FastMail’s servers are in the US – what this means for you

http://blog.fastmail.fm/2013/10/07/fastmails-servers-are-in-the-us-what-this-means-for-you/

by masnick • 13 years ago

292 169 13 years ago

blog.fastmail.fm

tweeeyjg• 13 years ago

This is a joke right? How much were they paid by the NSA to write this post?

merusame• 13 years ago

Ffs, why even bother writing junk like this at all?

sschueller• 13 years ago

The US government will just take their server. They don't care if you go out of business.

Look at what they did to megaupload.com.

jmtulloss• 13 years ago

The point that they're trying to make, and which is true in the Megaupload case, is that they would know that this had happened and they would disclose the fact that it happened.

brongondwana12• 13 years ago

This is the same megaupload where FBI agents took part in a raid on a house in a non-US country?

http://www.listener.co.nz/commentary/the-internaut/kim-dotco...

As I said in a response on our forum, if the stakes are high enough, no datacentre in the world is safe.

Bruce Schneier recommends protecting against terrorist attacks by improving emergency response capabilities - with the side benefit that your measures also help against natural disasters:

https://www.schneier.com/essay-292.html

(edit: that's not a great version of his point actually, https://www.schneier.com/blog/archives/2005/09/katrina_and_s... is more on point)

Similarly, our main focus for security is protecting against all forms of attackers, including common theft or misplacement of our servers. We consider that to be more valuable for the overall security of our users (including security against denial of service) than fighting an impossible fight.

FACT: if the three letter agencies in the USA want your data desperately enough, they will get it. With FastMail, they have a legal way to obtain it which is quite a lot of effort, but (hopefully) less expensive to them than taking our servers offline.

What they can't do, by Australian law, is require our cooperation in blanket surveillance on all our users.

rplnt2• 13 years ago

"As I said in a response on our forum, if the stakes are high enough, no datacentre in the world is safe."

The stakes being relevant to US that is.

pstack• 13 years ago

Absolutely. It is a powerful tactic. Impede or shut down their business, destroy their reputation, and then even if you can't do anything to them legally, you have still achieved the same ultimate damage.

And, my initial response to seeing this headline: "Oh, _yes_ you do."

Confusion• 13 years ago

There's a difference between going after a company that is obviously facilitating copyright infringement and is mainly used for that purpose vs. going after a respectable service provider. The latter would raise hell in the international relations between countries.

alextingle• 13 years ago

That's just a matter of perspective. Was Megaupload "obviously" facilitating copyright infringement any more than Google does?

andrewfong• 13 years ago

Note the obvious caveat though:

"There are of course other avenues available to obtain your data. Our colocation providers could be compelled to give physical access to our servers. Network capturing devices could be installed. And in the worst case an attacker could simply force their way into the datacentre and physically remove our servers."

As the colocation providers are based in the U.S., they would be subject to the National Security Letters. FastMail claims this is no different from any other hacking attempt. But in a normal hacking attempt, colocation providers would be free to explain to FastMail the extent of any hacking on their end. Moreover, hackers typically do not have physical access to any data. Even with encryption, physical access opens up a lot of attack vectors that most sysadmins don't anticipate.

MichaelGG3• 13 years ago

If they mount webcams and other sensors inside the cabinet, they could detect unexplained access to their servers. Not sure what it'd really accomplish. The colo provider would either say "tech mistakenly opened that cabinet" or "no comment". The only real defense is to assume any such access is a breach and have servers immediately overwrite FDE keys in RAM and power off - and if they were that committed, they wouldn't host in the US in the first place.

jamesaguilar• 13 years ago

Full disk encryption would be another option, with the key being obtained over a secure channel from servers hosted remotely before booting to the real system. Then, as long as they can detect whether the server asking for the key has been compromised, I think it should be pretty safe. (Not a security researcher though, I wouldn't bet money on it.)

duskwuff2• 13 years ago

There is some historical precedent for such methods. I believe one popular CDN (possibly Akamai?) has its nodes set up with sensors of some variety to discard sensitive data if the hardware is exposed to light.

brongondwana12• 13 years ago

And we'd want to turn that off every time we got them to replace a hard disk...

I wonder how many "sorry, the hairtrigger anti-intrustion systems took the site down" outages it would take before people begged us to turn the sensitivity down.

Vivtek2• 13 years ago

How likely is it that Fastmail data could be obtained without anybody at Fastmail noticing? And the key point is that Fastmail cannot be complied to keep such an attempt secret - which is not the case for a US company.

Vivtek2• 13 years ago

"Compelled", not "complied"... Ugh. Posting before breakfast: always a mistake.

kijin4• 13 years ago

According to a FastMail representative:

We use encryption to make hard drives worthless if they are stolen or just misplaced. [1]

[1] http://www.emaildiscussions.com/showpost.php?p=561920&postco...

Anything that makes hard drives unreadable by thieves would probably also make them unreadable by any U.S. agency that seizes them. Unless of course NSA has already broken the algorithms used by the disk encryption software.

Wingman4l74• 13 years ago

...or if they use RSA at too low of a bit depth: https://news.ycombinator.com/item?id=6506120

mike_esspe• 13 years ago

Encrypted HDD won't help against cold boot attack.

MichaelGG3• 13 years ago

The only real benefit I see here is that your IP won't be easily revealed. That is, given a fastmail account, the e.g. FBI cannot quickly get your login IP, like they can with e.g. Outlook or Gmail. So, for just low-level anti-surveillance, SSL to fastmail might suffice instead of using Tor with Gmail.

Unless you're using PGP or S/MIME, SMTP is still most often unencrypted.

rdl4• 13 years ago

I think the assumption is that FBI has to obey the law to produce evidence for prosecutions. NSA doesn't, particularly vs. "foreign".

nullc• 13 years ago

There are of course other avenues available to obtain your data. Our colocation providers could be compelled to give physical access to our servers. Network capturing devices could be installed. And in the worst case an attacker could simply force their way into the datacentre and physically remove our servers.
These are not things we can protect against directly but again, we can make it extremely difficult for these things to occur by using strong encryption and careful systems monitoring. Were anything like this ever to happen we would be talking about it very publically. Such an action would not remain secret for long.
Ultimately though, our opinion is that these kinds of attacks are no different to any other hacking attempt. We can and will do everything in our power to make getting unauthorised access to your data as difficult and expensive as possible, but no online service provider can guarantee that it will never happen.

This kind of frank disclosure should be highly rewarded. I provided similar frank disclosure text (elsewhere) only to have it whitewashed.

When everyone is underplaying the real limitations it's impossible for people to choose alternative tradeoffs— "Why should I use this slightly harder to use crypto thing when foo is already secure?"— because the risks have been misrepresented. Underplaying the limitations also removes the incentives to invent better protection— "Doesn't foo already have perfect security?".

danenania3• 13 years ago

"This kind of frank disclosure should be highly rewarded."

Yep, definitely. I think even more important than the information itself is the spirit of honesty and integrity that it demonstrates. This stands in stark contrast to the ambiguous slimeball statements issued by the likes of Google, Facebook, Apple, Microsoft, etc.

When Big Brother comes knocking, which companies are going to take a risk to stand up for you? It's as much a question of character as policy.

annnnd• 13 years ago

Note that G, FB, A and MS are not in a position where they can write such disclosure. I am not arguing with your main point, I applaud FastMail for taking a stand - it's just that USA companies must use "ambiguous slimeball statements" to at least appear clean (because they are not).

I would argue that if FastMail were an USA company their statements (if any) would be just as ambiguous as those of G, FB, A and MS.

asabjorn• 13 years ago

Definitely. I am actually really worried about the effect of NSA Surveillance and data collection on industrial espionage. How does a small and growing company know that a big company/interest group that feels threatened by it won't get access to NSA data on the company by using their connections?

If Snowden, an individual contractor, can dive deep into the data how do we know that others are not doing the same for other purposes?

alan_cx• 13 years ago

"This kind of frank disclosure should be highly rewarded."

With all due, Im sorry but, no.

Had it come before the Snowden leaks, absolutely. But it didn't.

After the event, facing a danger of customer loss or loss of confidence, it can only be seen as too late and defensive move. All these companies must have known something about these risks, yet remained in a passive conspiracy of silence. Not one stood up until Snowden did. By then, too damn late.

manojlds• 13 years ago

So Lavabit should have shutdown before the leaks?

What you say may be applicable to the big players, but not to the smaller ones.

Kudos• 13 years ago

Before the Snowden leaks Fastmail was owned by Opera, it has since been bought by Fastmail staff.

http://blog.fastmail.fm/2013/09/25/exciting-news-fastmail-st...

kamjam• 13 years ago

How could they have talked about it if they never knew about because they were never in bed with the NSA?

You are assuming they were cooperating with the NSA behind the scenes like Google et al, but they are saying they were not and could not be compelled to do so by Australian Law.

acqq• 13 years ago

The problem of this "disclosure" is that to the people writing the text the implications of Australian laws aren't clear, as seen in other thread here, started by westicle:

https://news.ycombinator.com/item?id=6506711

In short, don't expect that you can get any advantage from FastMail being Australian company -- you can even be worse off.

olegp2• 13 years ago

It's nice that they are frank about it, but it is also pretty clear that any company hosting in the US, even if they are based elsewhere, is less of an appealing option to the truly security conscious (or paranoid, depends on how you look at it). Sometimes these aren't necessarily the more technical people either.

The problem is that for most services, it is hard to tell where the company is from and where they are hosted, unless you're technical enough to run a traceroute. At StartHQ we've been trying to make that easier to find for non techies and the fact that FastMail host in the US became quickly apparent via their app profile page when we first added it: https://starthq.com/apps/fastmail - there was a pretty lively discussion on FB about it at the time as well.

pekk• 13 years ago

Less of an appealing option where?

If I don't trust (say) the Russian government, it is more secure to put my hosting in Russia? Nonsense.

aroman• 13 years ago

I agree that this is a nice gesture, but it's not a "frank disclosure". What did they disclose?

When they actually have a security breach and they promptly "[talk] about it very publicly", that will be something commendable. Right now we have words, not actions.

Though honestly I'd much rather have such words than not.

traeblain• 13 years ago

So they are saying that they can never get a NSL to turn over information, but where are these servers? Who has the keys to the door of the server room?

So maybe they don't get the NSL, but the people/group/company that is handling the servers might. This seems disingenuous. I could be wrong, but it feels like they are making claims that will dupe people into their service because they feel safe.

gelatocar• 13 years ago

They do in fact mention that in the article:

There are of course other avenues available to obtain your data. Our colocation providers could be compelled to give physical access to our servers. Network capturing devices could be installed. And in the worst case an attacker could simply force their way into the datacentre and physically remove our servers.

frenger• 13 years ago

So maybe they don't get the NSL, but the people/group/company that is handling the servers might. This seems disingenuous.

well they do say explicitly that, near the bottom. Hardly disingenuous.

phy6• 13 years ago

If I was going to set up a honeypot for evil-doers/dissidents, this is the message I would spread.

robn_fastmail16• 13 years ago

If I was an evil-doer/dissident I wouldn't be trusting my life to the collective wisdom of the internet ;)

CurtMonash• 13 years ago

The persuasive part of this is disclosure. It's a promise to be open about any breaches, plus an observation that the US lacks the legal clout to stop the promise from being kept.

rdl4• 13 years ago

The personal location of the operators is probably the #1 most important security risk; location of customers, location of servers, and country of incorporation are also important.

It's much easier to compel operators to do something (through legal threats or potentially physical threats) than it is to do any active modifications to a complex system, undetectably. Passive ubiquitous monitoring is a concern because it's passive and thus hard to detect -- it's highly unlikely TAO can go after a large number of well-defended systems without getting caught. Obviously they'd be likely to hide their actions behind HACKED BY CHINESEEEE or something, but even then, it's relatively rare to have a complete penetration of a large site in a way which isn't end-user affecting, and rarer still for the site not to publicize it.

That said, if I wanted to compromise Fastmail, I'd either compromise a staffer or some of their administrative systems to impersonate staff.

frank_boyd2• 13 years ago

our primary servers are located in the US

Why would you do that, especially when you're not even a US company?

robn_fastmail16• 13 years ago

Because most of our customers are in the US. If your goal is to provide the fastest service around, it helps to put your servers near your users.

brongondwana12• 13 years ago

Also because Australian bandwidth is hella-expensive, power isn't great either.

Why New York rather than West Coast - that's a trickier one. I'd certainly appreciate the slightly faster pingtimes, but it would be slower for Europe.

I think a major consideration is that we found a really good datacentre with NYI, and we're sticking with them because they're incredibly reliable. Reliability matters in this business.

frank_boyd2• 13 years ago

You're implying that you would make less money by trading in your US location for more security. That means that you believe not enough users care enough about their privacy to accept that (really light) trade-off.

skrause2• 13 years ago

But maybe most of your users are from the US because the servers are there? I'm from Europe and was a FastMail customer once, but I switched away because I didn't trust the US-based servers (and that was even before the NSA scandal).

sandstrom2• 13 years ago

What about European users? That market should be roughly equal in size.

As others have noted, I would consider Fastmail if servers were located in a country with greater respect for privacy, judicial oversight and rule of law.

brongondwana12• 13 years ago

Hello inflammatory headline.

That's a very small part of a lot of what we have to say, most of which is:

* we can't be compelled (under current laws) to install blanket monitoring on our users

* we can't be compelled to keep quiet about penetration that we notice

* there are always risks, including the risk that any random group knows unpublished security flaws in the systems that we use

We have written some things about techniques we use to reduce those risks (physically separate internal network rather than VLANS on a single router for example) - these help protect against both government AND non-government threats. But we can't make those risks go away entirely.

What we're saying is - the physical presence in the USA only changes one low-probability/high-visibility threat, which is direct tampering with our servers.

Regardless of the physical location of servers, we would still comply with legally valid requests made through the Australian Government.

It is our belief and hope that this process is difficult enough to mean that US agencies only ask for data when they have good cause rather than "fishing" - but still easier than taking our servers and shutting us down, with all the fallout that would cause.

robn_fastmail16• 13 years ago

Hi, FastMail employee and author of (most of) that blog post here.

Just so we're clear, the point of this post was not that we don't think the rules don't apply to us. Instead we're trying to make it clear where position on these things are. The topic of this thread is a sensationalist sound-bite, nothing more.

I'm not going to go over the points again here because I'm pretty sure we said it all in the post (but ask questions if you like, I'll be here all week!).

The most important point to take away from this post is that your privacy is your responsibility. We're trying to provide you with as much information as we can to help you determine your own exposure, and to let you know what we will work to protect and where we can't help. Its up to you to determine if our service is right for you. No tricks, and no hard feelings if you'd rather take your business somewhere else!

lessnonymous2• 13 years ago

Hi Rob,

Has the headline on HN been updated? Because both you and brongondwana talk about it being sensationalist, where I see it as just being a summary of the most salient part of what you have to say.

Do you have Australian legal advice to back up your conclusions? (I agree with them, but would like to make sure we're talking more than the "gist" of the law)

robn_fastmail16• 13 years ago

Has the headline on HN been updated? Because both you and brongondwana talk about it being sensationalist, where I see it as just being a summary of the most salient part of what you have to say.

To my mind it was one of the least interesting parts of what we had to say. "Non-US company not bound by US law" - its hardly earth-shattering news. Would "Non-Senegalese company not bound by Senegal law" be as interesting?

EDIT: Sorry, it just occurred to me that it was changed already and you might have posted this afterwards. The original post headline was "FastMail claims they do not have to comply with National Security Letters". That's what we were referring to when we said it was "sensationalist".

Do you have Australian legal advice to back up your conclusions? (I agree with them, but would like to make sure we're talking more than the "gist" of the law)

We've made our position public, and we're satisfied that its an accurate reflection of our position and our understanding of Australian law. You must not rely on it as a legal basis for anything though - get your own legal advice that applies specifically to your own circumstances!

anologwintermut• 13 years ago

I may have missed this elsewhere, but why are you're severs in the US at all?

robn_fastmail16• 13 years ago

https://news.ycombinator.com/item?id=6506626

smegel2• 13 years ago

Can you confirm you have never been contacted by US authorities (or Australian for that matter), and have never been placed under a non-disclosure order?

robn_fastmail16• 13 years ago

We have been contacted by US authorities in the past, and have referred them to the appropriate Australian authorities.

We have been contacted by Australian authorities in the past, and have worked with them in accordance with Australian law and our privacy policy, which you can read here: https://www.fastmail.fm/help/overview_privacy.html

chuu1• 13 years ago

I have a fastmail test account. The only reason I have not completely switched to FM is because your servers are in the US. I am in Europe.

westicle3• 13 years ago

Australia does not have any equivalent to the US National Security Letter, so we cannot be forced to do something without being allowed to disclose it.

This is not true. The Australian Crime Commission has some of the most extensive secret coercive powers in the Western world.

http://www.austlii.edu.au/au/legis/cth/consol_act/acca200228...

I would suggest that either:

a) Fastmail is aware of this and is covertly spreading the word that it might be compromised; or

b) Fastmail needs better lawyers.

robn_fastmail16• 13 years ago

I would argue that section 29 is very narrow in its scope, and allows for disclosure once an investigation is completed, and allows for disclosure to an attorney, whereas my understanding of an NSL is that it can order pretty much anything it wants without limitation. That seems quite different to me.

But then, I'm not lawyer. You're probably not either. Which is why I keep telling people to get their own legal advice if they're concerned about it.

westicle3• 13 years ago

Actually I am a lawyer. In the past I have even advised clients who received ACC notices (they are more common than most people would think).

Needless to say I was staggered at the scope of the powers granted. Forget about transparency, justice and the rule of law. If you receive one of these you can be compelled to give evidence or documents in secret, without judicial oversight or public scrutiny.

roel_v• 13 years ago

I would hope you have lawyers who have consulted you on this? What do they say?

GreyZephyr• 13 years ago

You don't need to even use the ACC, people for get that the 2005 counter-terrorism act[0][1] has provision for preventative detention without charge, and notably, made it a criminal act to tell anyone that you had been detained. Combined with a rather broad definition on what was terrorism and the ability of police to request information, documents and emails, this act seems to cover all of the functional aspects of the National security letters with even less oversight.

[0]http://www.ag.gov.au/NationalSecurity/Counterterrorismlaw/Pa... [1]https://en.wikipedia.org/wiki/Anti-Terrorism_Act_2005

616c• 13 years ago

Thank you, Fastmail. This is why I pay for you.

TwoBit2• 13 years ago

Despite that they just stated that your data will be owned by the US government in a raid on the US-based fastmail servers? And with no apparent way for US-based users to avoid that?

andyhmltn• 13 years ago

In all fairness, how are they supposed to combat that without moving their server location?

bad_user3• 13 years ago

I found this article brutally honest. What they are saying is that (1) NSA snooping is more expensive for the NSA as they can't engage in blanket surveillance on all of their users, while keeping them silent, but on the other hand (2) you can't expect and shouldn't assume privacy, because if the NSA wants to listen on your traffic, they will.

This in combination with FastMail being acquired by its former employees, coupled with their investment in CardDAV and CalDAV, makes me really excited about them. I was actually looking for a good replacement to Google Apps and FastMail might be it. It's still a little expensive though, compared to Google Apps, I hope they'll bring those prices down just a little.

TwoBit2• 13 years ago

I think there's reason to believe that a targeting a person like Snowden would cause the U.S. to use the most extreme measures discussed in the post, such as seizing the servers.

brongondwana12• 13 years ago

The point is, they wouldn't need to, because the Australian Government would order us to turn over the data, and we would. Everybody wins (except theoretical-Snowden)

Mind you, theoretical-Snowden is already screwed at this point, regardless of where his mail is. No reason to believe any European country would be susceptible to pressure:

http://www.bbc.co.uk/news/world-latin-america-23174874

Or maybe there is.

Which comes back to the point I've been trying to make all along here. In the most serious extreme, nowhere in the world is "safe". In a less serious case, nobody's going to invade NYI with jackboots on. The window between those two cases is where being not-in-USA could theoretically save us from having our servers snatched (assuming said jackboots weren't willing to just wait for the Australian Government to order us to hand the data over)

pppp• 13 years ago

I am more than willing to give FastMail twenty USD per year, so it is not expensive in that regard, but it is expense for what you get. 1GB of space? Give me a break. All of the tiers need to shift down a notch while keeping the price the same. $20 for 10 GB would be reasonable.

bad_user3• 13 years ago

Well, that's what I meant. I pay something like $50 / user account yearly in Google Apps and I get 30 GB of space, plus Contacts, Calendar, Google Hangouts, Drive and all the other goodies. Paying $60 per year for email with 15 GB of storage seems kind of expensive.

iSnow• 13 years ago

Since the Silk Road bust we know the US LE is able to convince or force colocation providers to provide them with an image of a server. After that, pretty much any communication can be considered open to the NSA. I am not surprised that he does not clearly mentions this.

So FM should move their servers out of the US even if that's inconvenient.

robn_fastmail16• 13 years ago

Actually we did clearly mention it:

  "Our colocation providers could be compelled to give physical access to our servers."

But in the very next paragraph:

    "These are not things we can protect against directly but again, we can make it extremely difficult for these things to occur by using strong encryption and careful systems monitoring. Were anything like this ever to happen we would be talking about it very publically. Such an action would not remain secret for long."

Its not hard for a skilled sysadmin to take an image of a running server. Its extremely difficult to do it without administrative access to the machine AND to do it without anyone noticing.

sandstrom2• 13 years ago

You could move the servers to a country with more respect for rule of law. That would be awesome!

kryptiskt• 13 years ago

Silk Road wasn't hosted in the US, in the documents it says they got the server image from another country.

rplnt2• 13 years ago

What we also know from that is that it doesn't really matter where your servers are physically located.

Quai• 13 years ago

I know that my word doesn't mean much, but I have had the chance to talk to several of the guys working at Fastmail during their years at Opera Software. They are -serious- about mail and they are -serious- about privacy.

Next time I'm out shopping for email services, I will give my moeny to them! (And, to give something back for all the Tim Tams brongondwana brought with him to Norway ever time he was on a visit ;) )

robn_fastmail16• 13 years ago

If you want to just send timtams, that would be fine too. We seem to have run out of them in the office...

brongondwana12• 13 years ago

I'll get you timtams if you run the fire escape with us...

topbanana• 13 years ago

They don't need to seize the server. SMTP is plaintext and on a well known port number. I'm sure the NSA have a record of every email sent through the US in the last few years.

kijin4• 13 years ago

It is possible to encrypt SMTP connections with standard SSL/TLS technology.

FastMail has been using opportunistic encryption on their incoming and outgoing SMTP servers for years. If you send an email to another service that does opportunistic encryption, and if both the sender and recipient uses SSL to access their mailboxes (as FastMail requires), the email will never be transmitted in plain text over the Internet.

janvidar• 13 years ago

The problem with such opportunistic encryption, is that you could insert a man in the middle which basically intercepts the traffic and modifies the handshake to exclude the STARTTLS extension.

With opportunistic SMTP encryption this will cause things to proceed in plain text. The sinister thing about this is that e-mails still flow, so it still works.

bckrasnow• 13 years ago

Transparency takes precedence over everything else in this post, aka the thing you haven't seen US companies doing at all.

Hmmmmmmmmmmmmmmmmmm.

smegel2• 13 years ago

Now swear in blood you weren't under any kind of nondisclosure order when you wrote that.

dutchbrit• 13 years ago

Or the US could just go to the Datacenter and force them to give access.

Maximal• 13 years ago

As Australia is a member of the five eyes group, I do not see any added protection from FM being incorporated there rather than in the USA.

This is why I use a email service in Norway (runbox.com), which, as far as I know, is not sharing information by default.

brongondwana12• 13 years ago

The legal situation in Norway is... in flux at the moment. The Snowden revelations might stop information sharing from coming in, but Norway is looking like leapfrogging Australia pretty much with data retention (along with much of Europe):

http://theforeigner.no/pages/news/updated-parliament-passes-...

Norway isn't some magical safe haven from legal data requests. We receive law enforcement requests through the Norwegian system for mail.opera.com users (which, despite running on the same infrastructure, is operated under Norwegian law, not Australian - isn't life complex)

http://en.wikipedia.org/wiki/Telecommunications_data_retenti... tells a few interesting stories.

Australian law may indeed change, and we'll be compelled to update our policies to match. So far, we've avoided it.

http://www.smh.com.au/technology/technology-news/government-...

workhere-io4• 13 years ago

There's one question they haven't answered: Why do they even need to have their servers in the US? Their blog post admits that there's a big chance that the US is spying on their customers. Given the fact that FastMail is a Norwegian/Australian company, why don't they just move their servers to e.g. Norway?

I realize that even if the servers were in Norway, an email from a FastMail user to a gmail.com account would still be read by the NSA (because it would pass through American servers), but email sent from FastMail to other email hosts in relatively safe countries would not be read by the NSA.

alfiejohn_4• 13 years ago

We're no longer Norwegian :)

http://blog.fastmail.fm/2013/09/25/exciting-news-fastmail-st...

workhere-io4• 13 years ago

Alright, but the point still remains: You could theoretically place your servers anywhere in the world, so why choose the US?

rdl4• 13 years ago

As far as I know, Australian law is common law and would allow a judge to seal a warrant. So, fastmail's asertion that there is nothing like an NSL where they couldn't disclose a search is incorrect. I'm sure it is just lack of awareness, rather than intentional deception.

(Ianal, ianaa, but I am pretty sure I am correct on this point.)

a3n• 13 years ago

FastMail's servers on on the internet, and so you're fucked.

Just sayin'.

jessaustin• 13 years ago

While some describe this as "frank", I think to have that quality TFA would need to specify where the decryption keys are stored. Are they in the USA colo's too? (I realize I could probably figure this out myself if I could be arsed to do so, but why not just tell us?)

duncan_bayne• 13 years ago

This makes me very happy to continue being a Fastmail customer.

aamargulies• 13 years ago

I've been having a discussion with a fastmail staff member about surveillance and fastmail. You can see the discussion here:

https://www.fastmail.fm/html/?MSignal=TZ-**378397*97ae93f3

FastMail’s servers are in the US – what this means for you

Related Stories