Updated 24 September 2021
We would like to provide important clarifications regarding the case of the climate activist who was recently arrested by French police on criminal charges. We are also deeply concerned about this case and deplore that the legal tools for serious crimes are being used in this way. In the interest of transparency, we would like to provide additional context.
In this case, Proton received a legally binding order from Swiss authorities which we are obligated to comply with. There was no possibility to appeal this particular request.
We would like to provide the following clarifications:
- Under no circumstances can our encryption be bypassed, meaning emails, attachments, calendars, files, etc. cannot be compromised by legal orders.
- ProtonMail does not give data to foreign governments; that’s illegal under Article 271 of the Swiss Criminal code. We only comply with legally binding orders from Swiss authorities.
- Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law)
- Transparency with our user community is extremely important to us. Since 2015, we have published a transparency report publicizing how we handle Swiss law enforcement requests: https://protonmail.com/blog/transparency-report/
- Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. More information can be found here.
- Under current Swiss law, email and VPN are treated differently, and ProtonVPN cannot be compelled to log user data.
- Due to Proton’s strict privacy, we do not know the identity of our users, and at no point were we aware that the targeted users were climate activists. We only know that the order for data from the Swiss government came through channels typically reserved for serious crimes.
- There was no legal possibility to resist or fight this particular request.
ProtonMail worked as designed
This case shows that ProtonMail works as it is designed to. The identity and location of the activist was already known to the French authorities (they had already been evicted once before for squatting, and the nature of squatting means that their location is known). Therefore, the authorities were most likely targeting email contents which might have provided further incriminating evidence. The fact that ProtonMail was not able to hand over any messages even under legal order proves that our encryption works, and very likely will be of great assistance to the activist in this case. Had they been using any other email provider, the outcome would have been very different.
What we are changing
What does this mean for activists using ProtonMail?
We understand your concerns and we stand with you – we are activists, too. There are a couple things we want to share.
Proton does fight for users
Unlike other providers, we do fight on behalf of our users. Few people know this (it’s in our transparency report), but we actually fought over 700 cases in 2020 alone. Whenever possible, we will fight requests, but it is not always possible.
Use Tor for anonymous access
There is a difference between security/privacy, and anonymity. As we wrote in our public threat model (published back in 2014), “The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as ProtonMail can be legally compelled to log your IP address.” This cannot be changed due to how the internet works. However, we understand this is concerning for individuals with certain threat models, which is why since 2017, we also provide an onion site for anonymous access (we are one of the only email providers that supports this).
Swiss law is still better than most
No matter what service you use, unless it is based 15 miles offshore in international waters, the company will have to comply with the law. The Swiss legal system, while not perfect, does provide a number of checks and balances, and it’s worth noting that even in this case, approval from 3 authorities in 2 countries was required, and that’s a fairly high bar which prevents most (but obviously not all) abuse of the system. Under Swiss law, it is also obligatory for the suspect to be notified that their data was requested, which is not the case in most countries. Finally, Switzerland generally will not assist prosecutions from countries without fair justice systems.
What should we do?
We need to help the youth activists, but ProtonMail cannot do that by breaking the law and ignoring court orders. We are on your side, and our shared fight is with the authorities and the unjust laws we have been campaigning against for years. The prosecution in this particular case was very aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used).
We will continue to campaign against such laws and abuses, and we will continue to challenge unjustified government requests whenever possible.