2 ms·

Given that the email is encrypted, the FRA laws don't really matter though, right? The question is rather if the Swedish authorities can coerce them into handi

by alipang 13y ago

Given that the email is encrypted, the FRA laws don't really matter though, right? The question is rather if the Swedish authorities can coerce them into handing over their data (including gagging them on even letting people know it happened) like in the US.

grey-area 13y ago
The question is rather if the Swedish authorities can coerce them into handing over their data I don't think there's any question that a sovereign government can coerce its citizens and corporations into handing over data. The answer to that is that yes they can, and if they cite national security it's hard to argue against them in court, or you might never be allowed to see a court, or even know about it. Depending on where the encryption happens, obviously if the company is compromised your data might be too. In this case they get you to install a java applet which you can't know the workings of, so I think it'd be pretty easy to subvert the encryption. So I see the cooperation of Sweden on collecting and handing over data as in indicator that they would go farther if required by the NSA (as the UK would for example), and that other jurisdictions less subservient to the US would be a better place to store data.
baudehlo 13y ago
PGP encrypts the body of the email. It leaves the metadata as-is. There's a surprising amount of information in there - the subject, to/from, IP addresses, DKIM signing information, References headers, etc. This would likely be enough information for a lot of the metadata path discovery that the government wants to do.
cb474 13y ago
For what it's worth, Countermail claims that under Swedish law this cannot be done. "The privacy laws in Sweden are much different than US and UK and many other countries, nobody can force us to store passwords, IP-addresses or decryption keys." https://support.countermail.com/kb/faq.php?id=74 https://support.countermail.com/kb/faq.php?id=74

by alipang 13y ago

grey-area 13y ago

The question is rather if the Swedish authorities can coerce them into handing over their data I don't think there's any question that a sovereign government can coerce its citizens and corporations into handing over data. The answer to that is that yes they can, and if they cite national security it's hard to argue against them in court, or you might never be allowed to see a court, or even know about it. Depending on where the encryption happens, obviously if the company is compromised your data might be too. In this case they get you to install a java applet which you can't know the workings of, so I think it'd be pretty easy to subvert the encryption. So I see the cooperation of Sweden on collecting and handing over data as in indicator that they would go farther if required by the NSA (as the UK would for example), and that other jurisdictions less subservient to the US would be a better place to store data.

baudehlo 13y ago

PGP encrypts the body of the email. It leaves the metadata as-is. There's a surprising amount of information in there - the subject, to/from, IP addresses, DKIM signing information, References headers, etc. This would likely be enough information for a lot of the metadata path discovery that the government wants to do.

cb474 13y ago

For what it's worth, Countermail claims that under Swedish law this cannot be done. "The privacy laws in Sweden are much different than US and UK and many other countries, nobody can force us to store passwords, IP-addresses or decryption keys." https://support.countermail.com/kb/faq.php?id=74 https://support.countermail.com/kb/faq.php?id=74