I'm not saying Swiss laws are infallible but this request was not simply "forwarded": "Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law)"
As they mentioned in the blog post, they do challenge many of these requests but it was not legally possible in this case.
Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes.
Secondly, emails encrypted at rest, are still encrypted, so at least the body is protected.
Unless you were receiving emails that were encrypted prior to being sent that wouldn't be the case with Gmail.
The threat model for Protonmail is fairly clearly defined under the "ProtonMail recommended use cases". https://protonmail.com/blog/protonmail-threat-model/
The fact still remains email was probably not the right tool for these people as there is a lot of data stored server side.
This is false - google stopped doing this for personal accounts many years ago (and never did for paid corporate).
> emails encrypted at rest
Google also encrypts at rest
Does seem to be the case https://www.theguardian.com/technology/2017/jun/26/google-wi...
> (and never did for paid corporate).
We weren't talking about Workspaces.
However that said, people logged into gmail generally use google search so they get to use all the data collected from that and youtube videos you watch so I don't think it really matters too much. https://support.google.com/google-ads/answer/7019460?hl=en
With ProtonMail they can't actually read the contents of your emails, even for law enforcement, whereas Google certainly would be able to hand over entire copies.
Honest question, because that's the obvious difference (if you believe ProtonMail claims).
Obviously they can modify their software to capture your decryption password, my question is more out of curiosity than it being a serious advantage against a state actor targeting you specifically.
I am fairly sure that protonmail cannot do this without modifying the software to target me by capturing the decryption password.
Of course they can always capture plaintext messages as they come in, we can only assume they don't keep records of that. If that's true, and we only have their word for that, it would make any requests forward focused, like a wire tap rather than a search of old bank records. They can't necessarily access old emails without explicit effort.
It's not some insurmountable barrier, and I don't mean to suggest it is. It's trivial to think of at least three ways to work around it, assuming you are still logging in. But it is a difference in design.
There is your answer.
What I have no idea about is Google. Do they even need to do anything targeting you in order to decrypt the data or not? Obviously they can modify your software with a remote update such that they can capture your decryption password, but that's a lot more work than querying a database and using a master key that Google has on hand for this sort of thing.
While (as you correctly pointed out) the fact that you lose access to the data if you lose your passphrase doesn't prove that the data is completely inaccessible without it, the opposite (being able to access the data even if you forget/lose all your secrets/keys) conclusively proves that such access is possible.
You can't. But this really doesn't answer if there was a special way for law enforcement, which I don't believe there is.
Encryption. That was always the point. Your emails are stored encrypted, and nobody can read their content except you.
Not sure why some people expected ProtonMail to act as a magical VPN, both truly anonymous and not obeying to any court order, to an unencrypted email account like Gmail.
Now, I don't support squatting, but launching an interpol notice, and attacking privacy under color of law seems like a misuse of the law, and abuse of the Swiss legal system.
We may need to attack this problem differently since it appears the Swiss do not have the vaunted protections they claim.
Also, we need Protonmail to look into offshoring, and obtaining independence of a potentially abusive legal system.
Sealand had at least a few good ideas around immunities from State power.
As much as we might like to believe it, law is not universally applied in a fair manner. Swiss authorities will approve requests that are total garbage requests. I happen to be on the receiving end of one of those, which was eventually, after significant time, effort and money thrown out for prejudice.
If I were an environmental activist, I would definitely step up my operational security.
Kinda weird actually considering they were operating on their own government's orders.
https://en.wikipedia.org/wiki/Sinking_of_the_Rainbow_Warrior
Can you imagine, the government telling you to do something and then dragging you in front of a court after you do it :S I don't think they should have gone through with it but as they were under orders I don't think the responsibility lies with them.
By the way I really miss the way Greenpeace is no longer a grassroots environmental organisation. Protesting against nuclear testing, whaling etc the way they did was risky but effective.
Nowadays they're just another multinational corporation, just with some environmental goals. It's no wonder they're never really in the news anymore. And the need for this activism is actually much greater than ever now.
The French agents were arrested by New Zealand, not France, and convicted in New Zealand. France also threw their weight around to avoid having their agents jailed for the term of their sentences, AFAIK.
Beyond that, there's nothing wrong with holding responsible agents of the state who follow illegal orders (whether this was by French law, I can't speak to it). Many liberalized states, and particularly the militaries of those states, operate on the assumption that you must refuse to follow an illegal order. (Intelligence services, which caused the sinking of the Rainbow Warrior, may have different rules, but fundamentally there's supposed to be a carve-out and an escalation process for addressing orders "beyond the rules"." An example from the United States: https://warontherocks.com/2017/07/when-can-a-soldier-disobey...
I totally agree they should have refused the orders. But the people who gave the orders are more accountable in my opinion.
I have seen this commented a lot by people, that specifically anti-terrorist laws were used? But from what I have found, they used regular laws. Any chance you can point me in the right direction?
https://www.liberation.fr/france/2015/11/27/l-etat-d-urgence...
https://www.climatechangenews.com/2019/04/03/french-police-t...
I have been a riseup user for years. They have received foreign legal requests, and they do not simply do the task requested. They've also received US-based legal requests, and challenge them, but in the end, they do not have the data that is being requested, so ultimately they can respond saying exactly that.
(throwaway aswell)
They are based in the US and only provide their services to radical leftist activists.
That combination seriously smells like FBI honeypot.
They're pretty chill on who to provider their services to. Yes, they host radical leftist activists, but they also host pretty mainstream leftist activists. And they obviously don't care who does what, they don't check your accounts.
I'm far from being a radical leftist (or any leftist!) and I have an account.
Unless of course you were using PGP - but then you would be about as well off with Gmail?
I mean, they provide a great service, and the stack is open - but I would hesitate to call it "secure" (that goes for ProtonMail too BTW).
If riseup were a trap, they could do all the logging (in secret), find the activist, then do parallel construction for the actual evidence presented in court.
Before you say, "Well, it could be done in secret", please look up the Wiretap + technical assist laws and note the disclosure requirements.
(There may be some solid evidence making this unlikely in reality, but that ultimately relies on some form of trust.)
If the Chinese government files a request by means of Interpol, it’s very dishonest to say “an Interpol request.” It’s a Chinese request.
There are, which they specifically described.
This also goes for your second described case. The chinese government is only one of the two required.
But usually interpol rejects many requests from the Chinese government (to track uyghurs for example).
The real scandal here is why the French authority is making such request on an activist, why Interpol processed it (as far as I understand there are no crimes in play here?), and why the Swiss authority recognizes the request? Perhaps we don't have the full story, but, with only the information we have, it sounds like an abuse of the protocol on 3 different entities. And double standards from Interpol (not okay to track down chinese activists, but ok for french activists?)
This seems easy to answer - according to French media[1], they were activists illegally occupying[2] buildings to protest rising real estate prices. This is illegal in Switzerland, too. What's the scandal? Authorities using their powers?
[1]: https://www.lesnumeriques.com/vie-du-net/protonmail-a-fourni...
[2]: https://www.lefigaro.fr/societes/a-paris-un-local-du-restaur...
According to Swiss law, yes.
Climate is fashionable and respected today, they would got medals maybe if not hiding?
I can openly say that I am for good climate and ecology. Greta Thunberg is also not hiding.
And about this specific activist, do you know what he is accused of? (It must be something other than activism, right? Difficult to imagine climate activism is illegal in France).
PS: I understand this topic is mostly about Proton failing the privacy expectations, but curious to know what can activist be charged with.
https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...
Still strange, how could they anonymously occupy the places, if they were physically present there.
If that qualify as serious crime is still up to debate and it could just be a excuse to go after the organizers. I do however find the case a bit more nuanced after reading those details.
PGP has been around since 1991, if it was as easy as writing a catchy how to, then some people might use it. Now 30 years in, basically nobody uses it. Got to wonder why ...
> don't offer this option for some (likely legal) reason
Not at all, they dont do it because it is a terrible customer experience. It is confusing, it is hard, if you lose a key, your data is garbage. If you make a copy of your key, you are not secure. Some people are happy to go that path, most are not.
If only it was so simple. Imagine a world where Gmail launched, but if you forgot your password, boom, all your email is gone as is access to your email address. The next company that came along and offered 'password resets' would have wiped them out.
Replace "email" with "Bitcoin"
As the manager of various accounts used by environmental and social activists on Protonmail, this is really bad.
I understand they have to follow Swiss law, but surely there are higher standard and processes than: police forward foreign request. Don't challenge or question, just do task required.
Interpol requests are not as universally recognized as what some people here are alluding to. Countries can file these requests with interpol but it's up each country to determine if they act or recognize the request.
If the Chinese government files 500 requests via interpol and the swiss police merely pass them on the proton, will proton mail automatically comply and install malware on their client on targeted accounts?
I hope this is not the case but I expect this to be clarified. On th face of it, organizing an occupy protest hardly seems to pas the bar of "serious criminal cases"