Special Holiday Offer from Runbox

We are feeling extra merry this month and would like to make the holidays brighter with a special limited time offer:

Throughout December you get a FREE YEAR with main account renewals on the Medium plan or larger!

Giftbox

This means that your existing account plan will be immediately upgraded for TWO YEARS if you purchase the Medium, Max, Max100, or Max250 plan now.

The additional subscription time will automatically be added to the end of your current subscription.

Just go to Plans & Upgrades and log in, and then select the Medium plan or larger. Finally, proceed to the shopping cart in the top right corner and complete your payment.

Happy Holidays from all of us at Runbox!

Continue Reading →

Update: Meta’s behavioural advertising vs GDPR

This is blog post #20 in our series on the GDPR and is a continuation of the blog post # 19 which ended with this:

  • After the Norwegian (NO) DPA (Data Protection Authority) imposed a ban on Meta’s behavioral advertising and put a fine on Meta, the company brought the case to Oslo District Court asking for provisional injunction – and lost.
  • Starting om August 14, the fine of NOK 1 million per day could last until November 3, unless the European Data Protection Board (EDPB) decided otherwise, as requested by the NO DPA.

And the story continues, currently in (at least) three different processes:

Scroll down and find that the noyb has on 28 November filed GDPR complaint aganst Meta’s “Pay or Okay”.

1. Enforcement notice against Meta from Ireland’s High Court

EDPB

Following the request by the NO DPA, the EDPB published on 27 October their conclusion and adopted an urgent binding decision, and instructed the Irish (IE) DPA to take, within two weeks, final measures to stop Meta’s processing of personal data for behavioral advertising across entire European Economic Area (EEA), arguing that reference to the user contract and legitimate interest is not valid legal basis for using personal data for behavioral advertising.

The GDPR states that consent for processing of personal data is not freely given when it is bundled to accessing a service, and when the processing of personal data is not necessary to that service.

IDPC

The Irish (IE) DPA notified Meta on 31 October the EDPB binding decision, giving Meta two weeks to comply.

Ahead of this, Meta announced on 30 October the new subscription model where users can pay monthly for ad-free Facebook and Instagram services in the EEA and Switzerland, but NO DPA has informed Meta that they have strong concerns regarding Meta’s “consent” mechanism. EDPB is evaluating, and (according to our knowledge) has not concluded yet. NO DPA is of course active in this process. [source]

The Irish (IE) DPA took action 10 November and served Meta with an enforcement notice saying that the company has seven days to cease processing data for behavioral advertising. If not, the company will be fined.

However, Meta has brought a High Court challenge, resulting in a permission for Meta to bring its judicial review action, and later also to grant Meta a temporary stay on the enforcement notice from coming into effect. When the matter will return to court is unclear.

2. Meta is taking a new case against the Norwegian Data Protection Authority

Datatilsynet

Following up on the decision from 14 July this year, where Meta was notified that they may impose a fine of up to NOK 1 million (approximately USD 100 000) if Meta did not comply with the GDPR regarding consent from users of Facebook and Instagram when the company use personal data for behavioral advertising, the fine started rolling from 14 August.

The NO DPA confirms that they have sent a claim of NOK 82 mill against Meta to the State Collection Agency, a unit within The Norwegian Tax Administration.

Meta claims that the ban is invalid, and for the second time, Meta is taking the case to Oslo District Court. They also claim that the compulsory fine has to be abolished.

However, Meta has later requested that the case be dismissed, and the NO DPA has agreed to this. But the case is not laid dead, because Meta kept open the possibility to raise the matter again, awaiting the outcome of the proceedings in the EDPB [source].

NO DPA (Datatilsynet) write in an email to a Norwegian newspaper (6 December 2023), that Meta has now reluctantly paid the fine. But it is not hard to guess that the last word is not said,

3. noyb files GDPR complaint against Meta over “Pay or Okay”

noyb

Recently (28 November), the Noyb – European Center for Digital Rights, a non-profit organization based in Vienna, Austria, filed a complaint against Meta with the Austrian data protection authority, on behalf of an anonymous complainant, who is unemployed and receives benefits, and lacks the financial means to pay Meta’s subscription fee €20.99 a month to access Facebook and Instagram. [source; source]

The noyb claims that paying up to €251.88 a year to retain their fundamental rights to data protection on Facebook and Instagram is unacceptable, and in addition, if such arrangement is not stopped, other tech companies will soon follow, according to noyb. [source].

With this, noyb opened up a wider concern and perspective on the matter, which may deserve another blog post. So, stay tuned.

4. Another complaint process: Meta’s “pay-or-consent” model contravenes consumer legislation

BEUC

The European Consumer Organization (BEUC, Bureau Européen des Unions de Consommateurs), organizing Forbrukerrådet (The Norwegian Consumer Council) and similar organizations in Europe, has filed a complaint against Meta’s changes to its service in the EU, saying that the “pay-or-consent” model is “… an unfair choice for users, which runs afoul of EU consumer law on several counts and must be stopped.”

Forbrukerrådet

The complaint is filed with the network of Consumer Protection Authorities (Consumer Protection Commission, CPC) “on the grounds of Meta engaging in unfair commercial practices in multiple ways.”

Further, the BEUC press release contains a very to-the-point list of issues that are identified under consumer protection law, and put Meta in trouble: Aggressive practice; sense of urgency; misleading consumers to believe in less tracking an profiling, and to believe that not paying then the service is “free” while they are paying through the provision of their data; the consumers do not have a real choice, because quitting the service means losing their contacts and interaction history.

Forbrukertilsynet

In Norway it is Forbrukertilsynet (The Norwegian Consumer Authority) that is entitled to impose a compulsory fine if the consumer legislation has been breached.

In addition, BEUC is also assessing whether Meta is infringing the GDPR.

Wrapping up the whole thing

There is an intense battle going on: The power of the big technology companies over people and society, versus democratic principles and how they are embodied in European legislation.

Because we at Runbox have the privacy flag hoisted, we will continue to follow what is happening in the field, and continue to keep our customers updated.

The content of this article is intended to provide a general guide to the subject matter, and Runbox take no responsibility for its accuracy. It is advised that when using the information for any purpose other than personal that the sources provided are verified. Expert advice should be sought about your specific circumstances.

Continue Reading →

In the case of GDPR vs Meta’s illegal behavioral advertising, the Norwegian DPA plays an important role

This is blog post #19 in our series on the GDPR.

Runbox takes a clear stand against big tech companies’ use of personal information for advertising purposes, and we are critical of their huge influence on society in general.

At the same time, we are proud of the Norwegian government agencies’ effort to crack down on companies breaking privacy legislation, by applying the legislation provided by the EU’s GDPR (General Data Protection Regulation).

This monitoring of privacy has its roots as far back as 1978 when Norway, as the second country in the world (shortly after Sweden), adopted a law on the processing of personal data, and established Datatilsynet (the Norwegian Data Protection Authority; NDPA).

For instance, in October 2022 we wrote about Google Analytics (GA) vs privacy, following up with a blog post about action taken by NPDA towards a Norwegian company’s use of GA, which implies unlawful transfer of personal data to the United States via GA.

In 2021 we published a couple of blog posts about reports from Forbrukerrådet (the Norwegian Consumer Council; NCC) about how the extensive AdTech and MarTech industry use personal data for targeted advertising.

NDPA was then prompted (by NCC) to impose a fine of NOK 65 mill (approximately USD 6,5 mill) on the dating app Grindr for breaching the consent requirement in the GDPR. (Read our update on 30 September 2023 on the Grindr case here.)

The Norwegian DPA case against Meta – and personal data as a commercial product

NDPA logo [source]

Meta Platforms Ltd is the umbrella organization that owns Facebook, Instagram, WhatsApp, and more. Currently, the Norwegian DPA has a lawsuit going against Meta Platforms Ireland Ltd and Facebook Norway AS, because of illegal behavioral advertising where they use personal data they are not allowed to for such purposes [source, source] according to the GDPR.

When they (as do Google and other tech companies) are using personal data for targeted advertising, it creates plenty of opportunities for advertisers to pay and get your personal information in return. [source].

In addition, they share the access to users’ data with other tech firms when doing business together, for instance Facebook argues that such firms are essentially an extension of itself, defined as “service providers” or “partners” [source, source, source, source].

If that weren’t enough, real-time bidding (RTB) results in the average Norwegian internet user’s data being shared 340 times per day, according to a study from the Irish Council for Civil Liberties (ICCL) [source]. The fact that personal data has become commercial merchandise could be a theme for a separate blog post, but for now we’ll stick to what the headline indicates.

The NPDA has taken a leading role and has been involved in this legal issue for many years precisely because it has such major implications for Norwegians’ privacy. [Source: Datatilsynet]

Meta’s gliding flight for legal use of personal data in their advertising business

The NDPA versus Meta is the provisional culmination of a long process starting in May 2018, the day after GDPR came into force in the EU.

At that time the Austrian non-profit European Center for Digital Rights (NOYB) filed four complaints against respectively Google (Android), Facebook, WhatsApp and Instagram over “forced consent”: The services would not be accessible if users declined to agree to their terms of use [source], which is a breach of GDPR Article 6.

The complaint against Meta was lodged on 25 May 2018 to Österreichissche Datenschutzbehörde [source] who transferred the complaint to Facebook Ireland Ltd on behalf of the data subject from Austria.

Irish DPC logo [source]

Because Meta’s regional headquarters in Dublin is serving European countries, it is the Irish Data Protection Commission (DPC) who is Meta’s lead European data privacy regulator (Lead DPA).

Since the NOYB’s complaints in 2018, the cases have been through the European Data Protection Board (EDPB) and the Court of Justice of the European Union (CJEU), where the conclusion is unanimous: Meta can’t use personal data for targeted advertising based solely on its Terms of Service (ToS). The GDPR’s Article 7, Recital 32, Recital 42, and Recital 47 make this very clear.

The apple of discord has been whether Meta uses the correct basis for processing personal information when they collect data about what users do on the platform, and use it to display targeted advertising. The dispute is about the term contractual necessity, legitimate interest, and consent, referring to GDPR Article 6.

Meta first argued towards the Irish DPC, that contractual necessity, as stated in Facebook and Instagram ToS from 2018 (after introduction of GDPR), was a sufficient legal basis for its advertising business – claiming that users of Facebook and Instagram are in contract with Meta to receive targeted ads. This actually means that Meta admits that behavioral advertising is a core service [source].

But after the ruling by EDPB 5 December 2022, and financial penalties totaling EUR 390 million from DPC 04 January 2023, Meta 5 April 2023 moved to “legitimate interest in its ToS. The fines are set according to GDPR Article 83 and seem significant, but is a small amount compared to that the advertisement practices that helped Meta generate $118 billion in revenue in 2021.

The penalty of EUR 390 million was decided because the contractual necessity in Meta’s ToS as legal basis for targeted ads was deemed in violation of the GDPR. However, Meta’s move to argue legitimate interest did not help, even when Meta provided an “opt-out tool”. Under the GDPR Articles 21(1) and (2), users have the right to object to companies claiming that they have a “legitimate interest” in the processing of their personal data.

A new player in the field: Das Bundeskartellamt

Bundeskartellamt logo [source]

Then on 7 February 2019, the German Federal Cartel Authority (“Bundeskartellamt”), with support from the German Consumer Rights Organization (“VZBV”), entered the arena. They brought into the game the German competition legislation with a decision arguing that Meta’s terms of use for Facebook violated German legislation due to the abuse of a dominant market position by Facebook merging and utilizing the data in user accounts.

Facebook’s terms were said to violate the GDPR, as using Facebook required that Meta could collect and process user data from various sources without actual user consent. On this basis Bundeskartellamt prohibits Facebook from combining user data from different sources — Facebook-owned services and third party websites included.

CJEU logo [source]

In the case between Germany and Meta that followed, the Higher Regional Court, Düsseldorf (Oberlandesgericht Düsseldorf), put the case forward to the CJEU which decided on 4 July 2023 that legitimate interest (referring to Article 6 (1f)) is not adequate for targeted advertising, and that the user’s explicit consent is necessary to be in line with the GDPR. With this, the CJEU agreed with noyb, and Meta is not allowed to use personal data beyond what is strictly necessary to provide its core social media products.

That said, the CJEU recognizes that legitimate interest may be used as basis for direct marketing processing, but this argument will not outweigh the interests and rights of individuals.

The Irish DPC is dragging its feet?

Here we have to mention that the Irish DPC has been unwilling to fully support the claim that Meta violates the GDPR regarding their targeting advertising. Instead, they (on 6 October 2021) in their draft decision, initially sided with Meta and put the light on Meta’s lack of transparency, and thereby violation of the requirements of the GDPR (Article 12 and 13c). According to this, the Irish DPC proposed a modest penalty of EUR 28–36 million.

“The GDPR countries” [source]

Following the GDPR procedure, the draft decision was sent to the other DPAs within EU/EEA who may have a legal interest in the decision. Ten of 47 raised objections against the DPC’s reasoning that the personalized service could legally include personalized advertising. The disagreement led the Irisih DPC to refer the point of dispute to the EDPB.

As referred above, the EDPB took the view that Meta Ireland could not rely on contractual necessity as legal basis for their targeted advertising, and due to the binding decision by EDPB 5 December 2022, the Irish DPC had a month to reach a final decision.

The story didn’t end there, as is explained in the 12 January 2023 EDPB press release where the Irish DPC is instructed to issue a tenfold penalty increase – both because of lack of transparency and breach of the GDPR – on Meta Ireland to €210 million in the case of Facebook and €180 million in the case of Instagram [source]. The Irish DPC then had to follow the EDPB instruction as it did on 31 December 2022 regarding Facebook and Instagram.

In the binding decision the EDPB also directed the Irish DPC to conduct a fresh investigation into Facebook and Instagram regarding the different personal data they collect, hereunder to assess whether processing of sensitive data is taking place [source].

The Irish DPC did not agree and said that “the DPC considers it appropriate that it would bring an action for annulment before the Court of Justice of the EU in order to seek the setting aside of the EDPB’s directions” [source]. And so it has done. The details are not known per 23 March 2023 [source], but the claims probably refer to Article 263 of the Treaty on the Functioning of the European Union, which allows the CJEU to examine the legality of the legal acts of bodies, offices or agencies [source].

The Irish DPC is Lead DPA for many Big Tech companies [source]. Click image to view full size.

The Irish DPC has been criticized as a bottleneck of enforcement regarding GDPR cross-border complaints concerning the 8 big tech companies (Meta, Google etc.) that have their European headquarters in Ireland. According to the report by the Irish Council for Civil Liberties (ICCL), and adding the new cases since the report was published, some 80 % of all cases have been overruled by the EDPB with demands for tougher enforcement action.

Back in 2020 the Austrian non-profit European Center for Digital Rights (NOYB) filed an open letter to the EU authorities that brought the Irish DPC’s weaknesses to light, referring to secret meetings between Meta and the Irish DPC to find ways to bypass GDPR requirements [source].

For the sake of balance we will refer to an article in The Irish Times where The Irish Data Protection Commissioner Helen Dixon defended the work of the DPC, and rejected claims that Ireland is a ‘bottleneck’ for enforcement [source].

The Norwegian DPA is taking action and imposes daily fines

The Irish DPC’s delay in the Meta case has triggered the Norwegian Data Protection Authority to intervene: On 14 July 2023, the Norwegian DPA notified Meta that they may decide to impose a coercive fine of up to NOK 1 000 000 (approximately USD 100 000) per day because of non-compliance with the GDPR’s Article 6, which in this case requires consent (ref. Article 6 (a)). Meta had until 4 August 2023 to either stop the use of personal data or receive daily fines.

On 4 August 2023 the NDPA put a temporary ban on Meta’s processing practice to use behavioral marketing. “Temporary” meant three months (from 4 August 2023), or until Meta showed that they had legally aligned themselves. That didn’t happen, the time limit was exceeded, and the NDPA did what they warned Meta about on 4 August by imposing a coercive fine of NOK one million per day [source], starting on 14 August, lasting until 3 November 2023.

It may seem strange that the NDPA can do this since Meta has its European headquarters in Dublin, and normally it is the Irish Data Protection Commission as Lead DPA that supervises the company in the EEA.

However, since NDPA’s concern is Norwegian users, they did this with reference to the GDPR Article 66 which allows data authorities to enact measures immediately when “there is an urgent need to act in order to protect the rights and freedoms of data subjects.” NDPA asked the Irish Data Protection Authority to impose a ban in May, but they didn’t, without saying why [source].

It follows that he decision from the Norwegian Data Protection Authority only applies to users in Norway.

Meta is taking the NDPA decision to Oslo District Court – and lost

It was no surprise that Meta didn’t accept the ban, and their reaction was to take the ban and the fine to Oslo District Court on 4 August 2023) , applying for a temporary injunction in an attempt to invalidate the decision. The reason: “This decision is invalid and causes significant damage to the company” [source].

“Meta Ireland and Facebook Norway have further stated that the decision is disproportionate, unclear, impossible to fulfill, contrary to other legislation (including the European Court of Human Rights, ECHR), and that it has already been fulfilled” [from the court’s ruling]. None of these statements were given weight, and Meta lost according to the court’s judicial ruling 6 September 2023.

In the court Meta stated that they would have to suspend Facebook and Instagram services in Norway to comply with the order. This seems strange, because in a blog post update 01 August 2023 they announced the following:

Today, we are announcing our intention to change the legal basis that we use to process certain data for behavioral advertising for people in the EU, EEA and Switzerland from Legitimate Interests to Consent.”

It is to be noted that the UK is excluded, Norway is not mentioned, and not a word is said about when and how the change will take place (more on this below).

In addition to the case in the legal system, Meta has submitted several administrative complaints against the Norwegian Data Protection Authority’s decision. These processes are ongoing. [Source: NDPA won against Meta]

NDPA asks EDPB to make the ban permanent, also for the EU/EEA area

The Norwegian DPA is only authorized to make a temporary decision in this case, and the decision expires on 3 November 2023. Because of the urgency as stated by NDPA, they, according to a press release 28 September 2023, have asked the central European Data Protection Board (EDPB) for a European binding decision in the case against Meta.

In the request, the NDPA asked that the Norwegian temporary ban on behavioral advertising on Facebook and Instagram be made permanent and extended to the entire EU/EEA.

Referring to Meta’s announced intention to change the legal basis to consent, NDPA says in the press release: “It is uncertain whether and when a valid consent mechanism may be in place. The Norwegian DPA believes that we cannot tolerate illegal activity in the meantime.

It is just about one month until the Norwegian ban expires, and one can only await the EDPB decision. It would seem strange if the EDPB decides against making the ban permanent, and that it is preferable that the GDPR should be interpreted consistently throughout the EU/EEA, and the rest of Europe as well.

Meta’s last move: Pay for your Rights”

In September this year Meta proposed to GDPR regulators that they want to charge Europeans monthly subscriptions if they don’t agree to let the company to expose them to targeted advertising.

According to Wall Street Journal on 3 October, Meta hopes to roll out the plan – Subscriptions No Ads (SNA) – in the coming months for Europeans users. This will hit users with fees in the range of EUR 10 to 20 per month depending on platform used and also if the accounts covers mobile devices.

With this, Meta is trying a smart move to circumvent requirements for explicit consent before processing user data to select ads that are targeted. The company refers to some other companies, such as Spotify, who offers users a choice to avoid ads for a paid subscription. But there is a difference, as Techcrunch points out: Spotify has to pay to license the songs it delivers ad-free to subscribers, while Meta gets content from its users for free.

In addition, Meta has pointed to paragraph 150 in the recitals of CJEU’s 4 July 2023 decision that “… if necessary for an appropriate fee…” could be an alternative to users who decline to let their data be used for ad-targeting purposes, and that opens the door to a subscription service. However, as NOYB points out, these 6 words are not directly related to the case and should not be part of the binding decision – and as Max Schrems, founder and chair of the NOYB put it (quote):

noyb logo [source]

The CJEU said that the alternative to ads must be ‘necessary’ and the fee must be ‘appropriate’. I don’t think € 160 a year is what they had in mind. These six words are also an ‘obiter dictum‘, a non-binding element that went beyond the core case before the CJEU. For Meta this is not the most stable case law and we will clearly fight against such an approach.” (our text highlighting)

Per 3 October it is not clear if the Irish DPO will deem the SNA-plan compliant with the GDPR, and it is also a question whether the CJEU will stick to its ruling from 4 July 2023.

Here it is also worth mentioning that Meta’s advertising network will fall under the EU’s Digital Markets Act which requires user consent before mingling user data among its services, or combining it with data from other companies [source]. 

The case of Meta vs GDPR will obviously roll on.

The content of this article is intended to provide a general guide to the subject matter, and Runbox take no responsibility for its accuracy. It is advised that when using the information for any purpose other than personal that the sources provided are verified. Expert advice should be sought about your specific circumstances.

ADDENDUM: Why is it urgent to stop behavioral advertising?

Behavioral advertising one of the largest risks to privacy: Statement from Datatilsynet

“Meta, the company behind Facebook and Instagram, holds vast amounts of data on Norwegians, including sensitive data. Many Norwegians spend a lot of time on these platforms, and therefore tracking and profiling can be used to paint a detailed picture of these people’s private life, personality, and interests.

Many people interact with content such as that related to health, politics and sexual orientation, and there is a danger that this is indirectly used to target marketing to them. 

“Invasive commercial surveillance for marketing purposes is one of the biggest risks to data protection on the Internet today”, head of international department at the NDPA Tobias Judin says. 

When Meta decides which advertisements will be shown to a user, they also decide what not to show someone. This affects freedom of expression and freedom of information in a society. There is a risk that behavioral advertising strengthens existing stereotypes or could lead to unfair discrimination of various groups.

Behavioral targeting of political adverts in election campaigns is particularly problematic from a democratic perspective. Since tracking is hidden from view, most people find it difficult to understand.

There are also are many vulnerable people who use Facebook and Instagram that need extra protection such as children, the elderly, and people with cognitive disabilities.”

Continue Reading →

New message action menu, search functionality, and HTML editor in Runbox 7

We have recently upgraded Runbox 7 with a new message list action menu. Per popular request from our customers we have now implemented a new menu that is always shown above the message list, instead of as a popup menu shown only when messages are selected:

We have also upgraded the HTML editor in Compose and added font selections so that you can change the font face when writing messages.

And if you search for email often (like us) you will be happy to know that searches now support date ranges. Here are a few examples of date searches that you can use either directly in the basic search field or via the advanced search pane:

  • date:2023 All messages in 2023
  • date:202310 All messages in October 2023
  • date:20231001 All messages on October 1, 2023
  • date:2022..2023 All messages from 2022 to (and including) 2023
  • date:20231001..202311 All messages from October 1, 2023 to (and including) November 2023

For more help on email searches in Runbox 7, please see message search help.

To see all changes to Runbox 7, please go see the Changelog in the app.

Continue Reading →

Email malware botnet dismantled by the FBI

Runbox was recently informed via our Internet Service Provider that a global botnet (robot network) consisting of hundreds of thousands of computers has been disrupted by the FBI.

In a coordinated operation taking place on August 29 in the US and several European countries, the malware (malicious software) known as Qakbot was removed from a large number of infected computers around the world.

What is Qaknet?

Since 2008, Qakbot had spread to victim computers mainly through spam email messages that contained malicious attachments or links. The infected computers effectively comprised a multinational infrastructure that cybercriminals utilized to commit ransomware, financial fraud, and other criminal activities.

In recent years the Qaknet botnet grew rapidly and some estimates state that it was related to around 25% of malware websites and responsible for extorting their victims through ransom payments amounting to tens of millions of dollars over the past couple of years.

Protecting your email account

As a security and privacy conscious email service we welcome this news and congratulate law enforcement on disrupting a vast network of cyber criminals who have victimized individuals and businesses on a large scale for decades.

Qaknet has also impacted some Runbox customers and we are contacting those affected directly via email in order to ensure their accounts are secured.

We strongly recommend that all email users utilize antivirus and antimalware software in addition to the spam and virus filters that are available in your email account. You can find a comparison of such software for various platforms at Wikipedia.

More information

More information about the dismantling of Qaknet can be found here:

Continue Reading →

Be privacy concerned when using ChatGPT (and other AI chatbots)

This is blog post #18 in our series on the GDPR.

Don’t tell anything to a chatbot you want to keep private.” [source]

Writing about AI in general and about chatbots specifically is like shooting at a moving target because of the speed of development. However, at Runbox we are always concerned about privacy and must examine the chatbots case in that respect.

Due to its popularity, we have mainly used ChatGPT from OpenAI as the target of our examination. NOTE: ChatGPT and the images from text captions DALL-E are both consumer services from OpenAI.

This blog post is a summary of our findings, leading to advice on how to avoid putting your privacy at risk when using the Natural Language Processing (NLP)-based ChatGPT.

Our examination is based on OpenAIs Privacy Policy, Terms of Use, and FAQ, and a number of documents resulting from hours of Internet browsing.

The blog post consists of two parts: PART I is a summary of our understanding of the technology behind language models in order to grasp the concepts and better understand its implications regarding privacy. In PART II we mainly discuss the relevant privacy issues. It is written as a stand alone piece, and can be read without necessarily have read PART I.

PART I: Generative AI technology

The basics

GPT stands for Generative Pre-trained Transformer, and GPT-3 is a 175 billion parameter language model that can compose fluent original writings in response to a short text prompted by a user. The current version of ChatGPT is built upon GPT-3.5 and GPT-4 from OpenAI.

ChatGPT was launched publicly on November 30, 2022. ChatGPT was released as a freely available research preview, but due to its popularity, OpenAI now operates the service on a freemium model [source].

The GPTs are the result of three main steps: 1) Development and use of the underpinning technology Large Language Models (LLMs), 2) Collection of a very large amount of data/information, and 3) Training of the model.

Let us also keep in mind that all this is possible only because of today’s advancements of computational power.

Language models

A language model is a system which denotes mathematics “converted” to computer programs that predict the next word/words in a sentence, or a complete sentence, based on probabilities. The model is a mathematical representation of the principle that words in a sentence depend of the words that precede them.

Since computers basically can only process numbers (in fact only additions and comparisons), text input to the model (prompts) must be converted to numbers, and likewise the output numbers have to be converted to text (response). Text in this context consists of phrases, single words, or parts of words called tokens.

When prompting a GPT then, your query is converted to tokens (represented by numbers), and used by the transformer where its attention mechanism generates a score matrix that determines how much weight should be put on each word in the input (prompt). This is used to produce the answer to the prompt, using the model’s generative capability – that is to predict the next word in a sentence by selecting relevant information from the pre-processed text with high level of probability of being fluent and similar to human-like text [source].

The learning part of the model is handled by a huge number of parameters representing the weights and also statistical biases for preventing unwanted associations between words. For instance, GPT-3 has 175 billion parameters, and GPT-4 is approximated to have around 1 trillion.

(The label “large in LLM refers to the number of values (parameters) the model can change autonomously as it learns.)

Collecting the data

The texts the GPT model generate stems from OpenAIs scraping of some 500 billion words (in the case of GPT-3, the predecessor for the current version of ChatGPT) systematically from the Internet: books, articles, websites, blogs – all open and available information, from libraries to social media – without any restriction regarding content, copyrights or privacy.

The scraping includes pictures and program codes as well and is filtered resulting in a subset where “bad” websites are excluded

The pre-training process

All that data is fundamental for pre-training the model. This process analyses the huge volume of data (the corpus) for linguistics patterns, vocabulary, grammatic properties etc. in order to assign probabilities to combinations of tokens and combinations of words. The aforementioned transformer architecture is used in the training process, where the attention mechanism makes it possible to capture the dependencies between words independent of their position in a sentence.

The result of the pre-training process is an intermediate stage that has to be fine-tuned to the specific task the model is intended for, for instance providing texts, program code, or translation of speech as response to a prompt. The fine-tuning process uses appropriate task-specific datasets containing examples typically for the task in question, and the weights and parameters are adjusted accordingly.

Of cause, a ChatGPT-response to a prompt is not “burdened” with the ethical, contextual, or other considerations a human will perform. To prevent undesired responses (toxicity, bias, or incorrect information), the fine-tuning process is supervised by humans in order to correct inappropriate or erroneous responses, using prompt-based learning. Here the responses are given a “toxicity” score that incorporates human feedback information [source].

ChatGPT usage training

The learning process continues when response generated following by a user’s prompts is saved and subject to the training process, at least for 30 days, but “forever” if chat history isn’t turned off. In any event it is not possible to delete specific prompts from user history [source], only entire conversations

In the world of AI and LLMs, hallucinations are the word used when responses are like “pulled from thin air”.

OpenAI offers an API that makes it possible for “anyone” to train GPT-n models for domain specific tasks [source], that is to build a customized chatbot. In addition, they have launched a feature that allow GPT-n to “remember” information that otherwise will have to be repeated [source, source].

Takeaways

  • The huge volume of data scraped is obviously a cacophony of contents and qualities that will affect the corpus and so also the probability pattern and the responses produced [source].
  • ChatGPT has limited knowledge of events that have occurred after September 2021, the cutoff date for the data it was trained on [source].
  • The response you get from ChatGPT to your prompt is based on probabilities, and as such you have no guarantee of the validity [source].
  • A prompt starts a conversation, unlike a search engine like DuckDuckGo and Google that gives you a list of websites matching your search query [source].
  • ChatGPT uses information scraped from all over the Internet, without any restrictions regarding content, copyrights, or privacy. However, manual training of a model was introduced to detect harmful content [source]. Violations of copyrights has resulted in lawsuits [source], and also signing of more than 10 000 authors of an open letter to the CEOs of prominent AI companies [source].
  • Your conversation is normally used to train the models that power ChatGPT, unless you specifically opt-out [source].

PART II: Chatbot privacy considerations

The privacy considerations with something like ChatGPT cannot be overstated” [source]

The following introduction is mainly made for readers that have skipped this blog post PART I.

Generative AI systems, such as ChatGPT, use information scraped from all over the Internet, without permissions nor restrictions regarding content, copyrights, or privacy (more on this in PART II). This means that what you have written on social media, blogs, comments on an article online etc. may have been stored and used by AI companies to train their chatbots.

Another source for training of generative AI systems is prompts, that is information from users when asking the chatbot something. What you ask ChatGPT, the sentences you write, and the generated text as well, is “taken care of” by the system and could be available for other users through the answer of their questions/prompts.

However, according to Open AI’s help center article, you can opt-out of training the model, but “opt-in” is obviously default.

So, both the Internet scraping and any personal information included in your prompts can have as result that personal information could turn up in a generated answer to another arbitrary prompt.

This is very problematic for several reasons.

Is Open AI breaching the GDPR?

First, OpenAI (and other scraping of the Internet) never asked for permission to use the collected data, which could contain information that may be used to identify individuals, their location, and all kinds of sensitive information from hundreds of millions of Internet users.

Even if Internet scraping is not prohibited by law, it is ethically problematic because data can be used outside the context in which it was produced, and so can breach contextual integrity, which has de facto been manifested in the EU’s General Data Protection Regulation (GDPR) Article 6, 1 (a) as prerequisite for lawful processing of personal data:

…the data subject has given consent to the processing of his or her personal data for one or more specific purposes

Here language models, like Open AI’s ChatGPT, are in trouble: Personal data can be used for any purpose – a clear violation of Article 6.

Second, there is no procedures given by Open AI for individuals to check if their personal data is stored and thereby can potentially be revealed by arbitrary prompt, and far less can data be deleted by request. This “right to erasure” is set forth in the GDPR Article 17, 1:

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay …” on the grounds that “(d) the personal data have been unlawfully processed

It is inherent in language models that data can be processed in ways that are not predictable and presented/stored anywhere, and therefore the “right to be forgotten” is unobtainable.

Third, and without going into details, the GDPR gives the data subjects (individuals) regarding personal data the right to be informed, the right of access, the right to rectification, the right to object, and the right to data portability. It is questionable if generative AI systems can ever accommodate such requirements since an individual’s personal data could be replicated arbitrarily in the system’s huge dataset.

Fourth, Open AI stores all their data, including personal data they collect, one way or another, on servers located in the US. That mean they are subject to the EU-US Data Privacy Framework (see our blog Privacy, GDPR, and Google Analytics – Revisited), and the requirements set there.

To answer the question posed in the headline of this paragraph, Is OpenAI breaching the GDPR?It is very difficult to understand how ChatGPT, and other language models for generative use (Generative AI systems) as well, can ever comply with the GDPR.

What about the privacy regulations in the US?

Contrary to the situation in Europe, there is no federal privacy law in the United States – each state has their own jurisdiction in this area. There are only federal laws such as HIPAA (Health Insurance Portability and Accountability Act) and COPPA (Children’s Online Privacy Protection Act) which regulate the collection and use of personal data categorized as sensitive. However, there are movements towards regulation of personal information in several states as tracked by IAPP (The International Association of Privacy Professionals).

How do OpenAI use data they collect?

When signing up to ChatGPT, you have to agree to OpenAI’s Privacy Policy (PP), and allow them to gather and store a lot of information about you and your browsing habits. Of course, you have to submit all the usual account information, and to allow them to collect your IP-address, browser type, and browser settings.

But you also allow them to automatically collect information about for instance

“… the types of content that you view or engage with, the features you use and the actions you take, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, and your computer connection”.

All this data made it possible to build a profile of each user – bare facts, but also more tangible information such as interests, social belongingness, concerns etc. This is similar to what search engines do, but ChatGPT is not a search engine — it is a “conversational” engine and as such is able to “learn” more about you depending on what you submit in a prompt, that is, how you engage with the system. According to their PP and the citation above, that information is collected.

The PP acknowledges that users have certain rights regarding their personal information, with indirect reference to the GDPR, for instance the right to rectification. However, they add:

“Given the technical complexity of how our models work, we may not be able to correct the inaccuracy in every instance.”

OpenAI reserves the right to provide personal information to third parties, generally without notice to the user, so your personal information could be spread to actors in OpenAI’s economic infrastructure and is very difficult to control.

Misuse of your personal information – what are the risks?

It is reasonable to assume that OpenAI will not knowingly and willfully set out to abuse your personal information because they have to adhere to strict regulations such as GDPR, where misuse could result in fines of hundreds of millions of dollars.

The biggest uncertainty is linked to how the system responds to input in combination with the system’s “learning” abilities.

If asked the “right” question, the system can expose personal information, and may combine information about a person, e.g. a person’s name, with characteristics and histories that are untrue, and which may be very unfortunate for that individual. For instance, asking the system something about a person by name, can result in an answer that “transforms” a credit card fraud investigator to be a person adhered to credit card scam.

Takeaways

Using generative AI systems, for example ChatGPT, is like chatting with a “black box” – you never know how the “box” utilizes your input. Likewise, you will never know the sources of the information you get in return. Also, you will never know if the information is correct. You may also receive information about other individuals that you shouldn’t have, potentially even sensitive and confidential information.

Similarly, other individuals chatting with the “box”, may learn about you, your friends, your company etc. The only way to avoid that, is to be very careful when writing your prompts.

That said, OpenAI has introduced some control features in their ChatGPT where you can disable your chat histories through the account settings – however the data is deleted first after 30 days, which means that your data can be used for training ChatGPT in the meantime.

You can object to the processing of your personal data by OpenAI’s models by filling out and submitting the User Content Opt Out Request form or OpenAI Personal Data Removal Request form, if your privacy is covered by the GDPR. However, when they say that they reserve the right “to determine the correct balance of interests, rights, and freedoms and what is in the public interest”, it is an indication of their reluctance to accept your request. The article in Wired is recommended in this regard.

Valuable sources

  1. GPT-3 Overview. History and main concepts (The Hitchhiker’s Guide to GPT3)
  2. GPT-3 technical overview
  3. Transformers – step by step explanation
  4. LMM training and fine-tuning

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Continue Reading →

Privacy, GDPR, and Google Analytics – Revisited

This is blog post #17 in our series on the GDPR.

Summary of the case

In our blog post on 23 October 2022, we referred to the Data Protection Authorities (DPAs) of Austria, Denmark, France, and Italy who were concluding that the use of Google’s Universal Analytics (UA or GA3) is not compliant with the EU’s General Data Processing Regulation (GDPR).

The reason for this is that the use of GA3 implies that personal data is transferred to the US, which at that point in time was not on the EU’s list of countries that have adequate level of protection of personal data. This means that the US was not fulfilling the requirements set by the EU/GDPR regarding ‘the protection of fundamental rights and freedoms of natural persons’, which is a key expression in the GDPR.

Furthermore, the Norwegian DPA (Datatilsynet) had up until 23 October 2022 received one (1) complaint regarding Google Analytics. Before any final decision is made, they have to confer with other supervisory authorities in the EEA that also have received similar complaints, according to GDPR Article 60 (One-Stop-Shop mechanism).

(We regret that links in italics in this article point to web pages in Norwegian.)

Universal Analytics (GA3) replaced by GA4

In October 2020, Google released Google Analytics 4, the new version of Google Analytics. In March 2022, Google announced that the Google Universal Analytics tool will be sunset in July 2023 and that Google would only provide the GA4 tool after 1 July 2023.

The Danish DPA have analyzed the GA4 regarding privacy, and concludes on their website that even if improvements have been made, it is still the case that “law enforcement authorities in the third country can obtain access to additional information that allows the data from Google Analytics to be assigned to a natural person.” That said, GA4 is illegal in terms of the GDPR because servers in the US are involved in the process, as long as an adequacy decision EU/US is not made.

The Norwegian DPA decision

Norwegian DPA reports on their website 27 July 2023 that they have concluded on the complaint mentioned above. The complaint stems from the noyb who lodged it against 101 European websites to the data supervisory authorities in the EEA for the use of GA. One of these was the Norwegian telecom-company Telenor, who at that time was using GA.

The conclusion is that personal data then was transferred to the US in violation of the GDPR, Article 44. In other words, the use of Google Analytics was illegal. Because Telenor discontinued use of GA on January 15, 2021, the Norwegian DPA in a letter on 26 July 2023 finds that a reprimand “to be an adequate and proportionate corrective measure”.

The Norwegian DPA relies on the Danish authority by claiming that the conclusion will be the same regardless of whether Google Analytics 3 or 4 has been used (see above).

What about adequacy EU/US?

On 10 July 2023 the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework and announced a new data transfer pact with the United States.

Accordingly, companies from the EEA area should be able to legally use GA as long as Google enter into a so-called Standard Contractual Clauses that provide data subjects with a number of safeguards and rights in relation to the transfer of personal data to Google LLC (Limited Liability Company) in the US.

However there is a big “but”: Max Schrems at noyb writes: “We have various options for a challenge already in the drawer, …. We currently expect this to be back at the Court of Justice by the beginning of next year. The Court of Justice could then even suspend the new deal while it is reviewing the substance of it.”

To use the same phrase as in the recent update of our blog post On the EU-US data transfer problem: The last words are obviously not said.

Continue Reading →

Better search functionality and HTML view controls in Runbox 7

With this release we are adding more advanced search features including date range searches, as well as improved HTML view controls that let you save display preferences per individual sender.

💡 To access these features, ensure that Runbox 7 is updated by reloading it in a web browser or restarting it on your phone.

More advanced search functionality

Search field controls

By clicking the wrench icon next to the search field you can now easily search only for messages that:

  • Have one or more attachments.
  • Have been replied to.
  • Are flagged.
  • Are unread.

This screenshot shows the advanced search area that provides you with extensive options for message search:

Advanced search screenshot
Advanced search area screenshot

Additionally you can now search by date ranges, for instance messages that were:

  • Received in 2023: date:2023
  • Received between 2020 and 2021: date:2020..2021
  • Received in 2021 or later: date:2021..

Improved HTML message view controls

We have also improved the HTML message view controls that allow you to save HTML and image display preferences for individual senders or for all senders.

The examples below illustrate how this functionality can be used.

HTML view options example 1

Show the text version for the current message:

HTML view options example 2

Show the HTML version with images for all messages from this sender:

Larger popular recipients list

The popular recipients list in Compose has also been improved by increasing the number of contacts from 5 to 10.

The addresses shown beneath the To field can be added to the To field by clicking on them, or dragged to the To, CC, or BCC fields.

Note that this functionality is only available when using the local search index, which is controlled by the “Synchronize index” button in the lower left corner.

Changelog since the previous release

For the more technically inclined, a list of the changes made to Runbox 7 since the previous release can be found below.

Please see https://runbox.com/app/changelog for the complete and categorized changelog.

Commits from fd5c902 to d6c1dca:

  1. Visual changes (preview): Improve formatting of the empty preview pane. (60fcacf)
  2. Visual changes (mailviewer): Increase vertical flexibility of subject field. (364272b)
  3. Visual changes (mail menu): Improve read and unread icons. (93e75ae)
  4. New feature (search): Add more options to advanced search pane. (f2104ac)
  5. Visual changes (preview): Improve HTML display buttons. (16b7a77)
  6. Internal changes (preview): Update test. (7cfda5f)
  7. New feature (search): Enable date range searches (6e8acdb)
  8. New feature (search): Enable Unread Only checkbox only if other options set (45ee5be)
  9. Bug fix (preview): Add tooltip for all senders button. (d86b6eb)
  10. Visual changes (compose): Improve and fix recently used recipients list. (ccbf85b)
  11. Bug fix (payments): Always show “payment not loading” for stripe (ff53567)
  12. Bug fix (payments): Change “payment not loading” to “not working” (e137b26)
  13. Bug fix (payments): Change “legacy” to “alternative” (d6c1dca)

Continue Reading →

Runbox 7 updates March – May 2023: Framework upgrades and interface improvements

This constitutes a major upgrade to the framework and libraries that Runbox 7 is built on, which will facilitate further continuous upgrades and features.

It also includes several bug fixes and improvements, including storing display preferences on the server. This will make the user interface work more consistently across browsers, devices, and sessions and result in a more streamlined experience.

  1. Internal changes (deps): bump ua-parser-js from 0.7.31 to 0.7.33 (75df34d)
  2. Internal changes (deps): bump jszip from 3.7.1 to 3.10.1 (ef32ab1)
  3. Bug fix (drafts): Ensure we only refresh drafts once per folders update (f024af2)
  4. Bug fix (delete): Catch/Prevent more errors by ensuring defaults (5e83f89)
  5. New feature (mailviewer): Display incoming attachment sizes (926ab4b)
  6. Bug fix (compose): More readable attachment file size display (e44fc63)
  7. Visual changes (security): Specify which special characters are allowed in passwords. (#1401) (c575f06)
  8. Internal changes (deps): Update angular2-hotkeys to v13 (85aee64)
  9. Internal changes (deps): Upgrade to angular 12 (11b3aeb)
  10. Internal changes (deps): Update nodejs version for CI (a5cd077)
  11. Internal changes (deps): Upgrade angular-datetime-picker (2a87817)
  12. Internal changes (deps): Upgrade to v13 (4c744c1)
  13. Internal changes (deps): Change swupdate.available to swupdates.versionUpdates (ad7b36a)
  14. Internal changes (deps): Move from tslint to eslint (c010fca)
  15. Internal changes (deps): Remove –aot for start-use-mockserver (08afe91)
  16. Internal changes (deps): Remove SingleMailViewerComponent from rmm6.module.ts (ddebc3f)
  17. Internal changes (deps): Upgrade cypress to 9.7 (c38f460)
  18. Internal changes (deps): Update ical.js to 1.5.0 and use ES2020 modules (9bf6dda)
  19. Internal changes (deps): Fix selectFile file path (ee83c8f)
  20. Internal changes (deps): Update dependant packages (2c11d60)
  21. Internal changes (deps): Upgrade to angular v14 (cddac42)
  22. Internal changes (deps): Explicitly specify runbox7 for build (1b07233)
  23. Internal changes (deps): Upgrade angular/material to v13 (adef6c3)
  24. Internal changes (deps): Revert to angular/material v11 for auto upgrade (97f89cc)
  25. Internal changes (deps): Manually upgrade to angular material v12 (3e04baa)
  26. Internal changes (deps): Upgrade material to v13 (3096d97)
  27. Internal changes (deps): Upgrade angular-datetime-picker to v14 (3876111)
  28. Internal changes (deps): Upgrade to material v14 (c280c39)
  29. Internal changes (deps): Fix missing hues for SCSS (6a916d5)
  30. Internal changes (deps): Update @angular-eslint packages (8b0c16f)
  31. Internal changes (deps): Upgrade to angular v15 (2374336)
  32. Internal changes (deps): Upgrade to angular material v15 (6dc73b2)
  33. Internal changes (deps): Remove duplicate @include from SCSS (b35a68a)
  34. Internal changes (deps): Change default browser for CI to firefox (ab522f6)
  35. Internal changes (deps): Upgrade npm, comment out pre-build.js integrity check (ff13958)
  36. Internal changes (deps): remove –browser firefox from e2e tests (ab8b437)
  37. Internal changes (tests): Add DISPLAY=” to ci-tests (8441a51)
  38. Internal changes (deps): Remove unused protractor dependency (6e0f935)
  39. Internal changes (deps): Upgrade core.js to v3 (7aa65d3)
  40. Internal changes (deps): Remove unused protractor files (b7c312b)
  41. Internal changes (deps): Upgrade @angular-devkit/build-angular and move angular/compiler-cli to devDependencies (4cd4bc2)
  42. Internal changes (deps): Remove unused ajv dependency (b447972)
  43. Internal changes (deps): Upgrade angular-calendar (a273376)
  44. Internal changes (deps): Update rxjs to v7 (a87c0b3)
  45. Internal changes (deps): Upgrade @angular/pwa (d4850f0)
  46. Internal changes (deps): Remove array-flat-polyfill (8c527d8)
  47. Internal changes (deps): Update moment-timezone and remove uneeded @types/moment-timezone (478eb5a)
  48. Internal changes (deps): Update rest of dependencies (excluding timymce) (5ed129b)
  49. Internal changes (deps): Update jasmine to latest version (d0084df)
  50. Internal changes (deps): Upgrade karma to latest version (da8a151)
  51. Internal changes (deps): Update ts-* deps and node types (0b7abb4)
  52. Internal changes (deps): Update start-server-and-test (ee77754)
  53. Internal changes (deps): Update eslint and @typescript-eslint (4285f0d)
  54. Internal changes (deps): Update cypress to v10 (d350af9)
  55. Internal changes (deps): Update cypress to v11 (480b506)
  56. New feature (all): Store user preferences on the server (1409515)
  57. New feature (compose): Store last used HTML compose setting (dc1a75e)
  58. Bug fix (mailview): Store “prompted for local index” preference on server (0d9085e)
  59. Internal changes (preferences): Ensures tests set defaults, test correct values (035f28c)
  60. Bug fix (preferences): Remove old style local storage after conversion (7ca13b7)
  61. Bug fix (preferences): Ensure higher server version takes precedence (d8766f8)
  62. Bug fix (preferences): Load screensize before settings (da76123)
  63. Internal changes (deps): Update cypress to v12 (4ba7f7e)
  64. Internal changes (lint): Only include src/ else we run out of js heap memory (f359c38)
  65. Internal changes (deps): bump @npmcli/arborist and npm (9cf4279)
  66. Bug fix (compose): Generate Reply/Fwd header text only when needed (7afcbf7)
  67. Bug fix (compose): Convert reply/fwd text if compose HTML default is on (c512556)
  68. Bug fix (maillist): Store and reload column widths from preferences (cfb732d)
  69. Visual changes (preview): Improve formatting of the empty preview pane. (60fcacf)
  70. Visual changes (mailviewer): Increase vertical flexibility of subject field. (364272b)
  71. Visual changes (mail menu): Improve read and unread icons. (93e75ae)
  72. Bug fix (changelog): Add missing categories and improve formatting. (fd5c902)

Continue Reading →

Phishing: What it is and how to avoid being scammed

In the past few weeks there have been a series of phishing attacks aimed at a small subset of Runbox customers. The goal of these scams is to trick unsuspecting email users into clicking on malicious web links and entering their Runbox username and password, enabling the scammers to steal their password.

At Runbox we are constantly on guard against phishing attacks against our customers, and here we take a closer look at this increasing problem and some simple steps you can take to protect yourself.

As a summary, ensure that you check:

  1. The From address. Phishing messages almost always come from a random email address that do not match our list of Official Runbox Email Addresses.
  2. The message addresses you by name. Scammers typically only have lists of email addresses without any first or last names, so if the message does not address you by your first and last name it is likely to be a scam.
  3. The legitimacy of any email with links. Check where the link will actually take you. Hover over it with your mouse, and you can see whether it will in fact take you to some random address not associated with Runbox at all.
  4. Any false urgency. Runbox will never pressure you to act suddenly. Scammers may try to create a sense of urgency to persuade you to do what they’re asking.

What is phishing?

Example of a recent phishing message

Phishing is a type of cyber attack in which an attacker attempts to obtain sensitive information such as usernames, passwords, or credit card details by posing as a trustworthy entity via email messages.

The word “phishing” is derived from fishing and refers to using lures to “fish” for sensitive information. Phishing attacks typically use social engineering to gain a victim’s trust, and use spoofing such as faking an email address or URL to make the attack appear legitimate.

When phishing attacks are targeted at certain services or individuals it’s called “spear phishing”, and in this case they appear to be sent from Runbox Support, the Runbox Team, or other similar official sounding names.

Email users who are unfortunate enough to receive a spear phishing message and end up divulging their Runbox login details can end up having their Runbox accounts hijacked and used to send spam, which then forces us to suspend the accounts until the customer can regain access.

With access to an email user’s account the attackers may then be able to access their personal information and use it to commit fraud or identity theft, which can in turn result in financial loss or worse.

Naturally such account hijacking causes much confusion for the affected customers in addition to the privacy intrusion and consequences for the recipients of the spam being sent, which is often another phishing scam. The phishing then continues to cascade to new groups of innocent users of other email services, while exploiting people’s trust and rarely being caught.

It is important to understand that these scammers are criminals, and that being tricked into disclosing any login details can have serious consequences.

How to spot phishing

The easiest way to see whether a message is in fact from Runbox is to check the From address, as phishing emails almost always come from a random email address not on any Runbox domain names such as runbox.com.

Example of legitimate email from Runbox

You can find more details on this here: How can I tell whether an email is legitimate?

Another important clue is whether the email addresses you by name, or whichever name you have entered in your Runbox Account details. Attackers typically only have lists of email addresses without any first or last names, so if the message does not address you by name it is likely to be a scam.

The third way to check the legitimacy of any email which asks you to click on a link, is to check where the link will actually take you. Some phishing links look like they link to a Runbox web page, but if you hover over it with your mouse, you can see that it will in fact take you to some random address not associated with Runbox at all.

If in doubt, go to our main website Runbox at https://runbox.com for information, or contact us via Runbox Support at https://support.runbox.com.

Do not be fooled or threatened by the scams

Most phishing emails have a very urgent and even threatening tone, trying to scare the recipient into acting right away to avoid having their account shut down or disrupted.

The scammers might even read our blog or other web pages and notice that we have two webmail versions, and subsequently send messages claiming that if you don’t switch to the newer version within X days, then your account will be shut down, for instance.

Legitimate messages from the Runbox Team will always give notice about something happening in the future, or optional new features.

Catching the scammers

We are constantly working to improve our defenses against phishing attacks, spam, and viruses, and we take immediate action to remove spear phishing messages as soon as we become aware of an attack.

If you have received any scam emails like the ones described above without responding in any way then your account is perfectly safe. We do however appreciate you notifying us via Runbox Support at https://support.runbox.com so that we can take steps to protect you and our other customers against the attack.

We also highly recommend enabling our Two-Factor Authentication features, which will keep your account safe even if your password should be stolen. For more on this, please see our Account Security Help page at https://help.runbox.com/account-security/.

If you have any doubts about an email you have received, then please don’t hesitate to contact Runbox Support at https://support.runbox.com.

Continue Reading →