ProtonMail is under fire after providing authorities with an activist’s IP address

ProtonMail, an email provider that prides itself on end-to-end encryption, has come under fire for handing up the IP address of a French climate activist to Swiss police. As the company is based in Switzerland, ProtonMail is bound by the laws of the country. According to its own transparency report, this includes logging IP addresses from users in “extreme criminal cases.” 

A group of individuals has been occupying a number of business properties and residences near Paris’ Place Sainte Marthe for the past year. They wish to have a fight against gentrification, real estate speculation, Airbnb, and high-end restaurants.  Although it began as a local dispute, it quickly evolved into a symbolic campaign. When they began occupying premises rented by Le Petit Cambodge, a restaurant that was attacked by the terrorist attacks in Paris on November 13th, 2015, they gained attention and made the headlines.  

The group released an article on Paris-luttes.info, an anti-capitalist news website, on September 1st, summarising several police investigations and legal procedures against some of the group’s members. According to their narrative, French police issued a Europol request to ProtonMail in order to reveal the identity of the individual who created the ProtonMail’s account used by the group to communicate. Various anarchist websites have also circulated the URL.

Andy Yen, the founder, and CEO of ProtonMail, responded to the police complaint on Twitter without revealing the precise facts of the case. “Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we’re required by Swiss law to answer requests from Swiss authorities,” he said. 

Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we're required by Swiss law to answer requests from Swiss authorities.

— Andy Yen (@andyyen) September 5, 2021

Andy Yen, in particular, wants to make it clear that his firm did not work with French police or Europol. Europol appears to have served as a communication channel between French and Swiss authorities. The matter was eventually taken over by Swiss authorities, who sent a direct request to ProtonMail. In its transparency report, the firm refers to these requests as “foreign requests approved by Swiss authorities.”