Europe won’t save you: Why e-mail is probably safer in the US
arstechnica.com
arstechnica.com
No email service stands above the law. They have to provide data about about suspect criminals if there is a search warrant. This will even work internationally with the mentioned treaties and the suspect will not be notified about the search. Lavabit would have complied with such a request as well.
HOWEVER, this does NOT mean blanket surveillance of everyone, without any due process, court orders, or search warrants. And frankly, European data protection laws are supposed to prevent such blanket surveillance while the American government clearly does not.
Where your email is more secure depends entirely on where you live and what threat you're trying to protect against. As a Chinese political activist I would feel safest with Google. As someone with friends and family in the Middle East I would try to route my email around the US if at all possible.
Some secrecy is needed to avoid evidence going down the toilet. This model strikes a decent balance, I think.
As such it's more of a political association than a telecom company, which at least in theory ought to give it the highest degree of protection under US law.
If you think email providers should be entitled to the same level of protection, okay. That's a sensible change to suggest. I don't see what good you think can come of obviously apolitical email providers pretending they are political organizations to get additional benefits. That's a "let's pretend we're a church so we don't have to pay any taxes!" level idea.
I wonder why we havent heard major political parties in EU countries them setting up their email/communications-equipment/networks/services inside their parliament buildings, or even just re-checking their current security standards.
"We would rather pull the plug than submit to repressive surveillance by our government"
Processing, processing, processing... Warning! Internal consistency error detected.
But that was true in 2012 as well. The problem now, as it was then, is that people have chosen and they are quite willing to trade some privacy for cost and convenience.
The rise of mobile is only further accelerating that trend, and the lack of really good open source (or even commercial) PIM is not helping matters either. There's a reason people are switching to GMail instead of sticking with their existing free email through their own ISP, after all.
No they haven't. Most people haven't made this trade-off at all, they just "use e-mail".
> As soon as it crosses international boundaries (even,
> apparently, virtual boundaries) it's fair game legally for
> the NSA to grab if they can.
For example, watch a documentary on Iraq war you will find that the US, French, British and German intels were exchanging information.
Why, what did you think they were doing?
Even beyond that I have assumed that Internet communications of mine that are unencrypted are likely to be read by botnets, Internet-based organized crime, spammers, and a host of other unsavory characters that I really don't need snooping in my bidness. I have assumed this ever since reading Schneier back in 2001 or thereabouts and making my first GPG key.
As Anon has been so fond of reminding us, "The Internet Never Forgets", and I remember that every time I use the Internet.
Fixed that for you. I don't like the way the article implicitly assumes an American audience, and so do the comments here. As a European, my email is certainly not safer in the US than in Europe.
Yes, as a European your email is always at theoretical risk of interception by NSA if it transits U.S. borders.
Although even there the law is murky; foreigners don't lose property rights just because they visit the U.S. for instance, and the Fourth Amendment applies to foreigners within the boundaries of the U.S.
So if you host your email on your own hardware, within the U.S., it's not as if the government has the authority to go rip your server off the shelves without a warrant. They can intercept your traffic between your home in Europe and the server in the U.S., but that's why we have encryption, you should always have been assuming people are snooping that anyways.
On the other hand hosting email abroad from your home nation may put you at risk of European intelligence agencies warrantlessly intercepting them (even the German BND appears to have that legal authority), so I suppose that's a risk factor you'll have to balance on your own.
Seems way more in the federated spirit of email than just using pgp.mit.edu.
Up and running in minutes, mostly limited by the download rate to install the required packages. Run that on a (old/small if you want) machine with full-disk encryption. You're mostly there for 'normal use'.
I really think this is possible for regular users, if provided in a simple way. A 'one click to set up your mailserver' thing (or maybe ArkOS etc.).
The country's laws come second when YOU are in control of the machine in question (and on a side note: I'm pretty sure the laws in German are much better if you're talking about your private service instead of a commercial service that you're offering similar to an ISP).
Even if such laws are passed within the European union, there still are countries outside of EU that have reasonable laws on freedom of speech.
Misleading headline. If option B is equally as bad as A, then how does that exclude C, or even recommend A again?
The problems we have with e-mail are due to e-mail itself. Traditional E-mail (whether it's delivered over SMTP/TCP/IP or UUCP or whatever) was not designed with privacy in mind. As hackers, tinkerers and makers we need to design and develop more resilient communications systems in the wake of this and clearly define what it is that we're protecting them from. Trying to find a country in which it's marginally safer to host a standard e-mail system in which there's no encryption is a bit like re-arranging deck chairs on the titanic.
I'm hoping (if my submission is accepted) to discuss this in more detail at 30C3 and Securi-Tay 3 in December and January, and provide a proof of concept that shows some ideas on how we can address specific threats.
For instance, I'm fairly certain that Sweden will do anything the US demands to not upset the big brother.
Oh wait, the NSA/CIA/military has their own private space shuttle (seriously)
> Lavabit’s own privacy policy at the time that Snowden was believed to have been using it stated that “premium users” would benefit from having their e-mail secured with “an asymmetric encryption process that guarantees that it can’t be accessed by anyone except the holder of the account password. For these accounts, only the encrypted version of the message is ever saved to disk.”
Except, of course, that lavabit is still the only party that controls the code that reads and writes your password, and has the power to replace that code without telling you. Furthermore it doesn't work at all unlesss it's connected to the internet. Updating lavabit's servers to send the password to your mails the first time you access them would be trivial, and well within the powers of the NSA/FBI/...
More importantly, though it's obvious to anyone who thinks about how "encrypted" mail works, many people(possibly including Lavabit's founder ... it appears he asserted to the fed's he couldn't give them envelope information) assumed encrypted meant nothing can be handed over ever, even with a court order.