• Home /
• News /
• 2005 /
• July /
• Italy: Police obtain wholesale access to encrypted e-mails and internet discussion groups used by activists

Italy: Police obtain wholesale access to encrypted e-mails and internet discussion groups used by activists

01 July 2005

On 21 June 2005, members of the association Autistici/Inventati found out that an operation by the postal police in June 2004 may have resulted in the entire telecommunications traffic passing through their servers, and its contents, having been under surveillance for the last year in the context of police investigations into terrorist activities by anarchists. Autistici/Inventati is active in the field of privacy rights and provides encrypted Internet and e-mail services widely used by Italian activists, journalists, lawyers and student groups. Investici, a non-profit association that is responsible for the autistici.org and inventati.org domains, plays host to 500 websites, 600 discussion groups with 30,000 participants, and 5,000 e-mail accounts, and offered secure communications encrypted using an SSL protocol.

On 15 June 2004, the postal police went to the headquarters of the commercial web hosting company Aruba, whose server farm had Investici's servers in "housing" (providing space and connection, although ownership of and responsibility for the servers are exercised by Investici), to carry out enquiries in relation to specific e-mail accounts, demanding access to the computer belonging to Investici, which held the entire contents of the two domains that it runs. The investigation related to the e-mail account of the group Crocenera anarchica (Anarchist Black Cross, an anarchist collective), and Aruba allowed the police access to the computer, unplugging the server and allowing them to copy its contents and encryption keys, thus rendering the server's SSL protocol and security certificates ineffective. The company did not inform Investici, its customer, about this, and when Investici complained about the server being down, staff at Aruba lied, claiming that there was a problem related to the electric mains cabinet. A statement by Investici argues that this case "clinically certifies the death of digital privacy in Italy", adding that if it had been informed and its lawyers had been involved "the violation of thousands of users' privacy may have been prevented".

The association found out about these events a year later as a result of an investigation into Crocenera anarchica, seven of whose members were arrested in May 2005 in Rome and Bologna. Their website, hosted by ecn.org (an activist domain), was confiscated by the police, after the prosecutors' office argued that it included subversive material which may have been related to a letter-bomb campaign that targeted, among others, Romano Prodi, the former Commission president. ECN's lawyer Gilberto Pagani argued that the website did not contain "anything of the kind", and the arrests were annulled by a judge who considered them "unfounded". The appeal and a request for Autistici/Inventati to shut down the group's e-mail account resulted in the disclosure of some details of the investigations. This showed that the police had copied the contents of the server "acquiring information that could be used for a potential mass registration", according to a statement by Investici. The documents concerning the investigation that were handed over to the association include a report by the Reparto Operazioni Speciali (ROS, special operations unit) of the carabinieri (Italy's paramilitary police force) which sought to map the "insurrectionalist anarchist scene" and a report by the Divisione Investigazione Generale e Operazioni Speciali (DIGOS, special operations and general investigation division) unit of the police that describes the investigation which led to the intervention by the postal police. The DIGOS report includes the complaints by postal police officers analysing the traffic data of the Crocenera anarchica bulletin who wanted to de-crypt the e-mail communications of some suspects to confirm their suspicions over who had sent out which issue of the bulletin.

Investici stated that it will take legal action, file a complaint before the privacy ombudsman, and trans