Why you should assume your email will get hacked or leaked eventually

John Podesta did almost everything right. When the Clinton campaign chair got an email claiming to come from Google and telling him he needed to click a link to change his password, he got suspicious. An email released by WikiLeaks on Friday shows that instead of clicking on the link, he sent an email the campaign’s technology help desk and waited for their instructions. Only after an IT worker confirmed that the email was legitimate did Podesta click the link and change his password.

Unfortunately, the IT worker was wrong. The email was actually a trap set by hackers with suspected ties to the Russian government. When Podesta clicked the link and entered his password, he gave the hackers access to his email account. They harvested thousands of emails from his account and leaked them to WikiLeaks.

There are, of course, further steps Podesta could have taken to lock down his account and prevent the attack. At the same time, it’s important to recognize that no security plan is foolproof. As more and more of our communications move to electronic media, the kinds of leaks we’ve seen during this presidential campaign are only going to get more common.

So people — especially people in positions of authority — need to start taking this into account. Private venting over email or other online communication platforms won’t necessarily stay private. It’s better to save your most vitriolic wisecracks for face-to-face meetings behind closed doors

“I'm changing how I use email,” said one Washington insider who was affected by the Podesta email leak. “I'm not candid anymore.” But he acknowledged to CNN that “I may be locking the barn door after the horse escapes.”

At the same time, it’s unrealistic to expect people to totally sanitize the emails they send. Sometimes clear, direct communication is essential to doing your job. Putting things too diplomatically could cause the recipient not to take the message seriously. Also, it’s natural to want to blow off steam every once in a while, and it’s easy to assume you won’t be the one who eventually gets hacked. So we can expect these kinds of juicy revelations to become a routine part of politics for the foreseeable future.

Locking down your email is hard

Photo by Drew Angerer/Getty Images

Theoretically, John Podesta could have thwarted the attack if he’d been more technologically savvy. The email he received had a “CHANGE PASSWORD” link that purported to go to a Gmail page but actually went to a page controlled by the hackers — but this fact was obscured by the use of the link-shortening service bit.ly.

The lesson here is that you should never click on a link in an email and then enter your password. What Podesta should have done instead is to manually type the address of the site he was trying to visit (in this case, “gmail.com”). From there, he could have navigated to Google’s change-password page.

And if they do click a link, users should check the address bar to make sure that it’s the address they expected (like “gmail.com” or “google.com” in this case). If Podesta had done that, he might have noticed that he’d been taken to some other address before he entered his password.

But these rules are pretty subtle and easy for users to get wrong. Hackers mounting these kinds of attacks often register domains that look very similar to the official one — like “facelook.com” instead of “facebook.com” — making it easy for the victim to get confused. And in this case, Podesta was suspicious, asked for advice from tech support, and then got bad advice in response.

“The fundamental problem is that security and usability are in opposition with one another when we're talking about logging into web services,” says Dan Wallach, a computer scientist at Rice University. Tech companies want to make it hard for the bad guys to break in — but without making it too cumbersome for the user to use the services. That’s an inherently difficult balance to strike.

Even if you’re careful, you can still get exposed if others aren’t

The Podesta leak hasn’t just been embarrassing for Podesta, it has also been embarrassing for many other Clinton campaign staffers who communicated with him. Also exposed were numerous other people in the progressive movement who either included Podesta in email chains or had their emails forwarded to Podesta after the fact.

So even if you’re extremely careful with your own online security, your private messages could still be exposed if anyone you correspond with is careless. Your emails could also become public if, say, a former colleague becomes disgruntled and decides to deliberately leak embarrassing private emails to the press.

Another danger is that your email provider itself could be hacked. Last month, we learned that hackers broke into Yahoo’s email servers, gaining access to 500 million accounts. So far, it doesn’t appear that the culprits have released any of that information to the public, but whoever was responsible for the leaks likely has a great deal of juicy information they could release in the future.

Other major email providers haven’t suffered breaches on this scale yet. But there’s no guarantee that it won’t happen in the future.

Governments are working hard to hack people’s email

Photo by Adam Berry/Getty Images

As that last example illustrates, the problem isn’t just that locking down email accounts is difficult. It’s that the growing importance of email communications has meant that governments are putting more and more resources into email hacking efforts.

Back in 2010, Google announced it was pulling out of China after discovering that the Chinese government had been trying to hack into the Gmail accounts of Chinese dissidents.

In 2014, the North Korean government hacked into the corporate network of Sony Pictures and dumped a massive cache of private emails in retaliation against Sony for producing The Interview, a comedy that mocked North Korean dictator Kim Jong Un.

In recent months, the United States government has blamed Russia for hacking email accounts connected to the Democratic National Committee and releasing them to the public. Meanwhile, hackers released a cache of emails stolen from the account of a senior aide to Vladimir Putin.

People should expect their email to leak

People should be doing more to lock down their private communications. And organizations should be doing more to train users on good security practices and encourage them to use them. That’s especially true for an organization like the Hillary Clinton campaign that are predictable hacking targets.

At the same time, it’s also important to be realistic. And the reality is this: There’s probably nothing we can do to fully prevent these kinds of attacks. Everyone is potentially vulnerable to having their emails stolen.

When I worked as a systems administrator in college 15 years ago, we had a saying: Never put anything in an email that you wouldn’t want to see on the front page of the newspaper.

Back then, the idea of leaked emails winding up in the news seemed a bit fanciful, since hardly anyone using email back then was prominent enough for their communications to be newsworthy. Obviously, the world has changed. Now almost everyone uses email — including future presidents and their advisers.

And as these emails have become juicier and juicier targets, various people and organizations are trying harder and harder to hack them.

All of which means that if you’re a prominent person — and especially if you’re a senior adviser to a presidential candidate or world leader — you should take the possibility of getting hacked very seriously. That partly means doing everything you can to lock down your email service — by enabling two-factor authentication and ensuring everyone in your workplace or organization gets thorough training on email security.

But it also means you should be careful about what you write in an email. Because there’s a very real risk that anything you write down and send over the internet will eventually become available to the whole world.

We have a request

Vox's journalism is free because we believe that everyone deserves to understand the world that they live in. That kind of knowledge helps create better citizens, neighbors, friends, parents, consumers and stewards of this planet. In short, understanding benefits everyone. You can join in on this mission by making a financial gift to Vox today. Reader support helps keep our work free, for everyone. Will you join us?

One-Time Monthly Annual

$95/year

$120/year

$250/year

$350/year

Other

$

Yes, I'll give $120/year

Yes, I'll give $120/year

We accept credit card, Apple Pay, and Google Pay. You can also contribute via