Domains and Privacy

From time to time we get asked why Runbox uses runbox.com as our primary email domain rather than our runbox.no domain.

The reason we are asked this is because some people assume that by using a .com domain all the Internet traffic to and from our servers is routed via the Unites States, and could be subject to US government eavesdropping.

(more…)

Continue Reading →

Outlook for iOS – Privacy Issues

Email Apps and Privacy

Back in May 2014 we reported on our investigations in to two smartphone/tablet apps that had been launched. We were worried to find that the apps did not use our outgoing SMTP servers directly, and instead sent email through non-Runbox servers. This made for much easier set up of accounts, but we didn’t like that it wasn’t obvious to the user what was going on.

Those apps were myMail and Evomail (the later is no longer available).

Outlook and Privacy

Outlook now has IMAP compatibility and is able to work with Runbox accounts, however, like myMail and Evomail it doesn’t connect directly to the Runbox SMTP servers for outgoing mail. In fact, we don’t know if it retrieves email directly from our servers either. We do know that it stores some details of your account on servers that are part of Amazon Web Services.

If this doesn’t bother you, then that’s fine as Outlook is turning in to a nice email app that sits nicely alongside the other Microsoft offerings for iOS and Android.

Using Email Apps that Connect Directly to the Runbox Service

We believe that for maximum security and privacy email apps should be connecting directly to the Runbox service and not connecting via other servers, or storing account details anywhere other than in the app on the device.

Usually if you have to enter the server details for incoming and outgoing mail then the app is likely to connect to those services directly. If you have any doubts about an app, please get in touch with Runbox Support and we will investigate how it behaves.

Continue Reading →

Notice to Apple Mail users regarding APOP

Today we disabled SSL 3.0 for POPS (Secure POP) and changed how we terminate POP connections to make it more secure.

Some Apple Mail users are using the server address apop.runbox.com and/or the authentication setting: Authenticated POP (APOP) in Apple Mail.

To change the account settings, please follow these instructions:

  1. Mail => Preferences to open the Accounts dialog.
  2. Select your Runbox account in the left pane.
  3. In “Incoming Mail Server”, enter: secure.runbox.com
  4. Click the Advanced button.
  5. Make sure the port is set to: 995
  6. Under “Authentication”, select: Password (Previously Authenticated POP)
  7. Click the red button in the top left corner to close Accounts.
  8. Click Save.

We added a Apple Mail compatible setup on the 13th of February 2013 after an update to Mail from Apple broke authentication for many users.

The new settings is a more secure way of using POP and will make sure your connection with our servers always use TLS (Transport Layer Security) or it will fail.

Continue Reading →

Special Holiday/New Year offer from Runbox

Gift BoxTo celebrate a great year and to further the cause of secure and private communication, we would like to give all our customers:

A free Sub-Account for one year
…if you subscribe or renew your main account by Jan 15th!

A Runbox account is a great gift to someone you know who cares about secure and private communication — and of course a fully featured, professional email service.

Just proceed to payment now to get your free sub-account!

And make sure you lock in our current great prices by taking advantage of our 3 years for the price of 2 offer on the Medium subscription plan!

Please contact us after you have completed your payment to let us know you want to take advantage of this offer so that we can add the sub-account slot to your main account.

You will then be able to set up the sub-account by going to Account > Sub-Accounts.

Note that whenever you renew your main account the additional time will simply be added to the end of your subscription, so you won’t lose any subscription time by renewing early.

Happy Holidays from everyone at Runbox, with our best wishes for the new year!

Terms of this offer:

  • The free sub-account will be of the same type as your main subscription (Micro, Mini, Medium, or Max).
  • The offer is for an additional free account and cannot be used to renew an existing sub-account.
  • The offer can be combined with the 2 years for the price of 1 offer upon subscribing to a new main account within 24 hours of signing up, and the 3 years for the price of 2 years offer which is available to everyone.

Continue Reading →

Projects in the pipeline 2015

We have worked hard on upgrading our email server park to accommodate all our new customers — and things will only get better: Based on our recent success, our shareholders decided to invest fresh capital to start several new projects that will take Runbox to the next level.

To boost IMAP performance and improve the experience especially for iPhone and iPad users we will soon deploy new Dovecot-based IMAP software.

We have started implementing an SSD (Solid-state Drive) based storage strategy to dramatically improve the performance of our email storage units. SSDs are up to 100 times faster than regular, rotating disks, so this will improve the speed of our IMAP services.

We are also expanding our server park with new servers and upgrades to continue improving reliability and overall performance.

Projects planned for 2015

We will continue working hard to ensure the privacy and security of your data, and have the following projects lined up for next year:

  • Implementation of two-factor authentication for improved login security.
  • Integration of PGP email encryption with our Webmail in order to make PGP easier to use with Runbox (note that you can already use PGP in your email client).
  • Improvements and upgrades to our spam servers and software to keep up with the ever-present spam challenge.
  • Implementation of a CalDAV server for calendar synchronization.

We look forward to continue providing great email services in the year to come.

Continue Reading →

New Webmail design: Runbox Aero

2014 has been an exciting year for Runbox and we’ve seen a substantial increase in popularity and growth. This has really boosted our progress — we now have several major upgrades in the pipeline, and we are very happy to be launching a new Webmail design!

Runbox Aero PreviewWe’ve called the new design Runbox Aero because it’s lighter, airier, and simpler — and it makes using email a breeze!

Runbox Aero is inspired by modern, state-of-the-art design, and we have listened carefully to feedback from you in order to make it both aesthetically pleasing and user-friendly.

You can try the new design now by going to
Webmail > Preferences and selecting Runbox Aero from the drop-down menu. Make sure you click Save Settings afterwards!

You will quickly notice some of the improvements, but the following changes are worth mentioning:

Modernized look

  • The font face has been replaced with a larger, lighter, and more modern font. A bolder font face is available in an alternative design.
  • The header has been shrunk to make more room for your email.
  • All the icons have been redesigned and optimized for retina (high resolution) displays.
  • All buttons have been enlarged and are now dark blue to make them easier to see.

Better menu navigation

  • The sub-menus have been enlarged to make them easier to navigate.
  • The Compose button has been moved to the far left and made more prominent.
  • The Folder Management button has been removed — just click Folders at the top of the folder list or the Folder Management link underneath it to access the Folders screen.
  • The Read, Unread, Flag, and Unflag buttons can now be accessed by hovering the cursor over the new Mark button.

Simplified Compose screen

  • The Compose screen has been simplified to only show the most important fields. To see the BCC, Attachments, Tags, and Nicknames fields, just click “Show all fields”.

We hope you like the new design, and please let us know if you have any comments or suggestions!

Continue Reading →

Upgrading Runbox 5 Customers

Today we have upgraded the remaining Runbox 5 users to the latest version of the Runbox webmail interface. We introduced Runbox 6 in January 2013 and gradually most of our customers have moved over to this.

This latest interface has a number of new features, and is built on programming that is more stable and allows us to add new features more easily.

You can read more about the features in the original blog post about Runbox 6.

The change to the latest webmail version also allows those customers previously using Runbox 5 to access the new webmail design called Runbox Aero. This is a modern and more user-friendly design, with graphics that are compatible with the newer high resolution screens featured on laptop and desktop computers.

If you have any questions about this change, please get in touch with us at Runbox Support or email support@nullrunbox.com

Continue Reading →

Why Runbox being in Norway is important

We are emphasizing Runbox’ location in Norway as something that is important to you as an email user, and you may wonder why. This article will explain it all.

Summary

  • Norwegian ShieldAll your Runbox email is privacy protected because our servers are located in Norway, and Runbox strictly adheres to the Norwegian privacy legislation.
  • Runbox protects your data against disclosure because the authorities must present a valid court order based on evidence of criminal activity to seize any data.
  • Any foreign nation requesting account information or contents have to send a formal request to Norwegian judicial authorities, and only with a Norwegian court order can any data be disclosed.
  • Norwegian authorities are not allowed to perform surveillance of data traffic without a court order.
  • Under Norwegian legislation, Runbox is not required to keep any traffic logs, and is permitted to delete your data if you ask us to.

Norwegian privacy legislation and regulations

First of all, Norway has enacted strong legislation regulating the collection, storage, and processing of personal data, mainly in The Personal Data Act (Lov om behandling av personopplysninger; Personopplysningsloven) and Regulations on the Processing of Personal Data (Forskrift om behandling av personopplysninger; Personopplysningsforskriften).

The first version of The Personal Data Act was implemented as early as 1978. This was a result of the pioneering work provided by the Department of Private Law at the University of Oslo, where one of the first academic teams within IT and privacy worldwide was established in 1970.

Additionally, the Norwegian Data Protection Authority (Datatilsynet), an independent authority, facilitates protection of individuals from violation of their right to privacy through processing of their personal data. It also verifies that statutes and regulations which apply to the processing of personal data are complied with, and that errors or deficiencies are rectified.

Any complaint against decisions made by The Data Protection Authority may be reported to The Privacy Tribunal (Personvernnemda), another independent authority, for decision.

The Norwegian Criminal Procedure Act (Lov om rettergangsmåten i straffesaker; Straffeloven, unofficial translation) is an important law governing the seizure of objects or data when a criminal act has been reported to the police. Section 211 states that mail may only be seized from an electronic communication service pursuant to a court order.

Another important law in this context is the Norwegian Penal Code (NPC, Almindelig borgelig straffelov; Straffeloven, unofficial translation) which states that it is illegal to access information systems or data unauthorized (NPC §145), and this includes all employees in the public sector (NPC §116).

We must also mention Norwegian Law on Electronic Communications (Lov om elektronisk kommunikasjon; Ekomloven), which regulates telecommunications in Norway. This law contains rules for the interception of electronic communications and for the duration of storage of personal data.

Because Runbox is similar to an Internet service provider and not a telecommunications company, Runbox is NOT affected by this law. This means that Runbox for instance is permitted to delete your email data upon your request at any time, and that we are not required to store any traffic logs.

The bottom line is that a request from Norwegian police authorities to disclose data from any Runbox account will be rejected by Runbox unless a Norwegian court has decided otherwise.

What does compliance with Norwegian privacy laws mean?

So what does Runbox’ compliance to Norwegian laws mean regarding your personal data when using Runbox, and the content of your emails stored on our servers?

Runbox does not collect any data about you except what is necessary to provide you with our services. This is in accordance with our Terms of Service and Privacy Policy, which is compliant to The Personal Data Act §8. This paragraph states that personal details can only be collected and processed with consent from the registrant.

Similarly important is §11, stating that personal data must not be used for purposes inconsistent with the initial purpose of collection except with consent from the user.

Only if presented with a court ordered seizure pursuant to the Norwegian Criminal Procedure Act may Runbox be forced to disclose information to The Norwegian Police Service. It is therefore an absolute prerequisite that a crime has been committed.

What about requests from authorities outside Norway?

A request from foreign authorities or agencies regarding Runbox account details or user data has a long way to go before it reaches Runbox:

It will in general start with a legal request (letter rogatory) submitted through diplomatic channels to the Norwegian Ministry of Foreign Affairs, who sends it to the Attorney General at the Norwegian Office of the Prime Minister, who will, if appropriate, forward the request to the Ministry of Justice and Public Security who in turn sends it to the appropriate police unit, for example the National Criminal Investigation Service, Norway (Den nasjonale enhet for bekjempelse av organisert og annen alvorlig kriminalitet; Kripos) or The Norwegian Police Security Service (Politiets sikkerhetstjeneste; PST) for independent investigation. All requests will of course be evaluated with regards to Norwegian laws and regulations.

The Norwegian police authorities may then present Runbox with a subpoena, which will be rejected by Runbox as a matter of principle. The case may then be submitted to a Norwegian court, and an attorney will be appointed to represent the account owner. If the court finds that there is evidence or probable cause for suspicion of criminal activity on the part of the account owner, Runbox may be presented with a court order requesting us to disclose the requested information.

Norway has entered into agreements with some foreign nations to cooperation in criminal matters regarding disclosure of objects and data, that may simplify the procedure above:

Through the European Convention on Mutual Assistance in Criminal Matters requests go directly to the Ministry of Justice and Public Security, through the Schengen Agreement requests go to the public prosecutor in Norway, and between Nordic countries, requests go to central or local police (district chiefs of police). Requests from Canada and Thailand go directly to the Ministry of Justice and Public Security.

All other nations, the United States included, have to follow the general rule outlined above: Requests must be sent through diplomatic channels to the Norwegian Ministry of Foreign Affairs. The agreement between Norway and the United States (and Australia) is about extradition of criminals only, not about assistance in “ordinary” legal matters.

Since Runbox Solutions was founded in 2011 we have received 0 court orders for disclosure of account details or user data. We have received 3 requests directly from attorneys in the United States, all of which have been rejected outright.

What about surveillance…

According to the laws mentioned above, the Norwegian police authorities can not execute communication control, for instance surveillance of electronic messages, without a valid court order. An independent tribunal, the Control Committee for Wiretapping (Kontrollutvalget for kommunikasjonskontroll) is established to control that the police’s use of wiretapping occurs within the framework of the law and that the use of such methods is as limited as possible.

This means that no surveillance of traffic to or from Runbox can occur unless a valid court order is presented. However, the regulation that governs wiretapping (Forskrift om kommunikasjonskontroll; Kommunikasjonskontrollforskriften) and the Control Committee for Wiretapping do not pertain to intelligence, which is the domain of The Norwegian Parliamentary Intelligence Oversight Committee (Stortingets kontrollutvalg for etterretnings-, overvåkings- og sikkerhetstjeneste), see below.

…and intelligence?

Let us examine the various Norwegian intelligence agencies and their mandates:

The Norwegian Intelligence Service (Etterretningstjenesten) is a body established in order to survey and monitor civil and military activities outside Norway. This body is not authorized to survey or collect information about Norwegian natural or legal persons, which includes companies. For that reason, Runbox is beyond the authority of this agency.

The Norwegian Police Security Service (Politiets sikkerhetstjeneste; PST) do NOT have any legal rights beyond The Norwegian Police Service, which is discussed above.

The Norwegian Defence Security Department (Forsvarets sikkerhetsavdeling, FSA) applies to military institutions only, and is not relevant for Runbox customers at all.

The National Security Authority (Nasjonal sikkerhetsmyndighet, NSM) is established to control governmental and civil institutions regarding security, and because Runbox does not provide services to such institutions, this authority is not relevant to Runbox or our customers.

Joint Counter-terrorism Center (Felles kontraterrorsenter, FKTS), is a recently established department within PST staffed with people from PST and EtterretningstjenestenFKTS is a cooperation agency sharing information and analyzing terror threats against Norway. FKTS is subject to the laws and regulations governing the activities of The Norwegian Police Security Service and the Norwegian Intelligence Service.

In order to monitor these agencies and ensure they are acting in accordance with laws and regulations, the Norwegian Parliament has established The Norwegian Parliamentary Intelligence Oversight Committee (Stortingets kontrollutvalg for etterretnings-, overvåkings- og sikkerhetstjeneste), and Control Committee for Wiretapping (Kontrollutvalget for kommunikasjonskontroll). Their mandate is to ensure that the police’s use of wiretapping is in accordance with the law and is as limited as possible.

What is the conclusion of all this?

All your Runbox email stored on our servers is safe because Runbox is located in Norway. Runbox strictly adheres to the Norwegian Personal Data Act and the Norwegian Criminal Procedure Act, which is the main legislation governing our operations. This fact, along with our ethics, prevent us from doing anything unauthorized with your data.

Specifically, Runbox protects your data against disclosure requested by the authorities because they must present a valid court order to seize any data. Such a court order is difficult to obtain, because it must be based on evidence of criminal activity related to the account owner.

Norwegian authorities are not allowed to perform surveillance of data traffic without a valid court order. Norway has established independent agencies to ensure that these agencies follow the laws and regulations under which they operate. In addition, Norway is an open democracy with a critical and investigative press which readily publicizes any suspicion of breached laws and regulations.

Any foreign nation asking for data have to send a formal request according to established protocols and strict rules. And any such legal request will be scrutinized by Norwegian judicial authorities, and only in cases where Norwegian law is breached could a request result in a court ordered seizure which is necessary to obtain data from Runbox.

In short, no authority or agency can monitor Runbox’ data or traffic without a court order, which can only be issued on evidence of criminal activity in violation of Norwegian penal code.

Additional protection

Runbox customers automatically have an advantage by storing their email in Norway, and you can add another layer of protection by encrypting your communication with Runbox.

To protect your privacy even further, Runbox does NOT use Google Analytics or any other third-party tracking of our customers’ usage. We never use data or traffic information for any other purpose than anonymous statistics in order to improve our services and our system’s performance. Our service is absolutely ad-free, and we do not share or sell your personal details to anyone.

The combination of the strict Norwegian legal environment, our solid IT infrastructure, Runbox’ ethics and Privacy Policy, and the technology Runbox provides, means that Runbox provides a service that is uniquely private and secure.

For more information about the privacy and security of Runbox’ services, please see the following links — and feel free to contact us with any questions or concerns.

Continue Reading →

Email, Encryption and Data Surveillance

As each day goes by there seem to be new revelations about which countries are spying on each other, or have secret agreements to monitor traffic by putting “taps” on strategically important cables entering or leaving countries. It is hard to keep track of all this information, and even harder to verify what is fact and what is speculation.

Questions, questions!

If you care about your data or email and whether it is private or not, then all of this should bother you; in fact it should bother you quite a lot. But how do you make sense of it all, and what action can you take, assuming you can take action that is? Which countries will look after your data best? And who can actually read your email as it is delivered to and from your email provider?

At Runbox we get asked a lot of questions like the ones above, and we have come to the conclusion that often we are worrying about the wrong things.

Who are the players in this real-life James Bond story?

five-eyesThe United States National Security Agency (NSA) and the British Government Communications Headquarters (GCHQ) have featured heavily in the media, and along with three other countries (Canada, Australia and New Zealand) they make up the so called “Five Eyes” countries that are known to be monitoring communications.

These countries have an agreement to share data that they collect through their extensive networks. This is not speculation, this is hard fact in the public domain, and together they form the single biggest data sharing network ever conceived. The allegations that they spy on each others citizens and then share data with each other to get around domestic regulations relating to spying on your own citizens is one of the most controversial claims that have been made in the last few years.

There are other revelations that suggest many countries also have agreements with the NSA and GCHQ in return for various kind of technological assistance that might benefit the collaborating nation.

More recently, and closer to home for Runbox, we have seen allegations that Denmark is monitoring data entering and leaving Norway, and that Sweden is pretty much in league with the NSA about as much as the other “five eyes” countries. At a glance this can seem worrying given that Runbox is based in Norway.

But does it really matter?

Data everywhere, and no place to hide

surveillanceOn a political front it probably does matter, but on a practical level if you email someone who is outside of Norway the chances are the data passes through a number of countries and worrying about the ones geographically adjacent to Norway seems a little pointless. For example, if you email anyone on Gmail, Yahoo, Outlook, iCloud or any of the other major providers, the chance is your data is going to end up in the one country that is at the centre of the recent revelations – the USA.

The reason we get asked questions about security is because people want to take positive action to protect their data, so what can you actually do?

Stored email and data

The question about which email provider will protect your data best when it is on their servers is a separate issue to the one surrounding your data when it is being transferred from one place to another. In respect of your email provider, you are better to keep your email data in a country that has strong privacy laws, and with a provider that tries to encrypt the transfer of that data to and from your account. Runbox is based in a country that does have strong privacy laws, and we always try to encrypt your data when transferring it to and from your account.

So choosing an email provider isn’t too difficult once you know what to look for.

So what about data transfer?

Given that we know agencies are monitoring Internet communications (it doesn’t matter how much or little of this is going on) it is best to assume that anything that you do on the Internet, or anything you email can be monitored by someone. You can think of this as being like sending a private message on a postcard through the usual mail where everyone including the post office and your family can read the postcard.

Fundamentally the data that makes up your email can be read by any server it passes through on its way to its destination. Mail servers also write information to their hard drives and then use that data when sending your email on to the next destination. This means that temporary copies of your email are also made!

There is very little you can do about this, it’s how email works.

Email-EncryptionAn obvious solution to prevent prying eyes from reading your email is to use some sort of code that only the sender and recipient can decode, and that is exactly what encryption is. If you encrypt a message with a strong enough key then it is currently not possible for anyone to read it without having the private key and passphrase. For now we will ignore allegations that encryption has been subverted by governments as it is clear that strong encryption does still work adequately.

Regardless of whether you encrypt messages yourself, Runbox attempts to encrypt your email when it sends to and receives email from other providers on your behalf. This is an important security feature, but it isn’t universally used and even some major email providers do not offer this kind of encryption. Where it is not offered your email is delivered unencrypted and it is just as vulnerable to interception then as a postcard is.

End-to-end encryption

Email is about 40 years old, and it hasn’t changed much in all that time. For decades computer security experts have been aware of the insecure nature of email, which is why email encryption has been around for about half the time email has existed. Encrypting your enigmail_gnupg_thunderbirdemail is not a new idea at all, but as a proportion of email sent very little is encrypted by the sender.

The best overall solution is to encrypt the message before it leaves your computer and not rely on anyone else to protect the data for you. The data can then only be decrypted at the recipients end if the correct key is available and the passphrase for that key is known. This is called end-to-end encryption.

There are various ways in which you can encrypt your email, some involve email client (app/program) like Thunderbird, Outlook or Apple Mail and others are integrated in to the webmail service of email providers.

You don’t need to be an expert to encrypt your email

Encrypting your email is not as difficult as you might think, but you might need to make some changes to how you use email.

We are used to having a very wide variety of email providers at our fingertips, and encryption isn’t necessarily going to be compatible with all of those various interfaces. Elsewhere on this blog and on the Runbox help website we explain some of the easier ways to implement strong email encryption that can be used with most email providers.

Yes, you are going to have to give your friends, family and colleagues keys so they can decrypt email and also send encrypted email to you, but is that really much more difficult than having to give them a key to get in to your home (assuming you want them in your home that is)?

If you encrypt your email it won’t matter what revelations are in the news next week, only you and your recipients will be able to read your email. Unless of course the revelations are about encryption having been compromised…

For more information

Continue Reading →