Look Who’s Using Encrypted, Self-Deleting Emails

Speaking of corruption (see previous post), this press release from Virginians for Safe Communities just arrived in my email inbox:

Fairfax, Virginia – Yesterday, Virginians for Safe Communities filed a formal complaint [read here] with the Virginia State Bar, the professional standards body for licensed attorneys in the Commonwealth, against the Commonwealth’s Attorney for Fairfax County, Steve Descano, for breaching professional ethics under the Virginia State Bar Rules of Professional Conduct. The complaint requests a formal investigation and appropriate sanctions, which could result in disbarment – preventing him from practicing law and forcing him to resign as Commonwealth’s Attorney, since they must be members of the bar under law.

The complaint stems from January 17, 2023 news reporting by WJLA, since confirmed by Descano, that he and his senior staff use an encrypted self-deleting text messaging app (“Signal”) to conduct official business of the Commonwealth’s Attorney’s office.
Such conduct is in contravention of Virginia’s Freedom of Information Act, although Descano purports his office complies with FOIA.

Virginians for Safe Communities bills itself as a Leesburg-based 501-c-3 organization dedicated to educating Virginians about public safety and justice. Leesburg, by the way, is located in Loudoun County, not Fairfax, so this group, previously unknown to me, is not likely a front for someone’s political campaign — although I’m willing to stand corrected.

Bacon’s bottom line: If your public prosecutors are breaking the law, you might have a major corruption problem.

In this instance, we don’t know that Descano broke any laws. Let’s wait and see if the state bar investigates him and releases its findings before drawing any hard conclusions. But I’ll say this: communicating with encrypted, self-deleting text messages is not a good look.

— JAB


Share this article



ADVERTISEMENT

(comments below)



ADVERTISEMENT

(comments below)


Comments

50 responses to “Look Who’s Using Encrypted, Self-Deleting Emails”

  1. how_it_works Avatar
    how_it_works

    When I worked for a small municipality in Virginia doing IT work, the mayor wanted me to implement encrypted email.

    Make of that what you will. No, I never implemented it. I also don’t work there anymore.

    1. Stephen Haner Avatar
      Stephen Haner

      “Encrypted” will still be discoverable and can then be decrypted. They want something that disappears and can’t be recovered, even by the techs. GA should ban. Don’t plan on it….

    2. Stephen Haner Avatar
      Stephen Haner

      “Encrypted” will still be discoverable and can then be decrypted. They want something that disappears and can’t be recovered, even by the techs. GA should ban. Don’t plan on it….

      1. how_it_works Avatar
        how_it_works

        Depends on how it’s encrypted. If the email is encrypted with a key known only to the email’s user, you basically need the user’s cooperation to respond to a FOIA request or do an investigation. In some situations a user may decide that they don’t want to cooperate.

        1. Stephen Haner Avatar
          Stephen Haner

          Right, but then you’ve got jail for contempt. 🙂

        2. Stephen Haner Avatar
          Stephen Haner

          Right, but then you’ve got jail for contempt. 🙂

          1. how_it_works Avatar
            how_it_works

            You do, but it still greatly complicates the process. There is no reason why email in local or state office should be encrypted. It’s not the DoD and they’re not dealing with top-secret classified materials.

          2. James McCarthy Avatar
            James McCarthy

            There are likely instances involving discussions of police investigations, possible plea bargains among a few sensitive items.

      2. Nancy Naive Avatar
        Nancy Naive

        So, you mean he can’t have any conversations in his office without a stenographer present and the door closed?

  2. Nancy Naive Avatar
    Nancy Naive

    Hey! Cheer up. At least the texts won’t show up in a Florida storage room or a Delaware garage.

  3. Nancy Naive Avatar
    Nancy Naive

    “Bacon’s bottom line: If your public prosecutors are breaking the law, you might have a major corruption problem.

    In this instance, we don’t know that Descano broke any laws…”

    Okay.

    1. LarrytheG Avatar

      Correct. Unless ALL communications MUST be saved , archived, and subject to FOIA.

      From what I understand, a wide variety of public officials including members of Congress currently do the same.

    2. Kathleen Smith Avatar
      Kathleen Smith

      Good point!!

  4. In addition to FOIA, there are state laws regarding document retention by public officials. I wonder if texts are covered in any way by those laws.

    1. how_it_works Avatar
      how_it_works

      The wording on the “RECORDS RETENTION AND DISPOSITION SCHEDULE” applying to “COUNTY AND MUNICIPAL GOVERNMENTS” from the Library of Virginia says:

      “This series documents incoming and outgoing letters,
      memoranda, faxes, notes, and their attachments, in any format
      including, but not limited to, paper and e-mail.”

      I would say that includes texts.

      1. Thanks. That certainly looks to me like it would cover texts.

  5. Dick Hall-Sizemore Avatar
    Dick Hall-Sizemore

    I predict that this complaint will be dismissed. There is no law against encrypting e-mail messages. In fact, because email is so widely used for almost all purposes, it is probably a good practice for prosecutors to encrypt their internal email messages. Otherwise, the bad guys could intercept (hack) a CA’s cell phone messages and get access, as Jame McCarthy points out, to sensitive information including such things as requested search warrants, planned arrests, etc. Except for the Governor, there is no document retention policy. When I was a state employee, I routinely deleted e-mails. I worked with folks who had their systems set up to automatically delete any e-mail over XXX days, weeks, or months old.

    1. LarrytheG Avatar

      But if you have a legitimate IT function, those emails can always be recovered.

      If they are encrypted though, without the “key”, they’ll never be read , active or archived.

      1. how_it_works Avatar
        how_it_works

        A friend of mine works for a company where the owner wants EVERY email saved forever. There’s emails going back 10 years or more that are archived. I think that’s a bit extreme.

        1. LarrytheG Avatar

          I’m not sure what the requirement is for govt. I would think a long time.

          1. how_it_works Avatar
            how_it_works

            I know of one Federal government agency that wanted all backup tapes kept forever. I had to feed new tapes into the library once a week and take out the old ones to be sent to Iron Mountain.

            As far as I know, an agency can have a document retention policy that exceeds what they might legally be required to do. For example, the law says that they keep documents for 3 years, an agency could decide they want to keep them for 10 years and that would be OK since it exceeds the requirements.

          2. LarrytheG Avatar

            From an IT perspective, ever heard of this company? https://en.wikipedia.org/wiki/Tripwire_(company)

          3. how_it_works Avatar
            how_it_works

            Yes, I have. I had to do an upgrade of a Tripwire server a while ago.

          4. LarrytheG Avatar

            Thanks. So Configuration Management …

          5. LarrytheG Avatar

            so thinking back to the Kennedy assassination…. those records should be kept that long?

          6. how_it_works Avatar
            how_it_works

            Those records should probably be kept forever.

          7. LarrytheG Avatar

            so how do they differ from other govt records? How do we know which ones kept “forever” and
            which for 3 yrs?

          8. how_it_works Avatar
            how_it_works

            It’s in a policy document somewhere.

            It’s not unheard of for documents over 100 years old to be kept.

            For example, National Archives has passenger lists of ships arriving to the USA from the 1800s.

            And I know someone (probably National Archives, but I found it on Ancestry) is keeping passenger lists of airplanes that arrived in the USA in the 1960s because I found my grandmother on one of those lists.

          9. LarrytheG Avatar

            so what policy do we follow right now in preserving data on govt IT systems? If we stuck to 3yrs, that sounds way too short….given all the other paper stuff we’ve kept for decades, no?

          10. how_it_works Avatar
            how_it_works

            3 years is what Virginia specifies for emails that are classified as administrative in nature. I don’t know what any of the Federal requirements are.

          11. See my reply to Dick below about Code of Virginia § 42.1-85,

      1. Dick Hall-Sizemore Avatar
        Dick Hall-Sizemore

        That is for county and municipal governments. Commonwealth’s attorneys are not county or municipal officials; they are constitutional officers.

        1. how_it_works Avatar
          how_it_works

          And there is no document retention schedule for the Commissioner of Revenue, also a constitutional office. I suppose from that we can (incorrectly) conclude that there is no requirement for the Commissioner of Revenue to keep any records.

        2. The definition in the state code includes constitutional officers.

          § 42.1-77. Definitions
          As used in this chapter, unless the context requires a different meaning:

          “Agency” means all boards, commissions, departments, divisions, institutions, and authorities, and parts thereof, of the Commonwealth or its political subdivisions and includes the offices of constitutional officers.

          Here is a link to the entire Public Records Act:

          https://law.lis.virginia.gov/vacodepopularnames/virginia-public-records-act/

          and here is a link to some retention schedules:

          https://www.lva.virginia.gov/agencies/records/sched_local/index.htm

    2. There are state-mandated document retention requirements at all levels of government in Virginia.

    3. Dick said, ” When I was a state employee, I routinely deleted e-mails. I worked with folks who had their systems set up to automatically delete any e-mail over XXX days, weeks, or months old.”
      They were violating the law under Code of Virginia § 42.1-85. The Library of Virginia sets the retention schedules for all local and state agencies, not just the office of the Governor (although it’s only a misdemeanor). https://www.lva.virginia.gov/agencies/records/retention.asp
      https://www.lva.virginia.gov/agencies/records/sched_specific/
      https://www.lva.virginia.gov/agencies/records/sched_local/index.htm
      Commonwealth attorney, for example has schedules ranging from 1 to 10 years, and some permanently, depending on the subject.

    4. Nancy Naive Avatar
      Nancy Naive

      Email, especially those to John.Doe@DoT.gov.va(example) are routed through a State server, should be strictly business (occasional personal use excepted) and are subject to archiving at the server.

      Your deleting them may not have, and probably didn’t, get rid of them, hence the policies against conducting business with personal email addresses.

      This is what drove me crazy with Hillary’s email. Any email originating at State, or sent to State were archived. The only emails that Hillary could send and receive would have been to/from other private accounts. There’s no preventing that activity for anyone.

      Text messages may not be subject to automatic preservation. In fact, we know they’re not from watching many cop shows. The phone companies record addressed phone numbers and times, but not content. Thank God.

  6. As long as he doesn’t / hasn’t indicted anyone else for doing the same thing, it’s probably no big deal.

  7. I wish this issue had first come up regarding a republican commonwealth’s attorney . It would be interesting to see if everyone had the same opinion(s) regarding the appropriateness of a public official auto-deleting texts sent/received while engaging in the public’s business using publicly-owned cell phones.

    For the record, my opinion is the same regardless of the party-affiliation of the official. I think it is inappropriate to auto-delete such information. Depending upon the nature of the information being sent/received, it might not all be subject to FOIA, but there is no legitimate reason to auto-delete it.

    By the way, I also think it inappropriate for public officials to discuss potentially confidential information/issues via text messages.

    Text messages are for:

    “I’m running 15 min late for meeting – start without me.”
    “Okay but we really need you for agenda item 1 so I’ll start with 2.

    …and such.

  8. Nancy Naive Avatar
    Nancy Naive

    It’s merely an extension of the expectation of privacy and the ethereal properties of a conversation in the office with the door closed. Or, is there a law dictating a 24/7 webcam in his office too?

    We have an expectation, but also trust, in the basic honesty of our elected officials. Fortunately, there is only one Santos, or whatever his name is.

    1. I do not think public officials should have any expectation of privacy when conducting the public’s business on publicly-owned electronic devices.

      1. how_it_works Avatar
        how_it_works

        Pretty much any Federal system will tell you when you connect to it:

        By using this information system, you understand and consent to the following: You have no reasonable expectation of privacy regarding any communications or information transiting, stored on, or traveling to or from this information system. At any time, the government may monitor, intercept, search, and/or seize any communication or information transiting, stored on, or traveling to or from this information system. Any communications or information transiting, stored on, or traveling to or from this information system may be disclosed or used for any U.S. Government-authorized purpose.

      2. Nancy Naive Avatar
        Nancy Naive

        So, back into the parking garage at midnight? One would hope that official correspondence is always logged and filed. Keyword, hope. But would a text message stream differ from a voice call?

        1. I do not know.

        2. LarrytheG Avatar

          No.. but “take a walk with me” might be hard…. 😉

  9. I wish this issue had first come up regarding a republican commonwealth’s attorney . It would be interesting to see if everyone had the same opinion(s) regarding the appropriateness of a public official auto-deleting texts sent/received while engaging in the public’s business using publicly-owned cell phones.

    For the record, my opinion is the same regardless of the party-affiliation of the official. I think it is inappropriate to auto-delete such information. Depending upon the nature of the information being sent/received, it might not all be subject to FOIA, but there is no legitimate reason to auto-delete it.

    By the way, I also think it inappropriate for public officials to discuss potentially confidential information/issues via text messages.

    Text messages are for:

    “I’m running 15 min late for meeting – start without me.”
    “Okay but we really need you for agenda item 1 so I’ll start with 2.

    …and such.

    1. Matt Adams Avatar
      Matt Adams

      Not just the auto-delete given a time window. It’s the end to end encryption. That IOT to read or view the messages it has to be the original devices with the keys.

      Depending on the application you can block someone from taking a screenshot as well.

Leave a Reply