The US Army, Navy, DARPA, others do not implement STARTTLS, a basic email encryption protocol
Lorenzo Franceschi-Bicchierai / Motherboard : Tweets: @ncweaver , @csoghoian and @trevortimm Tweets: Nicholas Weaver / @ncweaver : I'm sure every foreign intelligence service on the planet loves that almost all .mil doesn't use StartTLS: http://motherboard.vice.com/ ... Christopher Soghoian / @csoghoian : If you tweet about something enough - such as the gov not using email crypto - eventually someone will write about it http://motherboard.vice.com/ ... Trevor Timm / @trevortimm : How the US military fails to take the most basic steps to protect its soldiers' emails: http://motherboard.vice.com/ ...
Context & Ripple Effects
Security researchers Nicholas Weaver, Christopher Soghoian and Trevor Timm publicly flagged that much of .mil — including the Army, Navy and DARPA — leaves email unencrypted in transit, meaning any network observer can read messages meant to be confidential. Weaver's framing was blunt: foreign intelligence services 'love' the gap.
The disclosure fed directly into policy: two years later DHS issued a directive ordering federal agencies to adopt DMARC and STARTTLS, yet 2018 research found the CIA, NSA and DOD still had not fully implemented even DMARC on all their domains — making this story the opening data point in a recurring federal email-security compliance saga.
First-order effects
- Military personnel at the Army, Navy and DARPA have their emails exposed to passive interception in transit, since STARTTLS costs nothing to enable and its absence is visible to any adversary scanning mail servers.
Second-order effects
- Public researcher pressure pushed DHS to convert the practice from optional hygiene into a mandated directive covering DMARC and STARTTLS across federal domains — but the 2018 finding that intelligence agencies still lagged shows mandates alone did not close the gap.
Third-order effects
- The episode established a durable pattern of mandate-without-enforcement in federal IT: the same dynamic later surfaced with agencies still buying chips from an Entity-Listed vendor's subsidiary and with slow DMARC uptake, suggesting compliance now depends less on directives than on audited deadlines and consequences.
The trend: Federal cybersecurity is shifting from voluntary best practices toward mandated baseline protocols like STARTTLS and DMARC, with a multi-year lag between directive and verified compliance.