Is the text of an email subject line a softer target for surveillance than the text in the body?

Question

After using PGP for a long time I have trained myself to write bland email subject lines that disclose little or nothing about the contents.

Some people I correspond with unencrypted have an annoying habit of writing very explicit subject lines, sometimes all in upper case. It is annoying on a human level in that it hits your eyes even before you open the email.

There is other metadata which may flow with an email of slight concern such as sender IP.

Is there a real reason, beyond the annoyance, to keep email subject lines bland for all communication, not just PGP?

Is the text in the subject line an easier target for mass surveillance than the text in the body?

Answer 1

Mass surveillance isn't the only thing that you should be thinking about. Email subjects are often more visible, such as:

• On the lock screens of phones.
• In pop-up notifications on someone desktop (such as if they're sharing their screen).
• In their inbox (if someone is looking over their shoulder).
• To IT staff (subjects are often shown in admin consoles/reports, while email bodies might not be).

They can also draw attention to an email if a workstation is left unattended. If someone only has a few seconds alone, an email title with "SECRET PLANS" or "Employee redundancy list" is a much more appealing to snoop at.

So yes, there are definitely benefits to keeping sensitive information out of the subject lines.

Answer 2

Summary

You're really asking two different questions. The bottom line for both is that metadata carries information, intended or not. The more pragmatic question is whether reducing potentially-useful metadata such as subject lines buys you more security than the headaches it can cause users, and that's a risk assessment you need to make based on criteria not in your original question.

For example, unless you read every single email you get, if you can't skim subject lines or use your mail program to sort them, you may drown in useless emails. This is in fact one of the tricks of the trade for phishing and old-school spamming, and while generic subject lines may reduce a limited amount of metadata outside the message body, unless people are putting secrets directly into the subject header it doesn't really reduce the metadata footprint all that much but does make it a lot harder to sift and sort messages for the receiver.

As always, your threat model may vary.

Your Sub-Questions Questions Answered

Is there a real reason, beyond the annoyance, to keep email subject lines bland for all communication, not just PGP?

Not really, except to avoid placing secrets or sensitive data directly into a mail header as part of data loss prevention. The unencapsulated OpenPGP and S/MIME headers, as well as any actual packet analysis, will likely reveal a lot more metadata than a subject line.

In addition, I'd point out that from a practical point of view it doesn't really matter whether your subject header says Foo or See attached resume, since neither is actually a reliable source of data about what's in the message body. Not only can the subject line be irrelevant to the message contents, but it's also possible for any system along the delivery path to modify it, so the typical subject line lacks any meaningful non-repudiation characteristics in the first place.

Since it's perfectly possible for the subject line to have absolutely nothing to do with the body of the message, I would generally recommend using useful subject lines that conform to data-loss prevention policies. This is inherently more functional than simply labeling every message the same or using a UUID or other random or pseudo-random header. It just doesn't buy you all that much most of the time, and creates additional effort for both the sender and the recipient that are unlikely to pay off.

Is the text in the subject line an easier target for mass surveillance than the text in the body?

Not in any truly meaningful sense, although:

1. Header scanning is generally faster than scanning the full message, including the body and any attachments.
2. Body scanning of attachments, multi-part MIME messages, and so forth require more computing power, time, and possibly storage, so it's less likely they'd be scanned without a reason. However, scanning the full message is well within the capabilities of almost any commercial or professional entity these days, so it's not really the resource burden it might once have been.
3. Part of the metadata that can be quickly gleaned is whether a message contains MIME attachments, encrypted files, or ciphertext. Doing atypical things like encapsulating an encrypted email message (including one with encrypted email headers) inside one with visible headers is still fundamentally creating metadata about the communicating parties, but still has little or nothing to do with the subject line of the encapsulating message.

In short, while the headers are probably easier and faster to read than a whole unencrypted message, that won't matter much if someone is simply scanning for metadata or has the motivation and resources to do bulk scanning of the full message.

Re-Evaluate Your Threat Model and Controls

In other words, you actually have an X/Y question which seems to boil down to:

1. Do we have a threat model that prioritizes subject line metadata enough to make it worth the trouble to do anything about it?

2. If the residual risk from unencrypted mail headers is high enough to exceed the risk appetite of the stakeholders or communicating parties, are there mitigating controls that can be applied or is email simply the wrong communications channel to begin with?

The subject line, absent the direct inclusion of any sensitive data, is simply not enough of a problem for the typical business case. If you have a use case where even minimal metadata is an unacceptable risk, then I'd question whether email was the correct information channel to use in the first place.