ProtonMail, which has made the security of its users its main marketing argument, is currently under fire.
The encrypted messaging service had to provide information about some of its users as part of a legal investigation.
In the sights of the authorities, activists from the Youth for Climate association who occupied Place Saint-Marthe in Paris a year ago.
By squatting in private spaces, these activists wanted to fight against the gentrification of the neighborhood.
They are currently accused of "
theft and degradation in assembly and home invasion
".
In order to identify and arrest these suspects, the French police commissioned, via Europol, the Swiss justice system to recover their metadata from ProtonMail.
Indeed, the activists exchanged on this platform, whose headquarters are based in Switzerland.
Read alsoYouth for Climate: who are these teenagers who want to challenge capitalism?
The messaging service provided the authorities with technical information such as the date of creation of the accounts, the IP addresses and the fingerprint of the device used (smartphone or PC, application or web interface, etc.)
However, ProtonMail recently specified on its site that the platform "
did not record any metadata, such as the IP address used to connect to its account
", a reference since withdrawn from its Web page.
However, the service has no possibility of transmitting the contents of the exchanges to the authorities, the latter being encrypted.
"
A massive communication failure
"
“
We are very concerned about this case. ProtonMail has received the legal order from the Swiss Federal Department of Justice, with which we are obliged to cooperate. There was no way for us to appeal or fight this request, because an act breaking the law has indeed happened,
”the ProtonMail team explained on Reddit. In other words, if the IP address is not normally kept, it can be recovered when justice demands it.
On Twitter, some users denounce the lack of clarity of the terms of use of Protonmail, such as Christina Warren: “
This is a massive communication failure of ProtonMail.
The problem is not that he complied with Swiss laws but that the secret registration of IP addresses was never explicitly mentioned in their marketing.
For its part, ProtonMail argues that its encryption cannot be bypassed and that emails, attachments, calendars and files cannot be compromised by legal orders.
"
Nothing to do with anti-terrorism laws
"
Proton Technologies AG founder Andy Yen goes further in his argument, stating that “
the accusations in this case appear to be particularly aggressive. Unfortunately this is a pattern that we are seeing more and more in recent years around the world (especially in France, where anti-terrorism laws are used inappropriately). We will continue our campaign against these types of laws and their abuse
”.
“
Proton defends himself by saying that France uses anti-terrorism provisions. This is completely false,
”commented on Twitter the gendarmerie officer Matthieu Audibert. “
Switzerland has signed the Budapest Convention which provides for the collection of electronic evidence for any criminal offense. Switzerland also has cooperation agreements with Europol. So in practice, we have a request for cooperation which goes to Europol, which arrives in Switzerland, Swiss justice says OK and Proton responds to the request via Swiss justice and Europol,
”he explains. “
It has nothing to do with French anti-terrorism laws. It is common law governing the obtaining of digital evidence.
"
According to a tweet from the Open Terms Archive, carried by the Ambassador for Digital Affairs, Protonmail has since rewritten its privacy policy. It now specifies that "
if you are in violation of Swiss law, ProtonMail may be legally obliged to provide your IP address to investigators
".
