Don't Pull a Petraeus: How to Keep Your Private Email Private

Want to communicate with someone in strict confidence? Don't imagine you can just use a pseudonymous Gmail account. That didn't work out very well for former CIA Director David Petraeus. Just what are your options?

Hide Your Location
Quite possibly the mere fact that you're in contact with your shadowy partner may be evidence against you. Law enforcement needs a warrant to get access to the contents of your email messages, but they only need a subpoena to request the metadata contained in email headers. Every email header includes your IP address, and that IP address may well reveal your identity.

Clearly both of you need to mask your IP addresses, so there's no evidence you're connecting. A Virtual Private Network (VPN) tool will do the job. When you connect through a VPN, the IP address associated with your communications is that of the VPN server. The free VPN service from proXPN or Private WiFi will do the job. But hey, you're a high-ranking public servant, right? You can surely afford two licenses for one of PCMag Editors' Choice VPNs, Norton Hotspot Privacy or VPN Direct.

Hide Your Communication
Google receives thousands of government requests to hand over user data every year and offers a summary on the Transparency Report page. For example, in the first six months of this year Google received over 7,000 requests from U.S. authorities and complied with 90 percent of them. Clearly you can't rely on a standard email provider to keep the law from reading your messages.

The free Enlocked service will encrypt your email communication, but your messages travel to the Enlocked encryption servers in plaintext. PrivateSky, also free, takes the next step, handling all encryption and decryption on the local computer.

Eliminate the Evidence
Even if you do use encryption, law enforcement might conceivably obtain and decrypt the contents of your inbox. The free Send. 2.0 both encrypts your messages and scrubs them after seven days.

For maximum secrecy, consider purchasing two $79 licenses for VaporStream. This spy-friendly communication tool offers electronic communication that leaves no traces. As soon as the recipient has read your message, it vanishes. VaporStream sends the message header separately from the encrypted contents, and the header and body are never visible at the same time. The recipient can't copy, forward, or print the message. Messages aren't stored anywhere and thus can't be subpoenaed or leaked.

Just Don't!
A government agency that really wants to tap your communications will surely find a way around any of the solutions I've mentioned. Even VaporStream could be vulnerable if an agent managed to install a screen-scraping Remote Access Trojan on your system. Think they wouldn't or couldn't do that? How much would you bet?

One solution to the problem of hiding an affair or other illicit activity is simple; just don't do it. The fact that you're hiding it means you know it's wrong.

If you really must communicate in secret, avoid email altogether. Coded texts from frequently-replaced burner phones might be an alternative, or anonymous coded posts on public chat sites. Good luck!

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio