The Hanover-based e-mail provider Tutanota is once again forced by the court to help the police monitor suspects. According to advertising, the “world’s most secure e-mail service” protects its customers’ messages from one another with end-to-end encryption, and at least stores all other e-mails in encrypted form. The Cologne Regional Court is now forcing the company to reorganize its service so that investigators can still read individual mailboxes in order to obtain clues about the perpetrators in a case of extortion.
Tutanota has had such a monitoring function before, it was activated in June 2019. At that time, the company had to react to a decision by the Itzehoe district court. At the time, Managing Director Matthias Pfau told SPIEGEL that the monitoring would be switched on selectively and only for individual accounts if there was a corresponding valid court order: “We try to protect privacy as well as possible and are therefore not happy to have to incorporate such a function.” . End-to-end encrypted e-mails could not and cannot be decrypted by Tutanota; only the sender and recipient can read such messages.
After a ruling by the European Court of Justice (ECJ) in the same month, the situation changed for Tutanota. The ECJ ruled that e-mail providers – in the proceedings about Gmail – are not telecommunications services and are therefore not subject to the same obligations towards the police. When the Hanover public prosecutor’s office then asked for help with the surveillance in November 2019 – also in a case of extortion – Tutanota was able to fend off this before the Hanover regional court with reference to the ECJ ruling. The company removed the monitoring function from their systems.
After the decision of the Cologne court in August 2020, which has now become known, Tutanota is now reinstalling the technology from then. “Even if we cannot understand the decision, we have to implement it,” Tutanota spokeswoman Hanna Bozakov told SPIEGEL. But it will take “until the end of the year” until the renovation is complete.
Tutanota is seeking a decision by the highest court
Most of all, Tutanota is disturbed by the court’s argument that an email provider is not a provider of telecommunications services, but is a contributor. In the Code of Criminal Procedure it says: “Due to the ordering of monitoring and recording of telecommunications, everyone who provides telecommunications services or is involved in them has to enable the court, the public prosecutor and their investigators working in the police service to take these measures.”
The only difference is that the ruling that SPIEGEL has received does not explain which telecommunications service Tutanota is supposed to be involved in. Bozakov calls this “absurd”.
Ulf Buermeyer from the Society for Freedom Rights (GFF), a former judge at the Berlin regional court, also considers the reasoning of the regional court to be “unconvincing”. He regards it as questionable whether the decision is admissible under European law.
Tutanota wants to lodge a complaint against the decision and is currently preparing “in a similar case to appeal to the Federal Court of Justice in order to bring about a decision by the highest court,” says Bozakov.
Buermeyer regards the case, however unpleasant it may be for Tutanota, at the same time as a good example of the need for encryption, which even the provider himself cannot circumvent: “The lesson is that law will not protect us from surveillance. Only cryptology can do that. ”