4 ms·

We haven't been forced to add anything. The problem is that if the law says that we could be forced to add something and not allowed to tell our customers,

We haven't been forced to add anything. The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth. We pride ourselves on telling the truth to our customers, and we're quite clear that if we receive an Australian warrant for access to information about one of our customers, then we respond. That's different from adding backdoors. Our submission asks that the law be updated so we're allowed to talk about any surveillance capabilities that we may be asked to add, but not about which users are being surveilled. That way our customers know exactly what we are capable of. Right now we haven't received any capability requests (TCN) which is the bit we're concerned about, because if they required us to add features to the product without telling all staff about them, that would make it hard to maintain and ensure security as things were refactored. And any staff who DID know about it would have to be extra careful about what they say anywhere, because they could inadvertently leak something about the capability. We expect the law to be updated soon, and hopefully this will be addressed. Until then - honestly, nothing has changed. We still operate under exactly the same process - if we receive a warrant from Australian Federal Police we respond. If we receive any other type of request, we point them to the AFP and the mutual assistance treaties that are appropriate. But it's impossible for you to verify that, because if something HAD changed, we'd have lie - and that's frustrating to us.

larkeith 8y ago
Given that you're able to inform us currently that you've not received any capability requests, would it be legal and feasible for you to set up a warrant canary? I don't know if Australia has the same protections against compelled speech as the US [1, 2] which theoretically allow one to function, but if so, it might help encourage people to stay. [1] https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of_Education_v._Barnette https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of... [2] https://en.m.wikipedia.org/wiki/Wooley_v._Maynard https://en.m.wikipedia.org/wiki/Wooley_v._Maynard
- cyphar 8y ago
  Warrant canaries are explicitly disallowed under this legislation (you cannot comment on the existence or non-existence of a notice and there are strong restrictions on what sort of statistics you can provide). In fact, I'm a little worried that they just said they have received no TCNs -- while you can provide aggregate statistical information over a 6-month window, if you get it wrong you're looking at a 5-year gaol sentence. We have no real free speech laws (there is common law about it but that can be overridden by legislation). There is freedom of political speech, but that's a much weaker bar. Funnily enough, parliament has actual freedom of speech.
playpause 8y ago
The second sentence of this comment is the only one that matters, unfortunately.
- brongondwana 8y ago
  Yeah, I know - that's pretty much what we said. There's no way to distinguish between the two as an outsider. We're really strong on not doing security theatre nonsense: https://fastmail.blog/2017/12/05/the-fastmail-security-mindset/ https://fastmail.blog/2017/12/05/the-fastmail-security-minds... So we're not trying to pretend anything about the legal framework - when we said "nothing will change" up front, we meant it - and when we say "nothing has changed" now, we also mean it. But we can't pretend that we couldn't be forced to say that if things had changed either, because that would be dishonest.
tomputer 8y ago
I was wondering, with these new laws, did FastMail consider to operate (partly) in other countries? For example if FastMail has servers in Amsterdam (NL). Would it be possible to let customers decide on which servers they want to host their mail, so that it falls under the local (or EU) laws? Thank you in advance for taking the time to reply here.
- mercer 8y ago
  With the caveat that I'm far from an expert in this domain, as I understand it FastMail would have to comply with the laws of the country they're based in, as well as any country they'd have as customer or hosting provider. I imagine the only solution is to move the entire company to another country, but I'd very much like to hear from people who do know what they're talking about.
- brongondwana 8y ago
  Unfortunately "mercer" below is right - we need to comply with the laws of Australia regardless of where our servers are. The "Amsterdam server" idea is a red herring that doesn't change the legal landscape.
ddebernardy 8y ago
> The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth. Why not report the opposite on a regular basis? "We're happy to report that we haven't been forced by authorities to implement a backdoor in our systems." That way, when you stop writing that every week or month or what have you, everyone paying attention will know you've been forced to add a backdoor and might be gagged.
- hugh-avherald 8y ago
  If you regularly report "We don't do X" and then cease reporting, it's equivalent to saying "We're now doing X".
- kdtsh 8y ago
  Warrant canaries are unfortunately illegal in Australia in this context [1]. [1] https://boingboing.net/2015/03/26/australia-outlaws-warrant-cana.html https://boingboing.net/2015/03/26/australia-outlaws-warrant-...
  - cyphar 8y ago
    They are illegal, but you're posting the wrong link (that's about journalist warrants). The legislation in question explicitly states that you cannot comment on the existence or nonexistence of a TCN, TAN, or TAR.
cyphar 8y ago
> Right now we haven't received any capability requests (TCN) which is the bit we're concerned about I would be INCREDIBLY cautious about making statements like that. The penalty for discussing the existence or nonexistence of a notice under the new legislation is 5 years imprisonment. You can give 6-month statistical information, but you should have stated it that way if that's what you were doing. I really, honestly hope you spoke with your legal council before making statements like that (I personally will not make statements like that until I get legal advice about how it should be stated to avoid a 5-year conviction).

We haven't been forced to add anything. The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers,

larkeith 8y ago

Given that you're able to inform us currently that you've not received any capability requests, would it be legal and feasible for you to set up a warrant canary? I don't know if Australia has the same protections against compelled speech as the US [1, 2] which theoretically allow one to function, but if so, it might help encourage people to stay. [1] https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of_Education_v._Barnette https://en.m.wikipedia.org/wiki/West_Virginia_State_Board_of... [2] https://en.m.wikipedia.org/wiki/Wooley_v._Maynard https://en.m.wikipedia.org/wiki/Wooley_v._Maynard

cyphar 8y ago
Warrant canaries are explicitly disallowed under this legislation (you cannot comment on the existence or non-existence of a notice and there are strong restrictions on what sort of statistics you can provide). In fact, I'm a little worried that they just said they have received no TCNs -- while you can provide aggregate statistical information over a 6-month window, if you get it wrong you're looking at a 5-year gaol sentence. We have no real free speech laws (there is common law about it but that can be overridden by legislation). There is freedom of political speech, but that's a much weaker bar. Funnily enough, parliament has actual freedom of speech.

playpause 8y ago

The second sentence of this comment is the only one that matters, unfortunately.

brongondwana 8y ago
Yeah, I know - that's pretty much what we said. There's no way to distinguish between the two as an outsider. We're really strong on not doing security theatre nonsense: https://fastmail.blog/2017/12/05/the-fastmail-security-mindset/ https://fastmail.blog/2017/12/05/the-fastmail-security-minds... So we're not trying to pretend anything about the legal framework - when we said "nothing will change" up front, we meant it - and when we say "nothing has changed" now, we also mean it. But we can't pretend that we couldn't be forced to say that if things had changed either, because that would be dishonest.

tomputer 8y ago

I was wondering, with these new laws, did FastMail consider to operate (partly) in other countries? For example if FastMail has servers in Amsterdam (NL). Would it be possible to let customers decide on which servers they want to host their mail, so that it falls under the local (or EU) laws? Thank you in advance for taking the time to reply here.

mercer 8y ago
With the caveat that I'm far from an expert in this domain, as I understand it FastMail would have to comply with the laws of the country they're based in, as well as any country they'd have as customer or hosting provider. I imagine the only solution is to move the entire company to another country, but I'd very much like to hear from people who do know what they're talking about.
brongondwana 8y ago
Unfortunately "mercer" below is right - we need to comply with the laws of Australia regardless of where our servers are. The "Amsterdam server" idea is a red herring that doesn't change the legal landscape.

ddebernardy 8y ago

> The problem is that if the law says that we __could__ be forced to add something and not allowed to tell our customers, then there's no way for somebody to tell if we're telling the truth. Why not report the opposite on a regular basis? "We're happy to report that we haven't been forced by authorities to implement a backdoor in our systems." That way, when you stop writing that every week or month or what have you, everyone paying attention will know you've been forced to add a backdoor and might be gagged.

hugh-avherald 8y ago
If you regularly report "We don't do X" and then cease reporting, it's equivalent to saying "We're now doing X".
kdtsh 8y ago
Warrant canaries are unfortunately illegal in Australia in this context [1]. [1] https://boingboing.net/2015/03/26/australia-outlaws-warrant-cana.html https://boingboing.net/2015/03/26/australia-outlaws-warrant-...
- cyphar 8y ago
  They are illegal, but you're posting the wrong link (that's about journalist warrants). The legislation in question explicitly states that you cannot comment on the existence or nonexistence of a TCN, TAN, or TAR.

cyphar 8y ago

> Right now we haven't received any capability requests (TCN) which is the bit we're concerned about I would be INCREDIBLY cautious about making statements like that. The penalty for discussing the existence or nonexistence of a notice under the new legislation is 5 years imprisonment. You can give 6-month statistical information, but you should have stated it that way if that's what you were doing. I really, honestly hope you spoke with your legal council before making statements like that (I personally will not make statements like that until I get legal advice about how it should be stated to avoid a 5-year conviction).