ProtonMail Logs Activist’s IP Address With Authorities After Swiss Court Order

End-to-end encrypted email service provider ProtonMail has
drawn^[1]
criticism^[2]
after it ceded to a legal request and shared the IP address of
anti-gentrification activists with law enforcement authorities,
leading to their arrests in France.

The Switzerland-based company said it received a “legally
binding order from the Swiss Federal Department of Justice” related
to a collective called Youth for Climate, which it was “obligated
to comply with,” compelling it to handover the IP address and
information related to the type of device used by the group to
access the ProtonMail account.

On its website, ProtonMail advertises^[3]
that: “No personal information is required to create your secure
email account. By default, we do not keep any IP logs which can be
linked to your anonymous email account. Your privacy comes
first.”

Protonmail Homepage

Despite its no IP logs claims, the company acknowledged that
while it’s illegal for the company to abide by requests from
non-Swiss law enforcement authorities, it will be required to do so
if Swiss agencies agree to assist foreign services such as Europol
in their investigations.

“There was no possibility to appeal or fight this particular
request because an act contrary to Swiss law did in fact take place
(and this was also the final determination of the Federal
Department of Justice which does a legal review of each case),” the
company said^[4]
in a lengthy response posted on Reddit.

Put simply, ProtonMail will not only have to comply with Swiss government
orders^[5], it will be forced to
hand over relevant data^[6]
when individuals use the service to engage in activities that are
deemed illegal in the country. This includes monitoring IP
addresses from users in “extreme criminal cases,” according to its
transparency report^[7].

“Proton must comply with Swiss law. As soon as a crime is
committed, privacy protections can be suspended and we’re required
by Swiss law to answer requests from Swiss authorities,” ProtonMail
founder and CEO Andy Yen tweeted^[8], adding^[9]
“It’s deplorable that legal tools for serious crimes are being used
in this way. But by law, [ProtonMail] must comply with Swiss
criminal investigations. This is obviously not done by default, but
only if legally forced.”

If anything, ProtonMail users who are concerned about the
visibility of their IP addresses should use a VPN or access the
email service over the Tor network for additional anonymity.

“The prosecution in this case seems quite aggressive.
Unfortunately, this is a pattern we have increasingly seen in
recent years around the world (for example in France where terror
laws are inappropriately used),” the company said.

Update

In a blog post titled “Important clarifications regarding arrest
of climate activist,” Andy Yen said^[10] the company “can be
forced to collect information on accounts belonging to users under
Swiss criminal investigation. This is obviously not done by
default, but only if Proton gets a legal order for a specific
account.”

Updated Protonmail Homepage

Furthermore, in a revision^[11] to its privacy policy,
ProtonMail now explicitly spells out that it will be forced to log
users’ IP addresses if found in violation of Swiss laws —

“By default, we do not keep permanent IP logs in relation
with your use of the Services. However, IP logs may be kept
temporarily to combat abuse and fraud, and your IP address may be
retained permanently if you are engaged in activities that breach
our terms and conditions (spamming, DDoS attacks against our
infrastructure, brute force attacks, etc). The legal basis of this
processing is our legitimate interest to protect our Services
against nefarious activities. If you are breaking
Swiss law, ProtonMail can be legally compelled to log your IP
address as part of a Swiss criminal
investigation.“