updated 2:10 p.m. 21.May.99.PDT
|Wired Index | All Indexes|
|FIND A BOOK|
Subscribe to Wired.
Wired News staff
Wired News delivered
Bulletproof Email for the Masses
by Lindsey Arent
3:00 a.m. 21.May.99.PDT
A new free email service aims to bring the power of high-strength cryptography to anyone with a Web browser.
Hushmail, a Hotmail-style service, offers members the promise of near total privacy in their correspondence.
"We have a basic belief that everyone has the right to have a private conversation," said Cliff Baltzley, the 28-year-old president of Hush Communications.
"Strong encryption has existed for many, many years. We're trying to give this to every person on the Internet."
The site, which launched in a public beta just under two weeks ago, will likely feed fresh kindling to the ongoing debate in Washington over the widespread availability of strong encryption tools.
Hushmail appeared mere hours after a US Ninth Circuit Court of Appeals ruled that the US government's restrictions on encryption were unconstitutional.
Not that that matters in the case of Hushmail. The site uses 1024-bit encryption -- much stronger than the strongest crypto that the US government allows to leave the country under export control regulations.
The United States prevents American citizens from exporting encryption of a quality that the government cannot break, on the basis that it might be used by hostile nations to communicate in total secrecy.
But the site's patent-pending crypto process was developed abroad, so it is not subject to US export regulations. Non-US citizens wrote the code in the crypto-free tax haven of Anguilla -- a small UK protectorate in the Caribbean.
That code is freely available on the company's Web site, where it can be scrutinized by cryptographers.
"We want people to be able to look at the code to know that it's secure," Baltzley said.
Hushmail will no doubt raise flags at intelligence agencies such as the National Security Agency and the FBI.
"Law enforcement supports the use of strong encryption for legitimate purposes," said FBI spokesman Barry Smith. "Our concern is when advanced technologies are used by criminals and terrorists to the detriment of public safety."
Many people stand to benefit from Hushmail's privacy, including dissidents, whistle-blowers, and human rights workers. The FBI argues that such a system might also be used by criminals and terrorists to communicate beyond the reach of wiretaps.
Hushmail users can access an account from any computer that has a Web browser and Internet access. The encryption and decryption takes place inside a Java applet that Hushmail sends down to the member's Web browser.
Privacy advocates have for years blamed backstage lobbying by the FBI and NSA for upholding the export regulations. Further, the US software industry says that the rules have led to the development of a robust overseas crypto marketplace.
"Inside the US we don't care about the bit length or the algorithm used," Smith said. "We're concerned about immediate plain-text access to encrypted criminal-related texts or files pursuant to a court order."
"Criminal terrorists take advantage of all kinds of innovative technologies to enforce their criminal acts."
But the terrorist threat is largely unrelated to the Web-privacy issue, said Austin Hill, president of Zero-Knowledge Systems, a Canadian developer of Internet privacy solutions.
"This is no different than the privacy offered by an envelope on a piece of mail," Hill said.
"Law enforcement agencies like to be able to listen in on Internet traffic in general, and [Hushmail] is one of the things that will make that more difficult. Anything that improves privacy for users has to be considered a win-win situation."
Still, just to be safe, Hushmail's service agreement included a clause that requires users to keep their noses clean.
"You agree to comply with all applicable local, state, national, and international laws and regulations," reads the agreement.
"You also agree to not use Hushmail for illegal purposes ...."
But Hushmail's founders aren't as concerned with criminals as they are with securing funding for their venture -- which will be supported by advertising.
"Terrorism is one of the major issues of privacy," said Baltzley. "But terrorists use sidewalks, too. We all use sidewalks. Humans should be able to have private conversations."
Have a comment on this article?
Copyright © 1994-99 Wired Digital Inc. All rights reserved.
Send this to a friend
Fax this article for free