1

Someone told me you can "just send an email to yourself" as a means of proving non-disclosure, copyright, resolving disputes, etc.

What I'm specifically wondering is whether this requires you to use an email service where you have absolutely no way of sending backdated email or altering already sent email?

In other words, since you have full access to it at any given time, using your own email server for this purpose would render your evidence worthless, wouldn't it?

migrated from security.stackexchange.com May 10 '18 at 12:44

This question came from our site for information security professionals.

  • I think there was a court case with someone claiming an email from Mark Zukerberg gave him the rights to about all of Facebook, and the guy might be in jail right now. – gnasher729 May 12 '18 at 15:25
3

It doesn't really require anything beyond your say-so that it is what you say it is; that would be enough to satisfy the requirement for authentication.

From there though, as with any evidence, it's going to be up to a jury to decide how much weight to give the evidence. So the more you can show them to prove that the record is real -- and to knock down any questions the opposing party will raise -- the more likely they are to believe it. So if you just bring a printout that looks like it could easily have been forged, the jury may be thinking about that. If you can bring in a data forensics expert to say the document couldn't have been faked, that's probably going to help.

Addendum: As a practical matter, I wouldn't expect this to be much of an issue. Unless you're dealing with a savvy opposing party, the authenticity of e-mails seems to be generally assumed. Courts (1) generally assume that parties aren't perpetrating frauds; and (2) are generally run by judges with little to no technical savvy, who don't realize that one could forge an e-mail, let alone all the different ways it could be done. I've personally entered countless e-mail printouts without them being questioned, even though either party could have just gone down into the e-mail thread and changed what the other side had said earlier in the conversation.

To avoid the issue, though, it might be that sending the e-mail to a Gmail account would elimimate the question.

1

It would all boil down to credibility of the email hosting service. Running your own email server itself seems weird given the sheer difficulty of doing so competently. Because with the various security threats out there, "competently" is a high bar. If the server is not secure, then emails from it have a credibility problem for a different reason!

So your own email server makes sense for Ford, it makes much less sense for Joe Citizen, Esq. Also, at Ford the email system will be managed by a bunch of at-will employees who are not willing to go to jail for the company, and likely they are not the defendants. So the court can largely trust their subpoenas will be answered truthfully.

For you, the elephant in the room will be "why on earth would you run your own email server when Gmail accounts are free?" A factor would be whether you could've possibly anticipated using email to defend a case. The plaintiff will argue "you did it to set the stage for tampering with email evidence". And you'd need to show why a reasonable person in your shoes would have a private email server. If you fail, your email evidence is excluded.

Once I had to send a stack of documents to a friendly private business, and I knew the opposition would challenge the delivery date. I loaded them onto Google Docs and timely emailed the link to their Hotmail account. Plaintiff did object claiming the documents were tardy, and said I was a "computer hacker" who had "done technical stuff" to falsify the dates. We were fully prepared to subpoena both Google and Hotmail, but the court told us we didn't need to bother. The court was satisfied by the fact we had captured the documents via indifferent, well protected third party services. This was a rural court in middle America in 2009.

  • I run my own email server and I don't think money is the only reason why I do it. The court could be convinced of reasons. – mark b May 10 '18 at 18:00
  • @markb ok, you have convinced the court that you did not setup the email server to tamper the evidence. But now nobody can certify that the "evidence" that you show has not been tampered with, because you have full access to the data and you are able to modify it... IOW, you do not have evidence. – SJuan76 May 10 '18 at 22:21
  • Or maybe you do, if you display enough credibility to the court, but point is, you can't count on it. Reminds me of a presidential candidate once who was subpoenaed for certain specific emails, turned over those emails and not others, and deleted many others. A big stink was made. Later they got visibility into one of her correspondant's email accounts for an unrelated reason. Turns out this recipient's eye view proved she had complied. – Harper May 10 '18 at 23:31
1

Maybe it won't completely invalidate your evidence. Your email server may have logs, backups, etc. that could (somehow) certify that the email hasn't been tampered with (eg. the email was already present in a backup tape put two years ago in a bank safe, with the bank certifying the date it had been stored). However, it will certainly make it much more weak.

The point is, if you have full access to the data stored, you could have tampered with it. There are cases where you are not really having that access to "your" mail server, such as it being provided by your hosting, or the CEO/company owner technically "owning" the server, but not managing the server themselves so they would be unable to tamper with that data without the collusion of certain other employees/contractors.

Even if you don't manage the server itself, it could be possible for you to copy a backdated email through IMAP. My recommendation would be to send the evidence email [to anywhere you can pick it] from a third party provider which supports DKIM (any big player does).

This way, when sending the email, the third party (eg. gmail) will be signing [some parameters of] the message with their DKIM key (usually the subject, date, recipients, body hash...). You could later prove that gmail certified [at the signature timestamp] those email contents. Thus, [barring some catastrophic bug] the only way for you to have that signature with that message being false, would be that you convinced gmail to fraudulently sign that email (which should then considered infeasible by the court, concluding that the email was indeed sent at the given date).

0

Yes, using your own email server to do this would pretty much invalidate your claim. You'll find it pretty hard to convince the court you aren't able to alter the stored emails any way you want. What you want is a service where you can show the court a chain of custody that you can't manipulate.

  • A personal server might be suspect, but I think I can't think of any claim someone might bring that would be invalidated by a personal server. – bdb484 May 11 '18 at 20:45
  • @bdb484: If it's a personal server, one would have admin rights and can change or delete any file and remove the evidence they did so (given sufficient expertise). So any claim I make about the contents (or lack of) on the server can be invalidated. – KJ Seefried May 12 '18 at 15:01
  • I see. But there's a difference between saying that something would be invalidated and that it can be invalidated. The use of a personal server would not, by itself, invalidate much. – bdb484 May 12 '18 at 17:37
  • @bdb484 - I suppose I see what your saying, but that sound suspiciously like "if I can convince someone a falsehood is true, I get to win". IANAL, but as a domain expert called upon to speak about such things, a personal server would invalidate any claim that required things like chain of custody, immutable/reliable logs, etc. Someone may convince a court to ignore all that, but they'd be ignoring a lot of settled issues. So I guess that's what you mean. – KJ Seefried May 15 '18 at 1:59
0

As others have said. Email will be treated as just any other evidence, and there are no formal requirements.

However, I would say that "just send an email to yourself" is pretty bad legal advice. If you're facing an opponent that will contradict you and insist the mail was forged, you'll have a hard time proving him/her wrong, and the matter will boil down to who the judge/jury will be most inclined to believe.

If you want to make sure the authenticity of some historic document is not disputed at some future point in time, get it notarized.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy