6

I can understand that an SMS can be traced to the mobile phone which it has originated from and the phone owner has no chance in court but to claim that someone else has used his phone but what about an email from a PC?

Most emails are being sent using a browser and a web interface let alone the fact that you hardly find a PC outside a NAT. Add to that most laptops are connected via WiFi.

It seems very easy to claim that I have not sent email X and email address Y is not mine. IP address? it means nothing, I am sharing it with lots of people, it might be my wife who sent that email from her laptop or it might be my neighbors who hacked my WiFi.

How can an expert defeat such claims in court in front of a judge?

  • 2
    Sometimes in the email headers you can see the IP of the first client that submitted the message to the first email server. However, that can be forged and that also may be a NAT so that's not what I would call "proof". – user42178 Sep 28 '14 at 19:15
  • 1
    Was the 'alleged' email sent/composed via a desktop client (outlook) or a web interface (gmail)? This will help narrow things a lot. – Matthew Peters Oct 3 '14 at 16:56
  • What does computer in this context mean? A specific user on that computer? Or just any user on a given machine? – Marcel Oct 7 '14 at 6:25
14
+50

Experts are experts. What an expert says stands in court as long as:

  • He is an expert.
  • The other party cannot provide another expert, who says that the first expert is wrong, and says it in a more convincingly expertish way.

In practice, a email will be reputed to have been sent from a given PC if the context makes it a lot more plausible than any alternative explanation. Context elements include IP addresses registered from the SMTP server side, ease (or lack thereof) to assume that IP address on the client side (WiFi or not WiFi, accessible wires...), presence or absence of log files on the PC... and, more often than not, whether the purported sender admits to the deed or not.

Take note that perjury is a serious offence, so people tend not to deny sending emails when what is at stake (e.g. a commercial dispute) is "less serious" than the consequences of being caught in the act of lying to the judge. The crucial point is that proving whether an email was really sent by some specific individual is a complex matter in both ways: it is hard to convincingly pinpoint on the perpetrator, but it is equally hard to make sure that it will never be decisively proven.

This reproduces the security model of handwritten signatures. It is, in fact, not very difficult to imitate the signature of somebody else; it is also quite hard to actually verify that a signature is proper or not. But handwritten signatures happen in the physical world, with pens and human hands, so they tend to leave traces -- what I call contextual elements. You can repudiate your own signature, but it is risky, because you cannot be sure that nobody saw you, or you did not leave a fingerprint on the pen, or any other of a million possible incriminating details. And trying to repudiate your own signature is severely punished. Therefore, it is often preferable to recognize the signature as your own and assume the consequences.

In the case of emails, the same mechanism is at work. Though actual proofs are often flimsy elements (log entries and so on), denying having sent an email that you did send is risky, and felt as risky, especially since it involves computers (computers are beyond the "magical horizon" of most people). So most cases involving emails end up with producing a few log file entries (that could, indeed, be faked in a great many ways), and the sender crumbling under the steady gaze of the judge.

10

Basically, almost every method of discovering the sender is considerably unreliable.

Usually, you don't send the email "directly" from your PC. Usually, you use a SMTP server owned by your internet provider or your email service provider. This SMTP server takes care of your email. For instance if the end destination SMTP server was unavailable it delays the delivery until the destination would be up again and so you don't need to have your PC online all the time just to ensure email delivery. Email usually passes several SMTP's before it reaches its destination.

First, you should know, there are just few mandatory email headers. Even "From" header is just optional. It's just a SMTP's good will to puts its signature in any form (like its IP) to the email and it's only the SMTP's good will to keep others headers in the email.

How reliably you can find the sender? It depends on the SMTPs on the emails way and how you can trust them. And you almost always can't.

You can ask the SMTP admins if the observed email passed their server, but I'm sure, they don't tell you. You can check the email headers, but you can't fully trust them since everybody could have changed it.

Some level of certainty could be given by the DKIM signature (if the email is signed). For instance, if the email was sent from gmail.com, then you can check it's DKIM signature and if it was valid, you can be sure, it was really send from gmail SMTP servers and since I believe google wouldn't send any email with faked from (you must trust google about this) you got the sender or better, you got the person, who has access to the gmail account :-).

5

The short answer is no, nothing will stand in the court, all possible tracing techniques can be defeated in court by a clever lawyer and a tech savvy.

However, another way to think of the problem is to add additional proofs to what ever tracking information about the source of the email you have. For example if you can trace the IP address and link it to the suspect.

Then you use additional proofs such as Forensic Stylometric and Authorship Analysis. Some countries accept stylometric analysis as an evidence (e.g. Britain and the United States) You can look at this source for more information about stylometric in the court of law

5

From a technical point of view it possible to prove that an e-mail has been sent from a specific mail account, if the original SMTP server enforces such a policy and all intermediate servers authenticate the origin of pass-through messages, e. g. with DKIM (and assuming the servers themselves have not been tampered with).

From a legal point of view you need convince the judge or jury of your argument that the e-mail under scrutiny is spoofed. Many legal systems require certainty beyond a “reasonable amount of doubt” for a guilty verdict in penal trials. In civil lawsuits the bar is usually much lower. I won't go into that because this is an InfoSec and not a legal forum.

  • I have heard about case concerning usenet posts in which "infection by spying viruses" has been used by defense (in Germany?). – AnFi Oct 1 '14 at 12:34
  • @AndrzejA.Filip Your comment highlights the limitation of David's answer. You can prove that it was sent from a certain account, but not that the authorized account owner sent it. – schroeder Oct 3 '14 at 15:18
  • Exactly. I assumed that a reader would be able to distinguish between the entities “account” and “account holder”. – David Foerster Oct 3 '14 at 15:20
2

You need to ask the service provider of the mail account from which the email was sent. Most of them are probably required to log the IP address of clients connecting to their Web server, and some of them might do browser fingerprinting to verify that a connection corresponds to a user's known device. So, there is a chance that they can provide information that clearly identifies at least an IP-browser pair.

However note that if the discussion involves potential motivated and competent adversaries, you can't make assumptions. Someone could spoof an IP and find the fingerprint of a specific browser and reuse it.

  • I wonder how many mail providers do browser fingerprinting as a means of authentication? I suspect not any. – schroeder Oct 3 '14 at 15:27
  • @schroeder not as a factor that confirms who you are, but that raises suspicion about who you are not. Google is surprisingly good at telling me when people try to log onto my account, and I know I've had my password keylogged. They don't just use location, they also use information about the browser; the same routine has already blocked me when connecting with a slightly modified browser on the same machine. – Steve Dodier-Lazaro Oct 3 '14 at 19:56
2

As already stated, proving who sent the email will be tricky but what about proving your neighbor hacked your wifi? I don't know what you have in place but typically even basic router can track connected devices and sometimes list MAC addresses. The MAC you could compare to your wife's MAC. If you have more advanced router in place and have logs or much more detailed information, it may be possible to match logs to the time the email was sent. That would allow more reliable tracking. Or if you don't have this level of tracking, you could set it up.

  • Removed. For future reference, as I’m not clear on rules here, personal assumptions like the one I made are inappropriate? But alternatives that are not personal are? IE OP asks for help on resolution A for resolving root cause A. Answer purposes resolution B to solve root cause A. Resolution B is acceptable without a personal assumption? – Paraplastic2 Oct 3 '14 at 16:37
2

Summary: Proving a specific computer sent an email is hard-to-impossible. If all participants are acting in good faith, it can be deduced, but this requires a high level of participation.

Details: While positive identification of the source of an email is not automatically possible, based on the following assumptions, it may be possible to deduce it, by piecing together the following information.

  • If the sender signed the email using SMIME signed by a trusted CA (or a PGP key that is known and vouched-for), you can assume nonrepudiation of the sending person, unless and until the purported sending person can demonstrate that the private half of that key was compromise prior to the sending of the email
  • If the domain from which the email purports to have originated provides SPF and DKIM, you can determine whether the mail was relayed through one of their approved mail gateways (SPF lets you publish a list of allowed IP numbers for outbound mail, DKIM enables you to publish half of a key that lets a recipient validate a cryptographic signature on a received email memo and gain confidence that it could only have been signed by someone with the other half of the key)
  • Based on SPF and DKIM, you can positively identify the outbound mail gateway that relayed the memorandum to your organization, company or agency
  • At this point, you may have the option of subpoenaing the logs from the operator of the mail gateway, which may contain the originating (or at least previous-hop-relay) IP number
    • Note, this may be unreliable for two reasons:
      • The sending person may have sent the offending memo from a shared or public network, such as a coffee shop or library
      • If you have reason to believe that the relaying organization is colluding with the sending person, you may have to determine and prove whether the mail logs have been tampered (if they have not been deleted before discovery, as a matter of organizational policy)
    • Also understand the burden to get a subpoena for these logs; not all judges will issue one without a significant effort up-front
  • If the previous-hop-relay is another organization's mail gateway, iterate the process
  • Even if the sending device IP is identified, it is likely to have been a transient device, and as such, you may need to subpoena the DHCP logs from the organization operating the network in which the sending device resided, so that you can match it to the announced hostname when the sending device requested and IP

If everyone is acting in good faith, you may be able to determine the sending person and the sending device.

Best of luck.

-2

Oh my, so many replies. Yes it is possible if your IP address is not shielded. Your IP address is like a telephone number. Your mail server knows your IP address and it can be obtained by a court order if your ISP is reputable.

There are several ways to sheild an IP address with varying degree of success.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.