A relevant machine-translated paragraph appears to indicate that they are only required to implement monitoring of a single mailbox:
> This is about a blackmail that had been sent to an automotive supplier from a Tutanota mailbox. Tutanota is now forced to program a function by the end of the year that allows the State Criminal Police Office of North Rhine-Westphalia to monitor this mailbox.
Lacking the ability to read this without translation, I cannot determine conclusively whether or not they're also required to preemptively retain plaintext emails for other mailboxes in order to support any future wiretapping requests.
There's a clear distinction between "We are mandated by the court to maintain plaintext for all accounts for all time" and "We are mandated by the court to have the capability to maintain plaintext for one account when ordered so by subpoena-or-equivalent". This is the latter.
Arguments can be had about the relevance of that distinction, but relevant or not, the distinction does exist. Thanks for clarifying!
(I'm not participating in the "Is this distinction relevant?" discussion today, sorry, just trying to understand what was passed. See other threads for pro/con arguments.)
It only affects new incoming mails as they cannot decrypt the old ones.
My understanding of the German wiretapping law is also that they can only record messages from the point of the wiretapping court order so no older messages can be accessed by it.
My understanding is that they are only required to monitor a single specific mailbox (for which a court order has been issued) - so no preemptive collection.
The following (machine-translated) paragraph clears that up:
This should not change anything for the other users, their mails should continue to be encrypted by default. Nevertheless, Tutanota considers a one-time circumvention of the encryption to be a data protection and security risk for all customers.
[Update, 30.11., 12 o'clock] As Tutanota emphasized, the monitoring measure only affects newly incoming unencrypted e-mails. Already encrypted data as well as end-to-end encrypted e-mails in Tutanota cannot be decrypted by the company. [Update]
> This is about a blackmail that had been sent to an automotive supplier from a Tutanota mailbox. Tutanota is now forced to program a function by the end of the year that allows the State Criminal Police Office of North Rhine-Westphalia to monitor this mailbox.
Lacking the ability to read this without translation, I cannot determine conclusively whether or not they're also required to preemptively retain plaintext emails for other mailboxes in order to support any future wiretapping requests.