A French activist, who advocates for ecology, has been arrested by the Swiss authorities, after his IP was revealed by ProtonMail as a result of a court order that obliged them to do so. That the authorities have information on internet services is nothing new, but in this case we have that ProtonMail has as its main value that it is an “ultra private” email service, created by CERN (European Organization for Nuclear Research) and based in Switzerland.
The activist’s arrest took place after the authorities of the Alpine country asked ProtonMail for the IP of this activist, by means of a legal order that could not be appealed or rejected. In the case of ProtonMail, which users trust for its supposed respect for privacy, the always open debate about a person’s privacy and compliance with the law wins even more controversy.
What had the activist done to get arrested in Switzerland? According to the information published by ProtonMail, the order that came to them from the authorities spoke of “serious crimes”. According to official information, this activist participated in protests in Paris during the summer of 2020 against the gentrification of the city. For this protest, squares and buildings in the French capital were occupied and, to organize the mobilization, an email account registered in ProtonMail was used.
What does ProtonMail have to say about it
Andy Yen, CEO, has given his version of events. On the one hand, it says that the company is against the law for “serious crimes” being used in this way. It specifies that Proton received a legally binding order from the Swiss authorities that the firm is obliged to comply with. “There was no possibility to appeal this request“, he clarified.
At the same time, another tricky issue that we find here when we talk about privacy and legislation it is that, “ProtonMail does not deliver data to foreign governments; that is illegal according to article 271 of the Swiss penal code. We only comply with the legally binding orders of the Swiss authorities”, as the company insists, But reality is not like that.
The activist’s arrest was in France by the authorities of his country and for a crime committed in the Gallic country. And is that the French authorities contacted the Swiss through Europol (European Union Agency for Police Cooperation in which the Alpine country also cooperates despite not being a member of the EU). Of course, it seems that, according to Andy Yan, the Swiss authorities only approve requests from foreign governments that are in accordance with Swiss legal standards.
In 2020 Switzerland approved more requests from foreign governments than ever before
It should be clarified that these cases, Proton does not have to give the identity of the person. Encryption of communications cannot be bypassed even with a court order. That is, emails, attachments, calendars, files, etc. they cannot be sent to the authorities. What Proton had to provide the police with the IP address from which the email in question was operated.
With all this we know now, we have that, according to information from Andy Yas himself, the requests that ProtonMail receive from the Swiss authorities, but from foreign governments is common. According to its transparency report, In 2020, the Swiss authorities approved 195 requests from foreign governments of the 3,572 they received. Much more than those approved in previous years: In 2019 there were 129 and in 2018 there were 76. In 2017 there were just 13. And not only from governments of the European Union, but also from America and Asia.
There are serious cases on the list. Proton has even revealed that in June 2020 “we received a request addressed to a group of investigative journalists which was improperly approved by the Swiss authorities. As a result, we have rejected the application and have also demanded that the Swiss authorities investigate how this application was approved. “