Encrypted email service ProtonMail has become embroiled in a minor scandal after responding to a legal request to hand over a user's IP address and details of the devices he used to access his mailbox to Swiss police – resulting in the user's arrest.
Police were executing a warrant obtained by French authorities and served on their Swiss counterparts through Interpol, according to social media rumours that ProtonMail chief exec Andy Yen acknowledged to The Register.
[...] At the time of writing, the company's website said: "We believe privacy and security are universal values which cross borders."
After data from ProtonMail was handed to the Swiss and then French police, the author of a left-wing political activists' blog in France wrote (en français) that a group called Youth for Climate had been targeted:
The police also noticed that the collective communicated via a ProtonMail email address. They therefore sent a requisition (via EUROPOL) to the Swiss company managing the messaging system in order to find out the identity of the creator of the address. ProtonMail responded to this request by providing the IP address and the fingerprint of the browser used by the collective. It is therefore imperative to go through the tor network (or at least a VPN) when using a ProtonMail mailbox (or another secure mailbox) if you want to guarantee sufficient security.
Also at The Verge.
Related Stories
From TechDirt:Swiss Court Says ProtonMail Isn't A Telecom, Isn't Obligated To Retain Data On Users
Background:
ProtonMail offers encrypted email, something that suggests it's more privacy conscious than others operating in the same arena. But, being located in Switzerland, it's subject to that country's laws. That has caused some friction between its privacy protection claims and its obligations to the Swiss government, which, earlier this year, rubbed French activists the wrong way when their IP addresses were handed over to French authorities.
The problem here wasn't necessarily the compliance with local laws. It was Proton's claim that it did not retain this information. If it truly didn't, it would not have been able to comply with this request. But it is required by local law to retain a certain amount of information. This incident coming to light resulted in ProtonMail altering the wording on its site to reflect this fact. It no longer claimed it did not retain this info. The new statement merely says this info "belongs" to users and Proton's encryption ensures it won't end up in the hands of advertisers.
The news:
[...] these retention obligations that have been challenged. These obligations undercut earlier promises made by Proton to its users -- the ones that resulted in a rewrite of its privacy guarantees as well as its cooperation with French authorities.
Fortunately for ProtonMail and its users, surveillance of the service will go back to being more limited. The Swiss Federal Administrative Court has sided with Proton, finding that it is not a service provider under the definitions included in the data retention law.
Tools can be used for bad things. Therefore we must carefully monitor their use and users. Computers can be weapons. Just ask anyone who has been hit over the head by a laptop.
See Also:
ProtonMail Deletes 'We Don't Log Your IP' Boast From Website After French Climate Activist Reported
ProtonMail logged IP address of French activist after order by Swiss authorities
(Score: 3, Insightful) by Anonymous Coward on Wednesday September 08 2021, @10:23AM (18 children)
There. I saved you from having to read the article and all articles from this point forward.
(Score: 5, Insightful) by Anonymous Coward on Wednesday September 08 2021, @11:14AM (13 children)
No. The problem is that people can be assholes so that's why we have laws. But then assholes can make asshole-centric laws too, so we need a system that prevents that. And then we need people to administer this. This is the job that government does -- you should have learned that in school.
Anyone that advocates for some weird panacea like "Anarchy" or "This dictator will save us all!" are either too naive or too stupid to know this and have to learn one way or another. The entire system of laws is mostly because some (10-20%) people are antisocial assholes AND/OR we need common rules.
Protonmail is just another outfit that advocated "Anarchy" as a self-organizing solution which makes them either naive or stupid, possibly both. Never assume malice where mere incompetence is the real reason. So in the future, if you see such a stupid label somewhere, you know that it's run by naive and/or incompetent individuals and hence you should avoid id.
(Score: -1, Flamebait) by Anonymous Coward on Wednesday September 08 2021, @11:41AM (1 child)
You glow in the dark cocksucker, you just love to strawman the shit out of your horrible authoritarian arguments, don't you?
(Score: -1, Flamebait) by Anonymous Coward on Wednesday September 08 2021, @06:11PM
exactly. fuck that stupid pig.
(Score: 3, Insightful) by Anonymous Coward on Wednesday September 08 2021, @12:47PM (7 children)
It was complying with a government order (backed by law) that compelled ProtonMail to turn over the man's IP address. Government caused this, not ProtonMail.
(Score: 0) by Anonymous Coward on Wednesday September 08 2021, @02:21PM
and this makes ProtonMail what?
1. ignorant/naive?
2. incompetent?
3. malicious?
One can argue that #1 and #2 apply here -- maybe they are naive enough to think that laws didn't apply to them or that they can be ignored or that they have 'outsmarted' the poo-lice by only adhering to local laws. But that is a very stupid thing to believe considering The Law exists in one form or another for thousands of years. And the police manage to organize itself to catch criminals across borders for a few decades.
Original parent argued #3, but of course that is rarely the case.
(Score: 2) by Tork on Wednesday September 08 2021, @03:01PM (5 children)
And then they deleted their boast that they no longer serve you by breaking the law.
🏳️🌈 Proud Ally 🏳️🌈
(Score: 0) by Anonymous Coward on Wednesday September 08 2021, @03:36PM (1 child)
No, it just wasn't "clarified" up till then that ProtonMail was to act as a spy agency for the government. Now that's been clarified.
(Score: 3, Insightful) by Tork on Wednesday September 08 2021, @03:56PM
🏳️🌈 Proud Ally 🏳️🌈
(Score: 0) by Anonymous Coward on Wednesday September 08 2021, @04:16PM (2 children)
At what point were ProtonMail breaking the law? The tracking was because of a recently imposed court order. Before that they had no obligation to track anybody.
(Score: 3, Insightful) by Anonymous Coward on Wednesday September 08 2021, @04:28PM (1 child)
"We don't keep your IP addresses unless legally required" != "We don't log your IP."
(Score: 0) by Anonymous Coward on Thursday September 09 2021, @05:12PM
How is that "breaking the law"? Before the court ruling there was no legal requirement and afterwards they removed the claim.
(Score: 1) by fustakrakich on Thursday September 09 2021, @03:30AM
Or a catchy name for a honeypot. Could very well be malice. I think we can erase the word "trust" from the dictionary, "hope" is more accurate
La politica e i criminali sono la stessa cosa..
(Score: 2) by c0lo on Thursday September 09 2021, @04:39AM
Never rule out malice where mere incompetence could be the real reason, either. Because it's pretty easy for a malicious party to play incompetence for enough of a while.
https://www.youtube.com/@ProfSteveKeen https://soylentnews.org/~MichaelDavidCrawford
(Score: 0) by Anonymous Coward on Thursday September 09 2021, @03:23PM
When assholes take over the government, anarchy is the only solution.
(Score: 3, Insightful) by janrinok on Wednesday September 08 2021, @12:41PM
No you haven't - because you have read it incorrectly.
I am not interested in knowing who people are or where they live. My interest starts and stops at our servers.
(Score: 3, Funny) by DannyB on Wednesday September 08 2021, @04:31PM (2 children)
Did you realize you unintentionally included Google when you said "all organizations" lie?
Avoid overly general qualifiers.
The Centauri traded Earth jump gate technology in exchange for our superior hair mousse formulas.
(Score: 0) by Anonymous Coward on Wednesday September 08 2021, @06:25PM (1 child)
This post is confusing. Are you trying to imply that google does not lie?
(Score: 2) by DannyB on Thursday September 09 2021, @02:01PM
Google is not evil. Their original motto was: don't be evil. Therefore, conclusion.
The Centauri traded Earth jump gate technology in exchange for our superior hair mousse formulas.
(Score: 2, Insightful) by Anonymous Coward on Wednesday September 08 2021, @11:02AM
I'm still going to use it for throwaways.
(Score: 5, Interesting) by looorg on Wednesday September 08 2021, @11:23AM (14 children)
Not sure they actually had that many options. Legal requests are just that. They are not optional or is the suggestion here that Proton should ignore the request and face legal problems themselves or fight it?
That said their previous claim was that they don't log and then now it turns out that they do indeed log, and they are logging at least one more thing then just IP since they were also able to provide some kind of browser fingerprint (user agent etc I assume). So the question might be how much do they log and why do they log these things? I don't recall Protonmail serving ads, but it could just be that I block them and just never noticed. So what and why are they logging again? Is there some legal requirement to log? Did they turn on logging after the request or was the information already there ready to be served upon notice?
The other question tho is how french police was able to turn a IP and browser fingerprint into something useful and legally binding enough to have someone arrested. Did they beat the person senseless until they revealed both passwords? Or was this some kind of mail dead-drop with multiple users that all had the passwords (at least two) written down on some piece of paper?
Seems somewhat obvious. Still the person in question didn't break swiss law. They broke french law(s). So that statement doesn't make all that much sense either. Since swiss law enforcement was just a middle hand for a french Interpol request. Still legally binding tho but it wasn't for a swiss criminal investigation.
I do wonder what it will do for their user numbers. I assume a lot of people moved there cause the site was deemed secure and away from the prying eyes of big Google etc. Turns out not so much then. That said I'll still keep my account. I mainly use it for signups and stuff. I don't keep my criminal secrets there or anything.
(Score: 3, Informative) by RamiK on Wednesday September 08 2021, @11:43AM
Probably yes since France has similar requirements for WiFi hotspots: https://www.zdnet.com/article/five-bar-and-cafe-owners-arrested-in-france-for-running-no-log-wifi-networks/ [zdnet.com]
compiling...
(Score: 5, Interesting) by driverless on Wednesday September 08 2021, @12:21PM (9 children)
It's a bit more nuanced than they, they don't log as a matter of course but were compelled by a EUROPOL request to log the IP of that particular user. So they recorded it as a one-off in response to a law enforcement request.
(Score: 3, Insightful) by Anonymous Coward on Wednesday September 08 2021, @12:32PM (2 children)
Oh, so they only log *sometimes*. Yeah, it's a huge difference indeed!
(Score: 0) by Anonymous Coward on Wednesday September 08 2021, @08:18PM
They only log when powerful people are out to get you. Only then!
(Score: 1, Informative) by Anonymous Coward on Thursday September 09 2021, @05:16PM
Before the court order they never logged, so the claim was true. After the court order they were required to log so they removed the no-longer-true claim.
(Score: 2) by Rosco P. Coltrane on Wednesday September 08 2021, @12:35PM (5 children)
So instead of just removing the "We don't log your IP" statement, they could replace it with "We don't log your IP unless we have to". It's not terribly helpful but at least they don't look guilty as a puppy sitting next to a pile of poo like they do now.
(Score: 5, Informative) by janrinok on Wednesday September 08 2021, @12:53PM (4 children)
Emphasis mine.
I am not interested in knowing who people are or where they live. My interest starts and stops at our servers.
(Score: 0) by Anonymous Coward on Wednesday September 08 2021, @02:40PM (2 children)
... except that the Swiss police interact with other agencies around the world via INTERPOL and especially EUROPOL in EU. So, if you break the law in US or France or Greece or probably New Zealand or Thailand, they will probably co-operate with the investigation and slap Protonmail with a warrant requiring logging. It all depends what you do and how determined the other side is to get you.
It's the same like Russia-based servers probably are safe to use if you are not planning on targeting Russian interests with it. Of course, Vladimir could have a change of heart and start to crack down if you become a pain
https://economictimes.indiatimes.com/news/international/world-news/russias-most-aggressive-ransomware-group-disappeared-its-unclear-who-disabled-them-/articleshow/84396834.cms?from=mdr [indiatimes.com]
https://www.scmp.com/tech/big-tech/article/3141013/russian-linked-hacking-group-revil-disappears-dark-web-after-biden [scmp.com]
(Score: 4, Informative) by janrinok on Wednesday September 08 2021, @03:10PM (1 child)
They will ONLY prosecute offences that break the law in Switzerland. Now there are some acts (terrorism, murder, certain types of pornography) which would be punishable by Swiss law by virtue of the fact that the communications (e.g. emails) relating to the execution of those crimes are using a server hosted in Switzerland. Using a Swiss hosting service for such activities IS an offence in Switzerland. That is what appears to happened in this case. They confirmed that a Swiss law had been contravened.
However, most of us are just using emails to move mundane information to others. The Swiss will NOT allow Interpol or Europol or anyone else to have personal information if the individual has NOT contravened Swiss law. It is similar to their secrecy regarding bank accounts. Many have asked the Swiss to provide details of accounts held by Swiss banks - I am not aware of any being granted unless the crimes that I have noted above (and similar, the group above is incomplete) are proven in advance.
The cooperation between Switzerland and the rest of the world is only to the extent that it is permitted by Swiss law.
I am not interested in knowing who people are or where they live. My interest starts and stops at our servers.
(Score: 0) by Anonymous Coward on Thursday September 09 2021, @09:20AM
You mean like this,
https://www.reuters.com/article/us-ubs-idUSLJ59987220090819 [reuters.com]
Or,
https://www.reuters.com/article/us-hsbc-tax-swiss-idUSKCN1061S6 [reuters.com]
https://www.swissinfo.ch/eng/irs-wants-more-client-data-from-swiss-banks/46742698 [swissinfo.ch]
Emphasis mine. Entities involved in the schemes here may have done nothing wrong in the eyes of the Swiss law, but Switzerland has signed treaties that extend the reach of non-Swiss entities and laws into Switzerland.
Here is another example where this happened,
http://www.iconnectblog.com/2018/04/the-scope-and-limits-of-the-european-arrest-warrant-the-case-of-catalan-exiles/ [iconnectblog.com]
The bottom line is, if you do a crime in a nation that is deemed to have a fair criminal system as deemed by Switzerland, and the police from that state comes knocking, you are probably not going to hide just because Switzerland.
Having said that, as for email, no one really cares about your emails. You are not important and there is too much crap floating around the world for anyone to care to look at you. And if some powerful nation or entity is looking for you, a Protonmail account is not something that really is important anyway.
(Score: 1, Insightful) by Anonymous Coward on Wednesday September 08 2021, @04:20PM
As long as your aren't accused of committing a crime under Swiss law. There are no penalties for abusing the system with false accusations.
(Score: 5, Interesting) by janrinok on Wednesday September 08 2021, @12:35PM (2 children)
I'm perhaps reading it slightly differently than you are.
I'm not sure that they were saving data until they were directly 'requested' to do so, and it was from that point that they saved data originating from a specific IP address. They could not provide the content of emails - it is quite explicit that the encryption is between the sender and the receiver of the email. But, having been given the originating IP and begin told to monitor it they subsequently provided data collected from that point.
To my reading there was nothing, and still is nothing, to suggest that they are recording IP addresses as a matter of routine, but they can no longer claim that they 'never' record such information.
As I say, it is one of interpretation of what is being said. It remains true that every email company must respect the laws of the country in which it is hosted and that it must comply with legal requests for information when requested to do so.
I am not interested in knowing who people are or where they live. My interest starts and stops at our servers.
(Score: 2) by looorg on Wednesday September 08 2021, @12:52PM (1 child)
I'm uncertain to as when they started to log, if they always did it or if they just started when requested. That said I was under the impression, or my interpretation of it, was that they were asked for an IP that accessed a specific email account. Not the other way around. So they had the @protonmail.com and asked whom accessed it and was given an IP and a "fingerprint" in return. If they already had those logged and available or if that was something that was started upon request is unknown as far as I understand it. That said if they have started to comply once they more or less will have to comply in perpetuity now. If they fulfilled one request others are bound to follow.
(Score: 2) by janrinok on Wednesday September 08 2021, @01:03PM
I agree - they wanted to know who accessed a specific IP address. I have also commented further here: https://soylentnews.org/comments.pl?noupdate=1&sid=44805&page=1&cid=1175850#commentwrap [soylentnews.org].
I am resident in France and I am aware the France (and other countries) can sometimes be frustrated by Swiss laws which provide considerably more protection of personal information than elsewhere.
I am not interested in knowing who people are or where they live. My interest starts and stops at our servers.
(Score: 0) by Anonymous Coward on Wednesday September 08 2021, @03:41PM
Nothing to see here folks, go back to consuming products and living vapid worklives.
(Score: 2) by loonycyborg on Wednesday September 08 2021, @04:26PM (2 children)
Seems details on them are in french. Also there is no details of which exact their act(or allegation of it) triggered this action by Swiss authorities.
(Score: 2) by janrinok on Wednesday September 08 2021, @06:03PM
The French article doesn't give much, and nothing that would justify the Swiss having an interest in the individual or the organisation mentioned.
I am not interested in knowing who people are or where they live. My interest starts and stops at our servers.
(Score: 3, Informative) by tizan on Wednesday September 08 2021, @06:07PM
The people are from a group against gentrification of some region...they squatted some buildings...They are being charged for illegal entry and use of the said buildings
That is what i gather from that little article.
(Score: -1, Flamebait) by Anonymous Coward on Wednesday September 08 2021, @06:16PM
you fucking whore ass rats.
(Score: 1, Insightful) by Anonymous Coward on Wednesday September 08 2021, @08:25PM
Did anyone think they COULDN'T log IP addresses if ordered to by a court? Of course they could.
If you know how any of this stuff works you also know all mail is going and coming in basically clear text. It might be SSL wrapped in transit but their systems have to see it in the clear. They only promise it is encrypted "at rest." That means if they get served they could and would begin copying all of your email traffic, both inbound and outbound, for the authorities.
Another fact. Nobody here would be raising much ruckus if the the target was a Jan 6 protester or other "thought criminal." Ya gotta start raising a ruckus EVERY time.
(Score: 2, Interesting) by Anonymous Coward on Thursday September 09 2021, @12:43AM (3 children)
Looks like EuroPol can make any request and Swiss Law has to comply?
Does anyone know the answer? Seriously want to know the mechanism, not trying to troll here.
(Score: 0) by Anonymous Coward on Thursday September 09 2021, @09:23AM
Not any request, but a specific request. So you can't just blanket log, but you can request for one or few accounts.
They can just say this is in relation to a possible far-left or far-right or extremists/terrorist plot. And that is true.
(Score: 2) by ledow on Thursday September 09 2021, @10:48AM (1 child)
Anything that the Swiss would themselves consider reasonable to ask of a EUROPOL/INTERPOL country, I imagine.
Such arrangements are two-way, so if you start refusing them, suddenly you look incompetent because you can't ask allies for help tracking down Swiss criminals because the agreement needs to work both ways or not at all.
cf. Brexit, where the UK has lost access to a huge amount of police and terrorism databases. It hurts us just as badly, as it hurts them to lose access to the UK databases.
(Score: 0) by Anonymous Coward on Thursday September 09 2021, @03:02PM
From what I've seen of govt tracking, the govt does nothing until the terrorists commit a massive crime, and then it's too late. All that tracking was for what, exactly?