Proton
Swiss surveillance law

Impact of Swiss surveillance laws on secure email

In September of this year, the Swiss Parliament passed a new Swiss surveillance law, known as the Nachrichtendienstgesetz (NDG) in German and la Loi sur le renseignement (LRens) en française.

2017 Update – In the months since the law was first introduced, we have had repeated contact with the Swiss government and held a meeting at our office together with legal counsel and members of the PTSS(новое окно). In our meetings, we discussed the practical challenges of implementing such a law, and helped to advise policy makers on the most sensible implementation.

We appreciate that the Swiss government has recognized the leading role that Proton AG plays in developing the cybersecurity tools of the future, along with the role that we play in the economic re-orientation of Geneva, and Switzerland as a whole towards the high tech sector, and sought a meeting with us to discuss how to ensure both security and privacy in the digital age.

As a participant in these discussions, we can confirm unequivocally that upon implementation, the provisions regarding data retention introduced by the BÜPF will exempt companies like Proton Mail and Proton VPN which are not major telecommunications operators. This is in addition to the points in the article below, which still hold.

This did not come as a total surprise because the Swiss surveillance law has been debated for quite some time, and mirrors similar efforts which are ongoing in other countries such as Germany(новое окно), France(новое окно), the UK(новое окно), and the US(новое окно). Unfortunately, due to the tragic events in Paris, efforts to curtail privacy have attracted political support even though it is clear that banning encryption won’t prevent terrorism(новое окно).

As the world’s largest secure email service(новое окно), we are following the discussions in Switzerland closely and we have gone over law with legal experts to understand the implications for Proton Mail. The Swiss surveillance law is similar to the one which was recently approved in Germany(новое окно). However, there are some differences. The Swiss version requires sign off by a judge and needs to go through two levels of judiciary for approval. The Swiss also don’t have a history of cooperating with the US, unlike German intelligence.

After careful analysis, we can conclude that the new Swiss surveillance law will not significantly impact the environment for secure email services in Switzerland, and in particular will not affect Proton Mail. There are a couple reasons for this.

First, the new law only allows Swiss intelligence to conduct more surveillance. Given Switzerland’s neutrality, Swiss intelligence is mostly concerned with domestic threats and does not have an interest in the data of the 95% of Proton Mail users who are not from Switzerland. While the new law might open the door for Swiss intelligence, it certainly doesn’t open it for the NSA or other foreign intelligence agencies.

Second, there is a distinction between handing over the data we already have (which is end-to-end encrypted), and being forced to actively hack users. The new laws could compel us to hand over data that we have, but they definitely CANNOT force companies to hack their users. Because Proton Mail’s encryption is done client side, any obligations for service providers to remove encryption wouldn’t apply because the encryption is applied by the end-user on their device, and not by Proton Mail. It is also not clear the clauses regarding encryption would even apply to us in the first place, because we don’t fall under the standard definition of communication service provider used in the law, which largely relates to ISPs. This applies also for Proton VPN, as there is nothing in the law that can compel us to break Proton VPN’s encryption, or force us to obtain data from users that we don’t naturally possess (such as IP logs), nor are we legally obligated to start possessing them.

Third, while it seems bad that these new laws can force Proton Mail to hand over encrypted user data, this doesn’t actually change anything. Any company (Proton Mail included), can already be asked to hand over user data provided there is a VALID Swiss court order. The new law doesn’t change this. What it does is provides Swiss intelligence another avenue to get data. Instead of having to bring a case through the courts first, they can now directly request through the judiciary. This of course applies only to Swiss intelligence, foreign intelligence agencies will still need to go through the courts.

Fourth, since Proton Mail emails are encrypted using PGP (which provides end-to-end encryption), any emails that we do hand over would be encrypted, and only the owner of the emails will have the ability to decrypt them. This means the new Swiss surveillance laws actually strengthen instead of weaken Proton Mail’s use case. If Swiss intelligence has easier access to confidential personal data under the new laws, it becomes even more important to encrypt this data, which is exactly what Proton Mail does.

For the non-Swiss Proton Mail users, it is safe to say that these laws have little to no impact. As for Swiss users, unfortunately the privacy environment in our country has gotten worse which increases the need for secure email services like Proton Mail. Even though the new Swiss surveillance law does not fundamentally harm Proton Mail’s usage case (it in fact arguably improves it), we are consistent in our stance of opposing government invasion of personal privacy. For this reason, we are supporting the referendum effort to overturn these laws, and we encourage all Swiss Proton Mail users to also study the laws and sign the referendum. More information about the referendum can be found in our blog post here(новое окно).

Finally, it is worth noting that even with increased surveillance powers, Swiss surveillance agencies are not the primary threat actors that our security team are worried about. We see better funded and resourced actors such as the US NSA, CIA, and Russian or Chinese state security, and black hat criminal groups operating without the constraints of laws, as posing significantly larger threats. Compared to these actors, Swiss surveillance agencies operating within the confines of Swiss law are simply not the main risks to Proton Mail and Proton VPN users.

If you are interested in better protecting your email privacy, it is possible to get a Proton Mail account here: https://proton.me/mail/pricing(новое окно)

Статьи по теме

A cover image for a blog describing the next six months of Proton Pass development which shows a laptop screen with a Gantt chart
en
  • Новости о продуктах
  • Proton Pass
Take a look at the upcoming features and improvements coming to Proton Pass over the next several months.
The Danish mermaid and the Dutch parliament building behind a politician and an unlocked phone
en
  • Новости о конфиденциальности
We searched the dark web for Danish, Dutch, and Luxembourgish politicians’ official email addresses. In Denmark, over 40% had been exposed.
Infostealers: What they are, how they work, and how to protect yourself
en
  • Советы о конфиденциальности
Discover insights about what infostealers are, where your stolen information goes, and ways to protect yourself.
Mockup of the Proton Pass app and text that reads "Pass Lifetime: Pay once, access forever"
en
Learn more about our exclusive Pass + SimpleLogin Lifetime offer. Pay once and enjoy premium password manager features for life.
A cover image for a blog announcing that Pass Plus will now include premium SimpleLogin features
en
We're changing the price of new Pass Plus subscriptions, which now includes access to SimpleLogin premium features.
Infinity symbol in purple with the words "Call for submissions" and "Proton Lifetime Fundraiser 7th Edition"
en
It’s time to choose the organizations we should support for the 2024 edition of our annual charity fundraiser.