PGP BLUES —

Guardian reporter delayed e-mailing NSA source because crypto is a pain

Have you put off encrypting your e-mail? You're not alone.

If you still haven't gotten around to encrypting your e-mail, you have company. Glenn Greenwald, the civil liberties writer who recently exposed the National Security Agency's vast data-collection programs, wasn't quick to jump on the e-mail encryption wagon either.

According to recent articles in The New York Times and The Huffington Post, Greenwald first heard from National Security Agency (NSA) whistleblower Edward Snowden in either January or February. Snowden said he had information that would be of "great interest" and said he wanted to communicate securely using PGP encryption. According to accounts by both publications, the request was a nonstarter.

"Mr. Greenwald wrote back that he did not have such software," the NYT reported. "Mr. Snowden later sent him a homemade video with step-by-step instructions for installing it, which Mr. Greenwald watched but never completed." Greenwald then brought the same request to documentary filmmaker Laura Poitras. Given her experience covering surveillance and working with sensitive sources, she was more comfortable encrypting her communications.

"I have a lot of experience because I've been working with—as you note in your thing, I've done filming with WikiLeaks," she said in an interview with Salon. "I know Jacob Appelbaum. I already had encryption keys, but what he was asking for was beyond what I was using in terms of security and anonymity."

By late April or early May according to the NYT, Greenwald and Snowden began communicating over an unidentified encrypted chat program.

To be fair to Greenwald, his delay in completing the encryption video came before he knew who his would-be source was or what kind of information the source had. Still, the accounts highlight a major shortcoming of the Internet age. Despite the myriad ways of communicating online, precious few allow people to send messages that aren't susceptible to the type of NSA interception and monitoring reported by The Guardian and others. A case in point: even though instant messages sent through Microsoft's Skype service are encrypted, the company is able to pluck out plaintext at will.

E-mail encryption, at least when it's generated using properly implemented public key cryptography, is one of the notable exceptions since end users are the only ones who can decrypt the protected communications. But as Greenwald and countless others have discovered over the years, encrypted e-mail is non-trivial to set up. Stay tuned for a two-part series of articles in the coming days explaining how it's done.

Channel Ars Technica