Postal Service can time-stamp certified mail as e-mail, safely
If your office sends a lot of certified letters, chances are you'd like to e-mail them instead. That concept is under development at the U.S. Postal Service and could be a boon to agencies like the Internal Revenue Service, which requires many documents to be filed by specific dates.
If your office sends a lot of certified letters, chances are you'd like to e-mail them
instead.
That concept is under development at the U.S. Postal Service and could be a boon to
agencies like the Internal Revenue Service, which requires many documents to be filed by
specific dates.
The idea is that e-mail messages and attachments would be routed through a regional
USPS Internet server, which would time-stamp and digitally sign them to make it obvious if
there had been any tampering along the way.
The Postal Service concept will support the Data Encryption Standard and RSA Data
Security Inc. algorithms. There's no plan to support authentication by the National
Security Agency's Fortezza card.
Test messages I received from the Postal Service show great promise in the concept but
a bit of a problem, too. USPS assumes that government and private offices all have
properly configured, Multipurpose Internet Mail Extensions-compliant e-mail systems in
place.
That's a nice wish, but it's not reality. In fact, I couldn't read the first test
message because my office's MIME-capable mail system wasn't configured to accept all types
of MIME attachments.
That problem was fixable. But there was no way for the sender to know the message
didn't get through intact. I had to tell the sender myself.
Paul Rains, USPS program manager for electronic commerce services, said a secure return
receipt is on the drawing board and should begin early next year with an option for
delayed delivery, such as waiting until April 15 to deliver a tax form.
Certified e-mail is a concept I'd really like to see take off, because it's sorely
needed.
"In our wildest dreams, we see this as something that could be used for all types
of documents," Raines said. The delivery cost will be about 22 cents per e-mail,
undercutting first-class rates substantially.
Raines said certified e-mail could become so popular that organizations will be forced
to update their e-mail systems to participate. Best of luck in that endeavor. In many
offices, users feel lucky if they can just get a World Wide Web browser up and running.
The Postal Service acknowledges this problem and has a backup plan. A Web interface is
being developed so people can just fill out on-line forms to send their certified
messages.
It would be even neater if people could just use a Web browser to check for messages
held for them on a remote server. Then e-mail configuration wouldn't be a big issue.
Raines said his office is developing two electronic commerce services besides the
aforementioned certified postmark, which is in beta test now with a handful of banks,
health organizations and law firms. He's looking for government participants, too. Contact
him at praines@email.usps.gov.
A second service is certificate authority escrow, which may have the greatest potential
for USPS. The third is archiving services, which likely would be offered in conjunction
with the electronic postmark.
Because electronic messages threaten to make post offices irrelevant, these services
could give USPS a new and important presence in American commerce.
Public-key cryptography already is available through several commercial sources. Two
users can share a message encrypted via a secret key and decrypted via a public key. The
trick is verifying that key owners are who they claim to be. A disinterested third party
can serve as the certification authority.
The certificate authority function is most promising for USPS is because of its
existing legal powers. Mail fraud laws don't yet apply to e-mail, but the Federal False
Claims Act and the Federal Communications Security Act do. Messing with a USPS-stamped
message would carry a far higher risk than with other certificate authorities.
Finding the right beta testers to work out the technical bugs is a big step. If digital
files can be made as secure, reliable and traceable as paper documents, electronic
commerce and electronic filing of government documents might really succeed.
For more information on how current laws apply to digital signatures, visit http://www.rsa.com/rsalabs/faq/q157.html.
The National Information Infrastructure's Federal Information Security Infrastructure
Action Plan, which discusses cryptographic keys for citizen e-mail, can be found at http://www.gsa.gov/fsi/action.htm.
To see the original Internet request for comments on the MIME standard, visit http://ds.internic.net/rfc/rfc1521.txt.
Shawn P. McCarthy is a computer journalist, webmaster and Internet programmer for
GCN's parent, Cahners Publishing Co. E-mail him at smccarthy@cahners.com.
NEXT STORY: IRS and union come to terms on buyout plan