Encrypted mail service Proton hands suspect's personal info to cops again

https://www.theregister.com/2024/05/13/infosec_in_brief/

by belter • 2 years ago

3 4 2 years ago

beretguy• 2 years ago

Proton told advocacy outfit Restore Privacy it was well aware of the case, but its hands were tied under Swiss laws against terrorism. "Proton has minimal user information, as illustrated by the fact that in this case data obtained from Apple was used to identify the terrorism suspect," a Proton spokesperson protested. "Proton provides privacy by default and not anonymity by default because anonymity requires certain user actions to ensure proper OpSec, such as not adding your Apple account as an optional recovery method."

I mean, what do you want Proton to do? They are not above the law, and they merely gave away recovery email, which suspect didn’t have to do. One of the reasons I use proton is because it does not require me to enter a phone number or second email.

belter• 2 years ago

"...In 2021, the Switzerland-based vendor provided Swiss police with the IP address and device details of a netizen the cops were trying to identify. That individual – a French climate activist – was later arrested after Proton shared the same data with French police.

Shortly after that kerfuffle, Proton removed the claim that it didn't track user IP addresses from its website..."

obelus• 2 years ago

Proton responded to this in 2021: https://proton.me/blog/climate-activist-arrest

"the identity and location of the activist was already known to the French authorities. The fact that Proton Mail was not able to hand over any messages even under legal order proves that our encryption works, and very likely of great assistance to the activist in this case. Had they been using any other email provider, the outcome would have been very different.

"we also provide an onion site for anonymous access (we are one of the only email providers that supports this)."

They also updated the blog: "Update: In October 2021, Proton won a Swiss court ruling that email services are not telecommunications providers. Consequently, email services are not subject to the data retention requirements imposed on telecommunications providers and are exempted from handing over certain user data in response to Swiss legal orders."

r721• 2 years ago

Previous discussion: https://news.ycombinator.com/item?id=40280689 (269 comments)

Encrypted mail service Proton hands suspect's personal info to cops again

Related Stories