Where Does E-mail Go, and Who Can Access It?

Some people might wonder what happens to their e-mail after they click Send. The section “How E-mail Works” illustrated the process of how e-mail gets from point A to point B, but what happens to it at point B? The e-mail is stored on a server somewhere until the recipient retrieves it. The people who own and manage the e-mail server might choose to do a few different things with the e-mail that passes through:

• Archive all e-mail messages

• Journal all e-mail messages

• Back up the e-mail server

• Administer the e-mail server

The fact is, the administrator who manages the e-mail server has complete access and control to all the e-mail that is created on, sent to, or retrieved from the server.

Archiving all e-mail messages means that the administrator keeps a copy of every e-mail message that passes through the server. An administrator might do this for legal or business reasons, but the effect is that people's e-mail messages can be stored for weeks or years.

Journaling all e-mail messages means that the administrator keeps traces of all the e-mail messages that are passing through. This means that he keeps the header information, such as who sent the message, who the recipient was, and what the subject line read. With journaling, the message body and contents are not usually kept. Just like archiving, the journaling records can be stored for weeks or years, depending on how the administrator has it set up.

Most e-mail systems are backed up. If the server crashes, the administrator wants to be able to get it up and running as quickly as possible, hopefully with all the data and e-mail in tact. This typically means that all e-mail on the server is copied over to a tape, CD-ROM, or some other removable storage media. The tape or CD-ROM stores all of the e-mail and can be used to quickly restore the e-mail to the server. Any removable storage media can be kept for months or years. This means that just because you have deleted an e-mail message, it might not really be deleted everywhere. It might be stored as part of a backup for years.

E-mail servers must be maintained, or administered. This is the basic process of tending to the server to keep it running and updated. The administrators have total control over the e-mail server. They can typically access anybody's mailbox and read the e-mail. They might actually do this if a legal or business reason arises. However, known cases have existed in which bad-intentioned administrators have read other people's e-mail for no lawful reason.

In all these cases, the best means of protection you have is once again encryption. Using PGP, you can protect your e-mail from prying eyes, even if it is stored for years. We talk all about PGP in the second half of this chapter.