ProtonMail Secure Email Service Provided User Data That Led To Arrest
There are quite a few Internet services today advertising absolute privacy from both hackers and government agencies, such as Signal for messaging. After Lavabit's controversial shutdown, ProtonMail rose up to become the advertised email service of choice for privacy-minded users, especially those with secrets to keep. Sometimes, however, those secrets may run afoul of certain countries' laws, which often leads to email service providers handing over data to identify users under investigation. While ProtonMail advertised privacy and security against such actions, it was apparently forced to cave in to such legal demands, leading to the arrest of climate change activists in France.
This rather messy legal situation revolves around some members of the green movement Youth For Climate charged with setting up "climate camp" occupations in 2020 and 2021. Although those incidents happened in Paris, the investigation revealed some activists using ProtonMail to communicate their activities. This eventually led to the Swiss government ordering the email service to hand over the IP addresses of the aforementioned users, which eventually resulted in their arrest.
This might come as a shock to those that hold the traditional view of Switzerland as a bastion of privacy and autonomy from foreign powers, but the reality may no longer match that image. In addition to new laws that add a level of surveillance to entities based in the country, Switzerland also has to play nice with other sovereign nations. While Swiss courts try to lean towards denying requests for data from foreign governments, this is one such instance where it agreed with the demands of Europol.
Of course, ProtonMail was legally forced to hand over that data, but it didn't get away without incurring the wrath of the Web. It was questioned why it possessed users' IP addresses in the first place when it advertises that it doesn't log IP addresses by default. ProtonMail founder and CEO Andy Yen explains that it only started logging the specific users' IP addresses after it was legally forced to do so by Swiss authorities.
Some thoughts on the French "climate activist" incident. It's deplorable that legal tools for serious crimes are being used in this way. But by law, @ProtonMail must comply with Swiss criminal investigations. This is obviously not done by default, but only if legally forced.
— Andy Yen (@andyyen) September 5, 2021
Netizens are still taking issue with ProtonMail's marketing, hiding the legal intricacies of its logging activities away from its front page. On the one hand, ProtonMail isn't really exempt from Swiss laws even as it promises to continue fighting against data requests as much as it can. On the other hand, it probably does need to clarify the nitty-gritty of its privacy terms, especially for paying subscribers that have expected more from ProtonMail.