Law Enforcement Raided Cock.li Servers Again

Cock.li, a service known to most as an email provider, temporarily shut down many of their services “due to an ongoing legal search order.” The owner of Cock.li reminded users that the full disk encryption on every server prevents law enforcement from actually collecting information from seized drives.

German authorities notably raided and seized Cock.li drives in 2015 and again in 2016 before the owner, Gexcolo, moved from the hosting service in Germany to a hosting service in Romania. During the 2015 raid, though, Gexcolo kept Cock.li online. According to Ars, “the service was hosted on a server utilizing a pair of drives in a RAID1 (mirrored) configuration. One of the drives has been taken while the other mirror drive [was] still in use.”

There is very little information about the ongoing search of Cock.li servers. Gexcolo tweeted “The same thing happened almost exactly a year ago, so at least I know all we can do is wait!” The tweet also contained a link to the Cock.li status page: status.cock.li. The most recent incident, reported on November 20, 2019, provided additional information about the downtime.

All web, mail, and XMPP services are down due to an ongoing legal search order. Services will remain offline until the activities have finished. Thanks to full disk encryption on every server, no user data is at risk.

The backup MX is chugging along spooling mail to be delivered during this downtime. All Cockbox host servers are operational.

Gexcolo presumably shut down the servers as full disk encryption does not protect against the physical access while running.