Richard Lawrence

The most important reason to encrypt data is this: if you are sending a message directly to me, no one else has a right to read it. But if you don’t encrypt your message to me, then others can and will read it. That includes programs that scan your email in order to profit from targeted advertising, your disgruntled ex who just got a job as an email server administrator, intelligence agencies in the U.S. and abroad, and the U.C. Office of the President.

Since it’s easy to encrypt messages, but hard to foresee all the consequences of letting other people read them, you should just encrypt all messages that you only intend to be read by a specific recipient.

Particularly if you are one of my students, you should always encrypt your messages to me. Students often ask me questions or send me data that includes confidential information, such as student ID numbers, assignments, and grades. You should not rely on conventions or good luck to keep your information, your questions, and my replies private.

What if you are not sending me confidential information? Unless your message is specifically intended for public consumption, you should still encrypt it. Privacy is about ensuring your information is used as you intend, not about hiding something that is shameful or wrong. There are many aspects of your life that you expect to remain private even when you are doing nothing wrong: what you checked out of the library, how much you spend on your clothes, that embarrassing thing you said to your barista this morning. By always using encryption, you make this privacy the default for your Internet communication, just as it is the default for your in-person conversations and the rest of your life.

If you prefer to read your mail in a browser, try one of these options:

• Mailvelope: a browser plugin for Firefox and Chrome that works with various webmail services, including GMail, Outlook.com, and Yahoo! Mail
• Mailpile: a GMail-like webmail interface for reading mail stored locally
• Google End-to-end: a browser plugin for Google Chrome that allows you to use OpenPGP through GMail’s web interface

If you prefer to read your mail in a desktop client, follow the Email Self-Defense guide from the Free Software Foundation. This guide walks you through setting up your key and sending your first encrypted email, using the appropriate GnuPG plugin for your mail client:

• Thunderbird: use the Enigmail plugin
• Outlook: use the plugin included with GPG4Win
• Apple Mail: use the plugin included with gpgtools

After you have your client set up, import my public key into your key database. You can search for this key in the public databases using my Berkeley email address (richard.lawrence <at> berkeley.edu) or its hex identifier (996943E1CF6FA646), or you can download it here.

To test your setup, send me an encrypted email! If you want me to be able to encrypt my reply, you need to send me your public key. You can do this by exporting it and attaching it to your message, or uploading it to a public database. See the documentation for the program you’re using to find out how to do this.