Todd Kwon-Do

He should have carried a pack of Mentos....

The best thing about Mentos (according to the commercials) is that you can get away with anything you want if you have a pack of them in your pocket. Steal a taxi, run through a stranger’s living room to catch a bus, or use wet paint on a bench to pinstripe your suit after accidentally sitting on it! All you have to do is flash that pack of Mentos, give a toothy grin, and it all seems to work out.

Unfortunately, Larry Mendte didn't know that. He wasn't carrying Mentos this past Monday when he was charged with hacking into Alycia Lane's email accounts 537 times over the last two years.

It seems that Larry, as a product of obsession or just plain avarice, got into the habit of reading, recording, and leaking to the press, the embarrassing details of Alycia's life. He wanted to get ahead, and he wanted her to fall behind. Well, it worked... sort of. She did fall behind. In fact, she was fired from her job at the TV station after Mendte leaked sensitive (embarrassing) information about a pending legal case she had. Unfortunately, it backfired when the police seized his computer in May after discovering that it had been repeatedly used to access her accounts.

Everyone knows that accessing another user’s account is illegal. However, what caught my attention is that the authorities are focusing on the fact that he intercepted communications between Alycia and her lawyer. As a result, they are arguing that he violated privileged communications. The communications are only privileged if Alycia had a reasonable expectation of privacy when she sent her email.

The bottom line is that when it comes to email, privacy is subject to where you live. Some states claim that you have an expectation of privacy, and still others say that you don’t.

There have been plenty of law suits against companies that let people go after monitoring inappropriate email use. Of course, the business owner feels like corporate email accounts belong to them and that if they own the mail server, they own what it contains as well. Most of those business owners lost their case. As it turns out, you have to make it clear to your employees that you reserve the right to monitor them if you want to be able to smack them over the head with their own email.

Regardless of what the law says, if you know anything at all about the technology behind email, then you know there is no expectation of privacy. Here is some food for thought;

• Email messages sometimes pass through a half dozen servers before arriving at their destinations. A copy is often left on each server the message touches. That server’s administrator (a complete stranger to you) can read that message any time he/she wants. In that way, sending an email across the internet is a lot like passing a note in class and hoping no one will read it, even though everyone that passes it along will have the opportunity.
  
  
• Almost all email that is sent today passes through at least one or two spam filters. The filter’s job is to read the email! Then, if the message looks odd it will flag it. Most administrators review the messages that got flagged in the course of tuning their filters.
  
  
• Most email is not encrypted. They travel across the internet in plain text where anyone and their brother can read them if they like. In Fact, there are “traps” online that collect random samples of email in transit to better update spam filters. Those samples are reviewed by network administrators in the name of creating better spam prevention products.
  
  
• There are dozens of viruses and spywares that will collect and re-transmit email on any infected computer. Even if the recipient of your email is clean when you send the message, a future infection could easily result in the dissemination of your communication to hundreds, thousands, or millions of users. How do you think all that spam got out there in the first place?

I could go on for days, but I think you get my point. There is a lesson to be learned here. You do have an expectation of privacy when you are standing in a room with your lawyer and the door is closed, the shades are drawn, and you look around and don’t see anyone but your lawyer, his books, and maybe his 13 year old basset hound passed out on the floor.

However regardless of how this case goes, or how the law in your state reads, my feeling is that, when it comes to email, an “expectation” of privacy is a daydream. The fact is that your plain text email IS NOT private. Once you click send, you are leaving copies of it everywhere and setting yourself up to have someone read your message. Most of the time this will be harmless, but you should be prepared for the possibility that it might not be.

If you don’t email information that you wouldn’t want public then you have nothing to fear. For example, I sometimes will email a username to someone… but I never send the password. If I have to send something to my attorney, I encrypt the data BEFORE I attach it to an email. Do I email him the password for the file? NO! I use the phone, give him the password verbally, and take the opportunity to practice the long lost art of interpersonal communication.

Email is a great tool. It has revolutionized our lives. Unfortunately, it is also deceptively easy. If you are an employee, I would advise you to be more careful about how you use your email. Don’t expect that big brother isn’t watching.

If you are big brother, I advise you to inform your employees of that fact! Put it in the employee handbook so that you don’t end up emailing your attorney about being sued because you read an employees’ email……. perhaps you could email the revised email policy to your employees?

Wow. That’s it for me. I have to go now. I just got an email from a foreign finance minister. It seems that he has a large sum of unclaimed money. He needs me to to assist him by allowing him to transfer $30,000,000 to my account for which I can keep 20%.

posted by Todd @ 12:29 PM