> though it's unclear why the company was logging user-agent strings and IP addresses of client logins

The Protonmail statement says they can be compelled to log a user’s IP when Swiss law has been broken. That’s the most likely explanation: They got a court order and started logging IP addresses and user-agent strings for this particular user, after being presented with the order.

What court order?

If they weren't logging those IP addresses and connection strings, there was nothing to seize. They said the weren't. As to a court order requiring you to implement such logging when demanded.... show me the law that says any such thing, that somehow cannot be challenged!

Better still show me the court order itself. All I could find was copyright related (Article 77i CopA). The US pushed them to backdoor their privacy right, so they added a IP logging in the copyright law, but that's for copyright infringement.

Whenever dealing with "Swiss" stuff that feels America, (I class Proton Mail as this), you should recall Crypto AG, the "Swiss" encryption system, that was actually a CIA front.

https://www.washingtonpost.com/graphics/2020/world/national-security/cia-crypto-encryption-machines-espionage/

" The Swiss firm made millions of dollars selling equipment to more than 120 countries well into the 21st century. Its clients included Iran, military juntas in Latin America, nuclear rivals India and Pakistan, and even the Vatican."

"But what none of its customers ever knew was that Crypto AG was secretly owned by the CIA in a highly classified partnership with West German intelligence. These spy agencies rigged the company’s devices so they could easily break the codes that countries used to send encrypted messages. "

When you see a well funded company in encryption like this, I suggest you ask who the f**k funded that and who is the target audience. Is this company too good to be true?

So don't be surprised when the slightest court order lands on a fake CIA operation, and they cave immediately to create case law, in Switzerland or elsewhere, because that's what they're there to do, fold. Create false case law, false consensus, undermine privacy rights.

All that western tech, its all shit, its all backdoored. All secret police notices, all secret surveillance, backdoored encryption, false systems. All of it.

I agree with some of your points. But ProtonMail has always made it clear to anyone who reads their T&Cs that they come under Swiss laws and they are obliged to provide information to the authorities IF supported by a court order.

The Swiss legal system is robust and the right to privacy strong. It fills me with hugely more confidence than in my old homeland which has sadly become an authoritarian tinpot nation, especially since the Johnson Junta took over.

I use ProtonMail occasionally and never regarded it as a service that is totally hidden from the law, rather a service under stronger Swiss laws than the US and elsewhere.

Thanks for reminding me about Crapto AG. Maybe it's time to consider quitting ProtonVPN. Any recommendations for replacement?

Every VPN spies on you even those that say that don't. The business is in selling data not on the VPN service itself.

Absolute privacy/anonymity on the Internet is hard. Very hard.

Pretty much reinforces that if one wants to be difficult to track down, you'd probably be wise to put Tor between yourself and protonmail. (Or anything else.)

Better yet, don't use the Internet.

There are plenty of cases where TOR has been used and people still get caught.

It makes it difficult to trace, not impossible.

yes, it does not make it impossible, but the key adjective is "difficult". Unless those after you, are very, very, very powerful, the 'difficult' becomes 'good enough'.

Yes, for tracking of IP connections it would probably require the 5-eyes to bother to use their resources and data - not likely for much except terrorism.

However, Tor is not a magic privacy screen: there are plenty of possible mistakes that can still be made using Tor for privacy and anonymity. As a simple example, if you have a ProtonMail account and have ever sent a message to anyone's personal email address, they could be contacted to ask if they know who you are or anything about you, or their address can be correlated with clearnet emails to try to get some idea of who you might be. So, never forward, CC or send any message (however innocuous the message itself is) from your ProtonMail account to anyone who knows who you are (and certainly NEVER to your normal email account). Obvious in hindsight, but easy to forget.

And there are many other mistakes it would be easy to make. Tor only protects IP addresses, not other ways of finding out who you are.

You are aware that Tor was created by the US intelligence community ?

If you think they don't know how to subvert it, I have a bridge to sell you.

Cops can read the SMTP spec too, y'know [ [1]Citation needed ]

…

Oh, sure enough, the cops just gave me a citation!

[1] https://xkcd.com/285/

just that really. If you don't own manage and understand what's happening with your data, why would you be surprised ?

This is of course the case in every jurisdiction on the planet, which is to some extent why the fuss over US Privacy Shield as a special case was somewhat peculiar. Even under the GDPR the forces of law and order have special access to personal data in pursuit of their duties (for rather obvious reasons).

Apparently, if you can believe what you can read in some news, Westminster bods prefer to use and trust Telegram to keep their communications safe and secure and secret, but it is not something to be risking your life on being effective, methinks.

Everything is available to anyone who really wants it and knows what to do to get a hold of it.

So what did the Climate Activist actually do?

All police forces find it hard to distinguish between activists, whose policies and methods they may not as individuals support, and criminal behaviour.

Maybe this group had overstepped the mark, but look at the UK's undercover police scandals where police infiltrated activist groups who were not criminals to the point where they formed relationships with and even fathered children on their targets.

> and even fathered children on their targets

That's the best part of the job!

quite possibly, he is ALLEGED to commit a crime. And please, don't tell me the courts and judges are independent and fair, etc, etc, so 'there must have been a good reason'. Some are, some aren't.

Well, he wasn't a "climate activist"... he was an "anti-capitalist" and "anti-gentrification" activist who broke into several buildings:

https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/

Yeah, anti-capitalist and broke into buildings... clear to shoot on sight, no court order required.

Justification to undermine privacy is quite feeble here. If allowed to continue, it'll get worse and worse.

> By default, we do not keep any IP logs

"By default" covers what happened. Watch out for the weasel words. However, they now don't even say that. Are they now compelled to log all IP addresses?

and various other, for now undisclosed, parties.

"In this case, Proton received a legally binding order from the Swiss Federal Department of Justice which we are obligated to comply with. There was no possibility to appeal or fight this particular request because an act contrary to Swiss law did in fact take place (and this was also the final determination of the Federal Department of Justice which does a legal review of each case)."

Hmmm, either some issue in the reporting or just utter BS: Where I'm from, and I suspect this is the same in other countries in the Council of Europe, whether or not an act contrary ot national law has "in fact" taken place can only be determined by a Judge. Not by the executive branch. These orders can (and routinely are) appealed or fought.

They've been selling snakeoil for years. The opensource intelligencia and Snowdonites have been espousing their virtues for as long. Anyone else that works in email, epecially the security side, has been saying that Protons claims are spurious at best. Looks like their marketing is just downright misleading.

Well in any case, ProtonMail has now publicly and officially joined the vast coterie of "secure" mail services that are anything but.

Their lies destroy their credibility as far as I'm concerned. If you say you don't record IP addresses and, in fact, you do, you are not worthy of my trust.

Apparently what El Reg calls "Climate activist" was actually a squatter charged with breaking-and-entering commercial and private buildings as a protest against gentrification and "capitalism":

https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/

But he did it to get out of the weather.

That report stated that, "Proton’s marketing claims as a ‘user privacy centric’ company", whereas a more accurate description might be "Proton’s marketing claims as a ‘cave in at the first opportunity centric’ company".

I don't use that service and I certainly won't use them now if they do not protect the privacy of their users which is their supposed raison d'etre anyway.

I had a friend back in college, he came from the South Side of Chicago, gang territory. I once visited him there, he took a phone call from a *friend* and the whole thing was in code... something like pig-latin with lots of St's and be and eb's. When I asked what it was about, he said the party is at so and so's house, but his parents shouldn't know he was going...

... on the internet, your phone, your PC or your apps.

I wonder what'll happen, when they get served a valid court order demanding they issue a trojaned javascript file to targets-of-interest that, after they enter their password to unlock their private key in their browser, forwards it onwards...

>>What'll happen<

The obvious - They would continue to follow Swiss law after talking to their lawyers.