Email lessons from Gen. Petraeus' downfall

Computerworld - Email is at the center of the scandal that brought down CIA Director David Petraeus, one of the country's most decorated generals.

The incident, which has shined a spotlight on cyber harassment, online privacy and digital forensics, has left a lot of people wondering if the head of the country's intelligence community and his girlfriend, a former counterintelligence officer, can't keep their emails private, do most of us even stand a shot?

"The best way to protect yourself is to simply realize that privacy doesn't necessarily exist in the electronic world," said Dan Ring, a spokesman for the security company Sophos. "Simply put, if you don't want it out there in the world, don't put it in the electronic world."

Petraeus, who took over as head of the Central Intelligence Agency (CIA) just 14 months ago, announced his resignation last Friday, putting the blame on an extra-marital affair.

The affair, which reportedly was with Petraeus' biographer and Army reservist Paula Broadwell, came to light at the hands of an FBI investigation that had originally focused on a potential cybercrime.

This past summer, Jill Kelley, a fundraiser for the U.S. military, is reported to have told a friend in the FBI that she'd received five to 10 anonymous harassing emails. The FBI began to investigate.

What they found was a trail of emails between two people -- Petraeus and Broadwell -- who were trying to hide an affair.

Using a pseudonym, Petraeus had reportedly set up various email accounts, including Gmail accounts, that he used to send Broadwell messages. One email account was actually a shared account, created so they could leave each other draft messages.

The idea was that if they left unsent emails in a draft folder, which is known as an electronic drop box, they wouldn't leave a trail and would then be more difficult for anyone to find or trace.

The FBI tracked all of this down when they began investigating the harassing emails being sent to Kelley.

Using metadata footprints left by the emails to determine where the emails had been sent from, investigators traced the emails to an account that Broadwell shared with her husband, the Wall Street Journal reported. They used that information to get a warrant to monitor her email accounts.

Then the rest began to fall into place.

"If you're just a normal person sending email, then it's pretty easy to trace," said Keith Jones, a computer forensic investigator and co-owner of Jones Dykstra & Associates. "Every server [an email] hits going to its destination puts a little identifying line in there... It's like a chain of custody, showing who had the email when."