Court orders encrypted email biz Tutanota to build a backdoor in user's mailbox, founder says 'this is absurd'
- Reference: 1607461633
- News link: https://www.theregister.co.uk/2020/12/08/tutanota_backdoor_court_order/
- Source link:
Our friends at Heise [1]reported auf Deutsch that a court in Germany last month ordered Tutanota to help investigators monitor the contents of a user's encrypted mailbox. The site has until the end of the year to add functionality to perform this surveillance.
Such a peephole would destroy the unique selling point of Tutanota: it encrypts all data stored in people's mailboxes in such a way that it can't retrieve the contents [2]beyond some metadata . It also allows people to wrap their outgoing and incoming messages in end-to-end encryption that, again, Tutanota can't break.
Thus, the site can, say, provide the cops access to new incoming non-encrypted emails for a particular inbox but can't hand over its encrypted contents. We imagine Tutanota could alter its code to capture a copy of the user's password during login so that someone else can unlock it later, though it's not clear if the court order goes this far. In any case, if the user never logs in again, the mailbox contents will remain enciphered, and the court order can't be fulfilled.
Emails that are encrypted end-to-end in Tutanota cannot be decrypted by us
Heise reported Tutanota is considering challenging the order. Pfau today told us he's not taking the matter lying down despite being legally compelled to act in accordance with the order.
"According to the ruling of the Cologne Regional Court, we were obliged to release unencrypted incoming and outgoing emails from one mailbox," Pfau told The Register . "Emails that are encrypted end-to-end in Tutanota cannot be decrypted by us."
Pfau also added that in June the Hannover Regional Court [3]had struck down a lower district court's ruling that Tutanota was to be backdoored. While angry police workers reportedly threatened to attack Pfau, sending him menacing emails promising to abduct him from his home and throw him into "provisional detention" unless he obeyed their orders, the regional court dismissed the district court's ruling – leaving police powerless to follow through.
Will there be no end to govt attempts to break encryption? Hand over your data or the kiddies get it, threaten Five Eyes spies [4]READ MORE
Tutanota's successful legal argument at the time was that it did not qualify as a "provider of telecommunications services" within EU law. Pfau explained to The Register how the German police were attempting to counter that: "Although we are no longer a provider of telecommunications services, [they say] we would be involved in providing telecommunications services and must therefore still enable telecommunications and traffic data collection."
He added: "From our point of view – and German law experts agree with us – this is absurd."
In September, not long after Pfau's personal battles with police, [5]unidentified persons launched a series of DDoS attacks against Tutanota. Those attacks resulted in the email service going down for a while, prompting irritated users to moan until it came back up.
Backdoored encryption is a hot topic in the Western world, particularly the UK. Only this morning a little-known state agency called the Children's Commissioner published a [6]report demanding end-to-end encryption be backdoored to keep children safe. The request illustrates the level of threat facing ordinary people wishing to stay secure online.
History has taught us that encryption backdoors do not work; inevitably, the backdoors (such as the one in the NSA's Clipper chip) [7]are found by people who weren't supposed to know about them, or can be abused by those who do. That creates a far greater danger to internet security than whatever breaking end-to-end encryption solves. ®
Get our [8]Tech Resources
[1] https://www.heise.de/news/Gericht-zwingt-Mailprovider-Tutanota-zu-Ueberwachungsfunktion-4972460.html
[2] https://tutanota.com/faq/
[3] https://www.heise.de/news/Mailanbieter-Tutanota-Staatsanwaltschaft-wollte-Chef-in-Beugehaft-nehmen-4908806.html
[4] https://www.theregister.com/2020/10/19/e2e_break_five_eyes/
[5] https://www.theregister.com/2020/09/14/tutanota_ddos_storms_ongoing/
[6] https://www.childrenscommissioner.gov.uk/report/access-denied-how-end-to-end-encryption-threatens-childrens-safety-online/
[7] https://www.theregister.com/2020/01/27/clipper_lessons_learned/
[8] https://whitepapers.theregister.com/
And how will that help us, exactly? It just means crooks don't need to bother hacking our data, they can go straight to the motherlode.
Dear Courts. No. Go away.
What you order is impossible. We have no ability to do it, nobody we're aware of can do it, & every security outlet on the planet worth it's salt says it can't be done. As such we must ignore your order to do the impossible, Sorry. Have a nice day.
"We DEMAND you install a backdoor!"
You can demand I flap my arms & fly, be able to breathe pure vacume, or live underwater without a submarine around me, it doesn't change the fact that those things can't be done. You can demand all you want, I still can't fly.
"And we demand that you redefine pi as 3!"
Uh huh, nice try. And I demand that you give me a functional spaceship with which I can successfully go galaxy hopping in under a week. What's that, you don't have one & nobody's got one & it's not possible? Too bad. You want backdoors & I want a spaceship. Cough it up or STFU.
Re: Dear Courts. No. Go away.
"You want backdoors & I want a spaceship. Cough it up or STFU."
Trouble is, one side has the ability to throw the other side in jail. So there's a bit of a power imbalance here, and you need a 'better' argument than "the way our program is currently designed, I cannot do that."
All the people who want exclusive back doors for encryption have to do is tender a contract for the writing of one - payment to be made only when a committee of independent experts confirm it does what it says on the tin. If they think it's possible why haven't they done that?
Who does all this remind me of?
Ah yes, the Stasi.
Just ask
the police/spying agencies for some time on their big supercomputers to brute force the key
About 2 million years should do the trick....
Then show the judge why he cant unlock the mailbox, because if the police with their resources could decrypt it quietly, they would have done so and without telling anyone..
I trust police and politicians will lead by example and use encryption that has back doors in it.