Proton is clear that they complie with legsl government requests and post stats about how many they fight and handover. They offer private ways to use the service and if you dont take them thats on you.
Again, they did not "aid" nor "give" that information. They were legally obliged to do so. There was never a choice. This could've happened with literally any company, E2EE stops them from being forced to turn over the emails themselves, but basic account metadata (creation date, payment methods, contact details, potentially IP access logs) will always be available. What you can do is limit the amount of information a provider requires/saves (for which Proton is a good choice) or don't rely on a company at all and roll your own email server.
They complied with Swiss law. Only the name on the credit card was given.
My question is what's the legal requirements for payments? How long do they have to keep transaction records and do they have to connect this to accounts? This should be available in the ToS(but cannot find this). Compare with Mullvad (https://mullvad.net/en/help/no-logging-data-policy) (Edit: spelling)
No, they responded to a legal request by the swiss government to provide banking details.
We still blaming basic OpSec mistakes on Proton?
And that's why I only use Proton's free tiers. If they are going to openly support Dementia Don and openly hand out their users to fascist governments like Spain or the US, then I can at least do my part by being a financial burden to them.
I signed up for a proton account and they immediately suspended it for "suspicious activity."
My IP is on some foreign blacklist I found out. No option to appeal or anything, no explanation, I would have to verify my account with personal information which defeats the purpose.
Garbage company, 100% handing information to the cia and israel I bet.
More and more I consider just self hosting. Does have obvious drawbacks though 😅
proton mail and tutanota(?) are both walled garden faking it as if theyre super safe
Im not a fan of proton, but this trend of blaming corps for individuals poor opsec (paying with a method linked to their real identity) is pretty lame.
Do people using these services actually expect a corporation to break laws or violate court orders on behalf of their users?
Proton regularly releases very clear info about how often they comply with legal orders, this isnt a secret and its certainly not protons fault that activists had poor opsec.
Proton handed over the info to the Swiss government under a specific law. The Swiss government then turned around and readily handed over that info to the FBI without telling Proton that’s what was going to happen.
It doesn’t make anyone innocent here. Just adding that for clarity because this headline I keep seeing is not correct.
In addition to what @gravitas@lem.ugh.im said, as long as any third party is involved in the handling of PII, there should be no expectation of privacy whatsoever. For instance, I use Mullvad VPN, but that is as much a political/ideological statement to me as it is but one countermeasure against malicious actors in a very complex cyber environment. I could go on about how Mullvad has proven over and over - through third party audits and through actual incident response - that they have zero data to hand over to the authorities. But I won't, because that's not the point here. The point is: if I was involved in something that made me interesting to the authorities in any capacity, putting my trust, privacy, security and life in the hands of one company would not be the way to go about it. Not even in Mullvad, which I otherwise use.
Good OpSec is not about relying on technical solutions. It's about real-world threat modeling, assessment, having three backup plans and careful execution.
Is it morally questionable for Proton to cooperate with the authorities going after activists? Yes. Should there be any expectation of privacy and/or security from the end user's point of view? No.
Manage your expectations and scheme accordingly.
Morality / Deepstate convos aside. I personally I can’t really fault proton on here. They are the only public provider I’ve seen with 0 tracking across any of their apps.
What they provided was payment info.
No email provider will go to court for you for €3.99 per month.
From the start of the article:
Key Takeaways
- Proton Mail shared payment data with FBI through Swiss authorities via legal treaty
- Credit card payments eliminate anonymity despite encrypted email content remaining secure
- Third known disclosure reveals pattern of Swiss legal compliance over privacy promises
Oh so not privacy focused at all.
Credit cards create permanent identity links that no encryption protocol can erase.
Here’s the brutal truth about “anonymous” email services: your payment method matters more than your password strength. Proton accepts cryptocurrency and cash precisely because credit cards eliminate anonymity from day one.
Every monthly subscription charge links your encrypted account to your real identity through financial records that governments access routinely. The Stop Cop City activist could have sent messages in unbreakable code, but their credit card told the whole story.
Yeah, I kind of expected it would be an opsec error. Still a big L for Proton. I have been hesitant to move due to them not being on Fdroid or having Linux support. One of the last major things for me to de-google. Tuta seems nice tho.
Pretty much no company is going to go to court for you, best thing to do is act with the assumption they won't.
It was approved by a Swiss court, so they had no choice. It's an expected result, no company will break the law for you, if you have high threat model don't use paper trails.
That said, Proton marketing is very misleading and I hope this bad PR will force them to change direction.
Strike three
all 53 comments