Everybody and their uncle has an opinion on the Petraeus resignation by now, so I wasnt going to write about it at all. Its not really a tech story on the surface, its a Washington story with an affair in the middle of it. But then I actually read into how the FBI figured out who was sending those harassing emails to Jill Kelley, and I couldnt stop thinking about it, so here we are.
The part that got me: Paula Broadwell was apparently using an anonymous Gmail account to send the messages, and investigators traced it back to her mostly through IP addresses and login records tied to hotel wifi networks. Not some elite NSA wiretap operation. Not a warrant for the contents of encrypted messages. Just, hey, this account logged in from this hotel on this date, cross reference that against guest lists, and youre most of the way there. Google apparently complied with a subpoena for login records, which is a pretty normal Tuesday for them, and thats all it took.
And then theres the detail thats been making the rounds about how Petraeus and Broadwell reportedly avoided sending emails to each other at all for a stretch, and instead used a shared account where theyd each log in and leave messages sitting in the drafts folder. Never hit send, so in theory no message ever actually traverses the network as "sent mail." Its a real technique, apparently used by actual terrorism suspects too, and it still didnt matter, because the account itself wasnt hidden. If they can identify the account, the drafts folder trick buys you nothing.
Ive read a couple of the writeups on this (Wired had a good one, so did Ars) and the thing that sticks with me isnt the scandal part, its how casually the metadata did all the work. You dont need to break encryption. You dont need to read a single word of the actual message. You just need to know when an account logged in and from where, and you can build a pretty complete picture of somebodys life. I complain about Gmails "last account activity" feature at the bottom of the inbox all the time, the little link that shows you every IP address that touched your account recently, and I always figured it was just a mildly interesting security widget. Turns out its basically a confession machine if anyone with subpoena power ever wants to look at the same data from the other end.
Im not saying any of this to defend anybody involved, its just a genuinely uncomfortable thing to sit with as someone who uses Gmail for pretty much everything, personal and otherwise. I think most of us walk around assuming "anonymous account" means anonymous, full stop, when really it just means your name isnt directly attached to the username. The second you touch that account from a device or network tied to your actual identity, even once, the anonymity is basically theater. And most people log in from their phone within minutes of creating a new account, so the theater doesnt even last a day.
Small unrelated aside because I cant not mention it: Steven Sinofsky is apparently out at Microsoft as of yesterday, the guy who ran the whole Windows division and basically shipped Windows 8 and Surface single handedly as far as anyone outside Redmond could tell. No real explanation given, just a short statement about him "leaving the company." That is its own strange story and I dont have anything smart to say about it yet, I just find it bizarre that Microsoft loses its most visible exec a week after its biggest launch in years and offers about four sentences of explanation.
Anyway. If youre the type who reuses a "private" account for anything you actually want kept private, this is a decent week to rethink that. Not because youre under FBI investigation, presumably, but because the mechanism that caught a CIA director works exactly the same way on the rest of us, just with nobody bothering to pull the records unless theres a reason to.