"Many of the systems we have built for authentication and session maintenance assume no man-in-the-middle attack, " he said.

BBC: Google tackled on e-mail security

Also, client-side JavaScript encryption has its limitations since it would still be susceptible to a server-side code poisoning attack executed either through a man-in-the-middle attack or the service provider acting maliciously or subject to jurisdictional court order.

FORBES: Cryptocat Increases Security In Move Away From JavaScript Web Delivery

The danger would have been that they could then have staged a man-in-the middle attack.

BBC: Google detects fake website ID certificate threat

Washington (CNN) -- In the hours after the 1995 Oklahoma City bombing, law enforcement officials were searching for a dark-skinned Middle Eastern man in connection to the attack that killed 168 people, including 19 children.

CNN: Why officials, media wait to declare bombing suspect