FastMail is not required to implement the Australian metadata retention laws

[robn]

http://blog.fastmail.com/2015/04/09/...etention-laws/

[rusl]

Thanks for letting us know how the warrantless data access laws affect Fastmail customers. Good news that Fastmail infrastructure is offshore. It's interesting how only recently everyone was saying that they were concerned about Fastmail having servers in USA, but it turns out to be favourable in this case. These spying laws are both horrible and hopeless. They give burden without benefit and don't make much sense.

I'm so glad I can keep using Fastmail.

[jl66]

Congrats!

[BritTim]

I am not surprised that a definitive legal opinion took a while. This kind of analysis makes ones head hurt. I felt obliged, given the importance for some of my customers, to review the analysis, and just reading and understanding the whole thing is no fun. At least the conclusion is good news.

[ioneja]

Very good news! Thank you FM for taking the time to look closely at this, and please keep a vigilant eye on this issue if they start to make further encroachments into our privacy!

BTW, not to be negative, but please do keep in mind that just because you and your lawyer don't think the law applies to you today, doesn't mean some big-headed over-reaching administrator somewhere in Australia will agree with you, and challenge you in a court of law, or submit changes to the law later on. I encourage you to have a "plan B" ready in case further problems or challenges arise!

It's ironic that your hosting infrastructure in the US is what is protecting us from Australia's legislation. I hope they don't decide to expand the definition of "service provider" but at least we know how seriously you guys take it! Please keep up the good work and keep your radar up and running to watch out for further changes that might affect your customers!

BTW, I'm curious if you all had discussed moving outside of Australia had you discovered the law applies to you? Or what potential approaches had you discussed to handling further problems, if any?

[robn]

Originally Posted by ioneja

BTW, not to be negative, but please do keep in mind that just because you and your lawyer don't think the law applies to you today, doesn't mean some big-headed over-reaching administrator somewhere in Australia will agree with you, and challenge you in a court of law, or submit changes to the law later on. I encourage you to have a "plan B" ready in case further problems or challenges arise!

We know. Unfortunately there's nothing much we can do about that. As far as we can tell both the letter and the intent of the law should exclude us, so hopefully even if it did get to court, a judge would agree.

But honestly, I don't think it would get that far because of the ambiguity and because we're not actually hostile to law enforcement - with an appropriate warrant, we'll hand over actual data, not just metadata. So it seems that challenging us in court directly isn't really the most productive way to spend your time and your money.

BTW, I'm curious if you all had discussed moving outside of Australia had you discovered the law applies to you? Or what potential approaches had you discussed to handling further problems, if any?

We've discussed it a little, but not really seriously, as we were almost certain that the new rules would not apply to us.

Its my personal opinion that if we couldn't legally make the same privacy guarantees that we do now, we'd continue to operate and just accept that we'd lose the customers that are with us mainly for privacy reasons. We have a lot of customers that don't really care that much; hopefully enough to continue to pay the bills.

As I think about the staff in the Melbourne office, I think only a few would actually be willing to move away. Most of us have families and own houses and have kids at school and so on. It would take a lot to get us all to leave the country. It would be an absolute non-starter for me; Melbourne is my home. I'd just find another job somewhere else - shouldn't be hard, there's loads of interesting internet companies and startups nearby!

Its a pretty big hypothetical though. I hope it satisfies your curiosity. I don't think such speculation has much practical value though

[ioneja]

Thanks robn! Your openness, thoughtfulness and honesty are really refreshing compared to the finely parsed PR that comes out of many companies! I hope you guys never have to actually deal with those situations, and I hope you all keep the same open attitude with communicating your thoughts with your customers! Very much appreciated, and it makes me feel much more confident renewing.

[jl66]

robn: thank you for your sincerity.

[17pm]

Originally Posted by robn

We've discussed it a little, but not really seriously, as we were almost certain that the new rules would not apply to us.

Its my personal opinion that if we couldn't legally make the same privacy guarantees that we do now, we'd continue to operate and just accept that we'd lose the customers that are with us mainly for privacy reasons. We have a lot of customers that don't really care that much; hopefully enough to continue to pay the bills.

I am also thankful for robn's sincerity but I think this proves that fastmail is definitely not an e-mail provider for privacy-oriented people, sadly.

[ioneja]

Originally Posted by 17pm

I am also thankful for robn's sincerity but I think this proves that fastmail is definitely not an e-mail provider for privacy-oriented people, sadly.

True, but they are honest about it. Robn's response was as transparent as I've seen to capture the real perspective from the inside of a company like this. To me, that makes a huge difference. IF (and only if) the time comes when Australia goes the next step in its laws, then at least we'll know about it, we'll get an honest response from FM, and we can decide at that point based on far better info than some other company with their tight-lipped, trumped-up PR process we so often get. But I do agree, the core philosophy is laid out for us, and isn't for people who place the highest priority on privacy above all else. All varying degrees on that point with different providers, and fortunately, we truly know where we stand with FM, which is more than I can say about most providers.

[dragonfire]

I am currently using gmail and I saw this over at reddit.

Really doesn't mean much. FastMail's servers are hosted by the New York Internet Company which is in the US.

Anything going along the wire would be picked up by the NSA. The NSA has no qualms about capturing the complete contents of foreign communications.

Also if you send an email to someone who's email is in Australia that meets the bill's specifications then your metadata for that email will be collected.

Even with gpg encryption the headers of the email, (Date, From, Reply-To, To, Message-ID, Subject) can still be intercepted. Any metadata about the attachments such as MIME type, file name is also captured.

People need to move to more distributed technologies and away from email.

According to Last Week Tonight the NSA collects all the email information travelling in and out of the USA. This means that if I send with gmail or fastmail it'll still be collected by them anyway? How do you differ from all the other email service providers out there?

[robn]

Originally Posted by ioneja

But I do agree, the core philosophy is laid out for us, and isn't for people who place the highest priority on privacy above all else.

I would agree with statement.

Our privacy policy still stands, and we take it extremely seriously. You have a guarantee that we will make every legal effort to ensure that you get what it says you will, and that we'll let you know if we ever can't live it up to it.

At the end of the day though, we're not going to actively break the law. We're not vigilantes. We provide a great email service, not a data haven. Or put another way, I'm not going to prison for your $40!

"Privacy above all else" is a valid thing to want but not something we can provide. I would suggest that if its really want you want, to the detriment of all else, then you shouldn't be anywhere on the internet at all.

[ioneja]

Originally Posted by robn

I would agree with statement.

Our privacy policy still stands, and we take it extremely seriously. You have a guarantee that we will make every legal effort to ensure that you get what it says you will, and that we'll let you know if we ever can't live it up to it.

At the end of the day though, we're not going to actively break the law. We're not vigilantes. We provide a great email service, not a data haven. Or put another way, I'm not going to prison for your $40!

"Privacy above all else" is a valid thing to want but not something we can provide. I would suggest that if its really want you want, to the detriment of all else, then you shouldn't be anywhere on the internet at all.

Thanks, robn! Again, your honesty on this point is deeply appreciated. You can take my $40 (actually it's more than that since I pay for more than one account), since I know exactly what I'm getting into. However, please know, I'll likely be one of the guys jumping ship if Australia increases its encroachment. This latest legislation was (and is) disturbing, so I'm hoping the trend doesn't continue. Seems like FM is still okay for my purposes. As it stands now, I find FM to be a good balance for what I need in those areas, and more importantly, I have confidence that you'll let us know if this kind of situation changes. "Privacy at all costs" it is not, and I always knew that.

[robn]

Originally Posted by ioneja

However, please know, I'll likely be one of the guys jumping ship if Australia increases its encroachment. This latest legislation was (and is) disturbing, so I'm hoping the trend doesn't continue.

Yeah, I get that, and that's totally reasonable.

For now, all of us can keep talking about it and fighting it. Even if you're not in Australia, its important to keep talking to your own governments and privacy organisations about it. International pressure is a real thing. If we can get a majority of governments around the world to come out and say that mandatory data retention is a dumb idea, pressure builds on the countries that do have it and that can't hurt. For more info, see here:

https://www.eff.org/deeplinks/2015/0...ight-isnt-over

[ioneja]

Originally Posted by robn

For now, all of us can keep talking about it and fighting it. Even if you're not in Australia, its important to keep talking to your own governments and privacy organisations about it. International pressure is a real thing. If we can get a majority of governments around the world to come out and say that mandatory data retention is a dumb idea, pressure builds on the countries that do have it and that can't hurt. For more info, see here:

https://www.eff.org/deeplinks/2015/0...ight-isnt-over

Thank you for mentioning that. You're of course right that this is the way we can hopefully bring change. Sadly, I think over here in the US at least, there is not enough will power in the general public to make a big change. I hope I'm wrong, but we'll see if this general issue plays any real part in the campaigns that are starting to get rolling again here. I'm embarrassed to say it, but most Americans are more upset when their Netflix isn't working.