7 ms·

FastMail is not required to implement the Australian metadata retention laws

173 points by joneil 11y ago

brongondwana 11y ago
This is old news (April this year) but it got picked up again because one of our politicians posted it as a guide to how the law is about to affect companies that have servers in Australia, vs those (like us) without infrastructure on-shore. It's a strange law!
- alfiedotwtf 11y ago
  When an Australian Senator is linking to a VPN how-to in order to circumvent the law, and ISPs are still in the dark as to what data actually needs to be retained, it's a useless law.
  - michaelt 11y ago
    It may well be a useless law. But unless the senator is from the party that supported the law, politicians making the other party's laws look stupid might just be politics as usual :(
    - chris_wot 11y ago
      Scott Ludlum may be the Greens Senator who detailed how to get around the law, but the then Communications Minister and our now current Prime Minister, said the following [1]: “If you have a device, you know, a phone or a smartphone, and if I call you through the mobile phone network there will be a record. Say my phone’s with Telstra, there’ll be a record with Telstra that I’ve called your number. If on the other hand I communicate with you via Skype for a voice call or Viber, send you a message on WhatsApp or Wickr or Threema or Signal or Telegrammer — there’s a gazillion of them — or indeed if you make a FaceTime call, then all that the telco can see, insofar as it can see anything, is that my device has had a connection with the Skype server or the WhatsApp server; it doesn’t see anything happening with you.” 1. http://www.businessinsider.com.au/malcolm-turnbulls-sky-news-interview-basically-renders-the-metadata-retention-laws-useless-2015-3 http://www.businessinsider.com.au/malcolm-turnbulls-sky-news...
    - NamTaf 11y ago
      He most certianly isn't. Scott Ludlam is from the Greens party, which are a not-extreme-but-still-left left-wing party. They're the 3rd 'major' party in AU politics, but trail far behind the big two. The big two came together on this to pass it, so although many of the minor parties are up in arms about it, it got steamrolled through. Additionally, Scott Ludlam is far more technologically adept than many of the old white law-educated guys in parliament. He's younger, he's very much of the IT era and is much more understanding of technology as a result. That's why he speaks out against this and other technology-related policies so often, because he gets the technological side of things.
  - chris_wot 11y ago
    Yup. Probably pushed through by the last PM, who was such a moron he didn't even last 2 years before his is. Colleagues dumped him. The one who explained how to get around that law is our current Prime Minister [1]. 1. http://www.businessinsider.com.au/malcolm-turnbulls-sky-news-interview-basically-renders-the-metadata-retention-laws-useless-2015-3 http://www.businessinsider.com.au/malcolm-turnbulls-sky-news...
- beedogs 11y ago
  It's a terrible, unworkable law.
joneil 11y ago
The post is from April, I'm reposting this because it's even more relevant now, with Australia's data retention due to take effect next week. As a founder of an Australian startup that facilitates communication it's interesting to hear that using international hosting seems to bypass the requirements. IANAL etc. As the post mentions this is a pretty good way to discourage investment in local tech infrastructure. Previous discussion : https://news.ycombinator.com/item?id=9345935 https://news.ycombinator.com/item?id=9345935
- brongondwana 11y ago
  It's nice to see this blog post getting more traffic. Unlike our average blog post which we make up out of our own heads, this one had a bunch of legal research behind it by actual lawyers. And yes, totally agree. It made us put our plans of an Australian datacentre on the shelf for the foreseeable future. Data in Australia is already crazy expensive (https://blog.cloudflare.com/the-relative-cost-of-bandwidth-around-the-world/ https://blog.cloudflare.com/the-relative-cost-of-bandwidth-a...) and we're working at the latency problem from the other direction (http://jmap.io http://jmap.io) as well, so we're focusing more on making the location of the datacentres not matter so much. We're currently in Amsterdam, Los Angeles and New York.
  - joneil 11y ago
    Wow that CloudFlare link is pretty damning. It's interesting contrasting that to both sides of politics trying to talk up the "innovation economy". To your credit, I'm in Melbourne too and have always thought Fastmail was really snappy, which I assumed was due to Australian servers. So it looks like I was wrong, and your Jmap strategy is right.
  - voltagex_ 11y ago
    Thanks for all your work. I've recently set up FastMail, but damn, kicking the GMail dependency is hard.
    - Sophistifunk 11y ago
MichaelGG 11y ago
I just wish Fastmail didn't have servers in the US. Not really quite sure what the benefit is there; email isn't latency sensitive. If a Swiss company were to pop up with a competitive mail offering, I imagine they'd sweep up a lot of business easily eh? Not that it's much more secure, just harder to imagine Switzerland easily handing over records, whereas with folks like MS, they've shown they'll do it on even non-legal requests.
- stock_toaster 11y ago
  > Not really quite sure what the benefit is there; email isn't latency sensitive. My guess is the webmail interface.
- alfiedotwtf 11y ago
  > I just wish Fastmail didn't have servers in the US tl;dr - We are Australian, so PATRIOT Act doesn't apply. http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in-the-us-what-this-means-for-you/ http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in... "It has been pointed out to us that since we have our servers in the US, we are under US jurisdiction. We do not believe this to be the case. We do not have a legal presence in the US, no company incorporated in the US, no staff in the US, and no one in the US with login access to any servers located in the US. Even if a US court were to serve us with a court order, subpoena or other instruction to hand over user data, Australian communications and privacy law explicitly forbids us from doing so." "Australia does not have any equivalent to the US National Security Letter, so we cannot be forced to do something without being allowed to disclose it."
  - hydrogen18 11y ago
    I don't really follow your logic here. If your servers are physically in the US, a judge will just issue a warrant to seize the servers.
    - alfiedotwtf 11y ago
      All drives are encrypted. They may take our servers, but they'll never take our customer's data.
basicplus2 11y ago
Surely as they have servers in America Australia gets the data anyway as it will be collected for them by America.
tedunangst 11y ago
Is FastMail an Australian company? I'm guessing maybe yes, since otherwise it seems such a post is unnecessary, but nowhere does it actually say anything like "You may think the law applies because we're an Australian company, but...". For all I know, this could be a law attempting to target any company, in any country, that does business with Australians.
- robn_fastmail 11y ago
  Yes, we're an Australian company. https://www.fastmail.com/about/company.html https://www.fastmail.com/about/company.html
deleted 11y ago
[deleted]
kristianp 11y ago
Not unrelated: https://mako.cc/copyrighteous/google-has-most-of-my-email-because-it-has-all-of-yours https://mako.cc/copyrighteous/google-has-most-of-my-email-be... HN discussion: https://news.ycombinator.com/item?id=10229928 https://news.ycombinator.com/item?id=10229928
jacques_chester 11y ago
While it's important to get legal advice, there are two things to bear in mind. First, the meaning of a law can only be settled in the courts, strictly speaking. A legal opinion is a best effort, but it is an opinion, not a judgement. Second, Parliament can amend any law it passes at will. And it has the power -- rarely but sometimes exercised -- to make its legislation retroactively effective.
- brongondwana 11y ago
  Yeah, sure - at which point we change that blog post, inform our users. _NO_ jurisdiction is different in this regard - welcome to life.
rdancer 11y ago
I fail to see how this helps their users in any way, seeing as the data will be intercepted by NSA, GCHQ, or indeed ASD, retained wholesale (not just scraps of headers a.k.a. metadata) forever, and shared with whoever asks nicely?
verusfossa 11y ago
I generally like Fastmail and the for pay model, but their Employee Access to Data section of their Privacy Policy seems to be a bit too cavalier. I may just be naive though. PP:https://www.fastmail.com/about/privacy.html https://www.fastmail.com/about/privacy.html Also, I feel they overstate the jurisdiction piece. Being in Australia is important, but it certainly doesn't make you a paragon of privacy or Australia a privacy Eden. Company culture is great, but a five-eyes becoming more surveillance-heavy by the day doesn't make the technical aspects of maintaining private communication any easier. I'd be wary not to oversell.
- robn_fastmail 11y ago
  In what way do you consider the privacy policy cavalier? What would you prefer it said? I don't believe we made any claims that Australia is a "privacy Eden" or that we're "paragon of privacy". Indeed, we frequently say we're _not_ a privacy service, just an email service that cares about privacy among other things. More specifics on both these points would help us discuss them properly.
- vacri 11y ago
  I love that privacy policy - it feels real. None of this "Our employees can't access your data" where you know that they certainly can - since they can see it when they help troubleshoot things for you. It's a very direct, honest policy; it's definitely not the usual CYA bullshit that's kept in legalese to reduce clarity.
mrmondo 11y ago
Big ups to Fastmail, as a user myself, I find them to have both a solid product and fantastic service.
walkingolof 11y ago
I've been a Fastmail customer for almost two years now, its been working really great. The best thing with Fastmail is that it shows there is a future for a Internet with choices, choices beyond the 4 or 5 global cooperation that tries to dominate every aspect of our life.

173 points by joneil 11y ago

This is old news (April this year) but it got picked up again because one of our politicians posted it as a guide to how the law is about to affect companies that have servers in Australia, vs those (like us) without infrastructure on-shore. It's a strange law!

alfiedotwtf 11y ago
When an Australian Senator is linking to a VPN how-to in order to circumvent the law, and ISPs are still in the dark as to what data actually needs to be retained, it's a useless law.
- michaelt 11y ago
  It may well be a useless law. But unless the senator is from the party that supported the law, politicians making the other party's laws look stupid might just be politics as usual :(
  - chris_wot 11y ago
    Scott Ludlum may be the Greens Senator who detailed how to get around the law, but the then Communications Minister and our now current Prime Minister, said the following [1]: “If you have a device, you know, a phone or a smartphone, and if I call you through the mobile phone network there will be a record. Say my phone’s with Telstra, there’ll be a record with Telstra that I’ve called your number. If on the other hand I communicate with you via Skype for a voice call or Viber, send you a message on WhatsApp or Wickr or Threema or Signal or Telegrammer — there’s a gazillion of them — or indeed if you make a FaceTime call, then all that the telco can see, insofar as it can see anything, is that my device has had a connection with the Skype server or the WhatsApp server; it doesn’t see anything happening with you.” 1. http://www.businessinsider.com.au/malcolm-turnbulls-sky-news-interview-basically-renders-the-metadata-retention-laws-useless-2015-3 http://www.businessinsider.com.au/malcolm-turnbulls-sky-news...
  - NamTaf 11y ago
    He most certianly isn't. Scott Ludlam is from the Greens party, which are a not-extreme-but-still-left left-wing party. They're the 3rd 'major' party in AU politics, but trail far behind the big two. The big two came together on this to pass it, so although many of the minor parties are up in arms about it, it got steamrolled through. Additionally, Scott Ludlam is far more technologically adept than many of the old white law-educated guys in parliament. He's younger, he's very much of the IT era and is much more understanding of technology as a result. That's why he speaks out against this and other technology-related policies so often, because he gets the technological side of things.
- chris_wot 11y ago
  Yup. Probably pushed through by the last PM, who was such a moron he didn't even last 2 years before his is. Colleagues dumped him. The one who explained how to get around that law is our current Prime Minister [1]. 1. http://www.businessinsider.com.au/malcolm-turnbulls-sky-news-interview-basically-renders-the-metadata-retention-laws-useless-2015-3 http://www.businessinsider.com.au/malcolm-turnbulls-sky-news...
beedogs 11y ago
It's a terrible, unworkable law.

joneil 11y ago

The post is from April, I'm reposting this because it's even more relevant now, with Australia's data retention due to take effect next week. As a founder of an Australian startup that facilitates communication it's interesting to hear that using international hosting seems to bypass the requirements. IANAL etc. As the post mentions this is a pretty good way to discourage investment in local tech infrastructure. Previous discussion : https://news.ycombinator.com/item?id=9345935 https://news.ycombinator.com/item?id=9345935

brongondwana 11y ago
It's nice to see this blog post getting more traffic. Unlike our average blog post which we make up out of our own heads, this one had a bunch of legal research behind it by actual lawyers. And yes, totally agree. It made us put our plans of an Australian datacentre on the shelf for the foreseeable future. Data in Australia is already crazy expensive (https://blog.cloudflare.com/the-relative-cost-of-bandwidth-around-the-world/ https://blog.cloudflare.com/the-relative-cost-of-bandwidth-a...) and we're working at the latency problem from the other direction (http://jmap.io http://jmap.io) as well, so we're focusing more on making the location of the datacentres not matter so much. We're currently in Amsterdam, Los Angeles and New York.
- joneil 11y ago
  Wow that CloudFlare link is pretty damning. It's interesting contrasting that to both sides of politics trying to talk up the "innovation economy". To your credit, I'm in Melbourne too and have always thought Fastmail was really snappy, which I assumed was due to Australian servers. So it looks like I was wrong, and your Jmap strategy is right.
- voltagex_ 11y ago
  Thanks for all your work. I've recently set up FastMail, but damn, kicking the GMail dependency is hard.
  - Sophistifunk 11y ago

MichaelGG 11y ago

I just wish Fastmail didn't have servers in the US. Not really quite sure what the benefit is there; email isn't latency sensitive. If a Swiss company were to pop up with a competitive mail offering, I imagine they'd sweep up a lot of business easily eh? Not that it's much more secure, just harder to imagine Switzerland easily handing over records, whereas with folks like MS, they've shown they'll do it on even non-legal requests.

stock_toaster 11y ago
> Not really quite sure what the benefit is there; email isn't latency sensitive. My guess is the webmail interface.
alfiedotwtf 11y ago
> I just wish Fastmail didn't have servers in the US tl;dr - We are Australian, so PATRIOT Act doesn't apply. http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in-the-us-what-this-means-for-you/ http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in... "It has been pointed out to us that since we have our servers in the US, we are under US jurisdiction. We do not believe this to be the case. We do not have a legal presence in the US, no company incorporated in the US, no staff in the US, and no one in the US with login access to any servers located in the US. Even if a US court were to serve us with a court order, subpoena or other instruction to hand over user data, Australian communications and privacy law explicitly forbids us from doing so." "Australia does not have any equivalent to the US National Security Letter, so we cannot be forced to do something without being allowed to disclose it."
- hydrogen18 11y ago
  I don't really follow your logic here. If your servers are physically in the US, a judge will just issue a warrant to seize the servers.
  - alfiedotwtf 11y ago
    All drives are encrypted. They may take our servers, but they'll never take our customer's data.

basicplus2 11y ago

Surely as they have servers in America Australia gets the data anyway as it will be collected for them by America.

tedunangst 11y ago

Is FastMail an Australian company? I'm guessing maybe yes, since otherwise it seems such a post is unnecessary, but nowhere does it actually say anything like "You may think the law applies because we're an Australian company, but...". For all I know, this could be a law attempting to target any company, in any country, that does business with Australians.

robn_fastmail 11y ago
Yes, we're an Australian company. https://www.fastmail.com/about/company.html https://www.fastmail.com/about/company.html

deleted 11y ago

[deleted]

kristianp 11y ago

Not unrelated: https://mako.cc/copyrighteous/google-has-most-of-my-email-because-it-has-all-of-yours https://mako.cc/copyrighteous/google-has-most-of-my-email-be... HN discussion: https://news.ycombinator.com/item?id=10229928 https://news.ycombinator.com/item?id=10229928

jacques_chester 11y ago

While it's important to get legal advice, there are two things to bear in mind. First, the meaning of a law can only be settled in the courts, strictly speaking. A legal opinion is a best effort, but it is an opinion, not a judgement. Second, Parliament can amend any law it passes at will. And it has the power -- rarely but sometimes exercised -- to make its legislation retroactively effective.

brongondwana 11y ago
Yeah, sure - at which point we change that blog post, inform our users. _NO_ jurisdiction is different in this regard - welcome to life.

rdancer 11y ago

I fail to see how this helps their users in any way, seeing as the data will be intercepted by NSA, GCHQ, or indeed ASD, retained wholesale (not just scraps of headers a.k.a. metadata) forever, and shared with whoever asks nicely?

verusfossa 11y ago

I generally like Fastmail and the for pay model, but their Employee Access to Data section of their Privacy Policy seems to be a bit too cavalier. I may just be naive though. PP:https://www.fastmail.com/about/privacy.html https://www.fastmail.com/about/privacy.html Also, I feel they overstate the jurisdiction piece. Being in Australia is important, but it certainly doesn't make you a paragon of privacy or Australia a privacy Eden. Company culture is great, but a five-eyes becoming more surveillance-heavy by the day doesn't make the technical aspects of maintaining private communication any easier. I'd be wary not to oversell.

robn_fastmail 11y ago
In what way do you consider the privacy policy cavalier? What would you prefer it said? I don't believe we made any claims that Australia is a "privacy Eden" or that we're "paragon of privacy". Indeed, we frequently say we're _not_ a privacy service, just an email service that cares about privacy among other things. More specifics on both these points would help us discuss them properly.
vacri 11y ago
I love that privacy policy - it feels real. None of this "Our employees can't access your data" where you know that they certainly can - since they can see it when they help troubleshoot things for you. It's a very direct, honest policy; it's definitely not the usual CYA bullshit that's kept in legalese to reduce clarity.

mrmondo 11y ago

Big ups to Fastmail, as a user myself, I find them to have both a solid product and fantastic service.

walkingolof 11y ago

I've been a Fastmail customer for almost two years now, its been working really great. The best thing with Fastmail is that it shows there is a future for a Internet with choices, choices beyond the 4 or 5 global cooperation that tries to dominate every aspect of our life.