ProtonMail, an email provider that boasts security and end-to-end encryption is under fire after it disclosed the IP address of a French climate activist to Swiss police. TechCrunch reported that the company was responding to a request by French authorities via Europol for assistance from the Swiss. ProtonMail must comply with the laws of Switzerland because it is based there. According to ProtonMail's transparency report, this includes logging IP addresses of users involved in "extremely criminal cases."
Andy Yen is Proton's CEO. He wrote a blog today pointing out that the company had made it clear that it must follow local laws. He wrote that Proton had received a legally binding order by Swiss authorities in this instance, which he was obliged to follow. This particular request was not subject to appeal.
The activists involved in the case were able to take over apartments and commercial spaces near Paris's Place Sainte Marthe. TechCrunch reports that the protest started as a local effort to stop gentrification in the area, but quickly became a national movement that made national headlines in France. They published an article on September 1st claiming that French authorities had sent a message via Europol asking for information about who set up their ProtonMail account.
Yen points out that ProtonMail's encryption blocks it from viewing the contents of ProtonMail accounts, and that it doesn't know the identities of its users. In this instance, the company didn't know it was sharing information about climate activists. He says that the company will make it clearer how it handles criminal prosecutions. ProtonMail will also be promoted via the Tor site and its VPN for those who are particularly concerned about privacy.
Proton claims it received 3,572 user information requests in 2020. Proton contested 750 of these orders and eventually fulfilled 3,017 requests.
