Riseup mail service: Don’t Panic!

Popular activist mail and email list service Riseup put out a message last night after speculation rose that the US government has been trying to interfere in its services and placed a gagging order forbidding it from warning anyone:

  1. There is no need for panic.
  2. Our systemss are fully under our control.
  3. We will provide additional information at a later date.
  4. Our prior tweets did not have any hidden subtext.

The notes may not have much effect however, as they come directly after the death of the “canary” — a service run by Riseup which certifies that they haven’t received a gag order. The certification has not been updated and shortly before it expired Riseup posted Cohen lyrics: “Listen to the hummingbird, whose wings you cannot see, listen to the hummingbird, don’t listen to me” and an assurance that they weren’t planning on a shutdown. To be on the safe side, the Centre for a Stateless Society posted this set of tips for anyone working with sensitive information that they’d rather not lose:

  1. Backup all your emails on your Riseup account locally. This may require you to (install and) connect Thunderbird to your email account rather than just using the webmail through your browser. See this array of options for backing up while using IMAP.  (Additionally it’s a good idea to enable full disk encryption or separately encrypt your email back up. The EFF has guides for full disk encryption for Windows. For Macs see this. Ubuntu, Linux Mint and several other Linux variants provide full disk encryption as an option when first installing the operating system.)
  2. Get another email address that you can use as a fallback. Resist.ca is based out of Canada (which doesn’t do you much good but at least some). Protonmail is based in Switzerland, although be a bit suspicious about the “encryption” claims they make, there are problems. There are many other email providers. Gandi is popular. Time to shop around or — if you’re a confident sysadmin — roll up your sleeves and run your own email server.
  3. Set up another listserv with another provider if your group currently uses riseup for listservs. Resist.ca runs listservs.
  4. You can set up email forwarding with Riseup. Either to pipe emails to your Riseup account to your new account or pipe emails to your new account to Riseup (if say you want to start popularizing a new email address but continue primarily answering through Riseup for the time being).
  5. Remember that while some providers may encrypt emails once received on their server, all email is basically sent unencrypted between servers and often stored unencrypted. Every email is a postcard, readable by nearly everyone. Unless you and the person you’re corresponding with use PGP. So use PGP. It can be daunting to set up and to get a handle on using (the user interface is infamously non intuitive), however PGP is very useful and provides a good baseline. Email is a federated (moderately decentralized) protocol in wide use that will thus be one of the last services shut down by authoritarians (unlike encryption services that use centralized servers like Signal). The EFF has good guides to setting up PGP for Linux, Windows, and Mac. And Micah Lee has a good overview of it.

One Response to Riseup mail service: Don’t Panic!