Slashdot Mirror
Limited Email Surveillance Approved
MrNougat writes "CNet reports that some surveillance of your email has been permitted by U.S. District Judge Thomas Hogan in Washington, D.C., without first requiring any evidence of wrongdoing. Curiously: 'instead of asking to eavesdrop on the contents of the e-mail messages, which would require some evidence of wrongdoing, prosecutors [of the US Justice Dept.] instead requested the identities of the correspondents. Also included in the request was header information like date and time and Internet address--but not subject lines.'"
http://www.pgpi.org/
Look up a little about SMTP. You can send e-mails to addresses not contained anywhere in the e-mail header. The sender simply has to put in "RCPT TO: someone@somewhere.something" or even simply the username on the server and it'll get to them, no matter what it says in the To.
Try it. Telnet to your SMTP server and send an e-mail to yourself:
EHLO localhost
MAIL FROM: valid@email.address
RCPT TO: destination@email.address (or username on the system)
DATA
(From, To, Subject, etc would go here)
Any message
.
QUIT
This will send an e-mail with no To, or Subject in the header (it should contain the From at least). The only restriction you may have is that the SMTP server may do checks on the MAIL FROM or RCPT TO lines, which will restrict the addresses you can send to/from. If it's running AUTH, you may have other troubles too.
Two words:
Mixmaster remailer.
http://www.haxwell.org
This article is neither interesting, nor informative. In fact, the summary is very misleading. The application for a pen register requires, "a certification by the applicant that the information likely to be obtained is relevant to an ongoing criminal investigation being conducted by that agency." No evidence of wrongdoing, my ass.
Plus, as the article mentions, it was the intention of Congress to bring these type of "trap and trace" orders for email in line with phone lines when they amended the law more than 4 years ago, so this isn't really news.
The Supreme Court ruled as early as 1979 that the fourth amendment doesn't require a warrant for a pen register, because you have no expectation of privacy in what phone numbers you call. I can't fathom any reason why federal investigators should have to meet one standard to get a pen register on your phone, and a different standard to get the same information for your email.
Si vis pacem, para bellum
The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
http://www.gnupg.org/
Penny - plain text accounting