PhotoDude.com

Sat. Jul 14, 2007

The Illusion of Security

The other day I set up a “need it now” domain for a client, and they also wanted the email to be separate from their current workload. So I forwarded the domain mail to a Gmail account I created for them.

The question comes, “is this secure?” While the tempered response is along the lines of “it’s as secure and your current email,” it’s not really the correct answer.

That would be, “no, it’s not secure. Email is never secure, unless it is entirely encrypted. You should assume any email you send will be read by someone other than the addressee. It usually won’t be, but the point is it passed through a half dozen servers and a couple of ISP’s, all subject to subpoena. And arrives with someone (also subject to subpoena) who may decide to forward it to places you never imagined. So, no, email is never secure. Think of it like a mailed postcard, open for all to see, and you’ll be better off.”

And in others areas, the question comes, “are we secure?” While the tempered response is along the lines of “you are as secure enough we have not suffered an attack in nearly six years,” it’s not the truth.

Nor is the current news hubbub the truth, where the Secretary of Homeland Security describes his fearful gut to us, while also saying there is no credible threat or hard information about any attack this summer. It’s just his gut, which didn’t exactly serve him well during the Katrina buildup or aftermath. In fact, the “collective gut” of the Bush administration has rarely been right in six years.

And though the Bush administration now has an intelligence report claiming Al Qaeda is as strong as they were before 9/11, anyone who remembers how we let them escape at Tora Bora knew that was just a matter of time (Back then I wrote, “I just know where the buck stops. We had the cat in the bag, yet we’re chasing kittens all over the place three years later” ... make that six years, and a lot more kittens).

The truth about your security is actually much simpler. You’ve never been secure. Not in the way the question is asked today. You weren’t secure in the 1990’s, when the first Trade Center attack and the Centennial Park and Oklahoma City bombings took place. I wasn’t secure on May 1, 2004, when an idiot ran a red light a quarter mile from my home, totalling my wife’s car, and nearly me. The truth is that on any given day, some idiot may kill you, by accident or willful intent.

If you expect the government to both tell you what they judge the level of threat to be, and protect you completely from that threat, you will live in fear. A see-saw of fear, with Al Qaeda on one end, releasing audio tapes and videos boasting about what they have planned for us, and your government on the other, describing their fearful gut and lack of hard data. They will control your level of fear. Dial it in as they like.

The truth is that if you want some information to be completely secure, don’t send it via email. And if you want to be completely secure, do not leave your home. And pray a meteor doesn’t fall on it.

Or you can live, be free, and accept that those two acts come with some minimal risks. But the risks are greatly outweighed by the benefits (true for Gmail, as well).

However, along the way, you’ll encounter a surprisingly wide variety of people — jihadists, the media, politicians, bloggers — doing their best to shout “Boo!” at you, all with their own ulterior motives.

I’m sorry, I just ain’t a-sceered anymore. Disgusted? Yes, when I am unable to cover it with amusement. But afraid?

Sorry. I’m too busy living my life. You should be, too. Ignore the boomongers, domestic and foreign.