ProtonBlog(new window)

Important clarifications regarding arrest of climate activist

Share this page

Update: In October 2021, Proton won a Swiss court ruling that email services are not telecommunications providers. Consequently, email services are not subject to the data retention requirements imposed on telecommunications providers and are exempted from handing over certain user data in response to Swiss legal orders. Learn more(new window)

We would like to provide important clarifications regarding the case of the climate activist who was recently arrested by French police on criminal charges. We are also deeply concerned about this case and deplore that the legal tools for serious crimes are being used in this way. In the interest of transparency, we would like to provide additional context. 

In this case, Proton received a legally binding order from Swiss authorities which we are obligated to comply with. There was no possibility to appeal this particular request.

As detailed in our transparency report(new window), our published threat model(new window), and also our privacy policy(new window), under Swiss law, Proton can be forced to collect information on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account. 

We would like to provide the following clarifications:

  1. Under no circumstances can our encryption be bypassed, meaning emails, attachments, calendars, files, etc. cannot be compromised by legal orders.
  2. Proton Mail does not give data to foreign governments; that’s illegal under Article 271 of the Swiss Criminal code. We only comply with legally binding orders from Swiss authorities.
  3. Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law)
  4. Transparency with our user community is extremely important to us. Since 2015, we have published a transparency report publicizing how we handle Swiss law enforcement requests: https://proton.me/legal/transparency(new window)
  5. Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. More information can be found here.
  6. Under current Swiss law, email and VPN are treated differently, and Proton VPN cannot be compelled to log user data
  7. Due to Proton’s strict privacy, we do not know the identity of our users, and at no point were we aware that the targeted users were climate activists. We only know that the order for data from the Swiss government came through channels typically reserved for serious crimes. 
  8. There was no legal possibility to resist or fight this particular request.

Proton Mail worked as designed

This case shows that Proton Mail works as it is designed to. The identity and location of the activist was already known to the French authorities (they had already been evicted once before for squatting, and the nature of squatting means that their location is known). Therefore, the authorities were most likely targeting email contents which might have provided further incriminating evidence. The fact that Proton Mail was not able to hand over any messages even under legal order proves that our encryption works, and very likely will be of great assistance to the activist in this case. Had they been using any other email provider, the outcome would have been very different.

What we are changing

We will be making updates to our website to better clarify Proton Mail’s obligations in cases of criminal prosecution and we apologize if this was not clear. As a Swiss company, we must follow Swiss laws. We will also clarify that the use of our onion site (details below) is highly recommended for users with heightened privacy needs. Finally, we will also be updating our privacy policy to make clearer our legal obligations under Swiss law. 

What does this mean for activists using Proton Mail? 

We understand your concerns and we stand with you – we are activists, too. There are a couple things we want to share.  

Proton does fight for users

Unlike other providers, we do fight on behalf of our users. Few people know this (it’s in our transparency report), but we actually fought over 1,038 cases in 2022 alone. Whenever possible, we will fight requests, but it is not always possible.

Use Tor for anonymous access

There is a difference between security/privacy, and anonymity. As we wrote in our public threat model(new window) (published back in 2014), “The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as Proton Mail can be legally compelled to log your IP address.” This cannot be changed due to how the internet works. However, we understand this is concerning for individuals with certain threat models, which is why since 2017, we also provide an onion site for anonymous access (we are one of the only email providers that supports this). 

Swiss law is still better than most

No matter what service you use, unless it is based 15 miles offshore in international waters, the company will have to comply with the law. The Swiss legal system, while not perfect, does provide a number of checks and balances, and it’s worth noting that even in this case, approval from 3 authorities in 2 countries was required, and that’s a fairly high bar which prevents most (but obviously not all) abuse of the system. Under Swiss law, it is also obligatory for the suspect to be notified that their data was requested, which is not the case in most countries. Finally, Switzerland generally will not assist prosecutions from countries without fair justice systems. 

What should we do?

We need to help the youth activists, but Proton Mail cannot do that by breaking the law and ignoring court orders. We are on your side, and our shared fight is with the authorities and the unjust laws we have been campaigning against for years. The prosecution in this particular case was very aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example, in France where terror laws are inappropriately used). 

We will continue to campaign against such laws and abuses, and we will continue to challenge unjustified government requests whenever possible. 

Protect your privacy with Proton
Create a free account

Share this page

Andy Yen(new window)

Andy is the founder and CEO of Proton. He is a long-time advocate for privacy rights and has spoken at TED, Web Summit, and the United Nations about online privacy issues. Previously, Andy was a research scientist at CERN and has a PhD in particle physics from Harvard University.

Related articles

Can you password-protect a folder in Google Drive?
Protecting a folder with a password is a simple yet effective way of securing files. You may wonder whether you can password-protect a folder in Google Drive. We explain what access controls Google Drive offers and what you can do to improve your sec
Proton Pass now supports passkeys on all devices and plans
We’re excited to announce that Proton Pass supports passkeys for everyone, allowing you to manage and use passkeys across all devices seamlessly. Passkeys are an easy and secure alternative to traditional passwords that can help prevent phishing atta
what is a passkey?
Passkeys are a new way to secure your online accounts using cryptographic keys instead of passwords. They offer a high level of convenience and security, and are a real game-changer in the way we access and secure sites. What is a passkey, though, an
Apple’s marketing team has built a powerful association between the iPhone and privacy. The company’s ad campaigns claim that “what happens on your iPhone, stays on your iPhone.” And, “Privacy. That’s iPhone.” But Apple’s lawyers are telling a diffe
A cyberattack on national public employment service France Travail has exposed the personal data of as many as 43 million people.  The latest breach is the second major cybersecurity attack to happen in France in the past month, raising concerns abo
If I share a folder in Google Drive, can anybody see my other folders
Google Drive makes it easy to share files and folders, but you may have wondered at some point whether the people you’ve shared a folder with can see your other folders. We answer this question below and also share some tips for truly secure link sha
In 2014, Proton Mail was introduced as a web app, revolutionizing how we think about email privacy. Today, we’re excited to broaden the horizons of secure communication by launching the Proton Mail desktop app. Anyone can now use the new Proton Mail