ProtonMail under fire after giving authorities an activist’s IP address

ProtonMail, an email service that prides itself on security with end-to-end encryption, is facing criticism after it gave up a French climate activist’s IP address to Swiss police. As TechCrunch reports, the company was acting on a request sent via Europol by French authorities, who sought help from the Swiss. Since it’s based in Switzerland, ProtonMail has to obey the country’s laws. That includes logging IP addresses from users in “extreme criminal cases,” according to its own transparency report. 

Andy Yen, Proton’s CEO, pointed out in a blog post today that the company has tried to make it clear that it has to follow local laws. “In this case, Proton received a legally binding order from Swiss authorities which we are obligated to comply with,” he wrote. “There was no possibility to appeal this particular request.”

The case in question involves activists who took over commercial locations and apartments near Paris’s Place Sainte Marthe. According to TechCrunch, the protest began as a local effort around gentrification in the neighborhood, but quickly grew into a movement that snagged national headlines in France. On September 1st, they published an article claiming that French authorities sent a message through Europol to uncover who created their ProtonMail account.

Yen notes that the company’s encryption prevents it from seeing the contents of a ProtonMail account, and it also doesn’t know the identity of its users. So in this case, it wasn’t aware it was revealing information about climate activists. Moving forward, he says the company will be more clear how it handles cases of criminal prosecution, and it will further promote using ProtonMail via its Tor site and the company’s VPN for users particularly concerned about privacy.

In 2020, Proton says it received 3,572 orders for user information, contested 750 orders and ultimately complied with 3,017 requests.