Ger­ard Best

The cur­rent con­tro­ver­sy which has arisen out of the con­tri­bu­tion of the Leader of the Op­po­si­tion in the House of Rep­re­sen­ta­tives on May 20 has giv­en rise to a great deal of pub­lic dis­cus­sion.

At least two im­por­tant ques­tions arise. First, are these re­al e-mails or are they print­ed fab­ri­ca­tions de­signed to look like e-mails? Sec­ond, even if the e-mails were shown to ex­ist, can it be as­sumed that they were writ­ten by the peo­ple whose e-mail ad­dress­es were used?

Based on the pub­lic rep­re­sen­ta­tions alone, it is not pos­si­ble at this stage to de­ter­mine the va­lid­i­ty of the doc­u­ments as au­then­tic emails. This ques­tion will be put to rest on­ly if elec­tron­ic copies of the e-mails are record­ed as hav­ing ex­ist­ed on the servers of the rel­e­vant e-mail providers.

Fake E-mails: Easy To Cre­ate,Pos­si­ble To Spot

So, ex­act­ly how easy is it to fal­si­fy an e-mail ad­dress? And how hard is it to de­tect a fake?

The fact is that fake e-mails are a part of every­day life on the In­ter­net. Per­pe­tra­tors of­ten em­ploy so­phis­ti­cat­ed so­cial en­gi­neer­ing tech­niques to trick peo­ple in­to re­veal­ing per­son­al da­ta, bank­ing de­tails and pass­words. These tricks are reg­u­lar­ly used by scam­mers to de­ceive vic­tims in­to think­ing e-mails are com­ing from trust­ed rel­a­tives, friends, or fi­nan­cial in­sti­tu­tions, in or­der to get them to send mon­ey or ex­change sen­si­tive in­for­ma­tion.

Fraud­sters can cre­ate e-mails that ap­pear to come from any ad­dress they want in a few min­utes, us­ing com­mon e-mail soft­ware ap­pli­ca­tions, said Bevil Wood­ing, an In­ter­net Strate­gist with U.S.-based Pack­et Clear­ing House, a non-prof­it re­search or­gan­i­sa­tion that rou­tine­ly helps gov­ern­ments deal with cy­ber­se­cu­ri­ty breach­es. In­ci­dents of e-mail fraud of­ten have an in­ter­na­tion­al di­men­sion be­cause e-mail servers can be lo­cat­ed in var­i­ous parts of the world and are there­fore be­yond the ju­ris­dic­tion of lo­cal law en­force­ment.

"Fake e-mails are sur­pris­ing­ly easy to cre­ate, if you know the tricks. For­tu­nate­ly, they are al­so pos­si­ble to spot, if you know what to look for," Wood­ing said.

The way to ex­pose whether an e-mail mes­sage is fake or re­al, he said, is to ob­tain an elec­tron­ic copy of the e-mail and ex­am­ine the "head­ers" as­so­ci­at­ed with it. E-mail mes­sage head­ers out­line the tech­ni­cal de­tails about the mes­sage, such as where it orig­i­nat­ed, who sent it, the soft­ware pro­gramme used to com­pose it, and the e-mail servers on the In­ter­net that it passed through on its way to the re­cip­i­ent. The head­er in­for­ma­tion will al­so re­veal the re­al e-mail ac­count and IP ad­dress­es used to send the mes­sage.

Wood­ing ex­plained that every de­vice con­nect­ed to the In­ter­net is iden­ti­fied by a uniquenu­mer­ic ad­dress known as an IPad­dress.

Wood­ing ex­plained that In­ter­net Pro­to­col, com­mon­ly re­ferred to in tech­ni­cal cir­cles as IP, is the set of rules used by com­put­ers to com­mu­ni­cate with each oth­er over the In­ter­net.TheIn­ter­net's Do­main Name Sys­tem, com­mon­ly re­ferred to as­DNS,is like a phone book for the In­ter­net. It­trans­lates­do­main names such as tstt.co.ttorgmail.com­into a ma­chine-un­der­stood In­ter­net Pro­to­col (IP) ad­dress­es like50.56.72.22or 75.125.45.113. These ad­dress­es can be used as a sort of dig­i­tal foot­print to track where mes­sages orig­i­nate, tran­sit and ter­mi­nate.

"Find­ing the trail for trac­ing the true source of an email mes­sage has to be­gin with an analy­sis of the In­ter­net head­er for the email.How­ev­er, trac­ing the source can be chal­leng­ing if mul­ti­ple ju­ris­dic­tions are in­volvedand if the own­ers of the e-mail servers in­volved are un­co-op­er­a­tive. This is why e-mail traces typ­i­cal­ly in­volve court or­ders, po­lice in­ves­ti­ga­tions and pro­fes­sion­al foren­sic au­dit­sof the elec­tron­ic trail."

Ronald Hinds, CEO of Teleios Sys­tems, a Trinidad-based tech­nol­o­gy com­pa­ny, agreed.

"To fake an email is not hard," he said, "but to fake it prop­er­ly so that it's not go­ing to get caught is hard.I can eas­i­ly make an ac­count that says 'whistle­blow­er@tt-par­lia­ment.org', for ex­am­ple, on the 'From' field, but it doesn't mean when you re­ply that it's go­ing to go back to that ad­dress, and it doesn't mean it's from that ad­dress. I can send you an e-mail now that ba­si­cal­ly says I'm your boss, your banker or your un­cle. Un­less you look at the email head­er in­for­ma­tion to see it's ac­tu­al­ly com­ing from a dif­fer­ent ac­count and an un­usu­al IP ad­dress, you wouldn't know."

"For ex­am­ple,if an e-mail was sent to or from a gmail (Google) ac­count, it would like­ly still con­tin­ue to ex­ist on Google's servers, even if that e-mail was sub­se­quent­ly delet­ed from the ma­chine and/or email ac­count of the sender or re­cip­i­ent. The ques­tion might there­fore be re­framed to ask, if the doc­u­ments were emails, can their ex­is­tence be ver­i­fied or dis­proved. Briefly, the an­swer is yes. The next ques­tion be­comes how.

In that re­gard,a li­bel­case in­volv­ing Ja­maican busi­ness­man Gor­don "Butch" Stew­art and­Googleis in­struc­tive. In 2009,U.S. and Ja­maican agents searchedthe of­fices of Ja­maica Tours Lim­it­ed, owned by the fam­i­ly of Op­po­si­tion Sen­a­tor Noel Slo­ley, to trace the ori­gin of ane-mail that Stew­art claimed was li­bel­lous.

Track­ing e-mail fraud is not easy, par­tic­u­lar­ly when ju­ris­dic­tions over­lap. The com­plex na­ture oftwen­ty-first cen­tu­ry mis­deeds re­quires a re­sponse from ex­perts across sev­er­al dis­ci­plines. New lev­els of co-op­er­a­tion and dili­gence must be ap­plied. With the in­ci­dence­of elec­tron­ic crime is on­the rise, the mak­ers and en­forcers of our law­shave no choice but­to face this threat head on.

4 Ways To Fake E-mails

The Caribbean Net­work Op­er­a­tors Group (CaribNOG), a vol­un­teer com­mu­ni­ty of re­gion­al tech­nol­o­gy pro­fes­sion­als and eth­i­cal com­put­er hack­ers, lists sev­er­al meth­ods fraud­sters use­to send fake e-mails:

1.Spoof the con­tent of an email to claim that it came from some­one else. This is rel­a­tive­ly triv­ial since the sender can use any stan­dard email client to set the head­ers and body of any email which is sent.

2. Hack in­to an on­line email ac­count ser­vice or ac­cess an un­locked or com­pro­mised com­put­er, or a hacked on­line ac­count, and send an email as an­oth­er user. In this case, the scam­mer must get the de­tails and the tone of the mes­sage right so that it doesn't ap­pear out of char­ac­ter. Thissort of forgery can be hard to de­tect.

3. Hack in­to a mail serv­er and add an unau­tho­rised mes­sage in­to the mail queue. This ap­proach can be done to ei­ther in­bound or out­bound queue, al­low­ing an in­trud­er to cause mail to leave your Out­box, or en­ter your In­box. This sort of forgery can al­so be toughto spot.

4. Cre­ate­and print a doc­u­ment that looks like an e-mail, though it nev­er was, and leave that doc­u­ment as mis­in­for­ma­tion to be found and act­ed up­on. Of course, e-mails con­struct­ed this way will not match up to any le­git­i­mate e-mails found on servers or com­put­er logs. If a prop­er foren­sic au­dit is done, this type of fraud is gen­er­al­ly eas­i­ly ex­posed.

Ger­ard Best is New Me­dia Ed­i­tor at Guardian Me­dia Lim­it­ed, Trinidad and To­ba­go.