German provider of encrypted e-mail Tutanota must provide access to content e-mails

[Index.php]

A court ruling compels the German encrypted mail service Tutanota to give researchers real-time access to the content of unencrypted emails. Service developers now have to build in functionality for this.

A year ago Tutanota received a letter from the Amtsgericht of Itzehoe in the German state of Schleswig-Holstein requesting the police to have access to the content of certain encrypted messages. The police wanted to see the content of emails from criminals using malware to blackmail companies in the state.

The criminals used an email address from Tutanota. This service offers end-to-end encryption if both the sender and receiver have a Tutanota account. This means that messages on users' devices are encrypted and only decrypted at the recipient. Tutanota itself cannot then view the content. If one of the two parties does not have an account with Tutanota in an email conversation, there can be no end-to-end encryption: the company encrypts a message as soon as it reaches its servers. Tutanota must provide access to this category of messages upon request.

The company stated that it did not want to comply with the court's request. "I thought the claim was wrong when we received the letter and I think it is still wrong today," said Tutanota director Matthias Pfau to the Süddeutscher Zeitung. Earlier this year, the German court ruled that Tutanota should provide the data and pay a fine of a thousand euros. Service developers are now creating a feature that makes copies of emails that the police can read when a valid order is received from a German court. This therefore does not concern message traffic between two Tutanota users that is protected with end-to-end encryption: access cannot be given to this.

The mail service does not appeal against the decision, because this would have virtually no chance of being legally successful. The cause lies with the German Telekommunikationsgesetz, which contains too broad rules for access to communication. These rules are said to have their origin in providing telecom providers with access to telephone lines, but according to case law they have a wider scope.

Last year, for example, the Berlin e-mail provider Posteo tried to defend itself against the transfer of IP addresses from customers to the Public Prosecution Service. Posteo did not store these addresses at all, but at the end of January 2019, the judge ruled that the service should do so and release information at the request of the authorities.