Update: In October 2021, Proton won a Swiss court ruling that email services are not telecommunications providers. Consequently, email services are not subject to the data retention requirements imposed on telecommunications providers and are exempted from handing over certain user data in response to Swiss legal orders. Learn more(nowe okno)
We would like to provide important clarifications regarding the case of the climate activist who was recently arrested by French police on criminal charges. We are also deeply concerned about this case and deplore that the legal tools for serious crimes are being used in this way. In the interest of transparency, we would like to provide additional context.
In this case, Proton received a legally binding order from Swiss authorities which we are obligated to comply with. There was no possibility to appeal this particular request.
As detailed in our transparency report(nowe okno), our published threat model(nowe okno), and also our privacy policy(nowe okno), under Swiss law, Proton can be forced to collect information on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account.
We would like to provide the following clarifications:
- Under no circumstances can our encryption be bypassed, meaning emails, attachments, calendars, files, etc. cannot be compromised by legal orders.
- Proton Mail does not give data to foreign governments; that’s illegal under Article 271 of the Swiss Criminal code. We only comply with legally binding orders from Swiss authorities.
- Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law)
- Transparency with our user community is extremely important to us. Since 2015, we have published a transparency report publicizing how we handle Swiss law enforcement requests: https://proton.me/legal/transparency(nowe okno)
- Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. More information can be found here.
- Under current Swiss law, email and VPN are treated differently, and Proton VPN cannot be compelled to log user data.
- Due to Proton’s strict privacy, we do not know the identity of our users, and at no point were we aware that the targeted users were climate activists. We only know that the order for data from the Swiss government came through channels typically reserved for serious crimes.
- There was no legal possibility to resist or fight this particular request.
Proton Mail worked as designed
This case shows that Proton Mail works as it is designed to. The identity and location of the activist was already known to the French authorities (they had already been evicted once before for squatting, and the nature of squatting means that their location is known). Therefore, the authorities were most likely targeting email contents which might have provided further incriminating evidence. The fact that Proton Mail was not able to hand over any messages even under legal order proves that our encryption works, and very likely will be of great assistance to the activist in this case. Had they been using any other email provider, the outcome would have been very different.
What we are changing
We will be making updates to our website to better clarify Proton Mail’s obligations in cases of criminal prosecution and we apologize if this was not clear. As a Swiss company, we must follow Swiss laws. We will also clarify that the use of our onion site (details below) is highly recommended for users with heightened privacy needs. Finally, we will also be updating our privacy policy to make clearer our legal obligations under Swiss law.
What does this mean for activists using Proton Mail?
We understand your concerns and we stand with you – we are activists, too. There are a couple things we want to share.
Proton does fight for users
Unlike other providers, we do fight on behalf of our users. Few people know this (it’s in our transparency report), but we actually fought over 1,038 cases in 2022 alone. Whenever possible, we will fight requests, but it is not always possible.
Use Tor for anonymous access
There is a difference between security/privacy, and anonymity. As we wrote in our public threat model(nowe okno) (published back in 2014), “The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as Proton Mail can be legally compelled to log your IP address.” This cannot be changed due to how the internet works. However, we understand this is concerning for individuals with certain threat models, which is why since 2017, we also provide an onion site for anonymous access (we are one of the only email providers that supports this).
Swiss law is still better than most
No matter what service you use, unless it is based 15 miles offshore in international waters, the company will have to comply with the law. The Swiss legal system, while not perfect, does provide a number of checks and balances, and it’s worth noting that even in this case, approval from 3 authorities in 2 countries was required, and that’s a fairly high bar which prevents most (but obviously not all) abuse of the system. Under Swiss law, it is also obligatory for the suspect to be notified that their data was requested, which is not the case in most countries. Finally, Switzerland generally will not assist prosecutions from countries without fair justice systems.
What should we do?
We need to help the youth activists, but Proton Mail cannot do that by breaking the law and ignoring court orders. We are on your side, and our shared fight is with the authorities and the unjust laws we have been campaigning against for years. The prosecution in this particular case was very aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example, in France where terror laws are inappropriately used).
We will continue to campaign against such laws and abuses, and we will continue to challenge unjustified government requests whenever possible.
