261
Police shut more than 14,000 accounts on Mega, Tutanota and Protonmail (therecord.media)
submitted 2 years ago by to c/technology@lemmy.world
38 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 13 points 2 years ago (3 children)

Forgive my question, but if the email is encrypted and the service is unable to read it, how are they sure the accounts in question are criminal? How would they know any account was?

This is confusing to me so I am grateful for any insight.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 20 points 2 years ago (2 children)

    Fair question!

    If an email address is being used for fraud, they don't need to see the encrypted copy; they can see the copy sent out to other people from that address. So if I send you a message from my Protonmail to your Gmail, the following is true:

    Copy @ Protonmail: E2EE.
    Copy @ Gmail: NOT E2EE.

    There are other, circumstantial ways to tell as well. If you're trying to scam people with DudeBro Cryptocurrency, you necessarily reveal the address you use when you send our your spam or scams. If I send malware from notactuallydiotima@proton.me, the proof that I sent the malware does not require you to see my server stored mail; you can just look at your own copy to see.

    Does that make sense?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    So any email address is not encrypted even if the message goes to another encrypted account? Is this correct?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 2 years ago* (last edited 2 years ago) (1 child)

    Yes, the "to address" cannot be encrypted as it is necessary to deliver the mail, the "from address" are needed to send a notification when the "to address" doesn't exist.

    Technically, the "from address" probably can be encrypted, like in signal; but I think it is required in the current email standard.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 8 points 2 years ago

    There's typically reason to suspect the account owner first. They're not trawling through random accounts, law enforcement doesn't have the time or authority to do that. Note that intelligence agencies are not law enforcement, I'm not talking about what some spy agencies might do.

    Since this is law enforcement, typically you don't have a verdict to rely on, but they'd have a warrant or subpoena to get the necessary evidence to further the case.

  • permalink
  • fedilink
  • source
  • parent