is returned.

With this you could hand over the fake key to whomever you please and it will not get them the real contents of the file.

Re:PGP can be a substitute

[IronChef]

It's called deniable cryptography.

Re:PGP can be a substitute

[Sloppy]

Doing this prevents the recipiant from saving a plain text version on their disks

Surely this is a joke.

Anyone who trusts someone else's computer to obey their wishes, is going to be the owner of my next bridge.

Re:PGP can be a substitute

[Dwonis]

Can you explain the bridge reference?

Re:PGP can be a substitute

[Anonymous Coward]

As in, "Would you like to buy this bridge in Brookly, NY that I own? Honest - I'll give you a fair price!"

Metaphor for a _total_ scam.

Re:PGP can be a substitute

[fr2ty]

This "problem with PGP can perfectly be adressed with Aggressive Crypto Bombing, a game played by pairs of two people. One person is defined victim, one is the "bomber". First the "bomber" sends an encrypted email which he can not decrypt.
Then call the police. Be creative! Drugs, Terrorism, try not to sound funny.

Everybody does it. It's fun!

~~~~~~~~~
NO this was just a joke! Irony, satire. Laugh!

Re:PGP can be a substitute

[Pogue Mahone]

If you encrypt a message with a one-time pad, you can construct another one-time pad that will "decrypt" the message to anything you like - recipe for chocolate brownies, "evidence" to incriminate John Ashcroft, literally anything.

Script Kiddies

[Kubik - The Original]

I have a feeling that this technology will be used mostly by script kiddies to "shred" the pr0n that comes into their mailboxes on a daily basis.

They're at it again.

[epsalon]

Still corporations and individuals fail to understand a simple rule: Whatever you can see, you can store and copy. They failed to understand that with copy-prevention mechanisms, and the fail to understand it here. No crypto will help prevent seeing something that you already saw.

And no, hardware protection still can't help. In the worst case - take a camcorder and tape your screen contents. They can't overcome that!

Re:They're at it again.

[David Price]

This is absolutely true. However, these systems are not at all designed to foil the presumed intent of the recipient to copy the content (as DRM systems for copyrighted entertainment content are). They're designed to give a level of automatic prevention against inadvertent copying.

Consider, as an example: I run a business in which sensitive information is bandied about by internal corporate e-mail. In order to keep a whole variety of bad things from happening to that information (subpoenas years later, inadvertent forwarding to somebody who shouldn't see it, proprietary information being leaked by cast-off hardware), I enact an electronic document destruction policy; one year after an internal e-mail is sent, it is destroyed. I mandate use of one of these self-shredding systems to help enforce my policy.

Now I haven't really helped anything from a strict can-it-be-done standpoint: a whistle-blowing employee can still take the aforementioned camcorder and set it up; a sysadmin who's for some reason obsessed with archiving all his mail can probably download a crack for the system in question. These issues are pushed into the realm of policy, but the number of such issues that have to be dealt with strictly by policy means decreases by an order of magnitude. What I have really accomplished is to drastically reduce the probability that something will happen that nobody in the organization intended.

Um... ok

[SkyLeach]

"Authentica and other companies make online shredding systems that scramble e-mail messages and limit access to the software key needed to decrypt them. To make messages "disappear," access to the key is withdrawn after a given time"

Ok, so the first time they need to review a document that is now "expired" they start copying the documents to their local harddisks for review or putting the information into databases and refering to them in memos. Nobody has time to scower a whole corporate network for copies of documents which should not have been copied so this is still not really a solution.

And here comes yet another bit of work for interns

[Anonymous Coward]

Even if the self-shredding software disables printing, copying and screen-capture functions, nothing will stop a determined person from photographing the screen or jotting down the information by hand.

I can see it now. Interns' job descriptions will now include handwriting received email in addition to coffee-fetching, photocopying, and (in the case of Washingtonians) sexual favors...

the (l)users will undermine this...

[CheechBG]

The way I see it, (I'm not employed in a corporation, but I have received a few "confidential" emails) the (L)users can/will undermine this by simply hitting Print. Now you are back to square 1, having to manually shred a physical document. Yeah, forwarding emails all over the place is convenient, but there will always be someone who is militantly "anti-computer" and prints out hard copies of everything they get.

I kinda see the point behind this, they are playing off of Enron, milking that scandal du jour for all it's worth. I bet the scandal next month will have something to do with Linux and those pesky "h4ck3rs", right on time to push the SSSCA through.

mafia knew it better before.

[gl4ss]

like mentioned, one shouldnt send anything that will make you look bad later.
instead you should say it in person, and make sure the guy isn't wiretapped. then if you want to later _totally_ remove this message you said to him from existence(provided that he doesnt tell anyone), just dump him in the canal with heavy duty boots.
you just cant remove mails from all the machines they might get into..

Yeah, whatever.

[Cerebus]

"Self-expiring" email schemes work essentially the same way: a trusted key authority generates and stores encryption keys for any and all email. Reading an email requires authentication to the key authority, which either returns the key or decrypts the email. After a preset time, the key authority purges the encryption key, after which the email encrypted with that key is theoretically unreadable.

These schemes have several practical problems and weaknesses:

1) These are closed email systems. Composing, sending, receiving and reading all protected email *must* take place within the system. Communication outside the system typically involves a web-based email solution-- you don't actually send the email, you send a URL to a server that hosts the email for the recipient, and a one-time authenticator to access it.

2) There is no protection for email that is removed from the system. Screen captures, saving as text, etc. all remove the email from the "expiry" system, rendering it moot.

3) The key authority is a central point of failure. Reading any protected email requires that the key authority be online and available, and that it's keystore be intact. Any interruption in this services makes *all* email hosted by that service unavailable-- and this is (conceivably) all email in your enterprise.

4) If the key store is ever archived-- a typical response to worries about (3), above-- the archived keys can be used to access old mail that has otherwise "expired," or "shredded." There is nothing in the application of the encryption that prevents an archived key from being used past its valid date, should it be recovered from a backup or recovered forensically the key server's storage.

Just some thoughts.

Re:Yeah, whatever.

[GooberToo]

And if you use this system for which law enforcement access is required whereby the emails are no longer available will you now be charged with interference of an investigation? Dustruction of evidence? Failure to co-operate in an investigation?

I doubt there is currently much a legal-leg to stand here to prevent your self from being raked over one way or another.

Please keep in mind, I'm not a lawyer, however, these seem like the obvious paths law enforcemet would go to ensure these systems don't prohibit their ability to investigate.

Re:Yeah, whatever.

[mikec]

Your second point is the nastiest. However, it seems to me that this weakness could be mitigated to some extent. The key authority could strip off the real message authentication and substitute its own. I.e., it would say, effectively, "I certify that Joe Shmoe indeed sent this message, but you will have to take my word for it." Furthermore, it could then shred it's own authentication after the expiry date. Although someone might have a screen capture of the email, both Joe Shmoe and the key authority could plausibly deny that it was real.

Re:Yeah, whatever.

[Boiled Frog]

And if you use this system for which law enforcement access is required whereby the emails are no longer available will you now be charged with interference of an investigation? Dustruction of evidence? Failure to co-operate in an investigation?

IANAL but I don't think this is an issue. From the article:

For the most part, the law allows businesses to destroy documents as long as they do so uniformly and regularly, not in response to a specific threat of lawsuit or criminal investigation.

If the key expiry is set by the sender, this would be normal operating procedure and wouldn't be subject to "obstruction of justice" type of charges.

Re:Yeah, whatever.

[Anonymous Coward]

"The key authority is a central point of failure."

Then leave it.

Re:Yeah, whatever.

[GooberToo]

Yes, but the document hasn't been destroyed, rather, the accessibility of said document has been restricted. Furthermore, what happens if a document expires after an investigation has started? If you didn't make best effort to maintain a copy, are you now accountable? I don't have any problem coming up with gray areas that I certainly would not want to be held to.

While I hear what you're saying, it just doesn't sound like firm ground to me.

Self-Shredding email

[blibbleblobble]

Does anyone have information on how this idea works?

Okay, you have a remote encryption key (Me to keyserver: "Please make this key publicly available until 5/5/2002") which you can use to decrypt documents for a while.

But what is to stop people taking a copy of this key, or of the decrypted message? Do you have to run a "trusted software" reader to view the message?

Either way, it sounds like the equivalent of sending a Yahoo card - "Click here to view your message, which we will store for 3 months"

But then, screenshots are still admissable in court.

copy protection?

[Mr. Slippery]

These digital-rights management tools work much like copy-protection systems being developed for music, movies and e-books

And we all know how overwhelmingly successful those have been at preventing copying...

The old bromide that "information wants to be free" is not just a statement about copyright. It's a statement about privacy as well - whether you want it to spread or not, once you set information in a digital form and send it to someone else, controlling it becomes well-nigh impossible.

Hmmm

[F00]

I wonder if Enron had a hand in the creation of Disappearing, Inc.

And now for a word from our sponsers...

[Anonymous Coward]

"But e-mail is changing those rules, thanks to virtual shredding. Senders can destroy messages either remotely or automatically, without a recipient's consent or cooperation."

Yeah right! If that were true the RIAA would have been all over this 3 years ago. Sounds like a sales pitch, not news, to me.

Justification?

[NOT-2-QUICK]

Doug Hampshire, Peregrine's systems administrator, made the following statement in what I believe to be a futile attempt to give justification for the use of such an email system...

"Today's business market is so competitive, we want to make sure that communications that were meant to stay confidential and secure remain that way,"

Is it perhaps just me, or is this comparable to claiming that the chief reason for the development and use of the DeCSS decryption is to make local 'backup copies' of DVD's that you have already purchased!!! ;-)

In my opinion, little can be done to portray this software system as anything more than a means through which to destroy potentially incriminating documents/information. Not that this practice is illegal (I don't believe that paper shredders are considered contraband yet...), but it still amazes me how people incessantly try to provide wholesome and moral excuses for the world's necessary evils!!!

Re:Justification?

[Anonymous Coward]

thats not always true. shredders and corporate IT security are also used to combat industrial espionage, for one. You wouldn't want Big Bad Co. to go hire a private investigator who then goes and digs through the dumpster at your start-up Co. and steal your ideas . . .

Upped the stakes

[JohnBE]

All this means is that people will set up invisible proxies.

A way round this using public key encryption: You set up a temporary key (using a big randomly generated passphrase), you submit the public key to open keyservers, giving it a shelf life of two-weeks, you receive email X which is encrypted using the public key, you decrypt email X using the private key. You then securely erase the private key (even better keep the key on a floppy disk and destroy it).

The private key is lost, voila, a useless email.

Serious doubts

[Kopretinka]

If the document is physically at the client node, destroying it a fixed time after it was read always has to rely on a trusted software. Software can be reverse-engineered. Therefore I only see hope for thin clients securely authenticating and connecting to a trusted server storing the documents and destroying them exactly the given time after they were accessed.

This has several drawbacks:

1. A central server location can be attacked physically or subpoena-ed (don't know the spelling here)
2. the client must connect to the server when the information is needed - we're not there yet, I'd think
3. the information can be stored on the client in its uncrypted form.

Anyway, it's very interesting to think these paranoias. 8-)

The obvious observation

[JohnPM]

Can I just go ahead and point out the obvious here. Self-shredding email or whatever you want to call it can only work with the consent of the recipient, which goes completely against the tone of the CNN article:

Senders can destroy messages either remotely or automatically, without a recipient's consent or cooperation.

Just like the whole digital-rights management problem, eventually you have to give access to the message to your recipient and they can store a copy. If it's displayed on your screen then even the most recalcitrant software can be bypassed with a screen-shot or at absolute worst, a photograph of your monitor.

All these schemes can do is make it less convenient to store the email you receive. Even so, the receiving software could be dissasembled (DeCSS style) and you could create tools that would store the plain-text like a normal email client.

Mission Impossible

[jweb]

Somehow, this just doesn't seem as cool as a pair of self-destructing sunglasses.

Screen-shots and TRUSTING the recipiant

[SomethingOrOther]

I hope nobody reading this will rely on "pgp -m" for security

Thats why I said, you must still trust the recipiant not to take a screen shot!

This is a problem with ANY shreading system. Be it paper or electronic documents. There will always be somebody who takes a copy/screen shot to CYA (or is that CTA).

As I said, if you cant trust the recipiant, then you shouldn't be sending them sensative information in the first place!

Re:Screen-shots and TRUSTING the recipiant

[Boiled Frog]

Thats why I said, you must still trust the recipiant not to take a screen shot!

The market for this type of technology would be companies that don't want to get into trouble assuming "business as usual" practice. Bill Gates and Bill Clinton got hung out to dry by all the e-mails that were automatically saved by the system. Had they had they had a system like this, the old e-mails would be encrypted and the keys wouldn't function any more.

There's nothing that can protect you if you have a whistle-blower in your company. They could even -- technically but not legally -- bug your office if they wanted. So I guess Bill Clinton would have had the same problem as before because Monica Lewinski had his semen.

we had this years ago

[jd142]

Back in the distant mists of time, when we had cc:mail in house, messages were deleted from the server after 15 days. Since it was not pop3 and all messages were kept right on the server instead of downloaded to your hard drive, it meant that after 15 days it was gone for good. In theory, backups were made. But the person in charge of cc:mail and the backups had . . . issues with the backup, so itwas hit and miss anyway.

If people wanted to keep a message, they did what every one using these e-mail shredders will do: either print it directly or copy and paste it into word and print it from there.

Re:we had this years ago

[swb]

We still do this, just to keep the mail system managable. Without it, everyone keeps everying for a really long time.

Re:we had this years ago

[sphealey]

Back in the distant mists of time, when we had cc:mail in house, messages were deleted from the server after 15 days. Since it was not pop3 and all messages were kept right on the server instead of downloaded to your hard drive, it meant that after 15 days it was gone for good

cc:Mail's "Archive" function could be redirected to a floppy disk, where is would store the messages in a more-or-less plaintext format. Can't remember offhand if the Administrator could disable the Archive function though.

cc:Mail was a nice program - simple, easy to use, did exactly what it was designed to do and no more. Too bad it is gone.

sPh

Re:we had this years ago

[Lionel Hutts]

Dude, it's not 1988 anymore. Haven't you heard? Disks are free now. To within a rounding error, anyway.

Re:we had this years ago

[swb]

Disks are free, storage is not.

Re:we had this years ago

[blang]

Dude II, here's a law of nature you must take into account:

The annual change in price per MB of storage (unit = $/MB) multiplied by the number of emails multipled by the average size per email will always be > 0.

Moore giveth, Gates takes.

Re:we had this years ago

[uspsguy]

cc:Mail may no longer be supported but it is far from gone. Just ask out 200,000 users. It actually works pretty good and we have an interface set up to real email. The biggest problems we have are that it is so closely tied to DOS that network printing is always an issue. If we could trash it and f3fill, we would never see another LPT1 capture again.

Doesn't this lack the feeling?

[wbav]

Doesn't self shreading e-mails lack the feeling of a real shreader? I mean the whir of the motor, the sound of paper being cut; besides, how is one supposed to put a gremlin into it when they attack? (see the movie Gremlin's 2)

Re:Doesn't this lack the feeling?

[Aexia]

Shredding paper always gives me this warm fuzzy feeling.

The same feeling I get when I put body parts through the wood chipper.

slashdot?

[Anonymous Coward]

What's the matter, Slashdot? Is it contest for the stupidest article going on here? What makes you think that the average reader's IQ is decreasing? First Wal-Mart, then Futuristic Timeline, and now this. Are you competing with CNN? As the matter of fact, you can shred an e-mail message as many times you want, if it's already logged on dozen mail relay servers, routers, and couple of Carnivore systems. Well, maybe *I* just don't get it.

They address those issues

[Greyfox]

In a properly DRM enabled OS *Cough* such options simply won't be available for that particular window. In B2 OSes, covert channels (Whereby you copy information you are not entitled to copy) has always been a major issue and channels as esoteric as conveying information by varying processor load have been developed and presumably defended against. The difference in the past is that the machine has been a centrally administered box where it could be assumed that the administrator was a trusted party. In the new DRM paradigm, the administrator is considered a hostile entity not to be allowed full access to the hardware he purchased.

Re:They address those issues

[jnievele]

I don't think DRM really compares with B2-machines... B2-OSs would never sell on a mass-market, because they are a pain to work with.

DRM-protected music, for example, can always be copied by simply connecting a recorder to the line-out of the soundcard. With "self-destructing emails", people will print those mails on dead trees, or if that option is not possible, make screenshots (and OCR those if they want to save the document in a proper format).

Backing up the shreds

[shut_up_man]

If we used this system, I just *know* some HR director or marketing manager would come to me and ask for the backups of the shredded messages.

"But they're meant to be shredded for OTHER people" they'd say...

Honest men have nothing to hide?

[frog51]

Erm, how about your latest, not yet patented invention?
Or salary details? Or pretty much anything sensitive?

Admittedly you'd be best off not sending these bits of information, but if you have to then you'd best protect it.

On the other hand I for one can see no possible way a self shred system can work. Once you have information, it's yours. The original may be wiped, but you can use a screenshot, saved copy, hexeditor, memory dump etc etc

But, Bill has Learned...

[ackthpt]

He's learned to craft self shredding legislation, i.e. the M$+DoJ settlement terms.

not in a corporate environment

[Tenebrious1]

Maybe for personal email. But a corporate email system is the property of the company. Anything you create on corporate time becomes the property of the company. An email you send to your co-worker does not become the "property" of the co-worker. It's still part of the corporate network and is still the property (and responsibility) of the company. Thus they have every right to "shred" the message.

They have every right to tell you not to print it out and save it; but of course that's what people will do if they know the messages will be deleted after a certain time. I print out and save messages to cover my own ass.

Which brings up a point. I print out the stuff with full headers, with message ID and info when it was sent; however, does it really serve a purpose? I remembered thinking that while watching "Clear and Present Danger", when Harrison Ford prints out a memo and shoves it into the other director's face saying something like "here's the proof". What good is my printout if I don't have server logs to back up that the message was actually sent to me? What good is a backup of the server logs if I can't prove it wasn't tampered by myself? I know my boss will believe me if I used it as proof to protect my ass, but would a jury? Am I just wasting trees?

Re:not in a corporate environment

[Asic Eng]

Anything you create on corporate time becomes the property of the company.

Sorry for taking this a bit out of context, but I don't want to accept this "the company pay you, therefore they owe you". If I spent time at work composing a love poem for my girl friend, the company is perfectly entiteled to tell me off, for not doing my work. They are not entiteled to my poem.

They have every right to tell you not to print it out.

Normally yes, you will have to comply with company policy - however if the company engages in criminal behaviour, their rights have just ended. Collecting evidence about that is normally perfectly lawful, if it's not in you jurisdiction, I think it ought to be. I believe the US has "whistle-blower" laws too, though.

You're making a very good point about the proof issue, unless the email is PGP-signed (or something similar) it's not a terribly good proof. However, looking at a text it's sometimes possible to associate it with a writer anyway e.g. looking for typical spelling mistakes, a certain style of writing, etc. Basically there are signs which could be used to prove that you faked the email, so if those can't be found it increases your credibility. So it might help somewhat.

Re:not in a corporate environment

[Spilver]

This reminds me of a court case about some disputed transaction in Sweden a few years back, where the court used as evidence that the transaction had been made - a screenshot of the mail message in question!

Unfortumately I don't have the reference anymore. It really took my imagination for a ride when I thought about the possible applications for anyone with access to a bitmap editor...

Re:not in a corporate environment

[MajroMax]

What good is a backup of the server logs if I can't prove it wasn't tampered by myself? I know my boss will believe me if I used it as proof to protect my ass, but would a jury? Am I just wasting trees?

So far as I understand these expiring-email systems, the presence of a message will still show up in the server logs, at least for a while. That "presence of a message" log will be pretty convincing to a jury, as it at least proves that you didn't make the message up yourself.

On backups of server logs, the only thing I could recommend would be to have both yourself and a cow-orker PGP sign the logs at the same time -- then they have to prove a consipiracy between the two of you to alter the logs, which will probably harder than throwing just your credibility into question.

If you have shell access to the server in question (I.E. are high-enough up that you can do most anything to the server), try writing something that would take a hash (md5sum or so) of the logs in question (while they're still on the server, and thus unalterable to you) and mail the sum (along with a timestamp, a sum of the program itself, and a sum of something that proves it's not in a chroot jail -- all to prove that the program hasn't been tampered with) to both yourself and a trusted external data repository that you can't alter [Again, a friend comes in handy here].

Re:not in a corporate environment

[Anonymous Coward]

>> Anything you create on corporate time becomes the property of the company.
> Sorry for taking this a bit out of context, but I don't want to accept this "the company pay you, therefore they owe you". If I spent time at work composing a love poem for my girl friend, the company is perfectly entiteled to tell me off, for not doing my work. They are not entiteled to my poem.

Depends on your employment contract with them, doesn't it? They may not want that poem, but if you agreed to the wrong contract, they're entitled to it if they _do_ want it.

MS had this for years

[Taliban Lecher]

...for better use it has independent software agents called win, outlook, exchange etc.

it even has remote control capabilities

this post is 100% redundant

If you can read it once....

[qurob]

You can save it....

Anything on computer readable format can't be copy protected.

Sorry

Thats just the way it is.

Not Really

[Ms.Taken]

I fear however that they might be in for a surprise when the apparently "self shredded" messages pop up at all those likely and unlikely places like backup tapes, swap files, printouts and the like.

It doesn't matter. None of the copies will be readable either. From the article:

"Authentica and other companies make online shredding systems that scramble e-mail messages and limit access to the software key needed to decrypt them. To make messages "disappear," access to the key is withdrawn after a given time."

Re:Not Really

[CaptainZapp]

For starters:

Is it open source software. Or at the very minimum: is the crypto algorithm reviewed by reputable cryptographers? Further, how large is the key, how strong is the algorithm and do I have to take the software manufacturers word that there is no way to descramble the message?

But that aside. How does the software guarantee that no printouts, no backups of the cleartext and no copy/paste of the cleartext exists?

Re:I'm Xin Bai!!!!

[DebianDog]

That FUCKIN' music has GOT to go!

That's why AIM is so popular

[tkrotchko]

A lot more companies are probably going to be switching to AIM (and similar) to conduct business to avoid a lot of this mess.

Something that allows you to communicate, but without keeping records. No evidence, no worry, I suspect will be a requirement for future messaging systems.

Re:That's why AIM is so popular

[qurob]

I like watching the people on my node chat it up while I run Ettercap on my network connections *rolls eyes*

Self-Shredding E-mail Howto:

[Shuh]

Steps to self-shredding e-mail:

1. Get your "@enron.com" account...
2. Use account.

Spyware

[Registered Coward v2]

I wonder how this stuff interacts with spyware that logs keystrokes, viewed screens, email, etc.

Of course, talk about being hoisted by one's own petard:

Company X installs spyware on its machines - "to protect itself"; and the results wind up as evidence in a court trial, including "shredded" emails. Concievably, Company Y could send the email, and have it recovered from X.

legal?!?!

[Anonymous Coward]

i'm pretty sure this type of email would be delcared illegal faster than napster. business generally have to keep all business related financial documents for a period of time - seven years seems to come to mind. another dumbass idea by some dumbass people.

Re:legal?!?!

[pozar]

Not true as it has held up in court that you can destroy documents as a matter of course of doing business and not destroying documents that are about to be or are involved in a legal proceeding.

Companies and individuals destroy documents for a number of legal reasons. Such as keep the competition from seeing trade secrets, draft copies that are not ready for public release and to minimize discovery costs.

Many companies have document retention policies right now. Most paperwork can be destroyed at any time. Some paperwork may be required by federal, state or local law to be kept. For instance, companies that are regulated by the feds have certain paperwork that they need to keep around such as banks, airlines and radio stations. Some of these document retention systems will give you the ability to differentiate between the document you are creating and how long it is to stick around.

Automatic Shredding.

[Alien54]

I can just imagine that this will likely be the _first_ Microsoft security initiative, again for those big coporate players.

Automatic document shredding, unless specifically marked with the archive bit set to 1

It would sety a new standard for microsoft reliability.

The powers of warrant and subpoena...

[dpilot]

>"Self-expiring" email schemes work essentially the same way: a trusted key authority generates and stores encryption keys for any and all email.
>Reading an email requires authentication to the key authority, which either returns the key or decrypts the email. After a preset time, the key authority
>purges the encryption key, after which the email encrypted with that key is theoretically unreadable.

Now one must ask, is the encryption key truly purged, or merely taken offline? If the former, at what point does the FBI require that the keys NOT be purged, and be merely taken offline? Or for that matter, what about system backups that retain keys? You've got to backup your keys, in case of a true system failure, because unexpired messages MUST be read. But you then need to take care to purge backups of keyspace appropriately, as well.

And those are one two more points of failure, as well as the others people are mentioning.

Honesty is simpler.

Aim doesn't work too well for privacy...

[mickeyreznor]

AOL is not exactly a bastian of security. If my university really, really wanted to, they could intercept all my aim conversations. AIM is only secure as the ISP you are using to connect to it.

Maxwell Smart

[Anonymous Coward]

The header reminded me of maxwell smart / inspector gaget: This letter will explode in 15 seconds. *poof*

Problems...

[pozar]

The issue that there are holes in the system have been well known for years. All of these systems are designed so that their use was assumed to be between "friendly" parties. Such as within a corporate environment. This is the case with snail mail, or any form of hard copy paperwork.

The problem was, how does one create a system to help with document retention policies that a company creates? Up until companies like Omniva, there wasn't a software process to handle electronic documents where you can say "I don't have that document as it has been destroyed through our retention process".

BTW... These products are not just for large companies like Microsoft. Individuals can benefit through it. Email to your tax accountant would be examples of mail that you may want to disappear after you file your returns. A number of great example on how folks have gotten screwed by electronic documents can be found in Jeffrey Rosen's book, "The Unwanted Gaze : The Destruction of Privacy in America".

What if the Recipient cheats?

[baanista]

If the recipient does make a copy of the email (copy by hand into a notebook or take a picture of the screen), his copy becomes the only existing copy of the message. He could then create a "smoking gun" message that you would be hard pressed to deny since the original message is now shredded. Plus, you already look suspicious since you sent the message in self shredding form.

Morals:
Don't send messages that would look bad on the front page of the NY Times.
Consider using PGP to sign all your messages.
Select nude beaches as the venue for setting up those illegal conspiracies.

Re:And here comes yet another bit of work for inte

[Aexia]

>>and (in the case of Washingtonians) sexual favors...

They're supposed to provide those? God damn. Why didn't anyone tell me!?

Archivists can't be happy about this

[D_Fresh]

From a security standpoint, this is great, but from a historical perspective, this is an archivist's nightmare. How do you write a biography of a famous figure of the information age without their email to go through? (I know, insert MS trial email joke here.) How many current biographies of presidents, CEOs, entertainers, etc. are based on their mounds of personal correspondence squirreled away in six million shoeboxes in the family archives? With self-destructing email, the possibility of finding such a treasure trove in email form just got even smaller than it already was.

rubberhose

[rabidcow]

Just use an encrypted filesystem and make sure you can trust the people you're emailing. Self-shredding documents will only work better if you're sending to someone you can't trust that doesn't know anything about computers.

It *won't* work

[Anonymous Coward]

Oh, brother. "You need to look what this is targeted at". It's targeted at pointy-haired, tech illiterate bosses who have access to the budget and like the idea of "shredable email" despite the fact that this is totally insecure, and the claims are ludicrous.

I'm sure the people trying to push this would *love* to get their propriatary email formats adopted in the business world so that they can put the squeeze on business. But from a tech point of view, this is bullshit.

Unless of course I'm using Trillian...

[Aexia]

In which case, I can automatically make chats logs of all my conversations.

Provided AOL actually lets me get into the system of course....

Been there, Done that.

[sharkey]

describing a self-shredding e-mail system.

Been out for years, described here. You can even get a demo version!

Self-Deleting Spam

[Ukab the Great]

Self-shredding e-mail is cool. But messages that kill themselves if they contain the strings "Get Out of Debt" or "Penis Enlargment" would really kick ass.

Re:Self-Deleting Spam

[Nf1nk]

The only thing better than self-deleting spam is self-deleting spammers.
send spam and die.... almost sounds like an anti-drug commercial

Common Sense and Reproduction of Docuements

[Myuu]

One of the guys from the 2600 radio program has the right idea.

Basically, any computer document is vulnerable to reproduction. Anyone can 'PRT SCRN' or copy and paste. Anyone can retype the document in word.

"...Many of these services can also restrict what recipients do with messages -- such as bar them from forwarding, copying or printing e-mail..."

This is the closest to the best I have seen so far. However, things don't have to be eletronic copies either, someone can always take a photograph of the screen or pick it up on video survelliance.

Encryption does not work, PGP is breakable and anything new is bound to be broken by someone. Add to that the fact that such lovely technologies as Canivorie and Magic Lantern as government controlled and funded.

It stuff is just a joke, nothing is private.

If you have AIM on a Macintosh...

[J'raxis]

Open up Preferences and click on IM, then click Automatically Save IM Sessions to Log File.

You were saying?

• Macintosh AIM logs. PC version has a Save option for each individual chat.
• ircle logs.
• BitchX logs.
• mIRC logs.
• pIRCh logs.
• And in programs that dont have a log or save feature, theres always select, copy, paste.

Need I say more?

Re:If you have AIM on a Macintosh...

[tkrotchko]

That wasn't my point.

Companies routinelly save email. It is monitored, recorded, and can be the basis for court action.

People CAN save IM logs, but since they're trivial to fake, they lack the same authority that email does.

Most companies do not monitor AIM conversations, and I'm not aware of AIM conversations being used as evidence in any court procedings.

Re:Sad News - Goatse.cx guy DEAD

[wheany]

he died from complications resulting from "Self-Shredding E-Mail".

A-UTCH!

Self-deleting e-mail is (mostly) smoke and mirrors

[Patrick]

I'm surprised CNN managed to get fooled by such obvious nonsense. They claim "Senders can destroy messages either remotely or automatically, without a recipient's consent or cooperation." This is nonsense.

A fundamental law of information sharing is this: if I can read (or watch or listen to) it once, I can read (etc) it forever. I have the message, and I have all of the keys necessary to view it. All I have to do is keep them. Even simpler, I can copy and paste text out of the document, or I can just print it. Faced with the knowledge that all of your e-mail will be deleted after N days, you are much more likely to print anything of lasting value.

For the recipient to choose not to copy, print, or keep the message, he is cooperating with you. There is no way to prevent re-readability when the recipient is untrusted. Period. Saying otherwise is like claiming to have discovered perpetual motion.

I titled the post "(Mostly) smoke and mirrors" because a self-deleting e-mail system works unless the recipient specifically subverts it. In a normal e-mail system, messages are saved forever unless specifically deleted. So the marginal improvement is one of default behavior, not one of security.

--Patrick

Why not? Because...

[zpengo]

The Outlook e-mail shredder too often gets jammed and reboots.

Thanks for the laugh

[xenocide2]

Its a pretty ironic post. Just so you know, I haven't had any prescriptions in a long time. And im pretty sure they're useless now. As for the legal fees: typically they're covered in the suit. Damages plus legal fees. Now you see why the lawyers always win.

And for the record, I'm no business man. Just a simple college student. But if you want to bring up conspiratical investigations of computers, just look at how the Steve Jackson Games incident turned out.

Re:Thanks for the laugh

[sphealey]

just look at how the Steve Jackson Games incident turned out.

Laughs indeed. I was a high school student when Mr. Jackson's business was seized. If my wife and I had let the boys run with the neighborhood dudes I could have been a grandfather by the time the case was resolved. Mr. Jackson's business was destroyed, he never received any significant compensation from the government, and the DA maintains to this day that he did nothing wrong (note that the LA DA recently tried to have a defendent put in jail for speaking honestly about her plea bargain after the sentencing - but apparently its OK for the DA to state directly contradict a court order).

Oh - and it is the next thing to impossible to sue a district attorney for malicious prosecution.

Ha ha.

sPh

Re:Thanks for the laugh

[sphealey]

As for the legal fees: typically they're covered in the suit. Damages plus legal fees.

Assuming you win - which is a big if - that is one possible outcome. Another possible outcome is "actual damages only", which may not amount to a lot. Or "reasonable attorneys' fees" - which may not equal what you have already been billed.

sPh

Re:Thanks for the laugh

[xenocide2]

Mr Jackson's business is doing well. Just recently they shipped an "anime" version of In Nomine. In addition, you're completely fucking wrong. Taken from the website.

"The judge's official decision was announced on March 12, 1993. District Judge Sam Sparks awarded more than $50,000 in damages to Steve Jackson Games, citing lost profits and violations of the PPA. In addition, the judge awarded each BBS- user plaintiff $1,000 under the Electronic Communications Privacy Act for the USSS seizure of their stored electronic mail. The judge also ruled that plaintiffs would be reimbursed for their attorneys' fees."

Somethings are better left unseen

[Anonymous Coward]

Do you really want to see some whitey tighties and a few dirty dishes? And you don't need root to view stuff on a windows box.

Is this Snake Oil Still Around?

[Crispin Cowan]

They've been pushing this crap for years, and it is still crap: It fails to stand up to an y reasonable threat model.

• If it is truly meant to make incriminating e-mail disappear, it will fail. Recipients of incriminating e-mail are likely to make durable storage copies, with a camera if nothing else. The crypto software cannot possibly prevent this.
• If it is only meant to make casual e-mail disappear, then it is a great deal of fuss for something that can be handled by simpler means, such as corporate policy, leaving e-mail on mail server spools, and having the system administrators delete it.

Crispin
----
Crispin Cowan, Ph.D.
Chief Scientist, WireX Communications, Inc.
Immunix: Security Hardened Linux Distribution
Available for purchase

Two main problems

[griffjon]

first, the already-hammered screenshot effect. Some systems (infraworks comes to mind) disable various features (cut, copy, paste, screenshots, etc) in the filesystem (which restricts it to Windoze) (but doesn't address the person with a video-out card recording on a VCR, or photos of the screen, etc.

Secondly, this means that the private keys to your documents are stored on a server accessible via a website! Boggle! Have we not learned anything about the general security of most web services? And even presuming it has technical security, how secure is their identification scheme? Passwords, mostly, with no out-of-band ID system. Hi, I'm Santy Claus. My password is 122502 .

Sigh. All these wonderful sounding ideas, and me without my cluestick.

Only on closed, proprietary systems!

[phliar]

instead of devising ways to destroy damaging emails that you send we should instead focus on not sending damaging emails.

Especially since there is no way to prevent it. The article glibly talks about "disabling screen capture" -- how? Maybe on some closed proprietary systems you can; but if I'm on Unix, I can always grab a screendump using xwd (if on X11) or script (if using a plain text connection). They're being blinded by the paradigm of Windows, which is that the displaying program is completely responsible for printing/saving etc.

How easily they forget the fundamental axiom of copy protection: if the user can see it, the user can record/copy/save it.

I could just point a camera at the screen and take a picture....

Wow. Well said!

[Anonymous Coward]

You should be a writer. ;)

Paper-shredder humor at Despair...

[Anonymous Coward]

anyone see Despair's new paper-shredder decals?

you can now convert your boring old office paper shredder into one of three types- an "employee suggestion box", "customer suggestion box" and my favorite, an "Enron Document Storage" system.

funny stuff. how long til they get sued?

Archiving may be a good thing..

[nolife]

Maybe saving all traffic through a mail server is a good thing. This could prevent someone from forging a mail or a reply. It's not hard to craft a mail message. The mail servers at my last company were all screwed up IMHO. They used HP Openmail servers with Outlook clients. You could craft emails to look like anyone from the company to anyone at the company with absolutely no tracking from the client end. All you had to do was send an Internet email with a From: header that someone in the company had, like some_user@company.com. When it got to our mail servers, it would recognized the From: field as an internal user, attach all the associated Openmail routing stuff, remove the SMPT stuff and send it to the specified recipient. Result? A forged email that appears in every instance to have come from an employee at the company, to an employee at the company and sent internally (no indication that it was sent from the internet and sent via SMTP). You could send mail from one supervisor to another explaining how you thought they sucked and no one would know the difference, we had >50000 employees so you could find other useful things to do with it. Hell, I don't even work there anymore, have no access to their network and I could still send mails between employees. I never got involved with our Openmail setup but I assume that it was configured that way by our headquarters and not the default behavior. I for one would like to think that logging and backing up of email would prevent someone from getting away with this or being blamed for something they did not do.

Again and Again

[virg_mattes]

Yet again, someone with little real-world experience reduces this to a simple moral issue. The comment of "If you don't send anything incriminating, you have nothing to fear" demonstrates only that the speaker has never been on the receiving end of a subpoena.

I'll say it once more, in simple language, for everyone who hasn't been in this situation, so pay attention.

A document retention policy (with document destruction schedules) is necessary even for a company that adheres strictly to the moral "up-and-up" to prevent lawsuits from inflicting huge cost and manpower burdens. For example, let's assume that you keep your records forever, so you have five year's worth of emails. Let's also assume that you don't have anything incriminating in these emails. Someone presses a sexual harassment lawsuit against you and subpoenas all of your email records relating to the lawsuit. Now, even though you didn't do or say anything wrong, you (not they) get to pay your IT person to dig through every email sent by every employee for five years (and an attorney to sit with him/her, fending off the plaintiff's attorney, who will also insist on sitting with him/her) just to prove that there's nothing there that relates to the lawsuit. Sounds expensive, doesn't it? With a retention policy that says email is to be destroyed after six months, you can answer the judge by saying, "our policy for email includes destruction after six months, so we have no records farther back than that" and thereby limit the scope of a subpoena (and the time and money spent fulfilling it). There are other reasons, including taking comments out of context and such, but as you can see, even companies with a perfectly sterling record benefit from such policies.

Virg

Mission Impossible 3

[CrystalFalcon]

I can see it now, Tom Cruise reading an e-mail which ends in "This message will self-destruct in five seconds." Or rather, the computer reading it FOR him in a synthesized voice à la the speaking clock in Spy Hard.

After that, we are treated to a typical Hollywood-esque deletion of an email (typically a rendering of a screen melting or so, accompanied by the sound of jam pouring out of its jar).

*idea* Hey, I thought of it first! I should have royalties for the linking "Self-destructing email messages" to the phrase "This message will self-destruct in n seconds"! (I wonder if ye olde Aussie Patent Works will grant me that, now that they're done with the wheel?)

Feeling

[virg_mattes]

> > Shredding paper always gives me this warm fuzzy feeling.

> The same feeling I get when I put body parts through the wood chipper.

Really? I'd think that would hurt a lot. And you can really only do that four times (or five, if you're a fellow) before you'd run out of parts.

Virg

Several problems:

[Anonymous Coward]

1. Can't the recipient make backups?
2. Since it's still a recipient-side shredding, the recipient can change his program to not allow this.
3. And if shredding was really made foolproof, then can't it be abused easily for virusses?

Re:Several problems:

[IAmNotMe]

The systems I'm familiar with require you to obtain a decryption key from a server every time you want to view the content. Once decrypted and viewable on the screen they deter you from saving/printing the content. Most can prevent the basic user from printing and select/copy operations (not hackers, not people with video capture boards, ...).

The decrypted content and key are never stored on any persistent media on the client. Assuming recipients are not taking pictures of the screen with their camera, the content can be "shredded" by deleting the key from the server. The only thing left on the client is an encrypted document (with no decryption key).

The goal isn't to absolutely prevent the user from printing/saving the document. Most ./ readers know that's provably impossible. The goal is to help control a company's information by guiding users in the right direction. There are a number of examples where this type of solution could have helped companies (e.g. Enron, Microsoft, Arthur Anderson, ...). If two company executives are communicating about how they'll cut off their competitor's air supply, they both probably want that communication to be kept secure.

There are a lot of other issues, some of which were touched on by the AP article. For example, you have to maintain a retention policy on your server backups. You also have to worry about forensic analysis on the server hard drive, etc. These are somewhat solvable (burn the backup tapes after your corporate retention policy says it's OK, clean and rebuild the server database, etc.).

why encourage criminal behavior?

[mkcmkc]

Instead of allowing/encouraging corporations to dispose of evidence of their criminal behavior, wouldn't it make more sense to require them to preserve all of their documents for a limited time? (Limited in the Disney sense--175 years.)

Corporations are not people and they do not have a similar sense of moral compunction. Their rights should therefore be heavily restricted compared to us.

Mike

A Better way to do it - anon verification

[argoff]

A better way to do it is to have a system where all the emails are anonymous - and at the end of the message a one time SSL url (possibly javascript) that would allow the recipient to verify it once against it's md5 sum. This way it wouldn't matter what the email said, because anybody could have faked it. Only the person who checked knows for sure if it's real.

Re:A Better way to do it - anon verification

[Knobby]

Wow! You think we have SPAM problems now?, imagine what anonomous email services would do..

Re:A Better way to do it - anon verification

[argoff]

There may be a way to deal with spam too. A sender would manually half to set the verification, it could ask a simple question, or be a javascript that would require a keyboard entry.

when are people going to realise...

[DuncanMurray]

..that if you can read a message 'just once', then you can keep a copy of it. And if it's a juicy message which the sender thinks will be destroyed in day or so, you can bet that they will keep a copy of it.

Lame - sponsored by people who dont have a clue.

"Idiot Proof" tm

[Anonymous Coward]

The real purpose for email shreding is in the liability. A company wants to comply with its obligations to it's customers to destroy sensitive documents in-spite-of its employees. My boss is a perfect example. He lives out of his deleted box. From a company standpoint-iso 9000 and process controls- that is a terrible thing. Deleting email forces people to properly document what they read. From a coperate point of view your cute letters to girlfriends, chain lettters, jokes, ect. are all liabilites. It's nice to let you use them but why should the company get in trouble over them. Also, the issue is proof of destruction. Having electronic automated policies in place so that if the lawyers do come, you can prove to a reasonable judge that your company has made effort to comply with supeonas without stopping the entire business to go thru every PC hard drive and backup tape. A $10,000 wrongfull termination suit could cost $50,000 in fees at a 500 person company if every computer had to be searched.
The alternative is to have the MIS department read each and every email (you signed that paper when you hired in!) and sort it for each employee.

Am I missing something?

[Anonymous Coward]

This will require changes that will never happen. The protocols used to handle mail were established and pretty much set in stone before 90% of the people currently on the internet even knew what it was. The way things work now, once email is sent, you have no control. Period. Sure there are some proprietary systems that let you send out "delete that message" messages or request return receipts and the like but complying with those requests is entirely voluntary. I never send back return receipts unless I know the person. My email program pops up a warning that says, "Yo! This dude wants to know that you've read this email. Should I tell him?" Similar messages pop up when people try to retract email.

The only way to take this control away from the recipient would be to have a central email pool which is controlled by the senders. But even that doesn't stop the recipient from printing the email or copying it to a local file.

Once email is sent, it's out of your hands.

Re:Why not? Because...

[Orre]

Yeha that has hapend to!

Those micro people :-)

How about....

[Woodmeister]

#shred ~/mail/*

That should fix it!