Securing email

Currently email is usually encrypted, but on a per-organisation basis. The organisation holds the key used to encrypt the email, using TLS with SMTP, and used to verify the origin of the message using DMARC. The next step is to verify individual senders, and secure messages between pairs of people, probability using a system such as PGP. This would have the advantage of being more secure, and being visible. I think that this is possible, but initially the control must remain in the hands of the organisation.

The way I would roll it out is as follows. 

• Start with government departments. Each department sets up a key-server, that holds the public and private keys for the members. The IT bods within the departments start using PGP to sign messages, and building the web-of-trust from there. Maybe it can start smaller, with just those involved in networking, for example.
• Next, roll it out to the media-relations people within the department. They have a clear and present reason to sign messages such as press releases. Hopefully the IT folks at the media companies will see good reason to set up their systems to at least check the signatures against the key servers.
• Then I would aim to roll out signing (only) from the top-down in each department. The need for signing is greater the higher up within each department a person is, as seniority brings with it a greater need for communication. Also there are fewer senior people and the diversity of tasks is smaller (they are all managers, after all).

The problem is this system takes control away from individuals. This is a big issue for some people, and rightly so. However, I think the usability issues with PGP are too great right now for it to ever work in a general way. By starting with government and moving out from there we can build on existing skills what we know works, and use centralisation to plug the usability gap. I suspect that centralisation will erode over time, as contractors, NGOs, quangos, and individuals start adopting encryption.

I also suspect that I am being naive to think that this plan would work, but it is nice to dream on a sunny Friday in summer.