The Channel logo


By | John Leyden 20th November 2007 12:08

Hushmail warns users over law enforcement backdoor

Still secure, up to a point

Hushmail has updated its terms of service to clarify that encrypted emails sent through the service can still be turned over to law enforcement officials, providing they obtain a court order in Canada.

September court documents (pdf) from a US federal prosecution of alleged steroid dealers reveals that Hush Communications turned over 12 CDs involving emails on three targeted Hushmail accounts, in compliance of court orders made through the mutual assistance treaty between the US and Canada. Hushmail is widely used by privacy advocates and the security-conscious to send confidential emails.

Hush Communications, the firm behind Hushmail, previously claimed "not even a Hushmail employee with access to our servers can read your encrypted email".

However an updated explanation states that it is obliged to do everything in its power to comply with court orders against specified, targeted accounts. Unlocking targeted accounts involves sending a rogue Java applet to targeted users that captures a user's passphrase and sends it back to Hush Communications. This information, when passed onto law enforcement officials, allows access to stored emails and subsequent correspondence sent through the service.

The possibility that law enforcement officials can tap targeted accounts exists whether or not Hushmail users use the supposedly more secure Java applet option or a simpler web server encryption set-up. The updated terms of service explain:

Hushmail is a web-based service, the software that performs the encryption either resides on or is delivered by our servers. That means that there is no guarantee that we will not be compelled, under a court order issued by the Supreme Court of British Columbia, Canada, to treat a user named in a court order differently, and compromise that user's privacy.

International criminals and terrorists ought to look elsewhere for their encrypted email needs, Hush Communications explains.

"If you expect to engage in activity that might result in a court order issued by the Supreme Court of British Columbia, Canada, Hushmail is not the right choice for you," it said, adding that stand-alone desktop encryption packages such as PGP Desktop provide higher levels of security than web-based services.

PGP creator Phil Zimmermann has long fought to keep the software free of backdoors. Even after the September 11 attacks his convictions about privacy and civil liberties were strong enough to withstand pressure to tamper with the software, despite evidence it was been used by terrorists as well as its intended audience of human rights activists.

However, Zimmermann has defended Hushmail compliance with court orders, arguing that users who pick web-based products for their ease of use can't expect absolute security. Zimmermann, who sits on Hushmail's advisory board and helped found the service, told Wired: "Just because encryption is involved, that doesn't give you a talisman against a prosecutor. They can compel a service provider to cooperate."

Zimmermann explained that Hushmail has little option but to comply with Canadian court orders, adding that the service remained far more secure than other webmail services. ®

comment icon Read 15 comments on this article alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe