Safe Mail

[Mirrorshades]

Originally Posted by webster

I could see a paid email fighting a little harder to keep your information private...because if you are paying for privacy, you have some reasonable expectations to expect privacy, compared to something that you are getting for free. And $60 is a lot cheaper that losing your gear, or having LE knocking on your door asking questions.

Your premise is correct, if the underlying assumption is correct, namely that the service provider is willing to fight a subpoena -- basically, you're gambling with your freedom that you are correct.

Originally Posted by webster

I prefer to use an email provider that is based in a country that is not part of the MLAT (Mutual Legal Assistance Treaty). For those of you who do not know what MLAT is, it is an agreement that the US has with other countries to share information regarding criminal activity. That is what LE used to gain access to hushmail accounts in Canada for Operation Raw Deal. Currently there are 51 countries that are part of MLAT. They are:

Argentina. Australia, Austria, Bahamas. Barbados, Belgium. BVI, Canada, Cayman Islands, Czech Rep., Dominica, Hong Kong, Hungary, Israel, Italy, Jamaica, Latvia, Lithuania, Mexico, Morocco, Netherlands, Panama, Philippines, Poland, South Korea, Spain, St, Lucia, St. Vincent, Switzerland, Thailand, Turkey, United Kingdom, Uruguay, Cyprus, Estonia, Nigeria, Antigua, Romania, Singapore, Trinidad, Barbuda, South Africa, Ukraine, St. Kitts & Nevis, Russia, Egypt, Luxembourg, Grenada, Greece, and France.

I use anonymous speech because it is based in Japan and Japan is not part of MLAT that I could find. It costs about $60 per year but the peace of mind is well worth the expense for me.

Japan became a signatory of MLAT in 2003. You can read about it on the website of the Ministry of Foreign Affairs of Japan, here:

MOFA: Signing of a Mutual Legal Assistance Treaty between Japan and the United States of America

6 August 2003

The signing of the Treaty between Japan and the United States of America on Mutual Legal Assistance in Criminal Matters (Mutual Legal Assistance Treaty) [PDF] took place on Tuesday, 5 August 2003, in Washington D.C. The treaty was signed by Ms. Mayumi Moriyama, Minister of Justice, Mr. Sadakazu Tanigaki, Minister of State, Chairman of the National Public Safety Commission and Mr. Ryozo Kato, Ambassador of Japan to the United States of America (Japanese side) and Mr. John Ashcroft, Attorney General of the United States of America (US side).

So, Anonymouspeech is no longer safe from that point of view. Furthermore, Anonymousspeech suffers from the very same problem as Hushmail, Cyber-Rights, and their various clones. I am referring to the fact that Anonymousspeech generates and stores both halves of the PGP keypair for you, very much like Hushmail/Cyber-Rights. Now that MLAT is in play, this opens them up to the very same type of compromise that Hushmail was forced into by the Canadian courts. There is no doubt in my mind at all that the Japanese courts would do exactly the same as the Canadian courts, in forcing Anonymousspeech to hand over information in their possession to the authorities.

Mirrorshades

[Mirrorshades]

Originally Posted by espiros

It seems (according to a source outside this board) that Safe Mail encryption is been open by the Feds.
Therefore anything you do there will be seeing by them.

The problem with Safe-Mail is pretty-much the same as with Hushmail.

The only difference is that Hushmail uses OpenPGP, while Safe-Mail uses the other standard for public key encryption, S/MIME. Safe-Mail generates the public key certificate for you; this means that they have control over the private key, or can get it, just as Hushmail did.

When you're dealing with a service that promises encryption, the essential thing to remember is, "Who controls the keys?"

The ONLY person who should have a copy of the private key is YOU. If anyone else has access to it, your security is non-existent.

Mirrorshades

[Mirrorshades]

Originally Posted by Rangi

Does securenym.net really cost $60 per year. Thats what the website says. Thats kind of a lot for email. But maybe worth it if its the only secure one left.

From the Securenym website:

Is additional encryption supported?

SecureNym now supports both PGP and S/mime server-side encryption. This allows users to have all incoming messages automatically encrypted before being saved to your mailbox. For those users who archive messages on our mail servers, SecureNym recommends enabling PGP or S/mime encryption of incoming messages.

[...]

By installing PGP or an S/mime certificate on your computer, and uploading the public key to SecureNym, all messages in the mailbox are fully encrypted with a key that only the user can unlock.

Even when messages are sent to a recipient that does not use PGP or S/mime, his reply will be fully encrypted with your key upon arrival at SecureNym. SecureNym never has your private key, so only you can decrypt a message.

From the above, it would appear that one can supply Securenym with a PGP key that is used to encrypt all incoming email. Since they do not possess the private half of the keypair, they would be unable to decrypt any messages, even in the even they were ordered to do so by a court.

This service is probably the closest in terms of operation to the currently-operating nymservers designed by the Cypherpunks. The main difference between the two types of nymserver is that Securenym stores your email for you to retrieve after encryption, while the Cypherpunk nymservers merely forward the email (after encryption) to a destination specified by an encrypted reply-block.

I have seen a copy of an email purportedly from the Admin of Securenym, where he stated that Securenym was subpoenaed as part of Operation Raw Deal, but their lawyer managed somehow to have the subpoenas quashed. He further goes on to describe in his email how it is their philosophy to not collect information that can be subpoenaed -- he states, quite correctly, that one cannot be forced to surrender that which one does not have.

The only caveat I would offer is that if one wishes to use this service, that it should be accessed through Tor, to prevent the harvesting of IP addresses.

Mirrorshades

[Mirrorshades]

Originally Posted by alaski

FROM Hushmail site: "In some countries, government sponsored projects have been set up to collect massive amounts of data from the Internet, including emails, and store them away for future analysis. This data collection is done without any search warrant, court order, or subpoena. One example of such a program was the FBI's Carnivore project. By using Hushmail, you can be assured that your data will be protected from that kind of broad government surveillance."

LAW limiting Carnivore: "Getting the cooperation of the ISPs or the owner of the LAN onto which Carnivore is to be placed can either be voluntary or by court order; however, once a system is in place it is allegedly not allowed to simply capture every email that passes through the system — by existing U.S. law, publicly acknowledged USG personnel are required to get a warrant or court order naming specific people or email addresses that may be monitored. When an email passes through that matches the filtering criteria mandated by the warrant, the message is logged along with information on the date, time, origin and destination. This logging is believed to be relayed in real time to the FBI. All other traffic would presumably be dropped without logging or capture."

Hushmail Canada Jurisdiction: We are committed to the privacy of our users, and will absolutely not release user data without a court order from the Supreme Court of British Columbia, Canada, which is the jurisdiction where our servers are located. In addition, we require that any such court order refer specifically by email address to any account for which data is required. However, if we do receive such a court order, we are required to do everything in our power to comply with the law.

Hushmail will not accept a court order issued by any authority or investigative agency other than the Supreme Court of British Columbia, Canada. Other authorities must apply to the Canadian government through an appropriate Mutual Legal Assistance Treaty and request that a court order be issued by the Supreme Court of British Columbia, Canada.

It seems probable cause still exists in some form...

This is only true up to a point. The Harper government is currently planning (October 2011) to pass a "lawful access" bill sometime in the next six months or so, that will significantly weaken online privacy protections for Canadians and those using Canadian ISPs or other online service providers.

Police powers to demand information from ISPs without a warrant will be put in place, giving them the authority to demand -- without a warrant or any other court oversight -- subscriber name, address, IP address, device address, email address, etc.

So, say you were using steroids-r-us@hush.com -- the police could demand all theinformation Hushmail has on that user without a warrant, including their IP address, as Hushmail logs all IP addresses that access each account. Even if Hushmail doesn't have your real name, given an email address, they can provide the police with the IP address that, coupled with the dates/times of access could lead to the ISP subscriber being revealed. From there getting a warrant to search the email, and/ or the customer's premises is a no-brainer.

Remember, they don't need to show probable cause to get this information.

Mirrorshades

[Mirrorshades]

Originally Posted by alaski

Is reading a personal email is legal? That is like wire tapping without a warrant. Is any information gathered through email spying admissible in a court of law? That would seem outrageous that some US agency could arbitrarily, without probable cause, spy on one of its citizens. Has the State now become that intrusive in an attempt to control the behavior of its citizens?

Perhaps you are unaware of the American legislation which governs email storage. The two pieces of legislation are: The Electronic Communictions Privacy Act (ECPA) and the Stored Communications Act (SCA). Both of these pieces of legislation date from around 1986 or thereabouts.

In a nutshell, their provisions are as follows:

* Any piece of email, less than 180 days old, is considered as "in transit" and requires a warrant to access.

* Any piece of email, over 180 days old, is considered as "stored" and does NOT require a warrant to access -- the ISP can simply hand it over at the flash of a badge.

Now, there is one additional proviso to this -- email fields such as From:, To:, Subject:, Date:, Time:, and other header fields are considered as "transactional" in nature, and can be accessed by law enforcement at any time without a warrant, regardless of the age of the email(s).

Mirrorshades

[^mR.]

Mirrorshades

What would you use ? Or are we fucked either way we go ?

[prime]

Originally Posted by ^mR.

Mirrorshades

What would you use ? Or are we fucked either way we go ?

Sounds like Securenym with Tor to hide the IP. And delete any emails on the servers within 180 days.

Good info Mirror.

[^mR.]

Originally Posted by prime

Sounds like Securenym with Tor to hide the IP. And delete any emails on the servers within 180 days.

Good info Mirror.

Trouble is if they really want your info there going to get it.. i personally never keep the same email address for very long.

[prime]

That's where tor comes in. They won't be able to trace your IP with Tor. They would have to get a court order for the whole chain and I'm not even sure if it's possible if the peers are not keeping logs. Not worth the time and effort for an aas user(but you never know with the low hanging fruit leo likes to grab).

[Jo0sh336]

I have heard that you aren't safe with Tor for those who pirate music though. How would it make this case any different?

[prime]

I was under the impression that only the exit points were at risk with Tor.

[charmingttboy9999999]

my paranoia just went up 1000% I justwanna get a little biga but great info ,thanks, starting to grow eyes in the back of my head

[Mirrorshades]

Originally Posted by prime

Sounds like Securenym with Tor to hide the IP. And delete any emails on the servers within 180 days.

Using Tor to connect is an absolute must. However, I foresee a few potential problems:

1) Did Securenym log your IP address at the time of setup?

Some email providers do that, and retain this information for the life of the account plus as long as another year.

2) What I am going to describe next is a theoretical attack -- I am not aware that such an attack has even been attempted, much less successfully carried out. That said, you should still be aware of the possibility.

As we're all aware, Hushmail was forced to modify its software so as to provide a modified Java applet to those customers under investigation. Accordingly, it is not beyond the realm of possibility that SecureNym might also be forced to modify its emal encryption scripts, so as to preserve the plaintext of any email that comes in to a targeted account. Moreover, the incoming email could still be encrypted, just as before, leaving the target none the wiser. Although Securenym simply cannot decrypt any email, once encrypted with your public key since they do not possess the private half of the keypair, nor the passphrase, there is little to stop them from capturing the plaintext email prior to encryption with your public key.

To reiterate, this is a theoretical attack, which I am not aware has ever been attempted, much less successfully carried out. The only countermeasure you can employ in this type of threat scenario is to make use of end-to-end encryption; i.e. any messages sent to you must be encrypted before they leave the sender's machine on its way to you.

Originally Posted by prime

Good info Mirror.

Glad you liked it. Hope it helps.

Mirrorshades

[chiselmeat]

Much of this stuff has come about becuase of the patriate act introduced during the George W administration. It should be called what it realy is, "the repeal of the 4th amendment". Our liberties are being erroded, what is this country becoming, communist china?

[Mirrorshades]

Originally Posted by prime

I was under the impression that only the exit points were at risk with Tor.

Traffic within the Tor network is encrypted. An exit node, as the name implies, is a node with leads out of the Tor network onto the open Internet. As such, any activity you might carry out will be visible. The only times your traffic will be secure is if:

1) You are using Secure Sockets Layer (SSL) or

2) You have encrypted your traffic (e.g. with PGP/GPG.) or

3) You use a Tor Hidden Service (e.g. TorMail) in which case your traffic never leaves the Tor network, and therefore remains encrypted.

Mirrorshades

[Mirrorshades]

DEFCON 18: Your ISP and the Government: Best Friends Forever

Defcon 2010 - Your ISP and the Government Best Friends Forever - Christopher Soghoian.mov - YouTube

This video is the basis for my statements about cellphones being the most heavily surveilled devices currently deployed.

It's about 45 minutes long, and well worth the time to watch.

Mirrorshades

[BEAST]

Originally Posted by webster

I could see a paid email fighting a little harder to keep your information private...because if you are paying for privacy, you have some reasonable expectations to expect privacy, compared to something that you are getting for free. And $60 is a lot cheaper that losing your gear, or having LE knocking on your door asking questions.

I prefer to use an email provider that is based in a country that is not part of the MLAT (Mutual Legal Assistance Treaty). For those of you who do not know what MLAT is, it is an agreement that the US has with other countries to share information regarding criminal activity. That is what LE used to gain access to hushmail accounts in Canada for Operation Raw Deal. Currently there are 51 countries that are part of MLAT. They are:

Argentina. Australia, Austria, Bahamas. Barbados, Belgium. BVI, Canada, Cayman Islands, Czech Rep., Dominica, Hong Kong, Hungary, Israel, Italy, Jamaica, Latvia, Lithuania, Mexico, Morocco, Netherlands, Panama, Philippines, Poland, South Korea, Spain, St, Lucia, St. Vincent, Switzerland, Thailand, Turkey, United Kingdom, Uruguay, Cyprus, Estonia, Nigeria, Antigua, Romania, Singapore, Trinidad, Barbuda, South Africa, Ukraine, St. Kitts & Nevis, Russia, Egypt, Luxembourg, Grenada, Greece, and France.

I use anonymous speech because it is based in Japan and Japan is not part of MLAT that I could find. It costs about $60 per year but the peace of mind is well worth the expense for me.

This is an older read, but may be helpful with the above information, for a more secure email and better peace of mind on this subject.

Hushmail is rubbish, they lied and said not even the employees have access to the encrypted user files and emails. But the very second the NSA tossed them a letter, Hushmail folded up like a house of cards and spilled their information to the spooks.

»www.wired.com/threatlevel/2007/1···d-e-mai/
Encrypted E-Mail Company Hushmail Spills to Feds

For private and secure email, you generally want a few conditions to be met. (and I require them all for any service I use)

1) They use SSL/TLS encryption.
2) They encrypt your database on their servers, and it wipes when you download/delete all of your mail.
3) They scrub headers, so basically all your 'stuff' is removed from the headers before the email ships off.
4) Strong privacy policy, that basically says they can't share anything because they can't read anything!

I do recommend offshore email hosting providers for obvious reasons. Unfortunately, not a whole lot of companies meet all of the above criteria. You can find some obscure, high quality ones if you search using a lot of different search terms.

Some good ones...
»mutemail.com/
»neomailbox.com/services/secure-email
»keptprivate.com/

Do some searches, plenty more out there. Again, I recommend 'Offshore' hosting/email services. There are small Indonesian Islands loaded with incredible servers that do this as well. If the spooks send them a letter, they tell them to kiss off. Just the way it should be.

I have not checked these email providers and the locations or any updates of MLAT, but this looks like the best bet for starting more thorough research regarding current laws and email security/privacy. This information gets more technical with running your own server from home.


Run your own email server, locally hosted (like, in your house) and then the FBI will need to knock down your door, er, show you the warrant before they confiscate your server and read your mail.

Of course, your email is sent all over the place, and unless you encrypt it (as others point out) then it doesn't matter where it's stored as anyone can read the packets if they have access to the pipes. Access to the pipes is easy.

Oh, and be sure to tell everyone who sends you email to encrypt their email too.
--

I have my own domain with a very good host located in a top-tier datacenter. I create my own accounts, and use my own choice of mail scripts on my own server. All SSL, no .JS allowed.

I also have custom SpamAssassin rules, use DomainKeys, SPF Records, and the host uses Enterprise-Level Filtering Hardware.

It's good enough for normal email. If I need be I can send encrypted as well using my own 256 bit AES (1024 bit RSA/SHA) SSL cert. I don't need much more.

I could use GnuPGP....but considering I don't know anyone who'd know how to receive that sort of mail...it's kinda useless.

I haven't even used an email client on a computer since about 2007. No worries here.


My source top 5 safest and most secure email providers ? - Security | DSLReports Forums

I would read all pages, for they contain a lot of hardy information.

[Rebred]

Originally Posted by admin

To add to that.
I dont' think you need to give ID unless it's over $1,000 (been a while since I' used WU so I'm not certain. So you don't need to give your real name. And if it's over $1,000, it might be smarter to break it into two payments even if you have to spend $50 for the fee.

I tried to obtain a money order for less than $1000 from a US Bank branch, but I was told that it is "the bank's policy to require ID for all money orders." So I said "A'ight. No thanks." I then spent my money at a nearby liquor store where I doubt that they would have asked for ID had I purchased a $10.000 money order. Piss on banks.

[Mirrorshades]

Originally Posted by BEAST

Hushmail is rubbish, they lied and said not even the employees have access to the encrypted user files and emails. But the very second the NSA tossed them a letter, Hushmail folded up like a house of cards and spilled their information to the spooks.

»www.wired.com/threatlevel/2007/1···d-e-mai/
Encrypted E-Mail Company Hushmail Spills to Feds

Calling Hushmail rubbish is being too kind to them. For the life of me, I can't understand how they're still in business. According to court documents, the sequence of events here wasn't exactly as you have described it. Rather, what actually happened is that the DEA invoked provisions of the Mutual Law Enforcement Assistance Treaty (MLAT) between the U.S. and Canada. Under the terms of that treaty, the DEA asked the American government to contact the Canadian Minister of Justice to request his assistance in obtaining information desired by the DEA in a criminal matter. The Canadian Minister of Justice, having approved the request, ordered the Supreme Court of British Columbia to issue a search warrant against Hushmail for the information desired by the DEA.

You're absolutely right about the fact that Hushmail lied to their customers. That said, once a search warrant from a court of competent jurisdiction was issued, Hush had no other choice but to comply. The same would be true for any provider, not just Hush. No provider is going to deny a court order just to protect one of their customers.

Where Hush screwed the pooch were in two areas:

1) Lying to their customers. Their own FAQs, archived by the Internet Wayback machine, clearly show they were lying:

See below for details.

2) Designing their system for convenience, as opposed to security.

Hush violated one of the primary tenets of public key cryptography, in that they stored both halves of the users' PGP keys. The entire idea behind public key cryptography was to separate the (public) encryption key from the (private) decryption key.

From my point of view, the ONLY acceptable service is one where the user generates their own PGP/GPG key, using a local copy of PGP/GPG (i.e. on their own machine), and supplies the public half of that key to the service provider.

It may be less convenient, sure, but I'll take security over convenience any day.

Originally Posted by BEAST

For private and secure email, you generally want a few conditions to be met. (and I require them all for any service I use)

1) They use SSL/TLS encryption.
2) They encrypt your database on their servers, and it wipes when you download/delete all of your mail.
3) They scrub headers, so basically all your 'stuff' is removed from the headers before the email ships off.
4) Strong privacy policy, that basically says they can't share anything because they can't read anything!

This is a good list and, for the most part, I agree with it. That said, I do have a few caveats:

1) They use SSL/TLS encryption.

The various notary hacks over the last year or so (e.g. Diginotar and/or Comodo, to name just two) have rather shaken my faith in the system. Furthermore, there has been some evidence that the Iranian government has used man-in-the-middle (MITM) attacks using forged SSL certificates to access the Gmail accounts of people in that country, despite the fact that SSL encryption is supposed to protect individuals from such scrutiny. Frankly, if the Iranians can do it, so can other governments.

Even using a certificate-checking browser plugin like Certificate Patrol for Firefox, how is one supposed to determine whether a changed site certificate is valid or the result of a MITM attack?

2) They encrypt your database on their servers, and it wipes when you download/delete all of your mail.

Nymservers do not store email; rather, they forward it to a destination specified in an encrypted reply-block. Depending on how the reply block is structured, the messages can be sent to an email address (e.g. TorMail) or, for the highest security, they can be directed to an anonymous message pool (i.e. the Usenet newsgroup alt.anonymous.messages).

3) They scrub headers, so basically all your 'stuff' is removed from the headers before the email ships off.

Nymservers do this by default. Your email is automatically both encrypted and anonymized.

4) Strong privacy policy, that basically says they can't share anything because they can't read anything!

With all due respect, privacy policies aren't worth the paper they're written on. Essentially, they involve contract law, as the privacy policy is incorporated as part of the contract between you and the particular service provider. Most privacy policies have boilerplate exclusions, which state that they will give up information upon receipt of a valid court order or (sometimes) a request by law enforcement.

Hushmail had a strong privacy policy, as can be seen from their FAQs published before Operation Raw Deal went down in 2007. While Hushmail did state that their staff did not have access to a customers' email, the wording of their original FAQs went much further than that, as you can see from the following reproductions. The original FAQs can still be seen on the Internet WayBack Machine, even though Hushmail scrubbed them as soon as they could after ORD went down.

From Hushmail's FAQ in 2001:

Does HushMail have a "back door" that can be accessed by government agencies?

No. Email, which includes attachments, sent between Hush users is completely encrypted.

What if my message is subpoenaed?

Hush will answer valid, court-issued subpoenas. However, if the mail is fully encrypted, the subpoenaed version will not resemble the original text version.

HushMail.com - FAQs

From Hushmail's FAQ in 2002 -- note the change in wording to make their claims more explicit:

Does HushMail have a "back door" that can be accessed by government agencies?

No. Email, which includes attachments, sent between Hush users is completely encrypted.

What if my message is subpoenaed?

Hush, like any company or individual, is legally bound to respond to court-issued subpoenas. However, because not even Hush can access the encryption keys of individual users, in the case of a subpoena Hush would only be able to provide the encrypted (coded) version of the transmitted email.

HushMail.com - FAQs

Part of the reason I recommend the nymservers that I do is:

a) The nymservers do not store email, but rather forward it on to its destination; thus there is NO stored email for the authorities to seize.

b) All email is encrypted upon receipt with a PGP public key supplied by the account holder; once encrypted, the service operator cannot decrypt the email as they do not possess the private half of the PGP keypair.

Now, in theory it might be possible for the authorities to arrange to have an email to a nymserver account holder intercepted prior to its being encrypted with the recipient's public key. Such a potential attack is only theoretical; in the almost 20 years that nymservers have been operational, I have never heard of such a thing even being attempted, much less successfully carried out. Part of the reason for that is outlined in the next paragraph; the authorities would have to break the encrypted filesystem on the server to even attempt such a thing.

c) All original headers are removed, especially the From: lines. Subject: lines can be encrypted using a appropriate remailer-directive. (See below for sample output.)

d) The server itself is hosted in a secure datacentre, and the server filesystem is encrypted using LUKS (Linux Unified Key System) which is analogous to TrueCrypt. Accordingly, if the authorities attempt to seize the server, they will not be able to access any of the data on it without the operator's knowledge or consent.

There has been a documented case in the United States, where the operators of the nym.alias.net (NAN) nymserver were approached by the FBI. It appears that the FBI suspected one of the nymserver's users of involvement in child pornography. The operators were asked to produce what information they had on the user in question, and the FBI were duly supplied with the user's PGP public key and a copy of their encrypted reply block. The operators said they never heard from the FBI again.

See: The Design, Implementation and Operation of an Email Pseudonym Server
http://www.cs.unibo.it/~babaoglu/cou...m%20Server.pdf

One of the basic tenets of information security is that one cannot surrender that which one does not possess. The entire point of using a nymserver is to set things up such that the operator has little or no information which they can surrender to the authorities.

As I stated, what is typically going to be surrendered by the nymserver operator are:

a) A PGP public key; and

b) An encrypted reply block.

Using myself as an example, this is what the authorities would get if they approached the nymserver operator:

PGP Public Key:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBE67Lf4BEACcEQid1hvNTe+Pd8nHg43QGsxt8P5zpJkY8W e82gM0tQQ/WGnFyJkjwTjj
Os5as/pegT5jwtgRS4wrgBtXSdbJwE4GVHjopM6KlfgDJEAEmtiFaEyc pGOCFOmpOeUzt0mL
GIbilK4CmLoj8KTw3LPFzJHqXp3nhJaQRezBbK74E0nF/e+C78IV10HNioaV2rOBwAgIOS9M
VCoBrBleTxs0flf5Y2bBGKPTZmhTQJTmhb5nrsMl7kR1Jleaso xp+msDfbfvDLt4rvTB+6wm
gmE7N1vwO8drANa2h2Q0ARv3/wwZUlRoPBn7zR3auPdK1Mj6yuShpRnpkioDTd1Ocu0c8QZD
ZG7UUtRsISH8b2M51w6TlSlvua45qIB8XtQ5L/izgZaDrJ53ll01yqU/bmqmt8fu+aQHSk7k
YXFJddozD6m4hjORc/1lb3FwK9zY0SyZAZtVlJg6FrrlArETt5mjR3xEwhoUXpbmqdg6 4cGS
5bzPL/3Me3MlKCYnRkJwMpMD9ACvzRoXbKutD2T6McrsO7wtbXsoWpU/w+Em9JYWDZb0miqh
SmuxzamZCaGvkJgpdN4f8vD2OlxRp7TWVqoiufYosdTeTUtmlw swlwZU9XvDZS3+9BIzyTLi
INqsXN34kpnpCNENdLBAdwqtsiIRyz+0dCfIepQ8LVh5ZCl7ZQ ARAQABtCFNaXJyb3JzaGFk
ZXMgPE1pcnJvcnNoYWRlc0BUb3JQTT6JAjgEEwECACIFAk67Lf 4CGwMHCwkIBwMCAQYVCAIJ
CgsDFgIBAh4BAheAAAoJEKoUAgt9vcQPjxMP/0he9iZqdr6otsixGQmKpUBvgpL0R8cKt21t
jnQAEzH6wRRaYrfOT8govwf70lZK/KConsMMJkPHRo+KoTsFLUfpt5/wmgFvo4udn0Afn5bH
ig9WR0pil9ZsO63ML9q5dVRFYmVCZoRv49E0+HlOb5fgQ5TJ79 7cKloVcS7w48FxWXxic1d0
cqg1nzG48KzjnUWimyzu7gel/BMwsV++xQbxsLXqQXWk5RxdGtwayZ5smKK3zY04wlISRY8k
8UAXsnzZAnJm1QMj5LqxIIAZM/LMTAD8INXxVyHlW8PvYXncT+7jPjtUDFRHctcKbdQTz0/N
XFK70dtAcxeX0/NnI9GCGmysenrRMlfTuzP9FIxDBiw7A0SjFaekg1u+jLPfSotv UTHwJuBx
nVE2dD6o7O7FNKELE+XxAZPkEmqQtJXZAtyYb1gnZP8I+bb892 nEdDO7XK8bOeBybwCQac1f
2KzAIFvwadc31XQQYvH7fxgETzru/PXvJnKFCAGytQIpQPfWIRWcl2fYIVNBjM8DNbfaxViv
pMagalk/rnmX/1CAjd6/d3GPCSj6TdBnZQroZGF0K4EzYiVef/T818Vv1/zwDeX2egY0XhoO
r+DND8LgXrXBZis4TyvdqkKvVNtdgF0A/zzRiRH1Xjm5aeMefycyLHCQi0VkPA/TiswLA4Gp
tCRNaXJyb3JzaGFkZXMgPE1pcnJvcnNoYWRlc0BkaXp1bS5ubD 6JAjgEEwECACIFAk+GaHoC
GwMHCwkIBwMCAQYVCAIJCgsDFgIBAh4BAheAAAoJEKoUAgt9vc QPptEP/2C/KPQeU6KLotI9
s9zCdX1o6JEFZvh/JclfS3vrwXEEhZpJV9ipuPIoSspCRHIZNnj9n8M+ZnhKt1B9MS CYOGOe
WhII1fTs3qbqtbEnH6ct2A/LHcwOrP9wxWb6aDKUEybtjZVgtDaARiQckm0rMHyh/TFyOog/
ObCK4kOGWmZjaF+YPH9zwQyvEV+vhQ72bnellgIvt+tTFndxtm AE2vjJdiIhhyEEUGxqKkwD
BAlJqH8y7dge6iXfnluEmgQlw4VWbP0PI5QP2sukc/goodEr6d8a6C4BLjUjFJNv+B92+hRE
TdYUcaDONPUS558d71/bFEy42KK7s1pXNYNG5QxwFfRa4gRbDLm3Nt8L+xd/5WgM6l06iWgT
bMdCvq+Bd7fjU4qw02y0L5zo8j+ZLb6WwwZUtinl4/zPIH2axSuavNVmC7PX/DsHasS+it5W
Sa36syelExYSz1EgDPyZtScz1u3LqON/YYMbM5m1aP5QaORK2E4iYsYHtQPqGSxcbD3jBmm0
M3mF2rTVm9ifLkoFJeU4MONOXJYtQUrWI7Z+351tHq4nfGqCB2 HNnI3SC9ZI7iuhCnxxPoaG
hArW5f42zKqVVti7d7mCyKwaq7vQhRvorxv/Bg97j0xLH78AHL6mdyNiPbWaEku9Plslxhqx
DKhGZjX3V5EKEQGKn2pOtCdNaXJyb3JzaGFkZXMgPE1pcnJvcn NoYWRlc0BUb3JNYWlsLm5l
dD6JAjgEEwECACIFAk8BNfYCGwMGCwkIBwMCBhUIAgkKCwQWAg MBAh4BAheAAAoJEKoUAgt9
vcQPZ7YQAJagHMf3AzT8yO1328dru6duA+QskAj8HkOh3LJ9R5 Dz5hrKj2PmyTm89FgfRpMA
JoUGITB4VXjkwkUBKUgBWyAkeNTaUtZxyhvISZfVTSBFCG4LGk wMJph0kj4qfMU9qCyOnpTD
jLa0qhxMu1kHn4TSHgmEf8vC18FOpw1fTxTS5TRBj8ho4mjo4j 0gH5nQkbwwgpk58EE9uEQ+
Ll1LpQNz1dvazIsJqltMNKX7ds+Hn3PfI0/cn7CmsZudGby4Y4oYSdVAGlcKbfA8I5QlHPMJ
Zjd8HHAmaSQCgNY9go5mAODNCVt5CoOhJXm6rriUMt+HkDmaer ytwoDTmabBYrATvjBb5PxC
KeHVpuGaQOZ15FiRvEdJ/guzkV798kV8UBpAvDwS4OPLzBxLVggye7Y/FHA2+N5eGR8/P+5U
xqtEMQWHNxSm4Td5qIZqcyaazrUBUzpz3YPhlmHPFE9ZZSEzfy RJHYyRTnjVtYNA/7DFKgaP
nw1O98qdjcy2WrFw7LCZe+IfRjf1ljVRrm4KfECXfgeXVacwUr Sy+yBvkR52GtoL0R/s9qJC
Kq2xJpslaqMpUGWcmOuIKCVdxMo9EUgHmrK9poVMYD4f5+VG1j gf6tIFcnDMsGlWsND58Rio
/aOX5bKCOyeJylqEdrvwydikusg693hFrE5Uf9wdwXZgiQI7BBM BAgAlAhsDBgsJCAcDAgYV
CAIJCgsEFgIDAQIeAQIXgAUCT4ZowAIZAQAKCRCqFAILfb3EDz IaD/oDW/1kB27ynLW8p2I5
cnItFdQzzge7zk+N1s5NaziNK9PXwghaRMHngefa1rmWTmWOwP 7TGsNLQZwqN5kVtmQpWXxA
XzYu+oyzdXNLUO+ehFiIbIsdAJ3UFBvTB6gjl/0FV3uBQPmtyAUXyKH61RZAKTcK6EfLODKT
//pHWTyZk6kixE4GC4WCerzsdclW+X+kwbmwPI6zcMmVxSrRSZE0 7WcPe2P3UQhzOpy8uYCO
CA6q4l0dUy6F4sIBfKiTRfDFSB4Xrnb9gRBIy9SzgGEnqKj5xq yxjOZB3EM1V4u1nu3K+1aA
BrFWKSu4yrsWJz7rYD6TrrYbF+7cKOtKmqSfleCjE/BdMhLHfhiydpoSYZFOUH1EUck6MhZl
YwQqX5LUG1vt9poXCKaf+MfkGj6Kd5+3nWXLyE1nmvk5routiE YfpDSkRHJFyMm0A8zIFHEN
fAEc7ecfxct+TqpxJBgY4/y1iVe4nQAjsUSX9Ct27oliwNba4IJTWIeKVLX5kKqWb723R3O1
DWVRDj64+srktmAq29aM28aV51ocSF3PxTzyFeiGeo3G9PXUN+ I94d4ZPAZO85/CHqvwxyse
O9aXluBYK1KgC402El6ZyhlYlAGifg9o5QRqCl+1uFDOU4a85x JedUD3DCmjJA8bTO2SskpC
59Avr6tlWLkWoaUcc7QqTWlycm9yc2hhZGVzIDxNaXJyb3JzaG FkZXNAbnltLm1peG1pbi5u
ZXQ+iQI4BBMBAgAiBQJPhmg9AhsDBwsJCAcDAgEGFQgCCQoLAx YCAQIeAQIXgAAKCRCqFAIL
fb3ED+b6D/9reY4hJqUyFkUtRkZJ5vZ+J7jWZLjuczlOKD5vSecaYsx73Vfk fy7PLrIQ3zbZ
fCEfclES5mkToYsks91ikJfITbvEVOELXY2UCVIxjktsj22Utk 3EmSpMNCAx8xeWLx9YTi4V
sQCu4NtN0DT6AHPcTf7XmpBpIkcyDoBMXsQp49q3Hn0TLtIi4S xCuvzbVmYu8wHztnTwzFt/
55vhwbZqk1uTdyuHUFa4fhr4GWL0Eay8K6dJBFGbxwUnX5pxsN Xu2KStDZF6CtoHWrB6ar96
HCmoYmaIQBNAAH81RI2viffWFYvEmXcxoWR6chlt1011FZ0osQ Y1orV3oAl+eJN8l3I5Mm62
aJHXsLS9DOqYR5h4to2LTJIjEYGcexG7Nyp5Mm0pf9K19kD+a7 q9G83EO/ppemlX8xRsef3m
WwMA+bjgvLhNABPGBa/S5MDYAtvOi7r1Nh141uBcXj3cDS928T57fk4Z6ni58e7ilArZu qsr
rm11FkNQOeP2nkJbXVauNJ1WMGhP181leaKgJdNBjGdi7bMWFo m6zsLERt1Xh3gs9RJ8qsrD
1WPYwby14OV77dq1BGPP7nguFBZZiN3RRyPOR7ffORDFldeBzr cShzIZTZY954bE/Vm7lQEE
ZOTL84MrWtsbxYWu37KDKPz5xDt67cXprJJKQTB2u4PftLQvTW lycm9yc2hhZGVzIDxNaXJy
b3JzaGFkZXNAbnltcGgucGFyYW5vaWNpLm9yZz6JAjgEEwECAC IFAk+GaFwCGwMHCwkIBwMC
AQYVCAIJCgsDFgIBAh4BAheAAAoJEKoUAgt9vcQPGo0P/0kAEj5KPM0AyZwlZT/ZMdkJrX1r
hK0aOYoa1MXifIPfsuPGSTgViisDq1MIg8EVQRQT5MwzjTwvRO 3TTCM5w0RSKZvfZZ5ptU2T
4awajYI91BOno5X+JFk0ADOXJUdkFnd2moWb6iXkf5euYBxmL5 Yld8PN9wAKYkwK2oEDW4Hn
bnWtdY3/TARWAl480+EgvFFDVsBlTFZuZwmDPkcwuCpsVeGpfQNUnNZeU7 sxn0aZOJfX9UEw
VhW+277D2fqw52w+uk0auw3e26qGuad3mD0k5PR4uD82PiSoQt vCsy0okNa597nI3l++4wKA
EI+547ZMP79mqyCfxu8PTgjw9W/wXSMNnjDNu3bPHgzA6aLlsL3EUNtN8sgCKd46P8h//Vno
qRLlYdhMeF7fsY2ejuu7T1KM8udr7458LnivY6kmO0XNEbs/tGsFHRK6e8W+cRXFPtcfx3sS
WLu7iz4M9g6RYNZqIL7omOQk4uC1zCgjrGIAXBGeZTOR75Z2sf RtyXDFCGXvjgk9lHkyn+KQ
Jzg1hxxaToiD39iOf63cp2mXNUr5VTdGubrV60LKNjZDe4ciE9 kgoNTbv8yXrVn50nKOUpgO
FiwZkkISDzcH6bJWB5iEaQKQrjr16qKFk7YXIUKeZ1+g3TsM4t oanirg6TsMNoUbSxV5mD2Z
P2OyBskXuQINBE67Lf4BEACuvIK8Ifjnhwy3wrKEmncaHYpRwU nWxx/sGgpNjbQ2orFpjlvW
wdvxxbXShkoyXWBKAYTQas/AmBVvUl0IO414ajBDk1u0StkM73H7OInS3F+Wv26GJTuF9Z4W
+/JSxhNn59FzJrX3ZS84+EiMYyw4QmTrMn+sft1GBth/7zxQcxIer7Ah4TMypZYmLxfYghvl
WXWPqzIT2zP7iSFTv9TOgKpbNHfXbHK1OSEV50NeOlzf2L01HH y+77V+lw11wmEle3GSiHmF
T0zl0Goh9/1t6i6ussbypKVLgWrRzXjL7EUxI9MgUDCP022/Ege0Ihu0Zk2Qggi7SQbn+sPQ
Zhi+KpU7fys29DN8tfuxq9f3xHGaSfqhdWJcPs6QHIV1TOW+1S fTUjP2CPT50olTDr31z97p
S0ceRMtHwuYtbSKZ7dkw/hSewahQ/9lSICGXF7HBUSL8udiSry954eZIZTZIepvGnIOnOBzh
lHqiB27jBDGl8l2xZhPzGo1a+Ci4EJgF/DWXyhM/k0pMYsVzu3F/imQ/b9Ai1dCRJopNIEwE
dGWonepfEgLxFDPyhJiiLcvAz2yTzvJWuWYr8yF9rJzd/iGCNrJy4o/TmaIf1T8RfYwcKKyV
Zug2yHaFGp2vmJAHL8Z8Hp1PC1CTOHdd2DijHdQ+SfrZmbwSU0 4mQGkEwQARAQABiQIfBBgB
AgAJBQJOuy3+AhsMAAoJEKoUAgt9vcQPCnEQAIM+x9jbsBJzsn gpflNeg5lX9w6oFjz2gKWP
fCL70m1Bha4jss+OijKh9nusqbTIqtPDznnD5CDQkEFkPsiCpH R/C3KUJLSCw+OicVnrsyEY
Ad7cFP76ZMVQZFHaGCzuSLOSqZnyP+wEJL59vAzQVLd3EwoS3O LYbLZSlW731lFCdTMVbItI
1EExbnJpYpLH7gDyt242EmDlq7jOBRQHiLUq5XAKxLPDyWEEFf S3563MKHITuYpFhxygO2C8
dFGilKGHj7kbV+WkEsYKM1x9+b853T7SpdRDYg7Q3jsqbhn/ZtGKvPXFJ87xkryvt5G3E1TL
ZH/KsWKst3b/SIn0YwPSLTVm3l3G9bNST8pZ06iHUFQmd6Vm6o36jX+amLmEJR rIz6/+LqTB
uHJG5/5ki+P8HbapVC8T3OryryzJiBOmF9IGHtcjlyr7paAHUAjaKnxS oupU6mqVtMxQ4eZu
iPuGJQk+Fb4+6dG03SElkssKJ2JezIgF8IPZH17iUccXDzYPrt S3Ewl00VWBw4/0niTohWe8
VobfTBwPUJ+dhi1O19RDcbr8DfZirVxzXfbj5nwHtYe3vU/UpE08NQ2SGahxo91oLDKcwZAb
YtH7Yeb9HUMg1yGmKP9M9HpuDdC+XzgkAJiJIEMIKYMEEWLCH2 Xzu3uQCFaJl5r8K/SeONHF
=M2CB
-----END PGP PUBLIC KEY BLOCK-----

Encrypted Reply Block:

Reply-Block:
::
Anon-To: remailer@dizum.com

::
Encrypted: PGP

-----BEGIN PGP MESSAGE-----

hQEOAxuLTZeyVH2AEAP+PW/zEuSprrUOJWuwOgcwAHZQTRHwF5a/ndjPvvnmN6GL
4W3j8edpv6hMymEzgRg/c+9GZEF9e8qiFe+CIcu/DFbfiGtn/AFVlECqtUgeVHX/
iG6wajj029lnjrzdLbDpzjA6Jup4Fd238xVQvCAitrcnDWsIPO aovcKF1SraA6EE
AJpkdXq82WnMENJgQTQ83SgQb0wKi9rtnkFnR41fymN1IqUj+t EKryiqjCntPIAV
KNcjPVJ2wV7C4aZqPC/jsy0e3f2SPh6A1HsI7non2gGp/MsY6v1tH9FbGbsrsUzE
V4jyvRR0FGlUZ9PA/fIGOkd8QH3FPa9H+Ux/9ic3as5dhQEOAz0TUHXPg+8QEAP/
fXSCjuIWqQTci0xRU9iNa2fatn1cPscboaLEJD3v2Dyw2yFasS 5SNlv2f6CbOFPw
o7wseuZbnN1YIjrb+DVAhHsAR0QRghDikkLAHRy3km3Ee0Cn57 4rbBH6wicIGYF5
IM2/0cJcc1qK06dnZgDaVe/EjVQ7l97cdDprjLQMNt8D/RfmSazNvpHBYMas1aIt
wYEI9npE+DmUmFFOd5tOx9QKFqRoj9bgcUzOERuyVqcc/sExoaSZluvJLmkBAb0c
IRG8CfGBF33ifJqaeDkLffr42v7k2hcx8dpmF1WpPLbeH4igdy bfLfMOB31/hXbo
AJ5v4weONntle9qn8vjVALSshQIMA4wQGjTiCpebARAAkMp5P0 tO4ZXLrs2Pk6h+
V2wrmk2GU98/p2gq9+Op8Zwc0OVsbu8asRLViJ19mUKtD70yHLr65ZBofEZ5ED IS
FLmCmo91R1AQuGCJlZUSOZCI/rq+N+gFPYFbo8cMtaxZbQ0uEhycfXNwiTG94FF3
TKh1qhxUVqSsAfVVagfwvXPlpahvSgi2cjm8y3NZC8XWqWS60q J0jUlm2MpwKupX
liV1M+RjEp1v/gzksRVn66JjIBjvEyBR/lWcA7i4/GNKcjCpIqiW1veOi/EE77kD
Bd+KTsA7QrCI7Sk60Dlxmf2iUuG7l1tMm1ldtL6eyaN9GeY+h4 cfG0NpUQDO/zu+
JP85uK6SJizqvLSjowBkv+4QsJZl80yGBRXD1HlAVG5OOUnz+c r9owwg4qNmuZpx
U/31Jk+Xk8c8lYVV7ve4xBzgQyWZAhr0aYefR3FH8SzyNQ/HIGhMW+sgzfzzirwo
mXhVltteHSANgSGsx9zmfELEBcigXUH98/nB4n2BfXgEsTugRkYRPXMX9p1wNSGH
348ZrQ5sJxj7AtdmdE9HHqTfiH4+VLusXZXqPDVY+DmzB2NO2y 2j2DhmepoKREXp
h+uRSVFV+tIRPXStJAUzCUb2I2YqVt9FKeddafr7sXKJ4++GW8 yJO9+DaIWTir38
qqTK9v7kDtvFep4kRCXiTRTSwGIBVC87P09iQyaKa/r+jXV7O8CbyjqZASf+gJcl
JFx5Z6e+oAhu42BcYSKOVwTQOWAlRVFzRLe9AXeUTcDEMdnqaz fKn75kbDTkUHni
M/wLRy9vl5UfvRELMJ7k+V8M1opsPp1rx0nNqtCOL6Ov/0nqKPIWrQerd1EXP7zm
Yqj36DdfcyCr+1WfsahuC/0UDp2cOTIUg9FnkMuBb6+Ws9AA9Hu1rEVuiCn3yjHh
Z1bJP7E2Y+Q7Ofv1QK52ql/j/Wnr7Mw0x8Kah9xnsy6Ka3KSMuTv5TmKrglw8b6D
HkbkIlNmfXw4fyb6YcTqPR5gRVgrZvk2qkp4ZhiwC0gY+sD3tC ovHyGyin8j/f7i
oNhHR0UhnZ0J6e8jq2go/c+23Fsscw==
=1LZ/
-----END PGP MESSAGE-----

**

Now, I think you'll agree that this doesn't do them one helluva lotta good, so they'll have to approach the remailer operator to decrypt this reply-block, to try to get some useful information. Assuming that they are successful in doing so, this is what they'll get:

Decrypted Reply Block:

Reply-Block:
::
Anon-To: remailer@dizum.com

::
Encrypted: PGP

::
Request-Remailing-To: mail2news@mixmin.net,mail2news@dizum.com
Encrypt-CAST: arbitrary_string_goes_here
Encrypt-Subject: AKC688gsXwXzkRZPpdUwMQ2mbySOg6qC

##
Newsgroups: alt.anonymous.messages
Subject: Some arbitrary Subject: line goes here

**

**

Even using the information in this decrypted reply block, the most the authorities can do with it, is to isolate my message traffic from the anonymous message pool in which they are posted. All they will get are PGP encrypted messages they cannot read, as they do not possess the private half of the PGP keypair. This is something like what they would see, if they could isolate my message traffic:

From___________Date________Subject

Nomen Nescio Apr 11, 2012 8b2b63fb5fada173866dcacffe29f990104104f73406cf23

Nomen Nescio Mar 19, 2012 0fe3a6da0516d30ac65905c091a80c0414b200f5123e8d6d

Nomen Nescio Mar 18, 2012 3ff6614a67966d734209d24e54d1dea1e02134be03d00562

Nomen Nescio Mar 16, 2012 8c5fdedeec3a3849c11b6cdda4da3828e8e612ad55a41490

Nomen Nescio Mar 14, 2012 94fe76b8024d3d82e43532f0b5d29301ab414de077a4097f

Nomen Nescio Mar 13, 2012 b9fe7eaf33b390bae62e926278a273301537426a2168a405

Nomen Nescio Mar 13, 2012 6d354e6c606727b9ad2b9258363b7fef221bd3b4c872dd78

Nomen Nescio Mar 13, 2012 e376364261992b2c7f653f72323d57e20e1582cf89b4fde0

Nomen Nescio Mar 13, 2012 6363381ad7943084d5dbcc8867a10cc0451c0f1d68c80d26

As you can see, the sender's information has been stripped-off, as well as the original Subject: lines. The original header information, including the From: and Subject: lines (as well as the rest of the original headers) are contained in the encrypted message body.

The idea here is that you still have access to all the original information, but the authorities do not.

Now, what I've shown above is the most secure method using of reply blocks; i.e. having them point to an anonymous message pool, i.e. the Usenet newsgroup alt.anonymous.messages.

Newsgroup messages can be accessed from dozens, if not hundreds of services, many of which do not require a user account to read/download Usenet messages. Thus, there is no way to track where these messages are accessed/downloaded from.

To put it in non-geeky terms, this is the equivalent of publishing your encrypted message traffic in a newspaper; it would be impossible to know who is reading/accessing these messages as they are so widely available.

In order to retrieve your message traffic from alt.anonymous.messages, it is necessary to run a small script, written in Java, which will fetch the messages from alt.anonymous.messages, and keep those intended for you, while discarding the rest.

Alt.anonymous.messages gets several hundred new encrypted messages per day; any messages intended for you are mixed-in to a literal torrent of encrypted message traffic.

Directing Messages to An Email Account

Now using an anonymous message pool is probably overkill for most users here; if one changes a few lines in the reply block, the email can be directed to, say, a TorMail account:

Reply-Block:
::
Anon-To: remailer@dizum.com

::
Encrypted: PGP

::
Request-Remailing-To: Mirrorshades@tormail.net
Encrypt-Subject: AKC688gsXwXzkRZPpdUwMQ2mbySOg6qC

##
Subject: Some arbitrary Subject: line goes here

**

**

In either case, whether I use TorMail or an anonymous message pool, the authorities cannot locate me, nor can they read my emails -- stalemate.

Originally Posted by BEAST

I do recommend offshore email hosting providers for obvious reasons. Unfortunately, not a whole lot of companies meet all of the above criteria. You can find some obscure, high quality ones if you search using a lot of different search terms.

Some good ones...
»mutemail.com/
»neomailbox.com/services/secure-email
»keptprivate.com/

Do some searches, plenty more out there. Again, I recommend 'Offshore' hosting/email services. There are small Indonesian Islands loaded with incredible servers that do this as well. If the spooks send them a letter, they tell them to kiss off. Just the way it should be.

Mutemail.com

Mutemail.com is headquartered in the U.K. -- ther servers are allegedly housed in the Bahamas. From Mutemail's FAQ:

Where, generally, are your offshore servers?

In order to assure customers' email privacy and email security, our servers are located offshore in Nassau, Bahamas. Bahamas is well known as a country with strict privacy laws.

While I believe that may have been true at one time, I'm not so sure about today. Consider, for instance, the following article excerpt published by The Bahamas Financial Services Board, for publication in EU Banker:

"...the United States Treasury recognized The Bahamas as a cooperating country with respect to all relevant international efforts to counter money laundering activities."

* The Mutual Legal Assistance (Criminal Matters) Act 1988, governs requests for legal assistance in criminal matters from the United States of America, Canada and the United Kingdom, all of whom have entered into Mutual Legal Assistance Treaties (MLATS) with The Bahamas.

* The Criminal Justice (International Cooperation) Act 2000 allows the Attorney-General to render assistance to courts or tribunals exercising criminal jurisdiction, prosecuting authorities, or any other authority, which carries out such functions in countries that do not have a Mutual Legal Assistance Treaty with The Bahamas.

Source:
The Bahamas: Meeting International Standards
The Bahamas Financial Services Board
Thursday April 23rd, 2009
The Bahamas: Meeting International Standards - BFSB Releases - Bahamas Financial Services Board


Neomailbox.com

According to Neomailbox's privacy policy,

"Limitations

The abuse of our mail servers or of the service for the purpose of sending unsolicited junk mail, or for any fraudulent or criminal activity, will invalidate all privacy guarantees for the account(s) concerned.

Keptprivate.com

Keptprivate is an American-based company. My understanding of the current legislation is that the FBI (or the DEA) can request records using an administrative subpoena. An Administrative subpoena does not require a hearing before a judge, and can be signed-off by an agency supervisor.

The only good news is that, as far as I can determine, as of January 2012, Indonesia still has not signed-on to MLAT.

Originally Posted by BEAST

I have not checked these email providers and the locations or any updates of MLAT, but this looks like the best bet for starting more thorough research regarding current laws and email security/privacy. This information gets more technical with running your own server from home.

The situation is extremely fluid, and can literally chance at any time. Unfortunately for all of us, these changes tend to make matters worse, not better. For instance, in May 2012, it is widely expected that, in the Queen's Speech, the U.K. government will introduce broad, sweeping surveillance legislation that will require details of all calls, email and web-surfing (including URLs visited) recorded for some two years.

Originally Posted by BEAST

Run your own email server, locally hosted (like, in your house) and then the FBI will need to knock down your door, er, show you the warrant before they confiscate your server and read your mail.

Unfortunately, this is not an option for most people. In my experience, many people can barely cope with using PGP encryption.

Originally Posted by BEAST

Of course, your email is sent all over the place, and unless you encrypt it (as others point out) then it doesn't matter where it's stored as anyone can read the packets if they have access to the pipes. Access to the pipes is easy.

Oh, and be sure to tell everyone who sends you email to encrypt their email too.

Indeed. That is the entire point of using a nymserver, i.e. to have your email encrypted and anonymized automatically, so your correspondents never have to learn to use encryption, if they are unwilling (or unable) to do so.

Originally Posted by BEAST

I have my own domain with a very good host located in a top-tier datacenter. I create my own accounts, and use my own choice of mail scripts on my own server. All SSL, no .JS allowed.

I also have custom SpamAssassin rules, use DomainKeys, SPF Records, and the host uses Enterprise-Level Filtering Hardware.

It's good enough for normal email. If I need be I can send encrypted as well using my own 256 bit AES (1024 bit RSA/SHA) SSL cert. I don't need much more.

It sounds like you know more than 99.99% of people. You appear to be very well prepared, indeed. However, you might wish to consider updating your SSL key to 2048-bit. NIST has deprecated 1024-bit RSA as of the end of 2010.

Originally Posted by BEAST

I could use GnuPGP....but considering I don't know anyone who'd know how to receive that sort of mail...it's kinda useless.

I haven't even used an email client on a computer since about 2007. No worries here.

If you'd like, you can exchange PGP-encrypted email with me, just to try it out, as it were.

The difference between our two approaches is that your approach is not easily duplicatable, whereas my approach can be taught to people in an afternoon, or at worst, in a day or two. All that is needed is for people to be able to follow instructions. Your approach, while excellent, even superb, cannot be taught to an arbitrary number of people in any reasonable time frame.

Originally Posted by BEAST

My source top 5 safest and most secure email providers ? - Security | DSLReports Forums

I would read all pages, for they contain a lot of hardy information.

Excellent resource, thank you.

Mirrorshades

[IPGEAR]

Securenym has always operated on we do not want to know. They have never logged traffic. They have their system monitored for hacking attempts.

Safemail has an interesting method of tagging the two and from lines on accounts of about 10% of gear users. Do a mailing to 100 safemail accounts of gear customers and about 10% of them will have a message sent back saying the user account does not exist.

Kept private merely reports back that its banned content if you send a list. Real private.

Privacyharbor does not keep their server certificates up to date and so dealing with them is no longer worth doing.

Aol just has you targeted as a spammer even though you are responding to a request from a customer for a list and if you do not know that will get anyones provider uncomfortable.

The game goes on without them today for us.

IPG

[Mirrorshades]

Originally Posted by IPGEAR

Securenym has always operated on we do not want to know. They have never logged traffic. They have their system monitored for hacking attempts.

Just within the last few days I wrote the admin@securenym to ask them some questions, for example how do they deal with credit card chargebacks, what are their plans to deal with forthcoming Canadian online surveillance legislation, etc.

My email was sent on a Sunday, and I received a response about 4 hours later. Considering that, 1) I'm not a customer of theirs, and 2) that I asked some fairly pointed questions, I expected to receive an answer in a few days, if I received one at all. I have seen remarks made to the effect that SecureNym's responses to email queries were very quick, and my own experience proves this was no exaggeration.

I most certainly did not expect a reply within 4 hours on a Sunday; that in and of itself was impressive.

The admin's responses to my questions were guarded, which comes as no surprise, as they don't know me from Adam (nor should they). That said, what did come through loud and clear in their response was their passion for privacy.

Originally Posted by IPGEAR

Safemail has an interesting method of tagging the two and from lines on accounts of about 10% of gear users. Do a mailing to 100 safemail accounts of gear customers and about 10% of them will have a message sent back saying the user account does not exist.

I've heard from other sources I consider credible that certain accounts are liable to be flagged, and copies of email traffic both to and from those flagged accounts are carbon copied to the admins of the service, possibly with a view to passing on the messages to law enforcement.

Originally Posted by IPGEAR

Kept private merely reports back that its banned content if you send a list. Real private.

Good grief! How do they manage to stay in business? The mind boggles.

Originally Posted by IPGEAR

Privacyharbor does not keep their server certificates up to date and so dealing with them is no longer worth doing.

As of April 13th, 2012 there is a notice on their site that they are ceasing operations as of the end of April. As of a few minutes ago, their site was no longer responding, and failed to load.

Originally Posted by IPGEAR

Aol just has you targeted as a spammer even though you are responding to a request from a customer for a list and if you do not know that will get anyones provider uncomfortable.

The game goes on without them today for us.

IPG

It's AOL -- what else can be said, eh?

Mirrorshades

[IPGEAR]

Mirrorshades,

Your responses lead us to believe you are one of the most credible people to be advising people on the subject. Usually after 12 years of hanging with Securenym we still get hit with stuff like "anyone with servers in USA".... blah blah blah. You got what we have always gotten from them, where we honestly stand in regards to our anonymity and security in regards to their program. If you knew them like we did earlier on you would know that these guys were a core group of bad ass renegades who were some of the most computer savy people in the world. They could rock someones world in a hearbeat. They set it up so they would not know and therefore did not have to care. Over the years there have been court battles with the powers that be argueing that Securenym should be collecting more information on people, have access to accounts ect. But Securenym has always won their right to maintain what they initiated pretty much from the beginning. They give you accurate advise about how to maintain complate anonymity from the point of setting up the account. We have never heard of anyone getting into a securenym account who did not have the password and they do not have it. The system is monitored for hacking attempts and will shut down the account until the owner surfaces. They recognize with a password access can be gained and warn about using PGP for sensitive information if you are worried about that.

Today they have to play the game somewhat when it comes to trying to avoid blacklisting created by asshole providers who do care what you do.

They are not criminal, and they do not support criminal activity. but they do fight for your right to be anonymous and secure because thats the kind of guys they are.

They have always been forthcoming, and they have not to hide in our opinion.

Over the years you get a sense of who are the leaders in this business and in our book they are of those.

Thanks again for your excellent responses not because we are pretty close on perspectives, but you are bringing good things to the community.

IPG