ProtonMail, an end-to-end encrypted email service, shared an activist’s IP address with authorities in France. The judicial request was made to the Swiss police, via Europol, forcing the company to take the measure. The service is known for not registering IP addresses by default, but is said to have just complied with legislation.
The order, coming from the Federal Department of Justice of Switzerland (home country of ProtonMail), has been debated by users of the tool since the beginning of the month. In response, the company stated that there was “no possibility to appeal or contest this specific request” because Swiss law requires it to share information in such cases.
On its website, reinforcing the publication of a transparency report since 2015, the company gave new details of the case. ProtonMail advises that, “as a general restrictive rule”, it only fulfills legal requests approved by the Swiss authorities. However, “it is a crime to respond to foreign requests that have not been approved” by local authorities.
What was shared?
According to a police report shared on Twitter, the investigation had access to the details of the email address and IP address associated with the account, as well as the type of device used. In his social media account, CEO Andy Yen says it is “deplorable that legal tools for serious crimes are being used in this way.”
Cops are lying? pic.twitter.com/xIglWqLcfk
— MuArF (@MuArF) September 2, 2021
The activist in question was arrested. In a clarification, ProtonMail points out that, “under no circumstances” the “encryption [do serviço] can be bypassed”. Also, they do not provide data to foreign governments. The exception is, however, when these requests are approved by the Swiss justice.