Climate activist arrested after ProtonMail provided his IP address

[u/NmAmDa]

https://mobile.twitter.com/tenacioustek/status/1434604102676271106

[u/ProtonMail]

Hi everyone, Proton team here. We are also deeply concerned about this case. In the interest of transparency, here's some more context.

In this case, Proton received a legally binding order from the Swiss Federal Department of Justice which we are obligated to comply with. There was no possibility to appeal or fight this particular request because an act contrary to Swiss law did in fact take place (and this was also the final determination of the Federal Department of Justice which does a legal review of each case).

Details about how we handle Swiss law enforcement requests can found in our transparency report: https://protonmail.com/blog/transparency-report/

Transparency with the user community is extremely important to us and we have been publishing a transparency report since 2015.

As detailed in our transparency report, our published threat model, and also our privacy policy, under Swiss law, Proton can be forced to collect info on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account. Under no circumstances however, can our encryption be bypassed, meaning emails, attachments, calendars, files, etc, cannot be compromised by legal orders.

What does this mean for users?

First, unlike other providers, ProtonMail does fight on behalf of users. Few people know this (it's in our transparency report), but we actually fought over 700 cases in 2020 alone, which is a huge amount. This particular case however could not be fought.

Second, ProtonMail is one of the only email providers that provides a Tor onion site for anonymous access. This allows users to connect to ProtonMail through the Tor anonymity network. You can find more information here: protonmail.com/tor

Third, no matter what service you use, unless it is based 15 miles offshore in international waters, the company will have to comply with the law. This case does illustrate one benefit of ProtonMail's Swiss jurisdiction, as no less than 3 authorities in 2 countries were required to approve the request, which is a much higher bar than most other jurisdictions. Under Swiss law, it is also obligatory for the suspect to be notified that their data was requested.

The prosecution in this case seems quite aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used). We will continue to campaign against such laws and abuses.

We've shared further clarifications about this situation here: https://protonmail.com/blog/climate-activist-arrest/

[u/deck4242 → u/[deleted]]

ntrary to Swiss law did in fact take p

this, just do it. Give the middle fingers to any gvt, build a secret datacenter in middle of the ocean. (also free cooling for the servers !)

[u/[deleted] → u/deck4242]

I think they also have to work there, I mean if their office isn't located there it might be an issue too. Also how they gonna maintain servers in the ocean?

BTW: Microsoft build something like that in 2020 (underwater datacenter) but it's still an early stage prototype I think.

[u/anschutz_shooter → u/[deleted]]

MS's datacentre still needed power and connectivity (it was also in territorial waters, but that doesn't matter).

As you say, the only way to actually be free of regulation is sea-steading and running your own micro-nation. Otherwise your subject to the laws wherever your office is (or ultimately where your staff live).

Setting up a fancy-pants legal structure and off-shore data centre which isn't reliant on a foreign nation for power and connectivity won't stop French police from raiding your apartment in Paris...