Feeds

Hushmail warns users over law enforcement backdoor

Still secure, up to a point

Internet Security Threat Report 2014

Hushmail has updated its terms of service to clarify that encrypted emails sent through the service can still be turned over to law enforcement officials, providing they obtain a court order in Canada.

September court documents (pdf) from a US federal prosecution of alleged steroid dealers reveals that Hush Communications turned over 12 CDs involving emails on three targeted Hushmail accounts, in compliance of court orders made through the mutual assistance treaty between the US and Canada. Hushmail is widely used by privacy advocates and the security-conscious to send confidential emails.

Hush Communications, the firm behind Hushmail, previously claimed "not even a Hushmail employee with access to our servers can read your encrypted email".

However an updated explanation states that it is obliged to do everything in its power to comply with court orders against specified, targeted accounts. Unlocking targeted accounts involves sending a rogue Java applet to targeted users that captures a user's passphrase and sends it back to Hush Communications. This information, when passed onto law enforcement officials, allows access to stored emails and subsequent correspondence sent through the service.

The possibility that law enforcement officials can tap targeted accounts exists whether or not Hushmail users use the supposedly more secure Java applet option or a simpler web server encryption set-up. The updated terms of service explain:

Hushmail is a web-based service, the software that performs the encryption either resides on or is delivered by our servers. That means that there is no guarantee that we will not be compelled, under a court order issued by the Supreme Court of British Columbia, Canada, to treat a user named in a court order differently, and compromise that user's privacy.

International criminals and terrorists ought to look elsewhere for their encrypted email needs, Hush Communications explains.

"If you expect to engage in activity that might result in a court order issued by the Supreme Court of British Columbia, Canada, Hushmail is not the right choice for you," it said, adding that stand-alone desktop encryption packages such as PGP Desktop provide higher levels of security than web-based services.

PGP creator Phil Zimmermann has long fought to keep the software free of backdoors. Even after the September 11 attacks his convictions about privacy and civil liberties were strong enough to withstand pressure to tamper with the software, despite evidence it was been used by terrorists as well as its intended audience of human rights activists.

However, Zimmermann has defended Hushmail compliance with court orders, arguing that users who pick web-based products for their ease of use can't expect absolute security. Zimmermann, who sits on Hushmail's advisory board and helped found the service, told Wired: "Just because encryption is involved, that doesn't give you a talisman against a prosecutor. They can compel a service provider to cooperate."

Zimmermann explained that Hushmail has little option but to comply with Canadian court orders, adding that the service remained far more secure than other webmail services. ®

Remote control for virtualized desktops

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.