Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there any basis in not deploying anti-spam (or deliverability) technologies like DKIM, SPF, and SenderID because it affects plausible deniability?

Some definitions to get everyone on the same page:

Plausible deniability: This is a legal term used to disown accountability for something (an email, knowledge of an event, etc).

DKIM: An email signing technology that binds the message to the senders domain, or in some deployments to a specific user or set of users.

SPF: A whitelist of IP addresses that specify what email relays are permitted to send email on behalf of the domain.

I'm trying to understand if these technologies used alone or together can be used to remove doubt that an authorized sender is knowledgeable of "something" and if that could be used against them in court.

Examples of this "something" would be

  • Stock trades
  • Insider information
  • Mergers & Acquisitions
  • Other data that is material in a court case
share|improve this question
add comment

1 Answer

In my opinion, yes it is. These technolgies can be use as a basis to affect plausible deniability but are not strong enough to put the person in verdict. The answer to the question whether these technolgies affect or not plausible deniability lies from within the technical objective of these technologies and the strong justification of the technical components and reliability along with court evidences.

DKIM, SPF, SenderID's are used to improve mail deliverability based on the domain's trust relationship. On the other hand, when a private key has been used along with the above technologies to sign the message, it will be difficult for the sending party to deny and justify the fact that the message has originated from the domain and specifically to his/her account.

This particular instance removes doubt to the authorized sender having the knowledge in sending "something" internal to a recipient outside of the corporate realms and jurisdictions and proves a possible violation of corporate policy. In this regard, it is stronger from a technical perspective given that there is a technical prima facie evidence.

On the other hand, the burden of proof lies from within proving to the court that the evidences was not altered and the actual behavior of the allegation was committed by the person in charge.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.