Can you send a truly anonymous email?

15 Jul 2011
Mouse

Is it possible to send a truly anonymous email? Davey Winder investigates

This question was posed to me by my 13-year-old son: “Can I send an anonymous email, dad”, he asked, “and be confident it can’t be traced?”

Having got to the bottom of why he wanted to send such a message, and persuaded him that there are far more satisfying ways to vent his spleen at someone than hiding behind a cloak of faux anonymity, I got down to the technical nitty-gritty of his question.

There are far more satisfying ways to vent his spleen at someone than hiding behind a cloak of faux anonymity

You can send anonymous emails, and there are plenty of free and commercial services available that will offer to provide you with just that, but the effectiveness of such anonymity is another issue altogether. When you use an anonymous remailer service, it will be aware of the IP address from which you connected to it, and whether it obfuscates that IP from the ultimate recipient or not doesn’t really matter, because you’ve already left a trail.

No matter how many remailers you use to hide the original from the recipient, a determined person with the right resources and authority (a law-enforcement agency, for example) could still hop backwards through the server queue and eventually arrive at the starting point that carries your IP address.

While that originating IP address can – under court orders – be matched to your home address via your service provider, it can’t categorically tie you to the act of sending the email; even so, I expect that having the police knock on your door isn’t the kind of anonymity you were seeking.

Being an inquisitive 13-year-old, my son continued to press the matter and I had to admit that, yes, you could circumvent many of the deficiencies of anonymous email services by simply employing a disposable webmail account, created on a PC in some back-street cybercafé. That seemed to satisfy his curiosity, and possibly slaked his desire for schoolboy revenge as well.

Benjamin Fung, Professor of Information Systems Engineering at Concordia University, takes a bit more convincing when it comes to anonymous email – so much so that he’s been developing a system of email fingerprinting. This appears to be so effective that it can ascertain true authorship of any email to relatively high levels of accuracy, and could be used in court to positively tie a suspect to a particular IP address.

Using his knowledge of data mining and speech-recognition technologies, Professor Fung has employed related techniques to identify language usage patterns within the content of an email message, so that given sample emails from a number of suspects, all of whom have access to the same IP address, the Fung Fingerprint technique will identify the actual author of any particular message. Exactly how accurate is his emerging method? Analysing 100 emails by ten different authors in groups of ten, Fung correctly identified the writer in 80-90% of cases.

Okay, there’s still some way to go before it becomes completely foolproof, but that’s a pretty impressive start nonetheless. Unless those emails were encrypted, of course...