ProtonMail forced to comply with Swiss law and provide data in arrest of climate activist
French police arrested a climate activist with help from information they acquired from ProtonMail, despite ProtonMail's prior notice that it did not log some of the information in question.
As noted by The Register, ProtonMail has changed the wording on its website regarding logging of its users' IP addresses.
January of 2021: "No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first."
Now: "ProtonMail is email that respects privacy and puts people (not advertisers) first. Your data belongs to you, and our encryption ensures that. We also provide an anonymous email gateway."
ProtonMail was forced to comply with this information warrant from French police due to a Swiss legal request for the information. This was accomplished via Interpol transferring the French warrant to its Swiss counterparts. The information provided included the activist's IP address and the devices he used to access his inbox.
In a post on its official blog, ProtonMail stated the following points:
"1. Under no circumstances can our encryption be bypassed
2. ProtonMail does not give data to foreign governments; that’s illegal under Article 271 of the Swiss Criminal code. We only comply with legally binding orders from Swiss authorities.
3. Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law)
4. Transparency with our user community is extremely important to us. Since 2015, we have published a transparency report publicizing how we handle Swiss law enforcement requests: https://protonmail.com/blog/transparency-report/
5. Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. More information can be found here.
6. Under current Swiss law, email and VPN are treated differently, and ProtonVPN cannot be compelled to log user data.
7. Due to Proton’s strict privacy, we do not know the identity of our users, and at no point were we aware that the targeted users were climate activists. We only know that the order for data from the Swiss government came through channels typically reserved for serious crimes.
8. There was no legal possibility to resist or fight this particular request."
Regardless of these clarifications, it is a fact that the verbiage surrounding ProtonMail's logging of data on its front page changed following the publicity surrounding the arrest of this French climate activist.