> I have never assumed that an email address I gave the government would be protected. I would also not assume that the contents of any email I sent would be in

> I have never assumed that an email address I gave the government would be protected. I would also not assume that the contents of any email I sent would be in any way protected either. I have similar assumptions, but what about the less technically inclined citizens? Moreover, I wouldn't be surprised if the ploy described by the OP: > Could I request this data myself, then start emailing them scam emails "I know you contacted us in June, could you call me on 555-1223 etc" would work on me. Really, it would take me checking DKIM and/or SPF to notice such an email. And from this story it seems likely the city of Seattle doesn't actually implement DKIM or SPF.