In 2007, the US
National Security Agency approached Yahoo with an order to gain direct access to its
data centers and record and collect all information passing through in a decrypted form.
Yahoo decided to fight this in court, citing constitutional protections against unreasonable
search and seizure of American citizens.
The US government tried to blackmail Yahoo into complying with a $250,000 fine for each
day the company would continue to resist.
Eventually, Yahoo lost the case in the Foreign Intelligence Surveillance Act, or FISA court,
and became one of the first partners of the NSA PRISM program, that granted the agency
access to data centers of all major US-based tech companies.
Seven years later, the US intelligence came to Yahoo with a new request – to scan all
of their users emails in real time on the governments behalf.
This time, Yahoo complied without any resistance.
Voicing ethical concerns about mass surveillance, some high ranking security officials at Yahoo
resigned.
When asked for comments, Google, Microsoft and Apple all denied receiving any similar
requests, despite the fact they are all long time members of the same PRISM program.
The fact is, that all of these programs were classified and we only learned about them
years after they were initiated, thanks to leaks from former employees of these organizations.
Denials of any misuse of your private information is a common practice for both companies and
government agencies.
But the reality is that if you have an email account with any of these companies, chances
are your messages are most likely being scanned or even read by real humans.
You heard it right.
Not just scanned for keywords by algorithms, but read by actual employees of either private
companies or government bodies.
Without a warrant, suspicion or an ongoing investigation.
After Yahoo was acquired by Verizon, its privacy policy received an update.
Yahoo now reserves the right to read contents of your emails for any purposes – including
research and targeted advertising.
Yahoo has had automated systems scanning your messages for years.
But this time they will share that information with the Verizon conglomerate and won’t
give you any verifiable guarantees that your records will be anonymized before they are
viewed by human eyes.
At Microsoft, reading users’ emails has revealed the corporation’s true values.
Without a search warrant, Microsoft unilaterally decided to read emails from a blogger’s
hotmail account.
This was after someone from Microsoft leaked parts of source code of then upcoming Windows
8 to the blogger.
But Microsoft did this without any external or internal audit or even going to court.
When they found out the blogger was using hotmail, they just went through his emails
to track the employee who leaked the info.
In the process of hunting down the whistle blower, Microsoft showed no hesitation in
violating their user’s privacy, and potentially privacy of other people the blogger was communicating
with.
How do they rationalize this?
In their own words, everything you do using Microsoft services belongs to them automatically.
It becomes companies own resource to mine and exploit.
Google has been long implementing the policy to read emails of Gmail users.
The practice of serving ads that are based on the content of Gmail messages has been
in place since the giant’s email service was created.
After 13 years of privacy backlash and data security scandals, Google finally announced
to stop serving ads based on email content.
But Google still continues to read your inbox for any other purposes.
In some cases, Google employees would be allowed to read private emails but it wouldn’t just
stop there.
Google lets hundreds of third-party developers access inboxes of Gmail users, read their
contents, and even share that data with their partners.
If you expect Google to have a strong vetting process before it allows outside software
developers onto its platform, it became common practice for employees in the industry to
review and read emails directly.
One such company, Return Path, scans about 100 million emails per day and their employees
read thousands of emails on regular basis.
It may be hard to conceptualize, but this drastically changes the nature of private
conversations between two people.
Messages you thought were private are now routinely copied hundreds of times, as they
pass through the Internet and exchange hands between advertisers, developers, government
officials or malicious actors.
This system creates an environment of omnipresent real-time surveillance.
You can never know when someone is looking at your private emails and how they are going
to interpret your words.
Public Tweets from a decade ago are brought up today to tear someone’s reputation apart.
Think about how much more severe the implications are going to be once things you thought were
okay to say in private end up in the wrong hands.
Anyone’s hands.
At any time.
Now or in the future.
After the scandal with Facebook and Cambridge Analytica, we know that these data are valuable
to political campaigns and marketing teams wishing to manipulate masses on unprecedented
scale.
Companies want you to trust them with your data and even begin to capitalize on the latest
rising public interest in privacy.
Apple is the most notorious one, but they too can be blamed for the same practices.
Apple has always believed they have the right to access your information and content when
they feel like it.
Most recently, Apple has started using their customers’ call and email metadata to assign
devices “trust scores”, in what they claim to be measures against fraud.
But trusting companies with invasive privacy policies isn’t the only option you have.
If you don’t want your private conversations to be exposed to advertisers and manipulative
marketing campaigns you might disapprove of, the solution lies in end-to-end encrypted
email.
Managing end-to-end encryption used to be a daunting task.
But luckily, due to the rising market, more and more companies emerge to offer privacy
focused email services that are encrypted on users devices and not even their providers
could decrypt them.
Today you no longer need to know how encryption works to protect yourself from the level of
bulk collection you are exposed to at Google, Apple and others.
Because revenue from advertising is not an option with an encrypted email service, most
of the secure options are paid.
Tutanota and ProtonMail are two options that offer modern user friendly interface with
strong seamless encryption.
ProtonMail is the biggest end2end encrypted email service currently in operation.
Based in Switzerland, ProtonMail resides outside of the jurisdiction of the United States and
European Union, which means they can’t be compelled by the NSA to wiretap their data
centers.
ProtonMail’s free option starts with 500 MB but you can upgrade any time to unlock
more space and features.
German-based Tutanota is another viable alternative that starts with double the storage for free.
If you are ready to pay for your email privacy, you might consider Posteo that’s also based
in Germany and offers anonymous sign up, accepts cash, and comes with a synchronisable calendar.
If you want to check out more privacy focused encrypted email providers, I will leave the
link in the description below.
Switching your email provider might take you some time but that’s fine and it’s worth
it.
I kept my old email address for a year to make sure all of my contacts and services
I subscribed to would fully transition to my new address.
You should be in control of who gets to see the content of your conversations.
Encrypting your email makes mass surveillance and manipulative marketing economically unfeasible
and protects your private thoughts from future scrutiny.