3 ms·

>We follow due process when dealing with law enforcement, providing individual data in response to the appropriate Australian warrant, so there is no justificat

by na85 12y ago

>We follow due process when dealing with law enforcement, providing individual data in response to the appropriate Australian warrant, so there is no justification to attempt wholesale surveillance of all our users. Except if Fastmail can decrypt user's data, then they can be compelled to backdoor their system, and also compelled to keep it quiet. Australia is part of the "5 eyes", after all, and from an outsider perspective their government seems particularly hostile/authoritarian. Failing that legal avenue, would Australia's intelligence services refuse to simply hack their way into Fastmail's servers if the NSA asked them to? Would the NSA refuse to just do it themselves, if it came to that? Surely not. The president (or whomever) of NYI would certainly not refuse entry to federal agents wanting to install an implant. NYI just has to report an outage, meanwhile Fastmail's servers have grown a new rootkit. And failing that, then it's time to bribe a security guard in the middle of the night. To me this reads as nothing more than Fastmail trying to provide a false sense of security.

dangerlibrary 12y ago
At least they don't decrypt and read your email as part of their business model.
brongondwana 12y ago
It is impossible to run an email service without being able to decrypt data. You can search your entire email archive in seconds, from a phone on the end of a slow network, and it just works. End-to-end encryption isn't compatible with the way people want to use email. We are happy for people to use PGP, though of course we don't offer an interface to it because that would involve sharing keys with us and defeat the purpose. We've addressed the legal framework we work in in the linked blogpost, and addressed precisely the scenario you lay out. Governments change, and they love to posture, but the reality is the laws, not the soundbytes. We would be aware of the outage - have you seen how reliable NYI are? http://blog.fastmail.com/2014/12/10/security-availability/ http://blog.fastmail.com/2014/12/10/security-availability/ They don't have outages. I'm much more worried about the NSA (or any of http://en.wikipedia.org/wiki/List_of_intelligence_agencies http://en.wikipedia.org/wiki/List_of_intelligence_agencies) knowing of a hole in one of the pieces of software that we use and injecting a rootkit with that. Thankfully the same security practices that defend against hackers are also useful here.
- alfiedotwtf 12y ago
  To add to this, and this needs to be emphasised, is that we make it clear to anybody requesting data that there are legal channels with due process to go through which work. See the following for more info - http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in-the-us-what-this-means-for-you/ http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in...
  - sasas 12y ago
    https://www.youtube.com/watch?v=srk9c4rOgZ4 https://www.youtube.com/watch?v=srk9c4rOgZ4 Pretty scary isn't it?
    - hellbanner 12y ago
      Yes. Thanks for sharing this video. The minister refused to answer the guys question, just said "We collect what we need to do to our job, and stop asking this question."
    - ownagefool 12y ago
      One wonders if he's too stupid to understand the question, doesn't know the answer but can't be seen to not be answering, or if he's just trying to keep the options open. All of the above are scary. But this is not without precedence. The UK chancellor couldn't even answer which tax greggs should be paying.
- na85 12y ago
  >It is impossible to run an email service without being able to decrypt data. Counterpoint: seems to me that protonmail is doing exactly that. >We've addressed the legal framework we work in in the linked blogpost, and addressed precisely the scenario you lay out. Governments change, and they love to posture, but the reality is the laws, not the soundbytes. You haven't addressed any of the points I initially raised. Your blog post skirts the issue quite handily. >They don't have outages. Anyone claiming 100% uptime are fraudsters.
  - 12y ago
rayiner 12y ago
> Except if Fastmail can decrypt user's data, then they can be compelled to backdoor their system, and also compelled to keep it quiet. Australia is part of the "5 eyes", after all, and from an outsider perspective their government seems particularly hostile/authoritarian. If you don't expect the government to follow any rules, then most of these discussions are moot. But what we've been seeing with the Snowden leaks is that the governments are at least attempting to walk the tightrope of legality. Here in the U.S., that means having at least plausible procedures to filter out non-foreigner communications, and going through legal processes like subpoenas instead of simply breaking into computer systems. These facts have practical concerns. Unless you hypothesize that the U.S. and Australia are putting citizens in prison using secret courts, the government still has to present evidence in a court proceeding, and that has to comport with the 4th amendment in the U.S., and whatever the equivalent is in Australia. The law in this area is rapidly evolving, but in my opinion as someone with both a legal and technical background, encryption like what Fastmail has gives 4th amendment arguments a lot more teeth. When your data is in an e-mail service that's readily accessible to the service provider, or even data-mined for advertising purposes, it's susceptible to the charge that it's not private information, because after all you're allowing someone else to rummage through it. But if there are protections in place, even if they can be circumvented if needed, that's different. Now you're talking about something that's more like a safe deposit box at a bank or a rented storage unit, which do have 4th amendment protection. They're locked, and only the owner accesses what's inside as a matter of course. The lock can be broken, in an emergency, but that doesn't change the fact that the owner of the facility does not access the contents as a matter of course.
- sinak 12y ago
  > Unless you hypothesize that the U.S. and Australia are putting citizens in prison using secret courts, the government still has to present evidence in a court proceeding, and that has to comport with the 4th amendment in the U.S., and whatever the equivalent is in Australia. rayiner, how about the reports of "parallel construction" by the NSA? While it's true that the government still has to present evidence in a court, according to recent reports [1] the NSA "tips off" organizations like the DEA. 1 - http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05/the-nsa-is-giving-your-phone-records-to-the-dea-and-the-dea-is-covering-it-up/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05...

by na85 12y ago

dangerlibrary 12y ago

At least they don't decrypt and read your email as part of their business model.

brongondwana 12y ago

It is impossible to run an email service without being able to decrypt data. You can search your entire email archive in seconds, from a phone on the end of a slow network, and it just works. End-to-end encryption isn't compatible with the way people want to use email. We are happy for people to use PGP, though of course we don't offer an interface to it because that would involve sharing keys with us and defeat the purpose. We've addressed the legal framework we work in in the linked blogpost, and addressed precisely the scenario you lay out. Governments change, and they love to posture, but the reality is the laws, not the soundbytes. We would be aware of the outage - have you seen how reliable NYI are? http://blog.fastmail.com/2014/12/10/security-availability/ http://blog.fastmail.com/2014/12/10/security-availability/ They don't have outages. I'm much more worried about the NSA (or any of http://en.wikipedia.org/wiki/List_of_intelligence_agencies http://en.wikipedia.org/wiki/List_of_intelligence_agencies) knowing of a hole in one of the pieces of software that we use and injecting a rootkit with that. Thankfully the same security practices that defend against hackers are also useful here.

alfiedotwtf 12y ago
To add to this, and this needs to be emphasised, is that we make it clear to anybody requesting data that there are legal channels with due process to go through which work. See the following for more info - http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in-the-us-what-this-means-for-you/ http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in...
- sasas 12y ago
  https://www.youtube.com/watch?v=srk9c4rOgZ4 https://www.youtube.com/watch?v=srk9c4rOgZ4 Pretty scary isn't it?
  - hellbanner 12y ago
    Yes. Thanks for sharing this video. The minister refused to answer the guys question, just said "We collect what we need to do to our job, and stop asking this question."
  - ownagefool 12y ago
    One wonders if he's too stupid to understand the question, doesn't know the answer but can't be seen to not be answering, or if he's just trying to keep the options open. All of the above are scary. But this is not without precedence. The UK chancellor couldn't even answer which tax greggs should be paying.
na85 12y ago
>It is impossible to run an email service without being able to decrypt data. Counterpoint: seems to me that protonmail is doing exactly that. >We've addressed the legal framework we work in in the linked blogpost, and addressed precisely the scenario you lay out. Governments change, and they love to posture, but the reality is the laws, not the soundbytes. You haven't addressed any of the points I initially raised. Your blog post skirts the issue quite handily. >They don't have outages. Anyone claiming 100% uptime are fraudsters.
- 12y ago

rayiner 12y ago

> Except if Fastmail can decrypt user's data, then they can be compelled to backdoor their system, and also compelled to keep it quiet. Australia is part of the "5 eyes", after all, and from an outsider perspective their government seems particularly hostile/authoritarian. If you don't expect the government to follow any rules, then most of these discussions are moot. But what we've been seeing with the Snowden leaks is that the governments are at least attempting to walk the tightrope of legality. Here in the U.S., that means having at least plausible procedures to filter out non-foreigner communications, and going through legal processes like subpoenas instead of simply breaking into computer systems. These facts have practical concerns. Unless you hypothesize that the U.S. and Australia are putting citizens in prison using secret courts, the government still has to present evidence in a court proceeding, and that has to comport with the 4th amendment in the U.S., and whatever the equivalent is in Australia. The law in this area is rapidly evolving, but in my opinion as someone with both a legal and technical background, encryption like what Fastmail has gives 4th amendment arguments a lot more teeth. When your data is in an e-mail service that's readily accessible to the service provider, or even data-mined for advertising purposes, it's susceptible to the charge that it's not private information, because after all you're allowing someone else to rummage through it. But if there are protections in place, even if they can be circumvented if needed, that's different. Now you're talking about something that's more like a safe deposit box at a bank or a rented storage unit, which do have 4th amendment protection. They're locked, and only the owner accesses what's inside as a matter of course. The lock can be broken, in an emergency, but that doesn't change the fact that the owner of the facility does not access the contents as a matter of course.

sinak 12y ago
> Unless you hypothesize that the U.S. and Australia are putting citizens in prison using secret courts, the government still has to present evidence in a court proceeding, and that has to comport with the 4th amendment in the U.S., and whatever the equivalent is in Australia. rayiner, how about the reports of "parallel construction" by the NSA? While it's true that the government still has to present evidence in a court, according to recent reports [1] the NSA "tips off" organizations like the DEA. 1 - http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05/the-nsa-is-giving-your-phone-records-to-the-dea-and-the-dea-is-covering-it-up/ http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/05...