ProtonMail case tarnishes Swiss privacy reputation

France's "Youth for Climate" movement also fights against gentrification and real estate speculation Keystone / Yoan Valat

Geneva-based company ProtonMail, a provider of secure and anonymous email services that leverages the reputation of “Swiss confidentiality”, has played a role in the arrest of a French climate activist. The company is now in the crosshairs of online critics, but experts say that Swiss laws left the company no choice. 

Encrypted email service ProtonMail has been at the centre of a social media stormExternal link ever since a police report revealed that the company shared the IP address of one of its users as part of a French investigation that led to the arrest of climate activists. 

ProtonMail is a Swiss company founded in 2013 at the initiative of a group of scientists from CERN in Geneva and the Boston-based Massachusetts Institute of Technology (MIT). From its inception, the company has focused on user privacy and security,External link brandishing stringent Swiss privacy laws and a commitment to protect “civil liberties online” as part of its credentials.  

ProtonMail also guaranteed that “by default” it would not store any IP addresses that could be linked to users’ email accounts. 

However, when cornered by the Swiss authorities, the company was forced to provide the very data that made it possible to identify one of its users and activists of the “Youth for ClimateExternal link” movement, who was wanted in France.

Inspired by Swedish activist Greta Thunberg’s “Fridays for Future”External link, the environmental group also fights against gentrification and real estate speculation and has set up actions such as the “climate camp” in one of the districts of the French capital.  The French activist was among those who occupied commercial premises and apartments near Place Sainte Marthe in Paris. 

Andy Yen, CEO of ProtonMail, stressed that the company supports the causes of activists using its service, but it cannot do so by breaking Swiss laws and ignoring court orders. ProtonMail, in fact, had to comply with a Swiss court order, which came after the French police had requested Swiss cooperation through Europol, making use of international judicial assistance. 

No privacy on the Internet 

Despite this, the Geneva-based company has been criticised for its lack of transparency and clarity in promoting a service that primarily promises anonymity and respect for the privacy of its users and users.  

According to ProtonMail’s transparency report, the recording of IP addresses is only allowed in “extreme criminal cases”. At the same time, the company stated that “no information is required to create your secure email account,” a phrase later removed from the privacy policy. 

Yen responded to the allegations by stating that the Internet is not anonymous and by denouncing the use of legal tools for serious crimes in a case like this. However, the CEO stressed that “there was no possibility of appealing this particular request.” 

What does Swiss law require?

According to Swiss lawyer François Charlet, the criminal offenses charged against the prosecuted French citizen were serious and cooperation with France was therefore justified, as stipulated in the Federal Act on International Assistance in Criminal MattersExternal link. Furthermore, telecommunication service providers are subject to legal obligations in the case of investigations involving the surveillance of postal traffic. 

The activist behind the email address was being prosecuted for trespassing, theft and property damage, crimes – the latter two – that enable surveillance, according to CharletExternal link, a specialist in technology, crime and security. 

Contacted by SWI swissinfo.ch, the Federal Data Protection and Information Commissioner (FDPIC)External link also confirmed the legitimacy of the legal action by the Swiss authorities in compliance with the Data Protection Act. “It appears that the disclosure was made in accordance with legal requirements,” the commissioners said. 

Unclear communication 

ProtonMail, therefore, was left with no choice but to cooperate.  

Can it be said, however, to have “misled” its users? Not according to Charlet.  

“Perhaps it can be reproached for unclear communication”, says the lawyer, but this “does not mean that it can evade specific and justified requests from the Swiss authorities”.  

Is the ProtonMail case yet another “non-case” fuelled by social media? Or perhaps marketing using “Swiss confidentiality” is a double-edged sword?  

“There are worse laws than Swiss law,” Yen states in a recent blog entryExternal link on the issue. Certainly not a catchy marketing phrase.