ProtonMail shared activist's IP with law enforcement, claims had no other choice

Email service provider ProtonMail, praised for anonymity, shared a climate activist's IP details with law enforcement, which led to his arrest by the French police. The company's founder and CEO Andy Yen claims they had no choice but to comply with a "legally binding order from the Swiss Federal Department of Justice."

ProtonMail, founded in 2013, hosts its servers in Switzerland and claims that user data is safe under strict Swiss privacy laws. With that in mind, many journalists, activists, dissidents, and others use ProtonMail to protect their communications.

No wonder that Swiss-based company's cooperation with law enforcement caused public outrage.

In August, it was reported that ProtonMail cooperated with Swiss law enforcement.  According to the police report, the French authorities were able to obtain the activist's IP address. ProtonMail claims it does not give data to foreign governments. French police sent the request via Europol to the Swiss law enforcement, which issued a legally binding order.

The law enforcement inquired about the climate action movement, which has been mostly protesting against gentrification. According to TechCrunch, police wanted details on a person who created the ProtonMail account, which the group used to communicate. Activists attracted media attention when they occupied the premises owned by Le Petit Cambodge - a restaurant targeted by terrorists on 13th November 2015.

"In this case, Proton received a legally binding order from Swiss authorities which we are obligated to comply with. There was no possibility to appeal this particular request", Andy Yen claimed in a blog post. "Under Swiss law, Proton can be forced to collect information on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account."

In a lengthy post, Andy Yen stressed that there was no legal possibility to resist or fight this particular request and that he and his company sides with activists but will not do so by breaking any laws.

"We need to help the youth activists, but ProtonMail cannot do that by breaking the law and ignoring court orders. We are on your side, and our shared fight is with the authorities and the unjust laws we have been campaigning against for years. The prosecution in this particular case was very aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example, in France, where terror laws are inappropriately used.) We will continue to campaign against such laws and abuses, and we will continue to challenge unjustified government requests whenever possible," he wrote.

In the blog post, there’s even a section called ‘There are worse laws than Swiss law’, detailing that the Swiss legal system provides a number of checks and balances.

“Even in this case, approval from three authorities in two countries was required, and that’s a fairly high bar which prevents most (but obviously not all) abuse of the system. Under Swiss law, it is also obligatory for the suspect to be notified that their data was requested, which is not the case in most countries. Finally, Switzerland generally will not assist prosecutions from countries without fair justice systems,” the blog post reads.

More from CyberNews:

Access Now: governments vilify and persecute information security researchers

Russia blocks NordVPN, ExpressVPN, and four other VPN providers

The LockBit 2.0 ransomware attack against Accenture – time is running out

Cybercriminals increasingly use phishing, and no industry is spared

Longtime cybersecurity professional Kathie Miley: unknown malware is stressing out CISOs

On the prowl for nudes, California man steals 620,000 iCloud photos

Why the future of payments is frictionless and invisible

Subscribe to our newsletter