Deutsche Telekom, Web.de and GMX launch "E-mail made in Germany" initiative

Also there is Quellen-TKÜ, which means that every single one of the three gives access to their servers to German law enforcement. If I remember correctly, the Quellen-TKÜ law says that any online service provider that has more than X users (10k?) has to provide access to law enforcement in such a way that the provider operators themselves don't know about the individuall access operations.

De-Mail is another thing which was introduced some years ago now. In short: Messages are encrypted on the client side, then decrypted on the server, then again encrypted and sent to the recipient where it is decrypted again...Imagine your post-office opening you mail before forwarding it to the recipient. Along with some other things no sane person would ever suggest to do with email, De-Mail is a complete farce...

TL;DR: I'm from Germany, and my opinion is that this is the most brutal kind of PR bullshit you can get...

"The Americans provided the BfV with one of their most productive spying tools, a system called "XKeyscore." It's the same surveillance program that the NSA uses to capture a large share of the up to 500 million data sets from Germany, to which it has access each month, according to internal documents seen and reported on by SPIEGEL on the first of this month."

How is this anything but propaganda?

[1] http://www.spiegel.de/international/world/german-intelligenc...

It seems that there are enough idiots in the world who are willing to reelect that treacherous pile of smelly shit impersonating a federal government at the moment.

That's the most significant part of this announcement-- it means there's finally a push to phase out plaintext email transport, which allows passive surveillance to intercept mail.

A lot of ifs that need to be answered. But this could be a good thing.

I'm increasingly tempted to throw that switch myself, or at least start filtering all my non-TLS'd mail into a special mailbox of "figure out if I actually care if these people become unreachable in 6mo when I actually enforce TLS." Arguably it would be worse to accept the message and then bounce it, since you'd have received the text in the clear, but maybe log and send an informative-to-end-user rejection notice based on envelope, and to me?

Oops. Huge national security fail.

They haven’t said much publicly, but behind closed doors they're scrambling to figure out how to get their pants back up.

This is only the very beginning of a huge shift that most of the US is blind to or in denial about.

All around the world, in government offices and in business board rooms, leaders are trying to figure out how to get off the US cloud.

The US cloud has been compromised and that trust just isn't coming back.

The barrier now is not political will, but a lack of local tech talent that can build viable alternatives to the US cloud services.

Many countries are kicking themselves now for not growing/poaching tech talent more aggressively.

Interesting times when having good web developers is a big national security asset.

You'll see the more tech rich countries move first. It's no surprise Germany's a first mover here.

Of course, with any big disruption there will be winners and losers.

Who the losers will be is obvious - US cloud companies.

Sure, they'll still have the US market (which is huge), but international markets will start drying up.

Skeptical? Google is hearing a huge sucking sound of money evaporating from Germany right now. Google's so big, they may not notice a few million yet, but I assure you, they will notice eventually. Karmic justice for short-sightedness in not out-lobbying the big defense contractors in Congress.

What's comical is how cheap it would be to out-lobby the defense contractors: http://www.opensecrets.org/industries/indus.php?Ind=D

The top contributing defense contractor (Northrop Grumman) only gave about $3 million last year. I'm sure they paid more than that for actual lobbyists, etc, but it's still not even petty cash at Google.

Of course, I don't mean to pick only on Google. There are many multi-multi-billion dollar cloud companies in the US that have been easily out-lobbied by the defense industry.

It would have been pennies compared to what they'll ultimately lose in the drying-up international markets.

So, who will be the winners? While security companies will see a boon, it's the open source companies that I think will see the biggest win.

With open, auditable code, countries can set up their own services. Of course, they'll need support and training and that's where the open source companies really shine.

It's important to remember that the goal for these countries will rarely be fool-proof privacy for each individual citizen. Instead, the goal is to prevent a foreign power from having deep intimate access to every detail of your populace.

Granted, many of these countries will use this transition to just spy on their own citizens. However, other countries will have a good functioning democracy and a citizenry that values privacy and will avoid those abuses.

For those countries that have robust protections and engender international trust, they'll have a big business advantage when it comes to foreign consumers.

  > Data are encrypted directly by the provider, ...

  > automatically encrypt data over all transmission paths

However, there's a good reason for German citizens to prefer German services: it takes money away from American service. Money is the only voice that will ever fix this.

So I ask every non-US citizen: please, take your money elsewhere. Please.

Heck, if they could they would even charge extra for it.

and the uk will revert to OSI based email using dialcom software - "just don't tell anyone about the Level 7 accounts"

In other words this whole debate about security will pass and 95% of people will forget or become ignorant so unless they create a service people actually want to use this is just a waste of money.

From my experience gmx totally don't get it and if you become their user they will eventually piss you off to the point when you will run towards NSA just to use something like gmail.

Not sure how this is the solution. People need to learn how to do encryption themselves. For the average John Doe (or Hans Wurst :-)) there need to be tools to accomplish that without a degree in Math or CS.

I don't think provider-side encryption is a solution at all. Collecting vast amounts of meta data would still be possible.

They are a pretty crappy company in general (imo) but they got this right very early. And by got this right I mean that they are using it for marketing/sales. I mean yay SSL but German mail providers tend to be...meh

"I don't have a problem with a German judge in a German court, granting a search warrant with reasonable grounds where all checks and balances are in place. I do have a problem with secret courts with secret laws and gag orders hiding this kind of thing from the public."

Take it with a little salt anyways, there is always the possibility for American services to get Access on your Data for example if they had an Employee in any of the German companys.

Think about it. In the "De-Mail" system are all sender verified. Thats means that i can kick spammer easily out. Why would they decrypt it for scanning? Bingo! Surveillance.

But this is just that what i think. I have written an comment on there blog and i'm exited what they say.

Source: http://www.zeit.de/2013/33/nsa-spionage-industrie-profiteure

- Secure data storage in Germany as a reputable location

- Designation of secure e-mail addresses

Doesn't actually mean "secure".

I grew up in Michigan and well remember the demise of the auto-industry. They had a good thing going, and thought it could never end. People grew complacent.

There is no guarantee that American technology business will continue to dominate. Eric Schmidt's "you have no privacy" attitude was both arrogant and short-sighted. We've needlessly shot ourselves in the foot.