Source: https://posteo.de/en/site/transparency_report
Timestamp: 2017-03-25 01:56:05
Document Index: 372134053

Matched Legal Cases: ['§ 113', '§ 113', '§ 113', '§ 113', '§ 113', '§ 9', '§ 113', '§ 113', '§ 113', '§ 113', '§ 113', '§ 113', '§ 113', '§ 113', '§ 113', '§ 113', '§ 112', '§ 113', '§ 113', '§ 112', '§ 112', '§ 113', '§ 112', '§ 113', '§ 112', '§ 112', '§ 112', '§ 112', '§ 112', '§ 112', '§ 112', '§ 113', '§ 113', '§ 100', '§ 100', '§ 3', '§ 113']

Email green, secure, simple and ad-free - posteo.de - Transparency report
"We would like you to know how often authorities request user data from Posteo. For this reason we published a transparency report in May 2014, becoming the first German telecommunications provider to do so. Since then, we've regularly provided an impulse for more transparency and disclosed grievances in requests for information from authorities."
Requests from authorities to Posteo
Grievances for requests from authorities
Welcome to the Posteo transparency report.
We would like you to know how often authorities request user data from Posteo. In this report, we show how often investigative authorities and intelligence services have requested data from Posteo – and how often we actually had to release data. In addition, you will find out how often these requests were formally correct and how many of the requests were illegal. The report covers all requests from authorities that Posteo received until the end of December 2016. Numbers for the current year, 2017, will be published in January 2018.
Because many requests from authorities that reach Posteo do not comply with the legal provisions, we have continually devoted emphasis to the information process in our reports since 2015. Here we direct criticism at the chaotic conditions that rule in requests for user information under § 113 TKG. We reveal that in practice, grave security problems exist, there are regular breaches of the law and that deficiencies in controls are making the situation worse.
We also occupy ourselves with the control instrument of the judicial reservation, which is in a state that in our view is no longer equitable in a constitutional state. In practice, all applications for surveillance measures were clearly approved. Though no statistics are kept on the efficacy of the judicial reservation, we have found numbers that prove this.
In May 2014, Posteo became the first German telecommunications provider to publish a transparency report. We first had the permissibility of such a report checked with a legal opinion. With our move, we induced that in the meantime, other German providers also publish transparency reports – including, among others, Deutsche Telekom. With our transparency report, we would like to contribute to making existing grievances and legal realities public and allowing them to be debated.
Preliminary note: We are a privacy-oriented provider with a strong concept of data efficiency. We therefore possess neither personal data (user data like names and addresses), nor the IP addresses of our customers. If Posteo becomes required to release user data under a judicial ruling, authorities can therefore only receive content data (e.g. emails). In response to requests for personal information or IP addresses, we reply to the authorities that we do not possess the requested data. Between December 2015 and December 2016, the number of accounts registered at Posteo increased by about 40%. At the same time, the number of requests from authorities significantly decreased.
Number of requests 2016
Unclear requests:
Formally incorrect, unclear requests:
The difference between the number of requests for content data and their release is due to the following: a seizure can not be carried out when crypto mail storage is activated. Two accounts were each seized twice (various time periods requested).
Number of requests 2015
Number of requests 2014
2013 requests for information:
those from German public authorities:
those from foreign public authorities:
Type of public authority
Queries regarding inventory data:
those of a mailbox name regarding existent bank data:
Queries regarding traffic data:
TKÜ (monitoring of a mailbox for a specific time period):
Correctness/arbitrariness
Permissibility / formal correctness of the request (review by our attorneys)
Formally correct queries regarding inventory data:
Formally incorrect queries regarding inventory data:
Formally correct TKÜs:
Formally correct queries regarding traffic data:
Cases of arbitrariness on the part of public authorities
Allegation: unauthorised search of Posteo, coercion, encouragement of unlawful cooperation:
(see: Disciplinary complaints / criminal complaints)
Number and success rate
Total number of cases in which data were released:
Releases after simple queries regarding inventory data:
Reason: Data not available/anonymous log on
Releases after a query of a mailbox name for existent bank data:
Reason: Data not available/anonymous payment
Releases of data after a mailbox seizure, ongoing transfers of data according to a TKÜ:
Reason: formally correct court order
Appeals / complaints by Posteo
Complaints of our attorney to the data protection officers of the relevant federal states
Reason: transmission of requests from public authorities that does not conform to regulations
Criminal complaints/ disciplinary complaints against law enforcement officials, prosecutors and judges
Allegation: among other things, coercion, encouragement of unlawful cooperation, disregard of applicable law, ordering of a mailbox seizure, queries regarding traffic data and TKÜs without a sufficient legal basis, ordering of a search of Posteo without a sufficient legal basis
* We have received requests from public authorities in a total of 7 cases, of which 6 were solely queries regarding inventory data. In one case, various requests were made (inventory data, traffic data, mailbox contents and ongoing monitoring of telecommunications).
Constitutional state out of control: indefensible circumstances in manual requests for user information under § 113 TKG In this section, we document since 2015 the ongoing security problems in the practice of requests for information. Many requests are transferred to us insecurely, despite containing sensitive information. For this reason, many of the requests are illegal. We prove this using our own case documentation, which we publish here, blacked out. In addition, you will also find a large amount of correspondence between Posteo and the federal state privacy officers on this topic. Read more about illegal requests and security problems in practice here.
In the practice of requests for information under § 113 TKG there are serious security problems. Requests for user information under § 113 TKG contain sensitive personal information. From police authorities, we mostly receive email addresses or names that are specified in connection with a concrete criminal charge. Sometimes the requests even contain a person’s complete bank or payment details. Posteo frequently receives such requests for user information.
Investigative authorities are legally required by the BDSG (among other things) [translation] to ensure that personal data can not be read, copied, changed or deleted in an unauthorised manner under electronic transfer, during its transport or saving to a data storage medium. (BDSG, Anlage, sentence 4)
Many requests under § 113 TKG reach us via email and were transmitted to us insecurely or unencrypted. This procedure violates valid privacy provisions and is illegal. (See BDSG § 9, Anlage, sentences 4 and 8 as well as the respective rules on “technisch-organisatorischen Maßnahmen” of the Landesdatenschutzgesetze, among others). If requests are transferred unencrypted, they can easily end up in the hands of data thieves on their way over the internet.
Many requests under § 113 TKG exhibit additional deficiencies that also violate privacy provisions or other laws. Some examples include:
Requests for information and data, the release of which is not permitted under § 113 TKG, e.g. traffic data such as IP addresses
A large proportion of requests under § 113 TKG reach us in this way (by unencrypted email). Fax is seldom used by authorities (2013-2016), and only one single request has reached us so far by post. Occasionally, we also receive requests by email with an unencrypted document attached that is incorrectly marked "Telefax-Nachricht" (Telefax message). In January 2015, we first made complaints with the responsible privacy officers for the respective German federal states about the insecure transfer of sensitive data by police authorities. The responses from the privacy groups were unambiguous: the problem of insecure transfer of sensitive data by police authorities is known and remains an occasion for conversations and controls. The replies prove that insecure sending of sensitive information by police authorities is a topic requiring urgent action.
The privacy officers’ responses prove that unencrypted requests are a known problem to them. If it is common practice for police authorities to send sensitive information unencrypted via the internet (for example regarding requests under § 113 TKG), then it is not only a problem in terms of privacy: it is also illegal and possibly endangers current investigations. Data thieves can thereby easily access the requests or the authorities’ communication.
In some cases, we have experienced the bureaucracy as being very cumbersome. In response to one case, the Berlin privacy officer replied to us five months later, as follows:
Unfortunately, our complaints have not yet led to any remedies. During 2015 and 2016, all requests that arrived with us via email were transferred insecurely, including from German federal states where the federal state privacy officer appeared particularly engaged. We are therefore asking ourselves how remedies can be achieved. If officers are not sufficiently schooled in secure ways of dealing with data and IT engineering, this constitutes a fundamental security problem in the police’s work.
We will continue to give the privacy officers regular practical feedback and inform them of every unencrypted transfer of a request that reaches us.
As we see it, the security of the process in practice is currently not guaranteed. We therefore engaged politics. Ultimately, however, it is not the provider’s task to check if the dealings of authorities are legal or to work towards this. The state itself needs to achieve and ensure that. In July 2015 at an appointment in the Posteo lab we gave Thomas Oppermann, chairman of the SPD fraction, a statement on this. Oppermann then wrote to Federal Minister of the Interior, Thomas de Maiziere. In his reply to Thomas Oppermann, the minister admitted to braches of the law in the practice. He explained, however, that the BKA would only desire user information in plain text if no encryption was possible for the email communication with a provider or if it did not support the methods used by the police authority. These statements by the minister are remarkable. He clearly considers breaches of the law to be justified in some circumstances. In addition, his statements do not apply: we provide the keys required for secure communication on our website, for example. Encrypted communication with us is unquestionably possible. Nonetheless we have received multiple requests from the BKA that were all transferred unencrypted. Every insecure transfer is a breach of the Federal Data Protection Act (BDSG). Criminal investigators must ensure that personal data can not be read, copied, changed or removed in an unauthorised manner during its electronic transfer, transport or saving to data storage. If a provider does not offer any possibility for encrypted communication, then fax or the post is to be used. The security of authorities’ communication must urgently be improved – otherwise, data thieves and hackers can easily obtain it.
We hereby confirm the BITKOM “allegations”: in about 30% of all requests from police authorities that reached us in the years 2014 to 2016 concerning requests for user information under § 113 TKG, police officers illegally asked for dynamic IP addresses or the IP address of the most recent login.
To prove this, we continue to publish examples of such illegal requests (blacked out): the originals are located in writing at Posteo. In these, it is also clear that officers do not only attempt the illegal release of IP addresses, but also occasionally succeed to obtain and save these for their investigations. This is also not permissible.
Government again questioned in 2015
In the summer of 2015, member of parliament Dieter Janecek (speaker on economics from the Greens fraction) again asked the government about this topic, wanting to know if they remain faithful to their assessment. In his question, the representative referred to the BITKOM statement as well as the Posteo transparency report.
The Federal Ministry of the Interior explained in its response:
Perhaps there is a communication problem between the privacy officers and the government, because in all cases in which police authorities illegally requested IP addresses, we made complaints to the respective federal state privacy officers. In their replies, none of the privacy officers responded to our complaints on this matter. Our complaints were clearly not passed on to the highest federal authorities, as is otherwise customary according to the BMI statement. Illegitimate requests for IP addresses do not constitute mere violations of privacy guidelines; requesting an IP address within a request for user information is illegal under the TKG law (Telekommunikationsgesetz). Those involved are not only federal state police authorities. We have also received such illegal requests requests from state investigative authorities.
Due to escalated, illegitimate demands for IP addresses, we have already incurred enormous legal costs and financial damage of a mid-range, five-figure sum, for example, to lodge protective texts with the courts, for correspondence with investigating officers, legal advice, etc. In one case, we reported investigating officers who personally sought us out in our office. The public prosecutor’s office gave our notification no weight – as our lawyers had in advance predicted would happen. The prosecution told us that our document was plainly false and ceased any proceedings against the officers without any further investigations into them. Instead, they required us to pay a fine due to “false suspicion”, which the court also approved. Posteo company director Patrik Löhr was required to pay a fine. High legal costs are accompanied by the fact that we could theoretically receive 18 EUR back from the state for the effort involved in each request for user information under § 113 TKG. We do not make use of this facility. As a privacy-oriented company we do not accept any money from authorities for requests for user information.
Given the lack of process we would like to advise that the process under § 113 TKG with data retention ("Gesetz zur Einführung einer Speicherpflicht und einer Höchstspeicherfrist für Verkehrsdaten") will gain importance. The law will effect a large increase in the amount of data available for requests for user data.
Until this remedy is achieved, data retention (Einführung des Gesetzes zur Einführung einer Speicherpflicht und einer Höchstspeicherfrist für Verkehrsdaten) is in our view unreasonable for this reason alone, as it will in practice further increase the amount of insecure and illegitimate data transfer and the legal cracks in the disclosure process under § 113 TKG.
Independent of this, we completely and with great emphasis reject the reintroduction of data retention for countless further reasons, e.g. for privacy reasons and data security as well as due to its accompanying blanket restrictions of fundamental rights, that we do not deem reasonable. On this topic, please also read our text on the control instrument of judicial reservation, which we also criticise in this report. The law will nonetheless confront providers like Posteo with even more illegal requests and accompanying bureaucracy and legal costs in connection with requests under § 113 TKG.
The fact that controls regularly occur in the practice of requests for information by security authorities is absolutely essential for the balance between security and freedom in a democracy. Through it, misuse of the process can be prevented or at least identified in retrospect. Illegal practices can be counteracted with controls. We are convinced that controls of the information process under § 113 TKG and § 112 TKG exhibits grave deficiencies – if controls can be spoken of whatsoever. Requests for user information under § 113 TKG appears to be a grey zone. There is no requirement to keep statistics. Insofar as numbers become known at all, these originate from transparency reports by German telecommunications providers that only exist since 2014, after Posteo became the first German provider to publish a transparency report on requests from authorities. Read more about the deficient controls of the information process here. In a democracy, it is essential for a balanced relationship between security and freedom that controls in the practice of information processes regularly take place. Through these, misuse of the process can be prevented or ascertained in hindsight. Inadmissible practices can be counteracted with controls. We are convinced that the information process under § 113 TKG and § 112 TKG exhibits grave deficiencies – if controls can be spoken of at all, that is. The example of § 112 TKG: millions of automated requests and only a handful of controls
Not only in connection with a manual request for user information under § 113 TKG can authorities request user information. There is also the automated process under § 112 TKG, in which about 150 larger telecommunications companies take part (at Posteo, data can only be requested under § 113 TKG). In Germany, many millions of automated requests for user information under § 112 TKG are made each year. In 2014, 6.92 million requests were made to the Federal Network Agency which together led to 34.30 million requests to telecommunications providers. We asked ourselves how many controls these millions of requests made by authorities were actually subject to. We therefore wrote to the parties responsible.
[translation] In recent years there were only few requests made under § 112 TKG, mostly from police authorities. These cases were checked together with the Federal Network Agency. Complete response: see gallery 4, further below
Before we knew of this result, we had sent written enquiries to all the federal state privacy officers, asking for the number of controls from 2013 and 2014. For requests under § 112 TKG, the federal state privacy officers also have control powers, where it concerns requests from public positions in their respective federal states. This was also sobering: all the privacy officers replied that they had not undertaken any controls of requests under § 112 TKG. Some of the privacy officers, however, want to undertake controls in future due to our enquiry.
As a matter of fact, no controls of the process under § 112 TKG occur. The only positive thing to note is that for the automated request process under § 112 TKG there are still reporting and protocol requirements, so that it can at least be seen in the Federal Network Agency yearly reports how often the process is utilised by authorised parties.
Gallery 4: responses from privacy officers on the controls of requests for information under § 112 TKG Grey zone in § 113 TKG: no statistical data available
This statement is a warning from the federal state privacy officer. We see an urgent need to conform to the demands of the BfDI, such that more personnel and equipment is made available to them, also so that they can urge a secure and legally-conforming practice for information processes, for example, requests under § 113 TKG, and to comprehensively effect this with increased controls. The same applies for the federal state privacy officers’ equipment. The control organs must become altogether better equipped such that existing grievances can be effectively confronted.
In this section we occupy ourselves with the control instrument of the judicial reservation, which in our view no longer fairly performs its intended function. In practice, clearly all applications for surveillance measures are approved. Although no statistics are kept as to the effectiveness of the judicial reservation, we found numbers to demonstrate this. We also explain why the deficiencies that we present demonstrate that data retention should definitely not be reintroduced. Incidentally, if you think that a surveillance measure (TKÜ) couldn’t affect you because you haven’t committed any crimes, you are incorrect. In practice, people within the sphere of a suspect also have their communication surveilled or seized, even if there is absolutely no suspicion of a crime committed by that person.
Read more about the judicial reservation here.
How often a judge declines a surveillance measure mostly can not, however, be ascertained in Germany. In the Federal Office of Justice’s yearly report, only the number of rulings passed is specified, in which measures under § 100a Abs. 1 StPO were arranged, as well as the number of surveillance measures undertaken (cf. § 100b Abs. 5, 6 StPO). The German federal states have to supply these numbers to the Federal Office of Justice. Numbers such as how often an application for a surveillance measure is not satisfying to a judge are not included in the statistics, however. The judicial reservation is therefore a control instrument whose efficacy it is actually largely unknown.
Bundesdatenschutzgesetz § 3a
Do authorities only ask for data that companies are allowed to release within the framework of a disclosure of inventory data? No. In the practice of inventory data requests under § 113 TKG there exist grave security problems and deficiencies. Please read our transparency report from this year which concerns itself with this subject.