The below Register article " America - a nation of corporate email snoops" reports on the trend in email snooping by US corporates. I'll spare you the trouble of reading it - 44% of large companies pay someone to monitor email, and 38% regularly audit the content.
In the search for the eavesdropper, it was always clear that this was a real threat. A small one, but a real one. Unfortunately, the entire crypto industry got distracted on protecting against another threat, the MITM, which was too difficult and obscure to be real. Consequently, the net community fielded systems that didn't really work because of their grossly costly rollouts, and eavesdropping wasn't covered in any real sense (1% of servers use SSL, and 2% of email is encrypted, after a decade of trying).
Since the dawn of Internet crypto time, we've now gone from eavesdropping as a small threat to a potentially large threat. What is really worrying is not so much the corporate eavesdropping, but that we are on the verge of seeing massive ISP-based eavesdropping. All to be reported with a shrug and smile. All because Internet security experts are convinced that the MITM is a threat.
By John Leyden
Published Tuesday 27th July 2004 17:16 GMT
Forget Big Brother, US conglomerates are paying low-tech snoopers to read workers' emails.
According to research from Forrester Consulting, 44 per cent of large US companies (20,000 workers and above) pay someone to monitor the firm's outgoing mail, with 38 per cent regularly auditing email content. According to the study - reported without question in the mainstream press - companies' motivation was mostly due to fears that employees were leaking confidential memos.
Proof, were it needed, that your own staff are the biggest security risk. If the study is to be believed, the dystopian visions of films such as Brazil and George Orwell's 1984 are an everyday reality of today's corporate America. Yes, that's right: "privacy officers" are scouring your email looking for incriminating snippets among the flirtatious email, jokes exchanged between mates and the small amount of work-related stuff you might send during the course of the day.
Scary stuff. And we're asked to believe they are often doing this with little recourse to technology. Even scarier.
Paranoid Android
Joking aside, the 44 per cent figure on corporate snoops struck us as very high. So we got in touch with Forrester asking it to justify its conclusions. Forrester directed our enquiries towards Proofpoint, the email filtering firm which sponsored the research. Forrester Consulting, the custom research arm of Forrester Research, did the leg work for the survey but it was Proofpoint which wrote up the final report.
So how does Proofpoint explain its findings on email monitoring? It's all to do with complying with external regulations.
A wide variety of external regulations applying to email are driving the monitoring trend, according to Keith Crosley, director of corporate communications at Proofpoint. He cited US regulations such as HIPAA (which regulates the handling of personal health information) and Gramm-Leach-Bliley (which regulates the handling of private personal and financial information) as examples.
"It's because of these concerns that companies employ staff to monitor outbound email. Technology solutions for detecting confidential information or for detecting other breaches of email policy or external regulations have, to date, not been particularly effective or popular so the best recourse that companies have has been to have human beings monitor email," he said.
Proofpoint's angle here is that its anti-spam technology can be used as a way of ensuring that outbound emails comply with government regulations. "We believe that companies will, over time, turn to technology to help enforce their internal policies," said Crosley.
The (email) Conversation
If low-tech snooping is currently so widespread, could Proofpoint name a company which is paying someone specifically to check emails? We'd welcome the chance to have a chat to a modern day Harry Call (the lead charecter played by Gene Hackman in 70s classic The Conversation) but sadly we're out of luck.
"We have come into contact with numerous companies that employ staff (even full time staff) to monitor or audit outbound email, but I don't have a company name that you could use," said Crosley. "Because of this 'anecdotal' information, I can say that the results of the survey didn't really surprise us. But as you might imagine, most companies are not willing to talk openly about the use of these sorts of techniques even though they are completely legal in the US."
"To people not familiar with this issue, however, the number does seem astonishing. But our findings on other points are not out of line with other recent email related research. In a somewhat similar survey conducted by the ePolicy Institute, which found that about 60 per cent of companies use some sort of technology to monitor incoming and outgoing email."
Readers can review Proofpoint's survey here. ®
Related stories
netReplay is watching you
Google's Gmail: spook heaven?
US defends cybercrime treaty
Security fears over UK 'snooper's charter'
Merrill Lynch shackles employee Net access
Privacy in the workplace is a 'myth'
Well it may not be the MITM attack but the noise of other things that mean nothing from a threat standpoint that finally destroys us. Wasting resources on a predetermined threat seems like selling sun block in Alaska, good for six months out of the year, maybe less.
The failures are in assumptions that ordain a threat that has not been exposed. So what is the exposed threat? The answer to that question is the million dollar answer, of course.
Whatever it is, it has to be hyped properly, leveraged, and branded, then the value could be in the billions. This sounds like a Microsoft business group already, maybe I can sell stock on the inflated concept.
The threat model is the real threat.
Posted by: Jimbo at August 4, 2004 07:39 AM> The threat model is the real threat.
I love it! Yes, indeed, there is a germ of painful truth in that. The cold hard fact of it is that starting with a threat model raises the question of who chose those threats.
Threats should either be mandated by the customer - he who pays for the system - or they should be validated in an economic risk model. If neither is done, we are asking ourselves to pick and choose from among a grab bag of sexy and boring stuff.
As the technical world is often separated from reality, by many handshakes and degrees, it's no surprise that if we pick our own threats, we get it wrong.
Posted by: Iang at August 4, 2004 07:51 AMRight on track, here's the news from the US:
http://news.com.com/FBI+wants+to+eavesdrop+on+fiber+links/2100-7347_3-5295560.html?tag=nefd.top