Skeptics Stack Exchange is a question and answer site for scientific skepticism. It only takes a minute to sign up.
Sign up to join this community
At around the 28 mins and 13 secs of Season 3, Episode 9, of the TV series Strike Back, Major Oliver Sinclair (portrayed by Rhashan Stone) claims the following, the truth of which I'd like to know.
Any intelligence agency can monitor emails that has been sent and received. So if you want to avoid detection, leave it in the drafts box for someone to read.
In short: if the draft mail is stored in the server, it is saved there in a specific folder there like any other mail. So if the spying entity has access to the disk (as opposed to having access to the communications network) they have access to the drafts as well. Example: In maildir format (de-facto Unix standard) drafts are just a flag set by the user on the file that contains the message: http://cr.yp.to/proto/maildir.html:
Flag "D" (draft): the user considers this message a draft; toggled at user discretion.
Most mail agents using maildir, anyway, does not use the D flag but create a .Drafts diretory inside the cur directory, which relates directly to the Drafts folder on the MUA.
There are some instances where client-side encryption is used, for which drafts are stored encrypted on the server. They are still accessible to the spying entity, but not readable. This is not the case on any web-based mail provider that you can use from any browser. It is the case, however, with Lavaboom https://lavaboom.com/en/tech-info#key-handling which you can not use from several browsers.
Absolutely not. You can safely assume that an intelligence agency has access to your online mail box, including drafts.
For example, this is a leaked NSA document claiming that 500,000 online inboxes are snooped on every day.
Snowden again makes fun, in front of a community of peers, of using an online platform for espionage purposes:
A good example of this, really a bad example when it comes to Opsec, is this recent American spy who was discovered in Germany. He was apparently, allegedly, in the newspapers, suing for the United States against Germany. He then, I guess, wasn’t satisfied with what was going on so he said, “Hey, I’m going to shop myself to what I think are the Russians,” because he got an email — He was using gmail. Great, great OpSec there — and he got an email that purpotd to be the Russian embassy, and they said, “Hey, you want to sell some documents?” And he said, “Oh, yeah, sure, sure.” And he sent them three classified documents.
http://www.ellsbergsnowdentranscript.tumblr.com/ and http://youtu.be/FGgo7MSJVVA?t=30m
As an example: General Petraeus and his mistress used this system to swap private emails and were discovered by the FBI.
FBI agents traced the alleged cyber harassment to Broadwell, the officials said, and discovered she was exchanging intimate messages with a private Gmail account. Further investigation revealed the account belonged to Petraeus under an alias.
Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email traffic, one of the law enforcement officials said.
Rather than transmitting emails to the other's inbox, they composed at least some messages and instead of transmitting them, left them in a draft folder or in an electronic "dropbox," the official said. Then the other person could log onto the same account and read the draft emails there. This avoids creating an email trail that is easier to trace.
http://bigstory.ap.org/article/info-emerges-about-2nd-woman-petraeus-case
and the FBI has been snooping on these accounts after having established a just cause (in this instance, because some other emails had been sent). After that, it's game over.
They learned that Ms. Broadwell and Mr. Petraeus had set up private Gmail accounts to use for their communications, which included explicit details of a sexual nature, according to U.S. officials. But because Mr. Petraeus used a pseudonym, agents doing the monitoring didn't immediately uncover that he was the one communicating with Ms. Broadwell.
By late summer, after the monitoring of Ms. Broadwell's emails uncovered the link to Mr. Petraeus, prosecutors and agents alerted senior officials at FBI and the Justice Department, including Mr. Holder, U.S. officials say. The investigators never monitored Mr. Petraeus's email accounts, the officials say.
