Articles / Privacy Law

842 words

  • uk-law
  • investigatory-powers-act
  • self-hosting
  • email
  • telecommunications-operator
  • privacy

Can a One-Person Mail Server Be Handed an IPA Notice?

Yes, on the wording of the Investigatory Powers Act 2016, a Postfix box in your cupboard can plausibly count as a "telecommunications operator". Nothing in the Act says "big companies only". The interesting question is not whether the definition reaches you, but what a notice could then ask for, and what you would actually be holding.

This is general information, not legal advice, and I have kept the section references to the ones I am confident of. Check the current text on legislation.gov.uk before relying on any of it.

The definition is about function, not size

The Act's interpretation section (s.261) defines a telecommunications operator as a person who offers or provides a telecommunications service to persons in the UK, or who controls or provides a telecommunication system that is in, or controlled from, the UK. A telecommunications service is, broadly, anything that gives access to, and facilities for using, a telecommunication system. Email fits.

Two points that surprise people:

  • There is no turnover, user count or "commercial" threshold in the definition itself.
  • It is wider than "public" operators. Private systems can be within it too.

So the legislation does not exempt you. Whether anyone would ever bother is a separate matter, covered below.

What the notices actually are

Two powers matter for a mail server operator. Both are given to operators, and both go through the Secretary of State with Judicial Commissioner approval.

  • Data retention notice (s.87): requires you to keep specified "relevant communications data" for up to 12 months.
  • Technical capability notice (s.253): requires you to maintain capabilities that make warrants and authorisations workable, such as being able to disclose or remove electronic protection.

Separately, a targeted interception warrant or a communications data authorisation can be served on an operator without either of those notices existing first. The notices are about making you ready in advance.

Quick detour: what is "communications data" for email?

Hang on, this is the bit that makes it concrete. Communications data is the who, when, where and how, not the content. For email that is roughly the envelope: sender, recipient, timestamps, the IP that connected, and message size. The Subject line and body are content.

Now look at a normal mail log line:

postfix/smtp[2211]: A1B2C3: to=<[email protected]>, relay=mx.example.org[203.0.113.7]:25,
  delay=0.8, status=sent (250 2.0.0 Ok)
postfix/smtpd[2190]: connect from client.example.net[198.51.100.20]

That is already most of the metadata. A retention notice would mostly formalise what your logs record by default, and set a minimum period for keeping it.

Why you are an unlikely target, and why that is not a defence

Every notice has to be necessary and proportionate, and a one-person server with a handful of mailboxes is a poor candidate for retention obligations. Retention notices are aimed at operators whose data is useful at scale. My reading is that a notice to a hobbyist would be unusual rather than impossible, and I know of no published example, though notices are not generally published.

More likely is a warrant or data request about one specific mailbox. That is a different thing: it asks what you have, not what you must build.

What you would be able to hand over

This is where self-hosting design matters. Compare three setups:

  1. Plain Postfix and Dovecot, mail stored unencrypted on disk. You hold content and metadata, and can disclose both.
  2. Same, but with disk encryption such as LUKS. The server is protected while off; once running and unlocked, it is readable by you.
  3. Per-user encrypted storage where only the user's key opens the mailbox. You hold metadata and ciphertext.

Even in the third case, SMTP is store-and-forward between servers. Unless the message is end-to-end encrypted (PGP, S/MIME), the content crosses your server in readable form at delivery time. Server-side encryption of stored mail does not protect content in transit through your own MTA.

Key disclosure is a separate power

If you hold keys, Part III of RIPA 2000 is the route for compelling disclosure of keys or decrypted material, and it has its own safeguards and its own offence for non-compliance. That is distinct from the IPA, and I covered the shape of it in a separate post on handing over encryption keys. A technical capability notice is a different animal, because it concerns capability that must be maintained, not a one-off demand.

Practical choices that follow

  • Log only what you need for abuse handling and debugging, and rotate on a short, stated schedule.
  • Do not promise users things the architecture cannot deliver, such as "we cannot read your mail" on a server that decrypts at delivery.
  • If you receive anything that looks like a notice, treat it as real until proven otherwise: note the date, the issuing body and the legal basis cited, and get a solicitor experienced in this area.
  • Be aware that notices can carry non-disclosure requirements, so the lack of public examples tells you little.

The sober summary is that the law reaches further than most self-hosters assume, enforcement is very probably aimed elsewhere, and your actual exposure is decided less by statute than by what your server happens to keep.

← All articles