less Data-intensive E-Mail providers, such as Posteo must be able to give out the IP addresses of their customers to law enforcement officers, even if you do not want to collect. With this decision, the Federal constitutional court dismissed a constitutional complaint of Posteo.

In the press release the court States: “It is a violation of the basic law, that the provider of an E-Mail service is obliged, in the context of a correctly arranged telecommunications monitoring, to submit to the investigating authorities, the IP addresses on your Account, accessing the customer if he reasons, his service, privacy that is not organized in a way that he keeps track of this”.

Posteo had access to IP addresses

the starting-point locks, the 2016 the district court of Stuttgart arranged in a telecommunications surveillance of a Suspect to have been involved in drug trafficking and illegal weapons possession. Posteo was obligated for a total of four months, all of the saved, as well as more incidental data of the person Concerned. Including IP addresses, about which he combines with Posteos servers. With the help of this address, the investigators wanted to identify the Suspect themselves or, at least, the owner of the corresponding Internet provider.

Posteo said, however, to not have the System designed in such a way that IP-addresses in the first place, but are automatically discarded and are replaced by others. In this way, Posteo itself from the possible access to the real IP was excluded addresses. With the approach the company advertises explicitly to customers: To offer anonymous mailboxes “for all who have enough of the pervasive Monitoring on the Internet”. A duty, “and to make technical arrangements for the collection of data that would be needed solely for monitoring purposes and during the normal business operations are not incurred”, not recognized Posteo.

The Prosecutor’s office was of a different opinion. Section 100b of the code of criminal procedure (StPO) and section 110 of the telecommunications act (TKG) would require Posteo to assist in the Monitoring, fleshed out in further regulations and Technical guidelines. “…At its own cost technical facilities for implementing legally prescribed measures for the interception of telecommunications to provide and to make organisational arrangements for its immediate implementation”, – stated in the TKG verbatim.

tag would cost, according to Posteo at least 80,000 Euro

Posteo fought back with legal means, and argued, among other things, a forced reconstruction of the system was unlawful, it would take twelve months and a minimum of 80,000 euros in costs. The was a disproportionate amount of. The regional court of Stuttgart as the next higher instance rejected the.

With a constitutional complaint, just wanted to let Posteo finally, notice that the forced reconstruction of the technical infrastructure of a violation of the occupational freedom (article 12 of the basic law) and the Right to free development of personality (article 2 of the basic law). The Federal constitutional court has rejected the complaint as “already inadmissible, moreover, and for the unfounded”, as stated in the decision itself.

The engagement in the pursuit of freedom is covered by the code of criminal procedure and its accompanying regulations, and is not unconstitutional. In addition, not be made “to the Complainant a reasonable exercise of his profession, in fact, impossible.” Although the concern of Posteo, a data economical and user-attractive business model to offer, “is, in principle, is worth protecting”. The release of the company, but not from their obligations to support legal surveillance measures.

A spokeswoman from Posteo on request from SPIEGEL ONLINE “are very surprised by this decision”. You can reverse the previous Information system: “so Far, it was undisputed that the duty to provide information refers only to data held by telecommunications providers. Now companies have to collect data, apparently solely for investigative purposes – data which is not incurred by the provider demonstrably so, and the operation of the business not required”.

civil rights activist: “No data retention by the back door”

Posteo looks to be from an opinion of the former Federal Commissioner for data protection, Andrea Voßhoff, confirmed. The had written of a “precedent” and warned that to oblige providers to store data for the sole purpose of law enforcement.

The constitutional lawyer and civil rights activist, Ulf Buermeyer, on the other hand, one should not exaggerate the decision of the Federal constitutional court””. Here, no data retention will be introduced “through the back door”. Go for it first, only IP addresses, while the monitoring decision specified period, and, secondly, to the special system infrastructure of Posteo. There is a General obligation to store IP addresses, does not follow from it. Therefore, the decision was “not scandalous, even if a Provider with more expenses will be charged, who is committed to the privacy of its customers”.

Posteo announced an “architectural solution”, the “detrimental to the safety and the rights of our customers. We will not begin to log the IP addresses of our respectable customers. A conservative System tag is not an Option for us.”

Whether the publication of the IP addresses would have brought in the present case, anything at all, is unclear. The Suspect could have hidden his IP address, for example, with the help of the Tor-browser. Then the police would not be able to identify the connection owner.