Phil Zimmermann, the creator of the email encryption software PGP, has warned that anyone who uses consumer email services needs to be aware of the threats of exposing their metadata to eavesdroppers.
Zimmermann created the “Pretty Good Privacy” software in 1991, providing a more secure alternative to consumer email and file transfer that is encrypted.
Speaking exclusively to the Guardian, he said his assessment of security threats has changed radically since he created the software 22 years ago.
“When I developed PGP, all I wanted to do was to protect the content of the message,” said Zimmermann, who is now the president and co-founder of secure communications firm Silent Circle.
“I didn’t think that it was even doable to protect the email message headers. And still don’t, at least if you want to comply with email protocols.
“So what’s happened more recently is just that everyone has become aware that metadata is becoming increasingly important – that the message headers mean a lot.”
The risks associated with exposing metadata to potential eavesdroppers was highlighted when the Guardian revealed that the National Security Agency had been collecting data about phone calls from Verizon. The US government insisted that that data was not private, but in aggregate it can build a detailed picture of people’s lives.
Zimmermann argues that unprotected metadata isn’t just dangerous in aggregate. “You’re a journalist for the Guardian,” he told this reporter. “You know that the Guardian sometimes writes stories that are of great interest to intelligence agencies. Well, what if the intelligence agencies want to see if a journalist at the Guardian is talking to a particular sensitive source?”
“You don’t have to do a lot of data mining for that. All you have to do is find that so-and-so, some government employee, is talking to some journalist at the Guardian. Then somebody’s in a heap of trouble.”
That risk also led Zimmermann to develop a new feature for his Silent Phone app, encrypting conversations earlier in the call process. Dubbed “tunnelling”, the feature hides the knowledge of who is talking to who from any eavesdroppers. Zimmermann had the idea for the feature “quite a few months before the Edward Snowden revelations”, but its upcoming release will be timely.
Where PGP flaws are becoming clearer with time, Zimmermann argues that the core technology holds up just as well. “The first thing I did [after the Guardian published Snowden’s leaks] was review my own designs.
“I haven’t seen anything in the Snowden revelations that suggests that PGP or the stuff we do now is weak in any way.”
• Is the NSA losing its battle against the agents of openness?