And why every law school should teach everyone about encryption before any other “IT skills”

HERE IS a disturbing trend which is shared among pretty much all lawyers and other ‘legal’ professionals. I know because I checked. I also know because I saw how my friend, Pamela Jones (the paralegal behind Groklaw), got spooked by the spooks and stopped writing online after she had rejected my offer to use encryption about 8 years ago (saying it would only attract more attention). These are smart people who seem to be ignoring the threat of surveillance even when the threat is out there in the open, thanks to people like Edward Snowden. A lot of what Snowden showed had been known to me for years, but now there is undeniable truth which even the NSA’s chronic lies cannot cover up and shed uncertainty on. Ignorance is no longer a valid excuse.

I currently have a very strong case against a decision from the British government. I am sure I’ll win, the only question is when and at what cost (I have already spent thousands of pounds on it). I am not going to elaborate on it until the case is over, whereupon I will also release sensibly redacted papers (removing personal information) and explain the abuses which I have become aware of and personally suffered from. These abuses have impacted at least 4 people that my solicitor alone (an activist against torture) is working with. Nationwide, therefore, there may be thousands of such victims. It’s hard to say for sure how widespread this type of abuse has become, but one can estimate by extrapolation. In the future I will also file a formal complaint about it, then pressure my Member of Parliament to take action (not just yet).

Now, let’s deal with the key issue — or ‘beef’ — of this post. As in any legal case, papers are being sent back and forth, often electronically. It’s a practical thing to do because of speed (instantaneous for images and text). The stuff which the solicitor and I have already exchanged over E-mail is known about to the respondent, which has copies (this includes a request for appeal). Some stuff does not necessarily need to stay under the table, especially when it is accessible to both sides. Just as one requires no anonymity when purchasing a flight ticket (because the ticket itself already eliminates any chances of anonymity), for some documents it is fine to be visible to the opponent. There is not much to lose there.

But then there’s more sensitive stuff, like strategy.

Lawyers and barristers should always send sensitive stuff encrypted and sent over securely (to secure client-solicitor privacy/privileges). E-mail is one of the least secure methods of transferring data. It’s almost as thought it was designed for surveillance and profiling/linking people, but in reality it just got exploited by spooks and the protocols never adapted to counter these inherent deficiencies (encrypted mail still exposes the identity of the sender and recipient/s). Face-to-face or snail mail are better because bugging is hard and in the latter case it’s hard to achieve un-obtrusively, e.g. opening envelopes and re-sealing them. Since GCHQ and some government departments (e.g. Home Office) work together on increasing surveillance, right now under the guise of ‘emergency’ as if we’re in wartime, we can assume — pessimistically — that they may be studying the cases against them based on interception and preparing themselves based on this prior knowledge, or increased awareness. This is of course not acceptable, but then again, we already know that obeying the law is not our government’s best strength. That’s a debate for another day. In another circumstance one could probably chat or write about these issues (I know that my solicitor too advocates human rights at some capacity), but this is not the subject of this post.

As one who write prolifically on issues of national security, I have good reasons to suspect I have no privacy, unless technical measures are taken to protect it. I encrypt mail where possible. But I depend on others doing the same. Encryption is not a one-end preference, it needs to be agreed on and embraced by both ends.

People don’t want to jeopardise a case by unnecessarily giving away strategic arguments to the opposing side; I have seen people (usually in the US, some of whom I know online) on whom subversive means were used (illegal actions by those in power) to intimidate, harass, libel, etc. Completely bogus charges can be made up and hyped up in the media, framing of a person is very common (digitally too), and drainage of one’s resources through legal fees is also a common tactic of vendetta.

Any solicitor who wants to take on the government of his/her country absolutely must learn to encrypt. But this should not be limited to cases like these. Several months ago it turned out that the US government had spied on a US law firm which was working to advise a foreign nation on trade negotiations (this is a corporate matter). We know these types of abuses do happen in the West, so lawyers must learn to protect themselves. Unless they can sue to stop these practices (illegal actions by their government), they will need to adopt technical means of overcoming these dangers.

Perhaps I have become too cynical or too pessimistic when it comes to my government obeying the rule of law, but based on some recent revelations, the record supports me. We are living at times of lawlessness for the rich and powerful and oppression (through tyrannical laws and overreach) for the rest.

hat head of CIA has to use Gmail shows while better systems exist,” writes Jacob Applebaum, “network effect encourages interfacing through weaker systems” (Applebaum is a world-renowned privacy activist).

Applebaum speaks about this article (among others), which highlights a point I raised last week. And “the article completely misses PGP,” wrote my friend iophk, “and the reasons for PGP.”

E-mail privacy is not to be assumed; in fact, it hardly exists at all, unless two parties (or more), both at the sending and the receiving end/s know what they do. We really need to rethink E-mail as a communication tool. At present, it’s good for those who spy on us, it’s not good for its users.

HE SNAIL MAIL services are having a hard time. They are becoming obsolete and rather than improve in order to compete they have only become overpriced and they always underperform. It’s not just Royal Mail, this is a universal problem. Breaking up with the mail system altogether is hard for obvious reasons; quiting E-mail because it is not so reliable [1, 2] has the same issues because particular companies, utilities for example, insist on using postboxes (although some are moving towards E-mail, which isn’t much better).

The mail services are not trying to deliver as they should, so essentially they quit even showing what makes them more reliable than their competition. Why even bother with them? A lot of stuff can be shipped in alternative, more reliable means, even reproduced by printing (notably in forms that can be dealt with digitally or maybe scanned after a manual process).

The level of disturbance or even agony due to lost/missing mail is very high. In the majority of cases it seems to be happening or seems to be ending up as a failure. It doesn’t have to be like this. I am a resident at a place near the Town Hall/Centre (nothing difficult to find or reach) and I found it nearly impossible to receive packages, even when I am at home waiting by the intercom. Over the past year or so only 2 out of about 8 registered parcels sent to this address actually reached me. The post people don’t buzz me (I work at home) and eventually they return important packages to the sender or keep them at the warehouse. It is not possible to contact the post office to get the packages in alternative means, not even a note is left to suggest one does this. This is becoming a systematic and very serious issue and attempts to reach Royal Mail by phone are pretty pointless; it is exceedingly hard to find the phone numbers (they hide those) and once a number is finally dialed a person is hard to reach; they try to just automate an already-defunct system. Over the phone, one needs make sure s/he got the number/s and code/s right because their voice recognition is terrible, leaving one just wasting time talking to a robot and navigating through voice menus.

After a lot of struggle, I did mange to actually speak to a person from the post office (yes, they exist! And it’s not outsourced!). I spoke to an agent at Royal Mail, the national (British) mail service, who also kindly checked the Parcel Force tracker just in case. She insisted that we must speak to another post office, so it’s obviously becoming a game of ping-pong for them, which means to the client that s/he will have to spend dozens of hours of work trying to restore ‘justice’. I spoke to them for 10 minutes with a clear need to insist very strongly that they take action immediately, as their excuses are bad. They claim that the Office has no record of the package which is supposed to be track-able (registered mail), so they must urgently do something, right? But no. In a perfect (or better) world, they would look into it and issue compensation, but when there’s a monopoly on the mail system and the customers are assumed not to be right, no wonder the service is terrible. Time after time they get away with the same excuses, the same terrible service, and the same reduced productivity to everyone around.

People may be losing their jobs as the mail services implode, but society will have better services — i.e. ones that actually work and put the customer first — replace those. For me, the mail is service is something to avoid by all means possible. It’s just trouble. I would rather send and receive no parcel than deal with this ‘random delivery’ mode.

FEW months ago I started to phase out E-mail to an extent. I still use E-mail, but it’s just not a communication tool of choice. The frustration of falsely-flagged (and filtered) messages has convinced me that I made the right choice. Why should I spend half an hour in vain trying to just (re-)E-mail a friend messages that he did not receive for months because his ISP shot these messages down? This whole E-mail chaos (caused mainly by SPAM that compromised Windows boxes spew out) leads to degradation of relationships between people, it not only interferes with work (data loss). When people think that they get ignored simply because their E-mails are not received on the other side, then perhaps it’s time to give up on E-mail, then find a more reliable medium. Last month I reconsidered my position on E-mail, but after seeing it ruining more relationships — simply due to the loss of many messages in a row — I decided to just put friends before E-mail, even if that means not using E-mail unless there is no other choice.

Have any of your friendships been harmed by E-mail problems? Could it possibly happen without you knowing about it (due to communication problems, obviously)?

In order to decease dependence on E-mail, starting today I will have an automated response channeling people to other routes of communication. Here is the template:

From: Roy Schestowitz – Autoreply Message

Re: %subject% – Message Received

%from%,

I am in the process of replacing E-mail correspondence with other, more effective & real-time means of communication. I still read my E-mail, but I do not read it regularly. I will collect messages about once a week, which makes manual filtering of spam a lot faster.

If you are willing to have a conversation with me, please consider creating/using an account in identi.ca < http://identi.ca/ > (or Twitter) where I can be contacted by handle @schestowitz. Alternatively, you can find me on IRC, under the Freenode network at channel #techrights

If the E-mail is urgent, please send mail to [redacted], which I will read more regularly. For an explanation of why I prefer to phase my E-mail accounts out, see < http://www-cs-faculty.stanford.edu/~uno/email.html >

E-mail is still necessary for management of online accounts and sometimes passing of files (there are other means for that too). Due to high volumes of spam & phishing, E-mail is also dangerous. I wrote a great deal about E-mail since 2004. 6 years later I’m giving up.

ODAY I received some post. It was a familiar envelope with my handwriting. It turns out that it could not be delivered. The envelope said:

“Not available at this address, return to sender”

What was it? A cheque that I had sent in December 2004 to Matt Mullenweg. How on earth did it take 2.5 years for a letter to ‘bounce’? That was eerily funny/strange.

I am having some bitter-sweet feelings as I make a certain change. And this change is an easy one to make. Apart from taking my Web-based mail back to the desktop, I have also begun migrating my RSS feeds from RSSOwl to Thunderbird 1.5.x. It saddens me. I have been with RSSOwl for almost two and a half years. I contributed a little bit to the project, wrote about it, and recommended it to people. Having just tested some things in Thunderbird I came to realise that, as a feeds reader, it boasts several features that would greatly help my reading routine.

While I still have RSSOwl (and I might occasionally use it), the move to Thunderbird seems inevitable. But I am only having second thoughts because of export/import issues. Kudos to Benjamin Pasero for a wonderful tool which I may still regularly use. RSSOwl Development has been slow in the past year and I have remained loyal nonetheless. Now I’m just too tempted to ‘change teams’.

Update (the ‘morning after’): After a while of careful consideration, weighing the pros and cons, I decided to use the best of both worlds, at least for now. RSSOwl is good for quick opening of many pages in new tabs, whereas Thunderbird offers nice HTML previews. It also sports retention of old items which otherwise ‘leak’ out of sight. By mixing and relying on the traits of both applications I will probably get the best overall experience. Unless of course they mature to the point where one becomes obsolete and replaceable… let’s just wait and see.