8

There are similar question about how to prove YOU sent an email, but I want to know if it is possible to prove a 3rd party sent an email to me.

An individual sent some very threatening emails to my company, enough to warrant providing the email copies to authorities. Now, this individual is claiming he did not send the emails and they are fake. He even says in his final email that he will get away with it because emails are so easy to fake and so no one will believe he sent them.

I have the emails, the headers, etc but I do not know what I can provide that will show a specific mail server sent the emails or IP address or anything.

What steps do I need to take in order to prove this individual did send these emails?

  • 3
    If the mail has DKIM headers, you have won. If not, you have a problem. If it has headers, you should get a store the DNSSEC entry for the DKIM public key, it might be possible that it changes. – user10008 Nov 5 '14 at 0:34
  • Can you look at the email source (with headers) and search for something like "DKIM-Signature". Is that present? – thexacre Nov 5 '14 at 0:35
  • Hey, guys. Thanks for commenting. I have a "X-Google-Dkim-Signature:" in the headers. There are lots of vars=[strings] after that on that line. – o_O Nov 5 '14 at 0:45
  • 4
    The complete mail including all headers is enough proof for most cases. I doubt that google changes their domainkeys too often, and I doubt even more that they don't retain copies. – user10008 Nov 5 '14 at 1:22
  • 2
    So is the person sending from his Gmail account? If so, Google would have a list of his IP addresses already. From there you can trace to his ISP and home address. But you would need a court order. – Question Overflow Nov 5 '14 at 2:00
14

It sounds like your message is signed using DKIM which is good, because this provides cryptographic proof that the sending mail server sent the message and verifies the integrity of several key fields such as the to and from addresses. Assuming that the sending mail server can be trusted to properly authenticate the sending user (eg. via their login) then this essentially proves that the user in question sent it.

I'd provide the whole header to authorities, but the section which looks like this will be most important:

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=mime-version:message-id:date:subject:from:to:cc:content-type;
bh=62R0FTDx1ty9lsn/QNK3rrnxESP0zwJj1ca95CbZzxQ=;
b=JAd1gFDtEKmA+KtSYuALKekaVb150ZFfqxluvTb6nc3pi5n2l8EE8BjZFTlyuif+h9
aGk6MyYrsBLFYjAQtweTcBlChVvBTw01mhJKGrKEVAKrnmHNknN9ivoV90/7024UEjGJ
w5VOtjmTC0lBCYIrnuqK13yDbjx2Ra4SzJ62RaUpoM4eECsJbBLK9BK0TULg92ozfwf9
UHF4ozrXIyTgeG87ifDtuz5ddrwFvP47mgoqP7ENaXsxhGFZqHOFJly7jrvNbWEWEfRX
ygY2Miuu/DnB1g1C/ahGq8VtQvb0XmVEK4XESJPBgP3F0wfpT4MrGbJbYiW3Z9SIiA1F
jhXw==

Your mail server might automatically validate the DKIM signature and include the validation result in a header such as "dkim=pass", but you don't have to trust this and you could verify the signature yourself if they questioned it.

  • 3
    In order to verify the signature, you also need the headers specified in the h-line. – user10008 Nov 5 '14 at 2:29
7

The headers of the email will contain traces of the servers that were used and the originating account. But the authorities know this and will take care of it.

Besides the technical proof, it is also possible to compare wording and phrasing to provide a likelihood that an individual sent an email. Threatening emails tend to get creative and provide many unique characteristics. It's not proof, but it adds to the likelihood.

EDIT You can also run the header strings through a parser. That will tell you (and your audience) a lot.

  • Thanks. I already know the authorities know how to verify. It was mainly for things like lawyers who do not yet have any reports. Showing them absolute proof their client is not being honest and it can be proven might speed things along and not require us to wait for the finish to the investigation. Thanks. – o_O Nov 5 '14 at 1:37
  • 1
    @schroeder the problem with using just the server IP is how can the authorities be sure that OP hasn't edited these IPs himself in the print outs they provided. Having an actual signature signed by a private key of the sender (eg. DKIM) provides cryptographic proof that OP could not have forged it to frame the sender. – thexacre Nov 5 '14 at 1:46
  • 1
    @thexacre: Note that the DKIM signature key is typically held not by the sender himself, but by his ISP or email provider. The alleged sender could claim that his ISP is involved in the plot to frame him. – Nate Eldredge Nov 5 '14 at 5:58
  • @thexacre Who said that the emails should be printed off? That's an incredibly useless proposition. – schroeder Nov 5 '14 at 15:12
  • 1
    @RKS It looks like you're asking a legal question now. You talk about sending to the authorities, now you suggest that your intended recipient is opposing council. That makes this a legal question and not a technical one. The headers can be parsed to show the trace. That should be enough. – schroeder Nov 5 '14 at 20:47
1

What steps do I need to take in order to prove this individual did send these emails?

You can't with just the information you have on your MX. You can't both technically (information from the other MX aren't accessible to you) and legally (you aren't allowed to investigate or prosecute).

Provide evidence

This is the job for your authorities, who will be armed to conduct this investigation with success, if and only if, you provide them with:

  • the original message in its original version, i.e. which is one uniq piece of raw text, containing a long list of headers and a long set of contents,
  • the correct extract from your MX logs showing the exact events related to this exact message (identified by its uniq MSGID): reception and delivery.

Protect evidence

You have to keep these two pieces of evidence protected from any tampering (either internal or external). The best would be to keep them offline with their original date (any pass through anything like a text editor will corrupt them and render your action useless and abusive).

0

Unfortunately hiding behind plausible deniability is not necessarily an unrealistic plan on the part of the email sender.

As already discussed, DKIM signatures can verify the authenticity of an email and that it was indeed sent by the email provider from one address to another. The trouble is that this doesn't prove that a particular person sent the email - only that their account was used to send the email. If you can get the originating IP address out of the email provider (either in the headers or elsewhere) and trace that to a particular physical location (which can be hard after-the-fact if the home IP address has changed) then you could even establish that their account was used to send the email from their home, BUT...

Someone who thinks this through a bit more might still have plenty of options, especially keeping in mind that with criminal accusations the relevant level of proof is "Beyond a reasonable doubt". I.e. (said by the person who is being accused of sending the emails):

  1. I had lots of trouble with viruses and malware on my computer around then. I bet my email got hacked (and yes, as a security professional I roll my eyes at that, but it doesn't mean it won't work)
  2. My teenage (aka underage) son heard me complaining about [COMPANYNAME] and he admitted to me that he logged into my computer and sent some emails to them (probably plenty of people out there willing to throw their kids under the bus, especially since young kids might not see any repercussions at all).
  3. I left my computer open at starbucks while I went to the bathroom and when I came back 5 minutes later someone was on my computer. They ran away when I yelled at them but I didn't see anything missing so I just forgot about it until now... (obviously won't work if you've tied the email sending to their house)

Granted, depending on the circumstances such stories might get someone laughed out of the room, but they might not. I can't make any claims about that, because everything I know about court rooms I learned from TV crime shows. However I think it is important to keep in mind that all you can really prove is that a given person's email account was used to send an email. You can't even necessarily prove that it happened from a given location - only that a computer at the given location was used to send the email. After all if someone remote connected to a computer in someone's home and used that to send an email, the email provider would still see the person's home as the "originating" endpoint, even though it isn't really.

Probably the best way of "proving" that a particular person sent the email is by looking at the specifics of the language (i.e. schroeder's answer).

-3

EU legislation is quite clear about it. It says that email has not been sent until the recipient confirms (reply) on email. The interpretation of the legislation is quite reasonable, while until the email is in a system under sender control anything can happen. Therefore, you cannot prove that the email has been sent until recipient replies to this particular email.

  • 1
    Do you have a link to the EU legislation talking about this? Your suggestion of that particular service does not seem to apply in this case. The sender has to use the service, and if the sender is sending threats, they are not going to use a traceable system. – schroeder Aug 8 '18 at 10:08
  • I removed the link to the service as it amounts to spam. Your username is associated with SafeSigned, where one of the contributors is the owner of that service (and shares your last name). – schroeder Aug 8 '18 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.