Encrypted email website ProtonMail passes user’s IP address to French authorities, leading to arrest of climate activist

A French climate activist has been arrested after the private email service ProtonMail cooperated with authorities after a court ruling, logging details of a user before providing it to the police to identify a French citizen.

On Monday, Andy Yen, the founder and CEO of Proton, the company behind the Swiss email provider ProtonMail, published a statement saying that he deplored the way legal tools had been used to bring about the arrest of a French climate change activist, but claimed his service was still secure.

“In this case, Proton received a legally binding order from Swiss authorities which we are obligated to comply with. There was no possibility to appeal this particular request,” Yen wrote.

The data was requested as part of a wider investigation into the occupation of a number of Paris flats and commercial properties by climate activists. While attempting to remain anonymous, one of the activists had used the address “jmm18@protonmail.com” in online postings.

French police sought to find the person behind the account and registered a request with a court in Switzerland – the home of ProtonMail – with the help of Europol. Being a Swiss entity, the firm abides by that country’s laws, meaning foreign requests, such as the one put forward by the French and Europol, would only be acted upon if approved by a Swiss court. 

After the court approved the request, the encrypted email firm started logging IP information of the account in question before handing it over to the French police. The French activist was duly arrested.

ProtonMail explicitly says it will be forced to log and hold users’ IP addresses if they are found to be in violation of Swiss laws. However, the company claims it does not log details which could be linked with anonymous email accounts.

Commenting on the news, one person wrote on Twitter that they do not blame ProtonMail for adhering to the court’s request, but did blame the company for advertising anonymity features which it has been unable to deliver.

Another person told people to just use gmail: “If you do not want Google reading it, email is not the appropriate format for your communication.”

In his statement, Yen said that the contents of the arrested person’s emails are encrypted and could not be accessed, even by Proton. Under Swiss law, email and VPN (virtual private network) services are treated differently, Yen wrote, claiming that sister company ProtonVPN cannot be compelled to log user data and hand it over to the relevant authorities. 

The tech boss described the prosecution in this case as “very aggressive” and claimed it is part of an alarming trend where authorities are increasingly requesting data from firms such as ProtonMail.

Yen stated that the firm would continue to fight against unjustified government requests, and also called out the French authorities for inappropriate use of anti-terrororism laws. According to ProtonMail’s transparency report, the company was given 3,572 requests in 2020 from Swiss courts, more than double the previous year. Yen says the company fought over 700 of the cases in 2020 alone but did not reveal how often they were successful.

In August it was reported that ProtonMail was forced to hand over user data to American security authorities and enforcement agencies in a case concerning threats of violence toward Anthony Fauci, the chief medical advisor to the US president. 

If you like this story, share it with a friend!