I understand the concern over the law in general, but I don't agree with the sentiments about email in particular. Email is not and should not be considered completely secure, so if that is a need, something else should be used. In my opinion, the Australian law does not make it any more insecure or less private -- everything that could have been obtained via warrant prior to the law's passage is the same data that is accessible with it. If that's a concern, set up your email in a different jurisdiction.
I am currently a FastMail customer because I like the product, and this does not make me think I need to move. Unless something else changes, I'll keep it where it is.
For what it’s worth, email is not a private protocol/platform - some degree of encryption-at-rest and privacy-respecting SOPs can give services like Fastmail a fairly good screen against private malicious actors, but you should never count on email as a means of communication to have any decent way of protecting you from state surveillance, especially when you live under the jurisdiction of the state surveilling you.
Though that’s not to say that we should accept these laws as they apply to email services lying down. Any reason to refuse to use the services of Australian companies when foreign services of similar quality exist gives those Australian companies all the more reason to press the government to reform these laws on the grounds that they’re losing valuable business for negligible gain to national interest. If the government doesn’t listen to individual constituents, it might listen to companies which are hurting in their back pockets.
Fastmail rightly points out that the Australian law has no meaningful impact on them. They do not offer an end-to-end encrypted service, and hence, don't need to backdoor it.
The vast majority of mail services will hand your data to the government on court order. Though if your mail is hosted in a different country than you live in, it's arguably more frustrating for them to do so, since they must use international agreements to get it.
If state ordered surveillance is in your threat model, you need a very different type of mail service than almost everyone else.
tl;dr: The law passed doesn't affect FastMail at all, and your data is at least as private with FastMail as it is with Gmail, which also responds to lawful government requests for your data.
As far as I can tell, it changes nothing, assuming that your email was sent as plain text. Although Fastmail stores your email on encrypted disks [1], it of course has the encryption keys for these disks. Even before the new law, they would have been subject to any Australian search warrant requiring that they hand over your email, and would not have had any technical reason for not complying.
In general, unless you and your correspondents are using PGP or some such, your email is readable by anyone who can obtain a search warrant in the country where your email provider resides. (Protonmail may or may not be an exception [2]).
So let me see if I have this right - Fastmail will give the Australian government access to your private correspondence, but only if said government proves to Fastmail that you've been involved in a crime?
So their default position is to give access - with checks and balances, but still to give access.
Why must the default be that governments get access? That's NEVER gone well in the past, why should now be any different?
Thanks for reaching out to us about the recent bill in Australia. We love that our customers care about their digital rights and want to find out more about how companies are looking after their information.
The police can't intercept, access or modify your messages without us receiving a warrant, and we take our duty of care seriously. Fastmail responds to well formed warrants only and challenges requests for access that are inappropriate, either in scope (not adequately targeted), or depth (asking for information that seems out of proportion to what's being investigated). We will continue to do so, for any legislation that applies to us both now and in the future.
The new bill still doesn't allow 'trawling' for suspicious data: they can't request access to a wide variety of accounts hoping they'll come across something of interest. They need to have a particular account under suspicion and something that gives them grounds for that suspicion, and the offence in question needs to be suitably severe to be worth the intrusion.
Where we are permitted under a warrant, we will notify the accountholder of the access request, and due to our existing measures to help customers stay aware of any hackers compromising their account, police can't also enter your account without leaving evidence you can see.
What this means for you: Fastmail remains a privacy-first provider. We will comply with our legislated duties, while taking care to ensure that we do not act unless compelled by law and that all legislated preconditions have been properly satisfied. Your data remains under your control and you can rest comfortably knowing that your account won't get caught up in a surveillance net.
This is exactly the right perspective. If the US has secret warrants in the form of NSL (National Security Letters) or similar, it's easy to imagine Australia having precisely the same thing. I've enjoyed being a user of fastmail for some time but I'll be switching to one of the new projects (e.g., LEAP) or self-hosting in the future.
I have heard back from our privacy team and I’d love to share their responce to your query:
Thanks for reaching out to us about the recent bill in Australia. We love that our customers care about their digital rights and want to find out more about how companies are looking after their information.
Your data is held in datacentres in the US, but we require all requests for access to customer content to be served through Australia where our company is headquartered.
The police can't intercept, access or modify your messages without us receiving a warrant, and we take our duty of care seriously. Fastmail responds to well formed warrants only and challenges requests for access that are inappropriate, either in scope (not adequately targeted), or depth (asking for information that seems out of proportion to what's being investigated). We will continue to do so, for any legislation that applies to us both now and in the future.
The new bill still doesn't allow 'trawling' for suspicious data: they can't request access to a wide variety of accounts hoping they'll come across something of interest. They need to have a particular account under suspicion and something that gives them grounds for that suspicion, and the offence in question needs to be suitably severe to be worth the intrusion.
Where we are permitted under a warrant, we will notify the accountholder of the access request, and due to our existing measures to help customers stay aware of any hackers compromising their account, police can't also enter your account without leaving evidence you can see.
What this means for you: Fastmail remains a privacy-first provider. We will comply with our legislated duties, while taking care to ensure that we do not act unless compelled by law and that all legislated preconditions have been properly satisfied. Your data remains under your control and you can rest comfortably knowing that your account won't get caught up in a surveillance net.
Please let me know if you have any other questions.
Sincerely,
The hubbub about the article there is FUD, particularly when it comes to FastMail. Since FastMail isn't an end-to-end encrypted service (Gmail isn't either), laws about thwarting encryption are entirely irrelevant: Both must respond to a legal government order for your information. Google responds to many tens of thousands of these requests yearly: https://transparencyreport.google.com/user-data/overview?t=t...
If you are not Australian, the likelihood of getting your data subpoena'd from an Australian company is pretty low. If you're in the US, it's far more likely for your Gmail data to be successfully subpoena'd.
Unless you belong to a fairly narrow set of people, the risk of government access to your data is relatively low. Meanwhile, the threat of advertiser access to your data is high for everyone: Don't trust an ad company with your data, even if they currently say they won't use it for ads.
> I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to.
Nobody is arguing against search warrants. People are concerned about warrantless searches.
Australian here. The law passed on Thursday is a massive concern, but in the case of an email provider there isn't as much of a change from what they could already do (TCNs aren't necessary -- they fundamentally already have collection capability unless you are using PGP for everything).
However there are some other worrying changes like the fact that TANs and TARs are secret and have no judicial review. Warrants (even the new computer access warrants that were passed in the same bill) have judicial review. But at the end of the day, they'd be serving a warrant to fastmail, not you.
Personally I use mailbox.org, and one of the really nice features is that you can give them a PGP public key and they'll encrypt everything you receive. So in the case of a warrant (though Germany has different laws on that matter) they could, at most, get the contents of new emails.
> "We're advocating for privacy, but we aren't going to try to offer you any."
Your tl;dr is not quite accurate.
All companies, including FastMail, have to cooperate with local law enforcement. But there are different levels of cooperation. FastMail's level of cooperation, according to TFA, is, "Show us a valid warrant, and we'll show you exactly what you asked for, nothing more".
Certain other companies might be more cooperative, handing over user information in response to informal (warrantless) police queries, or handing over information to copyright-enforcement lawyers who write threatening (but not legally enforceable) letters, or handing over more information than is specified in a warrant. (I can't remember specific examples, but they get mentioned on HN now and then).
So FastMail is stating it will try to limit privacy violations as much as it can, without violating Australian law. This is not total privacy, but neither is it the same as "we aren't going to try to offer you any".
(Not affiliated in any way with FastMail, not even as a user)
However I would remind you that since Fastmail is based in Australia, its privacy is pretty limited.
> The new law also allows officials to approach specific individuals—such as key employees within a company—with these demands, rather than the institution itself. In practice, they can force the engineer or IT administrator in charge of vetting and pushing out a product's updates to undermine its security. In some situations, the government could even compel the individual or a small group of people to carry this out in secret. Under the Australian law, companies that fail or refuse to comply with these orders will face fines up to about $7.3 million. Individuals who resist could face prison time.
I'm sure that Australian Federal Police and Victoria law enforcement would be able to exercise search warrants on Fastmail's servers if they needed to.
Since you're in Tennessee (and thus a U.S. Person), you're actually ineligible for collection under FAA 702. Gmail/Hotmail/Yahoo, etc. would actually be the safest place for your information.
Of course that assumes that you believe the NSA follows U.S. law. If you don't have that assumption, that also implies that the NSA wouldn't respect Australian sovereignty enough to keep it from infiltrating Fastmail's servers.
I'm saying this to illustrate that there's no silver bullet for secure transmission and storage of information.
> Except if Fastmail can decrypt user's data, then they can be compelled to backdoor their system, and also compelled to keep it quiet. Australia is part of the "5 eyes", after all, and from an outsider perspective their government seems particularly hostile/authoritarian.
If you don't expect the government to follow any rules, then most of these discussions are moot. But what we've been seeing with the Snowden leaks is that the governments are at least attempting to walk the tightrope of legality. Here in the U.S., that means having at least plausible procedures to filter out non-foreigner communications, and going through legal processes like subpoenas instead of simply breaking into computer systems.
These facts have practical concerns. Unless you hypothesize that the U.S. and Australia are putting citizens in prison using secret courts, the government still has to present evidence in a court proceeding, and that has to comport with the 4th amendment in the U.S., and whatever the equivalent is in Australia.
The law in this area is rapidly evolving, but in my opinion as someone with both a legal and technical background, encryption like what Fastmail has gives 4th amendment arguments a lot more teeth. When your data is in an e-mail service that's readily accessible to the service provider, or even data-mined for advertising purposes, it's susceptible to the charge that it's not private information, because after all you're allowing someone else to rummage through it. But if there are protections in place, even if they can be circumvented if needed, that's different. Now you're talking about something that's more like a safe deposit box at a bank or a rented storage unit, which do have 4th amendment protection. They're locked, and only the owner accesses what's inside as a matter of course. The lock can be broken, in an emergency, but that doesn't change the fact that the owner of the facility does not access the contents as a matter of course.
Why? Fastmail always complied with warrants to get your data, so nothing changes because if this law. If you want to hide something, encrypt your e-mails before they reach Fastmail (and do the same regardless of provider you use, why trust anyone?)
TCNs (which is the primary thing this article is about) won't practically affect email providers, because email providers already have your plaintext emails -- they don't need to implement new capabilities to intercept them. (As an aside, I use Mailbox.org which has a feature to auto-encrypt incoming emails to a PGP public key -- which means that only new emails would be usable with interception.)
However there is now a no-warrant-required method of getting information (in the form of TANs and TARs) which has no judicial overview -- previously they would've needed a warrant. This is definitely a massive concern, but given that you wouldn't have seen a warrant previously (Fastmail would get it) this is not a practical difference to you (obviously it's a massive ethical difference and so on).
But to be honest, I actually hope people stop using Australian services and big companies start backing out of the Australian market. It's the only way our dropkick government will realise how much of an own-goal this legislation was.
The law has no privacy implications regarding FastMail: They always could, and had to, comply with legal orders for data. This is also true of Gmail and most other email providers. The primary difference here is that FastMail will only hand over your data in that scenario, but will never use your data for ad targeting or other corporate abuses of privacy.
ProtonMail and the like do more to protect you from the government, if that's your threat model, but you're going to lose out on a lot of features as well, because a lot of common expectations in email don't work with end-to-end encryption.
I like Fastmail, but as they are based in Australia, how do they address the A&A law[0] that requires companies to decrypt data when compelled by the government?
Edit: I found this response[1], which seems to boil down to: "we already were compelled by other laws, so nothing has fundamentally changed"
I am currently a FastMail customer because I like the product, and this does not make me think I need to move. Unless something else changes, I'll keep it where it is.
reply