Slashdot Mirror
The Pentagon Says It Will Start Encrypting Soldiers' Emails Next Year (vice.com)
An anonymous reader shares a Motherboard report: Basic decade-old encryption technology is finally coming to Pentagon email servers next year. For years, major online email providers such as Google and Microsoft have used encryption to protect your emails as they travel across the internet. That technology, technically known as STARTTLS, isn't a cutting edge development -- it's been around since 2002. But since that time the Pentagon never implemented it. As a Motherboard investigation revealed in 2015, the lack of encryption potentially left some soldiers' emails open to being intercepted by enemies as they travel across the internet. The US military uses its own internal service, mail.mil, which is hosted on the cloud for 4.5 million users. But now the Defense Information Systems Agency or DISA, the Pentagon's branch that oversees email, says it will finally start using STARTTLS within the year, according to a letter from DISA. DISA's promise comes months after Senator Ron Wyden (D-Oregon) said he was concerned that the agency wasn't taking advantage of "a basic, widely used, easily-enabled cybersecurity technology."
None of this, of course, is to say that encryption of email itself has been un available. Indeed I use the credentials on my CAC (Common Access Card) to encrypt most if not all of my email before sending it.
If you want news from today, you have to come back tomorrow.
...I think people have misconceptions about how exactly emails works. It's not bounced around from server to server until it gets to it's destination.
It's delivered directly to whichever server(s) your specified in your domain's mx record. So emails cannot simply be intercepted by whomever just like that.
However by default it is sent as clear text, which means in theory your Tier 3 (your ISP), tier 2 and tier 1 providers could intercept those emails since the packets have to pass through their networking equipment to get to their destination. But if most confidential emails are internal, then you could setup VPN tunnels between servers and that solves that problem.If you are sharing top secret or confidential military info , you should be encrypting every email you send via your email client, regardless if the servers transmit it in clear text or not.
StartTLS is no panacea, an active MITM peer can simply strip the request.
Actually, no.
- if you set to StartTLS to "required" (or if you use IMAPS), your client will only go further if a successful SSL/TLS encrypted link is established with the server.
The MITM can't just strip the request, the client will refuse to connect.
- SSL/TLS links will fail if they are not signed by a recognized authority.
The attacker needs to have a key that is signed by a trusted authority (and thus either needs to have a certificate issuer in cahoots - has actually hapenned with some cert authorities in the past - or needs to manage to get control of the e-mail server (thus can actually access without MITM. OR can steel the original private key and freely MITM. OR can generate a new key and have it at least non-EV signed and use this new key for MITM)
MITM is the main class of problems that SSL/TLS can succesfully fight (when done right). /certificates) )
(As opposed to "privacy" class of problems, which are better handled with end-to-end encryption, like PGP / GPG (web of trust) or S/MIME (public key
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Only the connection between the mail client and the mail server is encrypted. Once it leaves the mail server to go to the recipient it is no longer encrypted.
DoD networking isn't quite the same as what's available to the rest of us.
"Normal" stuff goes over something called NIPRNet. It uses Internet protocols and is connected to the Internet via a few gateways, but if you are emailing from .mil to .mil, it stays on NIPRNet. So it's a bit like emailing another employee at work - The message stays within your employer's network so it's hard(er) to MITM.
Important things go over SIPRNet, JWICS or another more secure network. Encryption in-transit over those networks has been standard since those networks were built, and is done via hardware devices.
Yes, you should not send official communications unencrypted. But even sending personal information unencrypted may be bad. If one person emails his wife saying that he is stationed at base X then that is no big deal. But if a thousand people say that they just got stationed at base X within a short period of time then that might be bad. There is a reason why during WWII before d-day they officially put Patton in charge of an inflatable and fake army. They were trying to convince Hitler that Patton's attack would be the real d-day and that any attacks before then were just diversions. If they had email back then, and Hitler noticed that none of Patton's troops were actually sending email to their family, then WWII might have had a different outcome.
Are they demanding a backdoor to be build on those too?
It would depend on who is talking or emailing. Who, why and how could be of great interest to other nations. .com in the USA? .mil related material as they got work deep in the .com and have total trusted access for work? .mil accounts (via some external agency or cover .com or outsourcing partner) and the trusted to/from/content parts.
What could go wrong?
Someone on a ship sends an email home with the final server been a very average for profit
Some faith or cult member or dual citizen makes a copy of all
Another nation slowly builds a database of all in use
Interesting gossip and news might filter out over years given the amount of data collected.
Only needs one person and their hidden server after getting a trusted job for any big telco. No buddy system in the private sector and all that over time working support issues is a cover.
The use of social media or internet use?
Other nations set up psychological warfare accounts to attract the attention of an average mil users online?
Instead of spies been just off base waiting to turn people in bars and clubs they are now online?
Spies on base give lists of sites that all the interesting mil people visit, the gossip about lifestyles and people get chatting with new friends.
The 1950's mil human efforts in a digital world.
Domestic spying is now "Benign Information Gathering"