UK Ministry of Justice secure email system browns out

The United Kingdom's Criminal Justice Secure Email (CJSM) system has been browning out for months, and in the 18 months an upgrade is expected to take users have been asked to stop using the service's webmail and revert to conventional email clients.

The CJSM is designed to help workers in the English and Welsh criminal justice systems to collaborate. The service describes itself as allowing “those working to prevent crime, including public, private and voluntary organisations, to send emails containing information up to an equivalent of ‘Restricted’ (i.e. sensitive data), in a secure way.”

“For the first time, it’s made it possible for these key groups of people to send emails securely to each other”, thanks to “a dedicated server.” Users of the service can “send secure emails to each other and to criminal justice organisations.”

Which is all very nice, except for the fact that the we've previously found the service uses some insecure technologies. And now the service's site currently includes a “Service slowness advice” as follows:

“We apologise for performance issues - this is due to unprecedented demand. You may consider moving to POP3 access which will allow you to receive your email in your normal email client (e.g. Outlook). If so please E-mail the Helpdesk for instructions providing the version of your mail client. Please note this can only be used with desktop mail clients and not other email accessed via a website.”

The Register has also been able to access an email sent to users of the system that says “The Ministry of Justice would like to apologise to CJSM users accessing the service through the CJSM website for the current poor performance of the service, There has been a growth in usage of the service over the pas few months beyond what was expected and over the last couple of months demand has outstripped the capacity of the service.”

“Please be assured that we are taking steps to remedy the situation,” the message continues.

The first step is billed as “a short term solution to increase capacity” that it's hoped will be in place in a couple of months. Which sounds like more servers are on the way.

There's also “a medium term plan to significantly increase capacity” and an intention to “replace the existing service with a completely new service … within 18 months.”

For now, the Ministry of Justice “would encourage you to use the POP3 version of the service which will allow you to receive your CJSM email into your normal email client e.g. Outlook, Thunderbird, MacMail, etc.”

Users unsure of how to wrangle a POP3 client are asked to contact the help desk, by phone or by using an @vodafone.com address rather than the service's own @cjsm.net mail domain. Vodafone provides the CJSM system to the Ministry. And presumably has enough security on its own email to prevent snoopers from reading discussions of how to configure CJSM's secure email.

The Register got wind of this situation during the UK's small hours, but we've fired off inquiries to the Ministry of Justice to learn more about the appropriateness or otherwise of that vodafone.com email address and the CJSM brownouts' impact on the criminal justice system.

Updated

A Ministry of Justice spokeswoman said: "The email system used by our criminal justice agencies is running slower than usual, but remains secure and encrypted.

“We have written to users to apologise for this and we are working to resolve it as soon as possible. In the meantime, users continue to send and receive secure emails relating to their work through an alternative version of the system without any issues. ”®