ProtonMail faces criticism for lack of anonymity of French activists

The ProtonMail provided IP addresses led to the arrest of French climate activists

IP addresses of activists got leakedProtonMail allowed access to the Frech activist IP addresses.

ProtonMail is facing a wave of backlash after giving up French climate activist's IP address to Swiss police upon the legal bounding request. The demand came via Europol by French authorities, who were seeking help from Swiss colleagues. ProtonMail is based in Switzerland; therefore, it has to follow the country's laws that state that personal information like IP addresses, could be given out in extreme criminal cases.[1]

Proton's CEO, Andy Yen stated, that company was legally bound and had to comply with local laws. This caused a lot of criticism and became a hot topic in French media. However, Proton's officials say that under normal circumstances, the encryption technology that ProtonMail was known for, prevents it from seeing the contents of the account, and it also doesn't know the identity of its users.

The company says they weren't aware of the fact that personal information was revealed or any details about a concrete person were given. It is stated that Proton will work on how to handle similar cases of criminal prosecution, and it will further promote using ProtonMail via its Tor site and the company's VPN for users particularly concerned about privacy. However, if any Swiss rules would be broken, ProtonMail can be legally compelled to log IP addresses as part of the investigation.[2]

ProtonMail security and privacy now get questioned

ProtonMail is a secure email service designed to protect inbox and identity. It was believed that Proton pays more attention to security aspects since it doesn't log personally identifying information and doesn't store data on the server. Simply said, ProtonMail encrypts all data so that it is rendered useless to anyone without the key to decrypt it. In case of a security breach, data swiped from mail wouldn’t be of any use, and it was believed that not even ProtonMail could read your email.[3]

Now, more security questions and doubts arise. As the story follows, for the past year, a group of people lived in several commercial premises and apartments near Place Sainte Marthe in Paris. They seem to be fighting against gentrification, real estate speculation, Airbnb, and high-end restaurants. It became a police matter as the group occupied the premise of Le Petit Cambodge – a restaurant that was targeted by terrorists during the Paris attacks.

On September 1st, the protester's group shared an article on Paris-luttes.info and summed up some legal cases against several groups' members. They stated that French police sent a Europol request to ProtonMail in order to uncover the identity of the person who created a ProtonMail account as the group used companies' services to communicate with each other. Later, the same addresses were shared on various anarchist websites.[4]

Email encryption may not be the key to privacy

Emails could present certain risks and vulnerabilities, especially when they are sent over unsecured or public Wi-Fi networks. Even when said emails are sent within a secure company network, they can be intercepted by other users, including login credentials. Encryption renders the content of your emails unreadable as they travel from origin to destination, so even if someone intercepts your messages, they can’t interpret the content.[5]

However, the recent situation shows that's not always the case as third parties could get involved. Researchers point out that decrypting messages outside of email using a third-party application could be safer as it would cut back on sending messages via PGP for both internal and external messages. However, such a suggestion wouldn't work with instances that are deemed to be criminal, as police have a way of getting involved one way or another.

About the author
Ugnius Kiguolis
Ugnius Kiguolis - The mastermind

Ugnius Kiguolis is a professional malware analyst who is also the founder and the owner of 2-Spyware. At the moment, he takes over as Editor-in-chief.

Contact Ugnius Kiguolis
About the company Esolutions

References
Files
Software
Compare