The private email service Protonmail is drawing harsh criticism from its users after providing IP information linked to a French activist who used the service, as first reported by TechCrunch.
The data was requested as part of a broader investigation into a group of climate activists who have occupied a number of apartments and commercial spaces in Paris. While the members of the group are anonymous, one had used the address “jmm18@protonmail.com” in online postings. As a result, French police sought to identify any persons linked to the account.
Because ProtonMail is based in Switzerland, it is not subject to French or EU requests. But the company is still subject to requests from Swiss courts, where French police where able to lodge their request with the help of Europol. After Swiss courts approved the order, ProtonMail began logging IP information on the account, which was subsequently handed over to French police, leading to the activist’s identification and arrest.
In a post titled “Important clarifications regarding arrest of climate activist,” Proton CEO Andy Yen said he shared concern over the prosecution, and gave further detail on the legal issues that had forced the company to provide the data.
“Proton received a legally binding order from Swiss authorities which we are obligated to comply with. There was no possibility to appeal this particular request,” Yen wrote in the post. “The prosecution in this particular case was very aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world.”
Crucially, the order did not provide the contents of the activist’s email, which are encrypted and cannot be accessed by Proton. Yen said a similar order would also not be able to provide ProtonVPN metadata, as VPNs are subject to different requirements under Swiss law.
Still, the arrest is alarming for many users of ProtonMail, who had expected the service to have more robust protections against legal identification. Yen pledged to update the service’s public documentation to “better clarify ProtonMail’s obligations in cases of criminal prosecution.”
Proton’s own transparency report shows the alarming growth of Swiss court orders, including those served on behalf of foreign investigations. In 2020, Proton complied with over 3,000 data orders from Swiss courts, more than double the number served in the previous year.
