9

Thriller novelist here looking to get something right.

I have a character who uses an alias. I have two scenarios I'm trying to have play out...

At some point, they have sent emails from the same phone whilst using their alias and real identity accounts (using different Gmail accounts, and using a VPN, assuming that would be enough to hide their real identity).

The police have an email sent by the person from their real identity, and an email sent from the alias account.

Would there be any data in, say, email headers that could say for sure that the emails from different accounts were sent from the same phone?

OR

If the person sent an email then logged into their alias account straight away and sent an email, would there be a way for the police to determine if the emails were sent from the same location?

OR

If anyone much smarter than me can suggest a simple way that common phone use between the two identities could be revealed through either common time or location data or something.

I'm very much hoping there is!

6
  • It's an author publishing under a pen name who is unknown to the publisher. But the author is suspected of murdering someone. The police are doing the investigating. Commented Feb 12, 2023 at 15:28
  • From the first answer it seems there are more legal then technical restrictions. So the possible answers also depend on the jurisdiction. Which country are you interested in?
    – quarague
    Commented Feb 13, 2023 at 9:42
  • @quarague This is for the UK. Commented Feb 13, 2023 at 9:53
  • 1
    If you have enough emails, you might be able to use corpus linguistics to compare the writing styles. Commented Feb 13, 2023 at 19:49
  • @AndrewRaymondBooks but are you interested in how normal investigations work, or how a normal investigation can get blocked? There are numerous factors in play, more than just legal, that could impede an investigation.
    – schroeder
    Commented Feb 14, 2023 at 9:16

5 Answers 5

13

Police don't need to investigate headers. They just ask for Gmail logs, "What IP was logged in when this account sent this email? And what device info do you have about the connection in your logs (browser, device type, etc.)?"

Then, in your scenario, they ask the VPN provider, "What account was assigned this IP at this time that accessed Gmail? And what IP was used for the VPN connection?"

Then they ask the ISP/mobile carrier that uses that IP, "What account used that IP at this time? And what was the tower location for the connection?"

In some places in the world, these checks can happen in a very short time.

7
  • 5
    To be noted: some VPN providers don't (or claim not to) record logs, so when the government asks "what account was assigned this IP at this time" they can only answer "we have no idea because we don't have logs/delete logs".
    – GACy20
    Commented Feb 13, 2023 at 8:23
  • 2
    @GACy20 absolutely, but the question is in the context of assuming that this tracing is possible. There are a number of factors that could affect a successful investigation at every step.
    – schroeder
    Commented Feb 13, 2023 at 8:55
  • 5
    Also of note, the VPN provider might be outside the jurisdiction of law enforcement wherever the novel is taking place.
    – jaskij
    Commented Feb 13, 2023 at 13:57
  • 1
    Some e-mail providers also do not keep logs; for instance, Protonmail (unless instructed otherwise by law enforcement). Commented Feb 13, 2023 at 14:09
  • 2
    @FedericoPoloni Yes, but the context here is Gmail and the ask is how it could be done, not ways where it can't be done.
    – schroeder
    Commented Feb 13, 2023 at 22:26
6

Other answers have already provided alternative ways for how the sender could be deanonymized with the help of service providers. But no answer so far addressed the actual question: Can the device be inferred from the email headers alone?

The general answer is no. When you look at the list of common internet mail headers, you will see that the device the mail was generated on is not one of them. The one that is closest is the Recieved: header which states the IP addresses through which the email was forwarded, but when the user uses a VPN to connect to their email server, then this header would only contain the VPN exit IP. However:

  1. Those are just the common headers. Email clients and relays are allowed to add more headers if they want to. But I don't see why an email client would risk the privacy of their users by adding an unique device identifier. And when the character in your story is tech-savvy and security-conscious, they probably would not use such an email client.

  2. While no header alone clearly identifies a device, the combination of multiple headers and their order might be enough information to create an unique fingerprint. And when the client formats their emails not as plaintext but as HTML (which many email clients do without the users at either side being aware of it), then the way the email client generates the HTML markup can also leak information about its configuration.

    Similar to web browser fingerprinting, the combination of enough traits can be enough to uniquely identify a specific device. So an unusual combination of headers that shows up in two emails is probably not definitive proof that they come from the same email client on the same device, but they could be a clue that this possibility might be worth investigating.

Note that in either case, the character in your story could probably avoid being fingerprinted like that by using two different email programs for their alias identities.

3
  • The first "Received:" header in an email generally contains the IP address of the sending device. Two emails having the same header and similar sending times may not be proof that they were sent from the same device, but it looks really suspicious.
    – Mark
    Commented Feb 14, 2023 at 0:44
  • 1
    @Mark The question said that the person uses a VPN, so the received-IP wouldn't be too helpful.
    – Philipp
    Commented Feb 14, 2023 at 9:09
  • @Philipp: From the question, it sounds like both identities are used to send emails while connected to the same VPN. The public IP probably is still not sufficient to link the emails together, but that has more to do with NAT/PAT than VPN.
    – Ben Voigt
    Commented Feb 15, 2023 at 21:30
3

Many Email providers including Google do following:

  • Keep the list of the most recent logins
  • Keep the list of devices used for login
  • Have a list of apps allowed to access Email account
  • Some can save also IPs (Google displays only Country)

The more factors correlate, the higher is the probability that the same device was used. However, unlike IMEI, these data do not uniquely identify the device.

0

You have mentioned the character used a VPN for hiding their identity. This can give their identity away if they are the only user of that VPN in a certain area or network. Whether they use the VPN all the time or just for the email, both scenarios could give them away.

Particularly so if they use public networks to access the VPN, such as their workplace or a public library. (For literary purposes, it would be easier to rogue-monitor these networks for connections to the VPN provider.)

3
  • "if they are the only user of that VPN in a certain area or network" -- how?
    – schroeder
    Commented Feb 14, 2023 at 15:51
  • @schroeder something along these lines: comparitech.com/blog/vpn-privacy/how-easy-is-it-to-detect-a-vpn (consider, for instance, you can break into the workplace router or such) Commented Feb 15, 2023 at 19:47
  • But how does this help the investigation from the other end of the VPN?
    – schroeder
    Commented Feb 15, 2023 at 20:27
-1

VPNs have their limitations. A VPN will conceal what data you send, and where you send it. It will not conceal when you send it, nor how many bytes you sent. The same applies to what you receive.

To send an e-mail, it is necessary to use an internet protocol called SMTP which specifies exactly what data must be sent and received.

If you have access to the network logs for the phone and the mobile operator, you can then observe if the phone sent a series of data packets at the right time and of the right size to create the e-mail.

The wikipedia page for SMTP shows an example with the phone (client) sending six messages and the e-mail content and the server sending eight messages back. There should also be a "login" step preceding these messages which establish the sender's identity and another layer of encryption. This takes another five or six messages back and forth.

So - the police can check if a specific phone could have used a VPN to send a specific e-mail. It does not prove that phone did, as those dozen-or-so messages could have been something completely different that just happened to have exactly the right number of bytes. If you have more e-mails though, the chance of it all being innocent co-incidences really declines.

Additionally, the e-mail company does know the e-mail came from via a specific VPN provider. The data logs for the phone will show that the phone was connected to that specific VPN.

3
  • This just doesn't work. 1. The email service in question is Gmail, so the device isn't sending SMTP at all. 2. In order to determine if the device or VPN did something, police would first have to connect those things together with the email. But how do you distinguish what account was used over VPN by traffic alone? 3. "the police can check if a specific phone could have used a VPN to send a specific e-mail" - no, only that the device was active on the VPN. 4. You last line is the only real portion that could make sense, but you've just repeated other answers.
    – schroeder
    Commented Feb 20, 2023 at 8:51
  • @schroeder Except 1) The email service is from a phone, so probably using a mail app and hence SMTP. 2) The police already have the phone in their sites as they have a "legitimate" e-mail from it to consider. 3) Data correlation and timing analysis are well known attack vectors against VPNs and that is what I'm talking about.
    – Simon G.
    Commented Feb 21, 2023 at 14:06
  • "To send an e-mail, it is necessary to use an internet protocol called SMTP" --no, one can also use an API, which is what the Gmail app uses. If you are using a VPN on a phone, then all traffic goes through the VPN, including all non-mail traffic. And phones are awfully chatty. Data correlation and timing analysis help, but they are not magic wands. My point is that you can't make such a straight line between all these points and make the conclusion you've made.
    – schroeder
    Commented Feb 21, 2023 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .