techcrunch.com
Open in
urlscan Pro
2001:4998:124:1704::5000
Public Scan
URL:
https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/
Submission Tags: privacy tech technology human rights surveillance dictatorship authoritarian court Search All
Submission: On April 21 via manual from US — Scanned from US
Submission Tags: privacy tech technology human rights surveillance dictatorship authoritarian court Search All
Submission: On April 21 via manual from US — Scanned from US
Form analysis 1 forms found in the DOM
<form action="" class="form newsletter-form" id="">
<div class="form-field form-field--checkbox form-field--default form-field--required">
<div class="form-field__checkbox-wrapper " id="wrapper-Readership"><input class="form-field__input form-field__input--checkbox " id="checkbox-Readership" name="newsletters" type="checkbox" value="Readership"><label class="checkbox-field-label"
for="checkbox-Readership">Daily News</label></div>
<div class="form-field__checkbox-wrapper " id="wrapper-Readership-wkend"><input class="form-field__input form-field__input--checkbox " id="checkbox-Readership-wkend" name="newsletters" type="checkbox" value="Readership-wkend"><label
class="checkbox-field-label" for="checkbox-Readership-wkend">Week in Review</label></div>
<div class="form-field__checkbox-wrapper " id="wrapper-Readership-startups"><input class="form-field__input form-field__input--checkbox " id="checkbox-Readership-startups" name="newsletters" type="checkbox" value="Readership-startups"><label
class="checkbox-field-label" for="checkbox-Readership-startups">Startups Weekly</label></div>
<div class="form-field__checkbox-wrapper " id="wrapper-Readership-event-updates"><input class="form-field__input form-field__input--checkbox " id="checkbox-Readership-event-updates" name="newsletters" type="checkbox"
value="Readership-event-updates"><label class="checkbox-field-label" for="checkbox-Readership-event-updates">Event Updates</label></div>
<div class="form-field__checkbox-wrapper " id="wrapper-Readership-sponsorship"><input class="form-field__input form-field__input--checkbox " id="checkbox-Readership-sponsorship" name="newsletters" type="checkbox"
value="Readership-sponsorship"><label class="checkbox-field-label" for="checkbox-Readership-sponsorship">Advertising Updates</label></div>
</div>
<div class="newsletter-signup__disclaimer">By subscribing, you are agreeing to <a href="https://legal.yahoo.com/us/en/yahoo/terms/otos/index.html" target="_blank">Yahoo's Terms</a> and
<a href="https://legal.yahoo.com/us/en/yahoo/privacy/index.html" target="_blank">Privacy Policy</a>.</div>
<fieldset class="form-field form-field--email form-field--default form-field--required"><input class="form-field__input form-field__input--email" name="email" type="email" required="" value=""><label class="form-field__label">Email</label>
</fieldset><button class="button button--black button--primary" disabled="">Subscribe</button>
</form>Text Content
TechCrunch plus-bold TechCrunch Login Searchsearch * Startups * Venture * Security * AI * Crypto * Apps * Events * Startup Battlefield * More Close Screen x(opens in a new window)facebook(opens in a new window)linkedin(opens in a new window)reddit(opens in a new window)mail(opens in a new window)Copy Share Link Link CopiedLink Copied Privacy PROTONMAIL LOGGED IP ADDRESS OF FRENCH ACTIVIST AFTER ORDER BY SWISS AUTHORITIES Natasha Lomas, Romain Dillet / 1:46 AM HST•September 6, 2021 comment Comment cameraImage Credits: Jaye Haych / Unsplash ProtonMail, a hosted email service with a focus on end-to-end encrypted communications, has been facing criticism after a police report showed that French authorities managed to obtain the IP address of a French activist who was using the online service. The company has communicated widely about the incident, stating that it doesn’t log IP addresses by default and it only complies with local regulation — in that case Swiss law. While ProtonMail didn’t cooperate with French authorities, French police sent a request to Swiss police via Europol to force the company to obtain the IP address of one of its users. For the past year, a group of people have taken over a handful of commercial premises and apartments near Place Sainte Marthe in Paris. They want to fight against gentrification, real estate speculation, Airbnb and high-end restaurants. While it started as a local conflict, it quickly became a symbolic campaign. They attracted newspaper headlines when they started occupying premises rented by Le Petit Cambodge — a restaurant that was targeted by the November 13, 2015 terrorist attacks in Paris. Place Sainte Marthe, Paris. Image Credits: Chabe01 (opens in a new window) / Wikimedia Commons (opens in a new window) under a CC BY-SA 4.0 (opens in a new window) license. On September 1, the group published an article on Paris-luttes.info, an anti-capitalist news website, summing up different police investigations and legal cases against some members of the group. According to their story, French police sent an Europol request to ProtonMail in order to uncover the identity of the person who created a ProtonMail account — the group was using this email address to communicate. The address has also been shared on various anarchist websites. The next day, @MuArF on Twitter shared an abstract of a police report detailing ProtonMail’s reply. According to @MuArF, the police report is related to the ongoing investigation against the group who occupied various premises around Place Sainte-Marthe. It says that French police received a message from Europol. That message contains details about the ProtonMail account. Here’s what the report says: > * The company PROTONMAIL informs us that the email address has been created > on … The IP address linked to the account is the following: … > * The device used is a … device identified with the number … > * The data transmitted by the company is limited to that due to the privacy > policy of PROTONMAIL TECHNOLOGIES. ProtonMail’s founder and CEO Andy Yen reacted to the police report on Twitter without mentioning the specific circumstances of that case in particular. “Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we’re required by Swiss law to answer requests from Swiss authorities,” he wrote. In particular, Andy Yen wants to make it clear that his company didn’t cooperate with French police nor Europol. It seems like Europol acted as the communication channel between French authorities and Swiss authorities. At some point, Swiss authorities took over the case and sent a request to ProtonMail directly. The company references these requests as “foreign requests approved by Swiss authorities” in its transparency report. TechCrunch contacted ProtonMail founder and CEO Andy Yen with questions about the case. One key question is exactly when the targeted account holder was notified that their data had been requested by Swiss authorities since — per ProtonMail — notification is obligatory under Swiss law. However, Yen told us that — “for privacy and legal reasons” — he is unable to comment on specific details of the case or provide “non-public information on active investigations,” adding: “You would have to direct these inquiries to the Swiss authorities.” At the same time, he did point us to this public page, where ProtonMail provides information for law enforcement authorities seeking data about users of its end-to-end encrypted email service, including setting out a “ProtonMail user notification policy.” Here the company reiterates that Swiss law “requires a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding” — however it also notes that “in certain circumstances” a notification “can be delayed.” Per this policy, Proton says delays can affect notifications if: There is a temporary prohibition on notice by the Swiss legal process itself, by Swiss court order or “applicable Swiss law”; or where “based on information supplied by law enforcement, we, in our absolute discretion, believe that providing notice could create a risk of injury, death, or irreparable damage to an identifiable individual or group of individuals.” “As a general rule though, targeted users will eventually be informed and afforded the opportunity to object to the data request, either by ProtonMail or by Swiss authorities,” the policy adds. So, in the specific case, it looks likely that ProtonMail was either under legal order to delay notification to the account holder — given what appears to be up to eight months between the logging being instigated and disclosure of it — or it had been provided with information by the Swiss authorities which led it to conclude that delaying notice was essential to avoid a risk of “injury, death, or irreparable damage” to a person or persons (NB: It is unclear what “irreparable damage” means in this context, and whether it could be interpreted figuratively — as “damage” to a person’s/group’s interests, for example, such as to a criminal investigation, not solely bodily harm — which would make the policy considerably more expansive). In either scenario the level of transparency being afforded to individuals by Swiss law having a mandatory notification requirement when a person’s data has been requested looks severely limited if the same law authorities can, essentially, gag notifications — potentially for long periods (seemingly more than half a year in this specific case). ProtonMail’s public disclosures also log an alarming rise in requests for data by Swiss authorities. According to its transparency report, ProtonMail received 13 orders from Swiss authorities back in 2017 — but that had swelled to over three and a half thousand (3,572!) by 2020. The number of foreign requests to Swiss authorities which are being approved has also risen, although not as steeply — with ProtonMail reporting receiving 13 such requests in 2017 — rising to 195 in 2020. The company says it complies with lawful requests for user data but it also says it contests orders where it does not believe them to be lawful. And its reporting shows an increase in contested orders — with ProtonMail contesting three orders back in 2017 but in 2020 it pushed back against 750 of the data requests it received. Per ProtonMail’s privacy policy, the information it can provide on a user account in response to a valid request under Swiss law may include account information provided by the user (such as an email address); account activity/metadata (such as sender, recipient email addresses; IP addresses incoming messages originated from; the times messages were sent and received; message subjects, etc.); total number of messages, storage used and last login time; and unencrypted messages sent from external providers to ProtonMail. As an end-to-end encrypted email provider, it cannot decrypt email data so is unable to provide information on the contents of email, even when served with a warrant. However, in its transparency report, the company also signals an additional layer of data collection which it may be (legally) obligated to carry out — writing that: “In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities.” > In general though, unless you are based 15 miles offshore in international > waters, it is not possible to ignore court orders. Andy Yen It’s that IP monitoring component which has caused such alarm among privacy advocates now — and no small criticism of Proton’s marketing claims as a “user-privacy-centric” company. It has faced particular criticism for marketing claims of providing “anonymous email” and for the wording of the caveat in its transparency disclosure — where it talks about IP logging only occurring in “extreme criminal cases.” Few would agree that anti-gentrification campaigners meet that bar. At the same time, Proton does provide users with an onion address — meaning activists concerned about tracking can access its encrypted email service using Tor which makes it harder for their IP address to be tracked. So it is providing tools for users to protect themselves against IP monitoring (as well as protect the contents of their emails from being snooped on), even though its own service can, in certain circumstances, be turned into an IP monitoring tool by Swiss law enforcement. In the backlash around the revelation of the IP logging of the French activists, Yen said via Twitter that ProtonMail will be providing a more prominent link to its onion address on its website: Proton does also offer a VPN service of its own — and Yen has claimed that Swiss law does not allow it to log its VPN users’ IP addresses. So it’s interesting to speculate whether the activists might have been able to evade the IP logging if they had been using both Proton’s end-to-end encrypted email and its VPN service. “If they were using Tor or ProtonVPN, we would have been able to provide an IP, but it would be the IP of the VPN server, or the IP of the Tor exit node,” Yen told TechCrunch when we asked about this. “We do protect against this threat model via our onion site (protonmail.com/tor),” he added. “In general though, unless you are based 15 miles offshore in international waters, it is not possible to ignore court orders.” “The Swiss legal system, while not perfect, does provide a number of checks and balances, and it’s worth noting that even in this case, approval from three authorities in two countries was required, and that’s a fairly high bar which prevents most (but not all) abuse of the system.” In a public response on Reddit, Proton also writes that it is “deeply concerned” about the case — reiterating that it was unable to contest the order in this instance. “The prosecution in this case seems quite aggressive,” it added. “Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used). We will continue to campaign against such laws and abuses.” Zooming out, in another worrying development that could threaten the privacy of internet users in Europe, European Union lawmakers have signaled they want to work to find ways to enable lawful access to encrypted data — even as they simultaneously claim to support strong encryption. Again, privacy campaigners are concerned. ProtonMail and a number of other end-to-end encrypted services warned in an open letter in January that EU lawmakers risk setting the region on a dangerous path toward backdooring encryption if they continue in this direction. > ProtonMail, Threema, Tresorit and Tutanota warn EU lawmakers over > ‘anti-encryption’ push Update: Open Terms Archive has spotted a change to ProtonMail’s privacy policy. The company added a line that reads: “If you are breaking Swiss law, ProtonMail can be legally compelled to log your IP address as part of a Swiss criminal investigation. This obligation however does not extend to ProtonVPN (see VPN privacy policy here). Additional details can be found in our transparency report.” More TechCrunch ROOMS, A 3D DESIGN APP AND 'COZY GAME,' GETS A MAJOR UPDATE AS USERS JUMP TO 250K TOO MANY MODELS HOW UNITED AIRLINES USES AI TO MAKE FLYING THE FRIENDLY SKIES A BIT EASIER DON’T BLAME MKBHD FOR THE FATE OF HUMANE AI AND FISKER close PLEASE LOGIN TO COMMENT Login / Create Account TECHCRUNCH EARLY STAGE Founder Summit April 25, Boston REGISTER TODAY SIGN UP FOR NEWSLETTERS See all newsletters(opens in a new window) Daily News Week in Review Startups Weekly Event Updates Advertising Updates By subscribing, you are agreeing to Yahoo's Terms and Privacy Policy. EmailSubscribe x(opens in a new window)facebook(opens in a new window)linkedin(opens in a new window)reddit(opens in a new window)mail(opens in a new window)Copy Share Link checkmarkCopy TAGS * backdoor * encryption * Policy * Proton * protonmail Privacy PROTONMAIL LOGGED IP ADDRESS OF FRENCH ACTIVIST AFTER ORDER BY SWISS AUTHORITIES Natasha Lomas, Romain Dillet 1:46 AM HST•September 6, 2021 ProtonMail, a hosted email service with a focus on end-to-end encrypted communications, has been facing criticism after a police report showed that French authorities managed to obtain the IP addre... Transportation TESLA LAYOFFS, CYBERTRUCK RECALLS AND SERVE ROBOTICS GOES PUBLIC Kirsten Korosec, Rebecca Bellan 9:15 AM HST•April 21, 2024 Welcome back to TechCrunch Mobility — your central hub for news and insights on the future of transportation. Sign up here — just click TechCrunch Mobility — to receive the newsletter every weekend... AI WOMEN IN AI: ANNA KORHONEN STUDIES THE INTERSECTION BETWEEN LINGUISTICS AND AI Kyle Wiggers 5:30 AM HST•April 21, 2024 To give AI-focused women academics and others their well-deserved — and overdue — time in the spotlight, TechCrunch has been publishing a series of interviews focused on remarkable women who’ve con... Featured Article HOW UNITED AIRLINES USES AI TO MAKE FLYING THE FRIENDLY SKIES A BIT EASIER “I think the travel industry has so many different examples of where AI can be used both fo... Frederic Lardinois 5:00 AM HST•April 21, 2024 Fintech FINTECH STARTUP RAMP SEES 32% BUMP IN VALUATION, MERCURY EXPANDS INTO CONSUMER BANKING Mary Ann Azevedo 4:30 AM HST•April 21, 2024 Welcome to TechCrunch Fintech! This week, we’re looking at Ramp’s big raise and valuation jump, Mercury’s move into personal banking, Klarna’s new credit card, global funding roun... Gadgets THIS CAMERA TRADES PICTURES FOR AI POETRY Haje Jan Kamps 10:31 AM HST•April 20, 2024 The Poetry Camera takes the concept of photography to new heights by generating poetry based on the visuals it encounters. Social BOSTON DYNAMICS UNVEILS A NEW ROBOT, CONTROVERSY OVER MKBHD, AND LAYOFFS AT TESLA Kyle Wiggers 10:15 AM HST•April 20, 2024 Welcome, folks, to Week in Review (WiR), TechCrunch’s weekly news recap. The weather’s getting hotter — but not quite as hot as the generative AI space, which saw a slew of new mo... AI WOMEN IN AI: EWA LUGER EXPLORES HOW AI AFFECTS CULTURE — AND VICE VERSA Kyle Wiggers 10:00 AM HST•April 20, 2024 Ewa Luger, profiled as part of TechCrunch’s series on women in AI, is co-director at the Institute of Design Informatics. Apps U.S. HOUSE PASSES REVISED BILL TO BAN TIKTOK OR FORCE SALE Anthony Ha 8:29 AM HST•April 20, 2024 The U.S. House of Representatives passed a bill this afternoon that would require TikTok-owner ByteDance to sell the popular social media app or see it banned in the United States. Efforts to ban T... AI WHY VECTOR DATABASES ARE HAVING A MOMENT AS THE AI HYPE CYCLE PEAKS Paul Sawers 5:00 AM HST•April 20, 2024 Vector databases are all the rage, judging by the number of startups entering the space and the investors ponying up for a piece of the pie. The proliferation of large language models (LLMs) and th... Venture NOTABLE CAPITAL’S HANS TUNG ON THE STATE OF VC AND THE UPSIDE TO DOWN ROUNDS Mary Ann Azevedo, Theresa Loconsolo 4:30 AM HST•April 20, 2024 To some investors, “down round” is a dirty phrase, but not to Notable Capital’s Hans Tung. Hans is a managing partner at Notable Capital, formerly GGV Capital, a venture firm focusing on investment... AI THIS WEEK IN AI: WHEN ‘OPEN SOURCE’ ISN’T SO OPEN Kyle Wiggers 3:15 AM HST•April 20, 2024 Keeping up with an industry as fast-moving as AI is a tall order. So until an AI can do it for you, here’s a handy roundup of recent stories in the world of machine learning, along with notable res... Security LAWMAKERS VOTE TO REAUTHORIZE US SPYING LAW THAT CRITICS SAY EXPANDS GOVERNMENT SURVEILLANCE Zack Whittaker 3:00 AM HST•April 20, 2024 House and Senate lawmakers passed a bill reauthorizing the controversial Section 702 powers under FISA, which allows U.S. spy agencies to conduct warrantless searches of Americans’ communicat... AI WOMEN IN AI: ALLISON COHEN ON BUILDING RESPONSIBLE AI PROJECTS Kyle Wiggers 3:00 AM HST•April 20, 2024 Alison Cohen, profiled as part of TechCrunch’s series on women in AI, is a senior AI projects manager at Mila, a Quebec-based AI research group. Featured Article INDIA’S ELECTION OVERSHADOWED BY THE RISE OF ONLINE MISINFORMATION As India kicks off the world’s biggest election, which starts on April 19 and runs through ... Jagmeet Singh 2:00 AM HST•April 20, 2024 Space CESIUMASTRO CLAIMS FORMER EXEC SPILLED TRADE SECRETS TO UPSTART COMPETITOR ANYSIGNAL Aria Alamalhodaei 11:57 AM HST•April 19, 2024 CesiumAstro alleges in a newly filed lawsuit that a former executive disclosed trade secrets and confidential information about sensitive tech, investors and customers to a competing startup. Austi... Featured Article YOUR ANDROID PHONE COULD HAVE STALKERWARE — HERE’S HOW TO REMOVE IT This simple guide helps you identify and remove common consumer-grade spyware apps from your Andr... Zack Whittaker 11:15 AM HST•April 19, 2024 AI TOO MANY MODELS Devin Coldewey 11:13 AM HST•April 19, 2024 How many AI models is too many? It depends on how you look at it, but 10 a week is probably a bit much. That’s roughly how many we’ve seen roll out in the last few days, and it’s ... TECHCRUNCH EARLY STAGE 2024 HARVARD’S STARTUP WHISPERER, PETER GLADSTONE, REVEALS SECRETS TO VALIDATING CONSUMER DEMAND AT TECHCRUNCH EARLY STAGE TechCrunch Events 10:18 AM HST•April 19, 2024 Validating consumer demand is a crucial step for any startup, and TechCrunch Early Stage is offering a golden opportunity to learn how to do it right. Peter Gladstone, senior adviser for startups a... Social POST NEWS, THE A16Z-FUNDED TWITTER ALTERNATIVE, IS SHUTTING DOWN Amanda Silberling 9:13 AM HST•April 19, 2024 Post was backed by Andreessen Horowitz and Scott Galloway, an NYU professor and tech commentator, but the platform never disclosed how much it raised. Startups STARTUPS WEEKLY: IS THE WIND GOING OUT OF THE AI SAILS? Haje Jan Kamps 9:05 AM HST•April 19, 2024 Welcome to Startups Weekly — your weekly recap of everything you can’t miss from the world of startups. Sign up here to get it in your inbox every Friday. After years of booming growth, the AI indu... * About * TechCrunch * Staff * Contact Us * Advertise * Crunchboard Jobs * Site Map * Legal * Terms of Service * Privacy Policy * RSS Terms of Use * Privacy Dashboard * Code of Conduct * About Our Ads * Trending Tech Topics * Cybertruck Recall * Lacework Valuation * Atlas Robot * Meta AI * Google Protests * Tech Layoffs * ChatGPT FacebookFacebook(opens in a new window)XX(opens in a new window)YouTubeYouTube(opens in a new window)InstagramInstagram(opens in a new window)LinkedInLinkedIn(opens in a new window)MastodonMastodon(opens in a new window) © 2024 Yahoo.All rights reserved.Powered by WordPress VIP(opens in a new window).