ProtonMail Caught Handing Over IP Address Of French Activist To Swiss Authorities

ProtonMail, an email provider that champions privacy through it’s end-to-end encrypted service, is under heavy criticism after a police report was uncovered showing that they had provided French authorities with the IP address of a French climate activist, leading to their arrest. While ProtonMail does not need to comply with French or EU laws, the Switzerland-based company must comply with the Swiss courts; and so, French authorities went through the Swiss police to get a court order.

Andy Yen, Proton Technologies CEO, came out with a statement that the company had no choice but to comply with the legally binding order as they are obligated to follow local laws. Under its own transparency report, they state that they are legally bound to log IP addresses “in extreme criminal cases,” such as when an account is suspected to be involved in criminal activity. “There was no possibility to appeal this particular request,” he said.

Andy added that their encryption be bypassed, meaning they, and therefore the authorities, have no access to the contents of users’ emails. “We do not know the identity of our users, and at no point were we aware that the targeted users were climate activists,” said the CEO. While Swiss law requires users to be notified of any requests for their data, ProtonMail notes that “in certain circumstances,” a notification “can be delayed.”

The data request was part of an investigation into a group of climate activists that protested against gentrification by occupying commercial locations and apartments near Paris’ Place Sainte Marthe. While it started as a local effort, it quickly grew into a national movement. On 1 September, the group published an article on an anti-capitalist news site that French police had contacted the Swiss authorities through Europol to uncover the owner of their ProtonMail account.

Proton reports that in 2020, it received 3572 orders for user information, contested 750 orders, and complied with 3017 requests. That number is more than double the number of requests from the Swiss authorities on behalf of foreign governments from the previous year, meaning that Swiss courts are issuing orders that violate privacy at an alarming rate. Amidst this worrying case, Andy Yen encourages its users to use Tor or ProtonVPN, as Swiss law does not touch on IP logging for VPNs.