In a letter to a watchdog lawmaker last week, the Department of Defense confirmed that it will finally, in 2018, join the 21st century and use a popular basic encryption tool to help make emails to and from .mil addresses more secure. What does that mean for your badass email@example.com account? Lets break it down.
The Defense Information Systems Agency confirmed to Democratic Sen. Ron Wyden of Oregon, a Senate intelligence committee member, that by next year, the Pentagons .mil email will implement STARTTLS for enhanced email encryption a longstanding application that Wyden has called a basic, widely used, easily-enabled cybersecurity technology.
The move came after years of poking around by the reporters at Vice and some tough talk from Wyden questioning how the militarys 4.5 million-user cloud-based email service had never implemented STARTTLS before.
I cant think of a single technical reason why they wouldnt use it, one former U.S. Special Operations Command IT whiz told Vice. A hacker and former Marine similarly told the outlet: The military should not be sending any email that isnt encrypted, period. Everything should get encrypted, absolutely everything. Theres no excuse.
Vices Motherboard blog has a nice breakdown of STARTTLS, which is whats called an opportunistic encryption app. Basically, when your email server and a recipients email server hook up to exchange info, STARTTLS sets up the exchange on the fly as an encrypted transaction. When your emails are sent out into the world without encryption, opportunistic or otherwise, they are as readable as postcards, per Vice:
When your email provider doesnt support STARTTLS, your email might be encrypted going from your computer to your provider, but it will then travel across the internet in the clear (unless you used end-to-end encryption.) When your email provider, and the email provider of the person youre sending the email to, both support STARTTLS, then the email is protected as it travels across.
Kinda, yeah, but not super-big. STARTTLS has been around since 2002, and Gmail first implemented it in 2004. Vice points out that Google and your other popular private email and social-media sites including Microsoft, Yahoo, Twitter, and Facebook have already integrated STARTTLS. In the wake of the NSA surveillance disclosures by contractor Edward Snowden, Facebook led a very public charge to get more sites to use STARTTLS to keep the feds from looking at your emails.
So theres nothing new here; DoD is simply catching up to a basic encryption technology thats been around for a decade and a half long enough now that the vast majority of emails you send and receive communicate with another STARTTLS-equipped server. It has some weaknesses, and it aint PGP encryption, but its a good start.
Well, you probably already know from experience that no Pentagon-level IT policy changes overnight. But more than that, keeping mail.mil STARTTLS-free has also given the military a lot more freedom to snoop through your emails a freedom DISA was probably reluctant to give up. In a letter to Wyden in April, DISA deputy director Maj. Gen. Sarah Zabel said the agencys software regularly sweeps incoming soldier email for phishing scams, viruses, and the like.
DISA currently rejects over 85% of all DoD email traffic coming from the Internet on a daily basis due to malicious behavior, Zabel wrote. We also inspect for advanced, persistent threats using detection methods developed using national level intelligence. Many of these detection methods would be rendered ineffective if STARTTLS were enabled.
In fact, top civil liberties groups like the ACLU have long called for government agencies to use encryption not just to protect their sensitive info, but to help establish a broad pro-encryption consensus in America: If the government gets to encrypt its data, then why shouldnt free American citizens get the same right? Such a norm might not sit well with government agencies, like the NSA, CIA, and FBI, who rely on signals surveillance to further intelligence and investigative aims.
Beyond that, if the military has to triage its IT systems for info security, its probably going to tackle unclassified email servers last, after focusing on secure and closed systems like SIPRNET, the National Military Command Center, and Link 16 tactical data transmission networks.
Well, that was DISAs initial suggestion: Using STARTTLS could make it harder for the Pentagon to catch and neutralize viruses in your emails. But its decision to migrate everyones mail.mil accounts to a new STARTTLS gateway by July 2018 suggests whatever kinks the application threw in DISAs surveillance have now been worked out.
In the meantime, the service is still adamant that you shouldnt be passing any sensitive info or clicking any weird links in your nonsecure mail.mil account in the first place, so, you know, keep not doing that.
Yeah: Download less porn. Seriously. Even if its virus-free, that much cant be healthy, man.
Also, remember the cardinal rule of opsec:
- What Is Encryption? | Surveillance Self-Defense - December 4th, 2017
- Comodo Disk Encryption Download - softpedia.com - December 1st, 2017
- Encryption - Simple English Wikipedia, the free encyclopedia - November 24th, 2017
- BitLocker Drive Encryption Overview - technet.microsoft.com - November 23rd, 2017
- The Encrypting File System - technet.microsoft.com - November 18th, 2017
- FBI cant break the encryption on Texas shooters smartphone - November 13th, 2017
- DOJ: Strong encryption that we dont have access to is ... - November 13th, 2017
- DOJ Fires Up New War With Apple Over Encryption - November 12th, 2017
- Security Awareness - Encryption | Office of Information ... - October 15th, 2017
- Data Encryption and Decryption (Windows) - October 14th, 2017
- Trumps DOJ tries to rebrand weakened encryption as responsible ... - October 11th, 2017
- How to encrypt (almost) anything | PCWorld - September 22nd, 2017
- Private Internet Access | VPN Encryption - September 21st, 2017
- Encryption Substitutes | Privacy | Encryption - September 21st, 2017
- Data Encryption: Hardware & Software Security: Online ... - September 21st, 2017
- How To Enable BitLocker Drive Encryption In Windows 10? - September 21st, 2017
- PGP Encryption Tool - iGolder - September 21st, 2017
- encryption - How to encrypt String in Java - Stack Overflow - September 21st, 2017
- Encryption Software Market, Size, Trends and Forecast 2020 - September 21st, 2017
- Encryption Definition - Tech Terms - September 20th, 2017
- Why You Should Be Encrypting Your Devices and How to Easily Do It - Gizmodo - September 6th, 2017
- Black Hats, White Hats, and Hard Hats The Need for Encryption in Mining and Resources - Australian Mining - September 6th, 2017
- How can enterprises secure encrypted traffic from cloud applications? - TechTarget - September 6th, 2017
- Encryption Explained - Arizona Daily Wildcat - September 6th, 2017
- News in brief: Call to link encryption to ID; Facebook maps everyone ... - Naked Security - September 2nd, 2017
- 'Independent' gov law reviewer wants users preemptively identified before they're 'allowed' to use encryption - The Register - September 2nd, 2017
- High-Dimensional Quantum Encryption Performed in Real-World ... - Futurism - September 2nd, 2017
- It's Time to Replace Your Encryption-Key Spreadsheet - Data Center Knowledge - September 2nd, 2017
- Legislation to limit smartphone encryption 'may be necessary,' deputy AG Rosenstein says - Washington Times - August 31st, 2017
- Cloud Encryption Market by Component, Service Model, Organization Size, Vertical And Region - Global Forecast to ... - Markets Insider - August 31st, 2017
- Cipher Suites: Ciphers, Algorithms and Negotiating Security Settings - Hashed Out by The SSL Store (registration) (blog) - August 31st, 2017
- Encryption in Office 365 - Office 365 - August 29th, 2017
- Need-to-Know Only: Use Encryption to Make Data Meaningless to ... - Security Intelligence (blog) - August 29th, 2017
- Four strategies to prevent data encryption from hijacking your network - Digital News Asia - August 29th, 2017
- Amber Rudd is wrong - real people do want end-to-end encryption - ITProPortal - August 29th, 2017
- Why encryption is for everyone - IFEX - August 29th, 2017
- 4D quantum encryption successful in first real-world test - New Atlas - New Atlas - August 29th, 2017
- For the First Time Ever, Quantum Communication is Demonstrated in Real-World City Conditions - Futurism - August 26th, 2017
- High-Dimensional Quantum Encryption Takes Place in Real-World ... - Photonics.com - August 26th, 2017
- Hedvig Bakes Encryption into Software-Defined Storage Platform - IT Business Edge (blog) - August 26th, 2017
- Hedvig storage upgrade adds flash tier, encryption options - TechTarget - August 26th, 2017
- How to use EFS encryption to encrypt individual files and folders on Windows 10 - Windows Central - August 26th, 2017
- Cloud Encryption Market Worth 2401.9 Million USD by 2022 - Markets Insider - August 23rd, 2017
- To Protect Genetic Privacy, Encrypt Your DNA - WIRED - August 23rd, 2017
- Data Encryption in OneDrive for Business and SharePoint Online - August 21st, 2017
- Researchers use encryption to keep patients' DNA private - Engadget - August 21st, 2017
- Additional proof that Lancaster County Commissioners should reconsider encrypting police transmissions - LancasterOnline - August 21st, 2017
- iPhone Secure Enclave firmware encryption key leaked - TechTarget - August 21st, 2017
- Encryption, speed push the modern mainframe into the future - TechTarget - August 21st, 2017
- Hardware encryption vs software encryption: the simple guide - Kroll Ontrack UK (press release) (blog) - August 21st, 2017
- Encryption Technology Could Protect the Privacy of Your DNA - Gizmodo - August 21st, 2017
- Beginner's guide to Windows 10 encryption - Windows Central - August 18th, 2017
- Encryption key for iPhone 5s Touch ID exposed, opens door to further research - AppleInsider (press release) (blog) - August 18th, 2017
- How security pros look at encryption backdoors - Help Net Security - August 18th, 2017
- The Laws of Mathematics and the Laws of Nations: The Encryption Debate Revisited - Lawfare (blog) - August 18th, 2017
- 72 percent of security pros say encryption backdoors won't stop terrorism - BetaNews - August 18th, 2017
- Ex-MI5 Boss Evans: Don't Undermine Encryption - Infosecurity Magazine - August 14th, 2017
- Despite end to end encryption, apps like WhatsApp, Messenger are still vulnerable to hacking: Study - Firstpost - August 13th, 2017
- What is Encryption? (with pictures) - wiseGEEK - August 12th, 2017
- Ex-MI5 chief warns against crackdown on encrypted messaging ... - The Guardian - August 12th, 2017
- Former UK security service head says weakening encryption would be too dangerous - 9to5Mac - August 12th, 2017
- News in brief: facial recognition planned for Carnival; spy chief backs encryption; ginger emoji planned - Naked Security - August 12th, 2017
- Avoid getting lost in encryption with these easy steps - We Live Security (blog) - August 12th, 2017
- Here's why IBM Z Mainframe Wants to Encrypt the World - Edgy Labs (blog) - August 10th, 2017
- Symantec Announces Plesk Will Integrate Symantec Encryption Everywhere Security Into Its Website Management ... - Business Wire (press release) - August 10th, 2017
- Australia: Shelve Proposed Law to Weaken Encryption - Human Rights Watch (press release) - August 6th, 2017
- IBM India Helps Create Breakthrough Encryption Technology That's Completely Hacker Proof - Indiatimes.com - August 6th, 2017
- Letter to Prime Minister Turnbull re Encryption and Human Rights - Human Rights Watch (press release) - August 5th, 2017
- Zscaler Finds Hackers Using SSL Encryption in Malware to Hide ... - eWeek - August 5th, 2017
- HBO Hack Highlights Importance of Encryption, Data Governance - eSecurity Planet - August 3rd, 2017
- UK flip-flop on encryption doesn't help anyone - CNET - August 3rd, 2017
- UpVote: Turkish regime jails IT trainers in encryption clampdown - Ars Technica UK - August 3rd, 2017
- Telegram messaging app strikes deal with Indonesia on encryption - Digital Trends - August 2nd, 2017
- Encryption is for 'Real People' - Human Rights Watch - August 2nd, 2017
- We don't want to ban encryption, but our inability to see what terrorists are plotting undermines our security - Telegraph.co.uk - August 2nd, 2017
- Real people don't need encryption - Fudzilla - August 2nd, 2017
- Ex-NSA boss questions encrypted message access laws proposed by Malcolm Turnbull - ABC Online - August 2nd, 2017
- Facebook's Sheryl Sandberg: WhatsApp metadata informs governments about terrorist activity in spite of encryption - CNBC - July 31st, 2017
- Commissioners need to rethink encryption - LancasterOnline - July 31st, 2017
- Ex-NSA chief Chris Inglis backs government's encryption push against Apple, Facebook - The Australian Financial Review - July 31st, 2017