Police get online account takeover, data disruption powers - Page 3

FredOnline · 6 Sep 2021, 03:25 PM

Quote:

Originally Posted by TenFour

It would be nice to hear from Fastmail with their opinion on how this might impact their customers.

Over on Reddit, a ticket was supposedly raised to Fastmail, and they supposedly replied:

https://www.reddit.com/r/fastmail/co...eb2x&context=3

Quote:

Thanks for reaching out to us about the recent bill in Australia. We love that our customers care about their digital rights and want to find out more about how companies are looking after their information.

The police can't intercept, access or modify your messages without us receiving a warrant, and we take our duty of care seriously. Fastmail responds to well formed warrants only and challenges requests for access that are inappropriate, either in scope (not adequately targeted), or depth (asking for information that seems out of proportion to what's being investigated). We will continue to do so, for any legislation that applies to us both now and in the future.

The new bill still doesn't allow 'trawling' for suspicious data: they can't request access to a wide variety of accounts hoping they'll come across something of interest. They need to have a particular account under suspicion and something that gives them grounds for that suspicion, and the offense in question needs to be suitably severe to be worth the intrusion.

Where we are permitted under a warrant, we will notify the account holder of the access request, and due to our existing measures to help customers stay aware of any hackers compromising their account, police can't also enter your account without leaving evidence you can see.

What this means for you: Fastmail remains a privacy-first provider. We will comply with our legislated duties, while taking care to ensure that we do not act unless compelled by law and that all legislated preconditions have been properly satisfied. Your data remains under your control and you can rest comfortably knowing that your account won't get caught up in a surveillance net.

DumbGuy · 6 Sep 2021, 05:22 PM

That (alleged) CS response from FM sounds moderately reassuring.
I specifically took notice of "due to our existing measures to help customers stay aware of any hackers compromising their account, police can't also enter your account without leaving evidence you can see". I wonder what that evidence trail refers to. Perhaps the IP-address login history accessible from our account settings area.

TenFour · 6 Sep 2021, 07:40 PM

That reply (if it is real) from FM sounds reassuring, but also makes me wonder how this is any different in scope from previous search warrant laws that exist all over the world. I believe even Protonmail says it must comply with warrants to turn over whatever information they have about you. I doubt there are any email providers who can refuse to comply with warrants to search your data. In some ways I think using an encrypted email provider might put you more in the crosshairs of law enforcement since there are probably many fewer users than the biggies, and no doubt some of them are using encryption to hide illegal activity. It's sort of like frequenting the bar where illegal drugs are often sold--you're there just for the drinks, but could get caught up in the surveillance of what else is going on.

alexu2007 · 6 Sep 2021, 07:59 PM

Every email service provider should and would comply with the law.

The problem is that in Australia a warrant to access the email accounts is issued by a member of the Administrative Appeals Tribunal, not by a judge. From what I was able to understand it's more easy to obtain such a warrant and with less legal control.

My personal oppinion is that if a corrupt police officer needs a warrant, it would be more easy for him to bribe a member of the Administrative Appeals Tribunal than it was to bribe a judge.

I am not involved in any criminal activities, but I am afraid of corruption.

About 15 years ago I dated a girl that I met at a party. I didn't told her where I live. And one sunday evening she rang at my door. I asked her where did she get my address, and she told me that a friend of her works at the mobile phone company I was using and she looked up my address using my phone number. This is how things could happen if personal information is easy to access.

TenFour · 6 Sep 2021, 08:16 PM

Quote:

I didn't told her where I live. And one sunday evening she rang at my door.

Addresses, phone numbers, and email addresses are trivial to find for almost anyone who knows how to look, and they can be obtained legally. I used to work as a reporter for an international publication and we could quickly find the phone numbers and home addresses of almost anyone we needed to reach, and that was before most of today's online tools existed. By the way, I have read that even in this age of everything online one of the most frequent ways to have personal information stolen is to simply steal someone's physical mail direct from their mailbox or from the trash. In some cases they just contact the post office and switch your mail to their address. Lots of people still receive things like bank statements, new checks, and refund checks via snail mail. Here in the USA we all receive and send lots of paper checks back and forth--very easy to steal.

alexu2007 · 6 Sep 2021, 09:07 PM

In my case the address was obtained ilegally.

TenFour · 6 Sep 2021, 09:15 PM

At least here in the USA your address is public information widely available from many sources--you can't claim your address is private. https://www.dmv.org/public-records/

alexu2007 · 6 Sep 2021, 09:17 PM

In Romania neither the phone number nor the address are public information.

ChinaLamb · 6 Sep 2021, 09:35 PM

Quote:

Originally Posted by TenFour

At least here in the USA your address is public information widely available from many sources--you can't claim your address is private. https://www.dmv.org/public-records/

Please note --- DMV.ORG is not DMV.GOV

DMV.ORG is practically a scam. They ask you for personally identifiable information to get access to the "records" they provide... In the process they develop a database on YOU!

They are a private company masquerading as the DMV. I advise AGAINST using dmv.org

DMV.ORG searches some public databases -- but you can get your info removed from most of those databases. For instance, I searched for my name, and I get nothing -- because I've spent lots of time wiping my name from databases.

TenFour · 6 Sep 2021, 09:41 PM

Sure, dmv.org is not a government entity, but there are many other sites like that you can search to obtain information on people. If you have a driver's license, own property, vote, etc. you are listed in multiple public databases that are readily searchable. Don't kid yourself--it is very easy to obtain this information unless you disconnect from the modern world, and as I have said most of the information was already readily available via other means long before we even had the Internet. For example, if you know the city a person lives in you can usually go to the clerk's office and look up exactly where someone lives. Perfectly legal.

ChinaLamb · 6 Sep 2021, 09:49 PM

Quote:

Originally Posted by TenFour

Sure, dmv.org is not a government entity, but there are many other sites like that you can search to obtain information on people. If you have a driver's license, own property, vote, etc. you are listed in multiple public databases that are readily searchable. Don't kid yourself--it is very easy to obtain this information unless you disconnect from the modern world, and as I have said most of the information was already readily available via other means long before we even had the Internet. For example, if you know the city a person lives in you can usually go to the clerk's office and look up exactly where someone lives. Perfectly legal.

As stated, you can request in writing. However, it is possible to remove yourself from many of these online databases.

ChinaLamb · 6 Sep 2021, 10:01 PM

https://twitter.com/tenacioustek/sta...04102676271106

Proton mail is not what people think it is... They respond to requests for information just like others. They can and will send IP address information when required. Also remember, Proton has access to unencrypted messages as they arrive and when they are sent.

TenFour · 6 Sep 2021, 10:42 PM

I doubt there is any email service that can refuse government warrants for information no matter what is implied in their advertising or on their websites. This also shows how pointless it is to search for email providers that don't require phone numbers or email contacts to sign up--you can be tracked by your IP address and other means, without taking extraordinary precautions. If the government wants to find you they will.

FredOnline · 6 Sep 2021, 11:16 PM

Quote:

Originally Posted by ChinaLamb

Proton mail is not what people think it is... They respond to requests for information just like others. They can and will send IP address information when required. Also remember, Proton has access to unencrypted messages as they arrive and when they are sent.

https://protonmail.com/blog/climate-activist-arrest/

ChinaLamb · 6 Sep 2021, 11:35 PM

Quote:

Originally Posted by FredOnline

https://protonmail.com/blog/climate-activist-arrest/

Nothing there contradicts what I've written. Proton mail has access to unencrypted messages as they send them via SMTP. Proton mail also has access to unencrypted messages when they arrive via SMTP.

People act like they don't.

I would suspect they even have access to messages sent from one Proton mail account to another, as they are moving the messages between accounts.

6 Sep 2021, 05:22 PM	#32
DumbGuy Essential Contributor Join Date: Oct 2008 Posts: 212	That (alleged) CS response from FM sounds moderately reassuring. I specifically took notice of "due to our existing measures to help customers stay aware of any hackers compromising their account, police can't also enter your account without leaving evidence you can see". I wonder what that evidence trail refers to. Perhaps the IP-address login history accessible from our account settings area.

6 Sep 2021, 07:40 PM	#33
TenFour Master of the @ Join Date: Feb 2017 Location: USA Posts: 1,719	That reply (if it is real) from FM sounds reassuring, but also makes me wonder how this is any different in scope from previous search warrant laws that exist all over the world. I believe even Protonmail says it must comply with warrants to turn over whatever information they have about you. I doubt there are any email providers who can refuse to comply with warrants to search your data. In some ways I think using an encrypted email provider might put you more in the crosshairs of law enforcement since there are probably many fewer users than the biggies, and no doubt some of them are using encryption to hide illegal activity. It's sort of like frequenting the bar where illegal drugs are often sold--you're there just for the drinks, but could get caught up in the surveillance of what else is going on.

6 Sep 2021, 07:59 PM	#34
alexu2007 Essential Contributor Join Date: Aug 2007 Posts: 287	Every email service provider should and would comply with the law. The problem is that in Australia a warrant to access the email accounts is issued by a member of the Administrative Appeals Tribunal, not by a judge. From what I was able to understand it's more easy to obtain such a warrant and with less legal control. My personal oppinion is that if a corrupt police officer needs a warrant, it would be more easy for him to bribe a member of the Administrative Appeals Tribunal than it was to bribe a judge. I am not involved in any criminal activities, but I am afraid of corruption. About 15 years ago I dated a girl that I met at a party. I didn't told her where I live. And one sunday evening she rang at my door. I asked her where did she get my address, and she told me that a friend of her works at the mobile phone company I was using and she looked up my address using my phone number. This is how things could happen if personal information is easy to access.

6 Sep 2021, 09:07 PM	#36
alexu2007 Essential Contributor Join Date: Aug 2007 Posts: 287	In my case the address was obtained ilegally.

6 Sep 2021, 09:15 PM	#37
TenFour Master of the @ Join Date: Feb 2017 Location: USA Posts: 1,719	At least here in the USA your address is public information widely available from many sources--you can't claim your address is private. https://www.dmv.org/public-records/

6 Sep 2021, 09:17 PM	#38
alexu2007 Essential Contributor Join Date: Aug 2007 Posts: 287	In Romania neither the phone number nor the address are public information.

6 Sep 2021, 09:41 PM	#40
TenFour Master of the @ Join Date: Feb 2017 Location: USA Posts: 1,719	Sure, dmv.org is not a government entity, but there are many other sites like that you can search to obtain information on people. If you have a driver's license, own property, vote, etc. you are listed in multiple public databases that are readily searchable. Don't kid yourself--it is very easy to obtain this information unless you disconnect from the modern world, and as I have said most of the information was already readily available via other means long before we even had the Internet. For example, if you know the city a person lives in you can usually go to the clerk's office and look up exactly where someone lives. Perfectly legal.

6 Sep 2021, 10:01 PM	#42
ChinaLamb The "e" in e-mail Join Date: Dec 2004 Location: a virtually impossible but finitely improbable position Posts: 2,320	https://twitter.com/tenacioustek/sta...04102676271106 Proton mail is not what people think it is... They respond to requests for information just like others. They can and will send IP address information when required. Also remember, Proton has access to unencrypted messages as they arrive and when they are sent.

6 Sep 2021, 10:42 PM	#43
TenFour Master of the @ Join Date: Feb 2017 Location: USA Posts: 1,719	I doubt there is any email service that can refuse government warrants for information no matter what is implied in their advertising or on their websites. This also shows how pointless it is to search for email providers that don't require phone numbers or email contacts to sign up--you can be tracked by your IP address and other means, without taking extraordinary precautions. If the government wants to find you they will.