Court rules encrypted email provider Tutanota must monitor messages in blackmail case

The decision could have implications for invasive surveillance.

The Federal Court of Justice (BGH) in Germany has ruled that encrypted email provider Tutanota must monitor for three months the messages of accounts implicated in a blackmail case.

The decision, which impacts two accounts in all, comes months after the Regional Court of Cologne ruled that Tutanota must provide said emails. Tutanota had asked BGH to re-examine that decision given that Tutanota does not consider itself a telecommunications service and therefore should not be required to monitor them under German law.

The Cologne decision also appeared to contradict an earlier ruling from the Hanover Regional Court, which affirmed Tutanota did not provide telecommunications services, according to Tutanota.

BGH ruled late last month that the Tutanota request was admissible, but unfounded. BGH found that providers like Tutanota that provide “over-the-top” services are also considered to be providing telecommunications services under the Code of Criminal Procedure. The ruling only surfaced in German press in recent days.

BGH’s dismissal of Tutanota’s appeal means Tutanota must provide unencrypted incoming and outgoing emails of the two implicated accounts. But the legal circumstances surrounding the decision could set a precedent for broader surveillance for users of Tutanota and other email providers like it, Tutanota warned.

“We consider this decision to be absurd,” Tutanota told CyberScoop in a statement Friday.

The decision will only impact unencrypted incoming and outgoing emails, as Tutanota can’t decrypt data that has already been encrypted, Tutanota added. It also said this should serve as a warning that for customers interested in maintaining their privacy, encryption is paramount.

“This ruling shows again how important end-to-end encryption is,” Tutanota said. “All data transmitted without end-to-end encryption can be accessed by third parties.”

The decision comes as nations around the world have sought to weaken encryption to benefit law enforcement investigations. Just last October the U.S., U.K., Australia, New Zealand, Canada, India and Japan issued a joint announcement advocating for increasing law enforcement access to encrypted data. Other efforts to require tech companies to provide law enforcement access to encrypted devices and services have accumulated on Capitol Hill as well.

Supreme Court justices skeptically question both sides in geofence surveillance case

A ruling could come this summer in Chatrie v. United States, which could have bigger ramifications about the scope of government surveillance.

Potential EU law sparks global concerns over end-to-end encryption for messaging apps 

Broad coalition of advocacy groups urges Slack to protect users’ messages from eavesdropping

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure