7 ms·

ProtonMail team here. These allegations are false. Hidden at the bottom of the article, is this: "Public prosecutor Walder of the Competence Center Cybercrime

ProtonMail team here. These allegations are false. Hidden at the bottom of the article, is this: "Public prosecutor Walder of the Competence Center Cybercrime contacted me, saying he had been misquoted". In other words, the alleged source (a public prosecutor) has also supported our denial of these false allegations. ProtonMail does not voluntarily offer assistance. We only do so when ordered by a Swiss court or prosecutor, as we are obligated to follow the law in criminal cases. Furthermore, end-to-end encryption means we cannot be forced by a court to provide message contents.

sebiw 7y ago
From the addendum: > I was live-tweeting the event, including the interesting presentation by public prosecutor Walder. The remark that ProtonMail was a (potential) PDCS would have been too trivial to be live-tweeted. The insight on the other hand that ProtonMail voluntarily offers assistance for real-time surveillance, was spectacular and I therefore live-tweeted the statement. In its transparency report, ProtonMail – as mentioned above – itself refers to at least one case of real-time surveillance.
- protonmail 7y ago
  The prosecutor in question has come on the record and said he was misrepresented. ProtonMail is also on the record as saying the "voluntary assistance" claim is false and untrue. Unless there is some massive conspiracy/cover-up involving a Swiss public prosecutor, the most likely explanation (the article is wrong) is probably the correct one.
  - chmars 7y ago
    Isn't it more likely that the state prosecutor spilled the beans? The statement even matches your own transparency report where you describe a case of IP logging, a typical real-time surveillance measure: 'In April 2019, at the request of the Swiss judiciary in a case of clear criminal conduct, we enabled IP logging against a specific user account which is engaged in illegal activities which contravene Swiss law. Pursuant to Swiss law, the user in question will also be notified and afforded the opportunity to defend against this in court before the data can be used in criminal proceedings.' https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/ (You mention April 2019, the statement by the state prosecutor was made at the beginning of May, i.e., he was probably really happy about your cooperation.)
    - addicted 7y ago
      So you’re saying that it’s more likely that there is a secret conspiracy, and a prosecutor in a public televised event for which they almost certainly had pre prepared their remarks, accidentally spilled the beans, than someone who is live tweeting an event mishearing, misinterpreting, or misunderstanding those remarks?
      - chmars 7y ago
        There is no need for a conspiracy. The Swiss surveillance state is a fact. It is also a fact that the relevant laws were recently updated with a focus on services like ProtonMail. We are not talking about a public televised event. We are talking about a statement during a presentation. It happens all time time: People talk, sometimes they talk too much.
    - cblades 7y ago
      >Isn't it more likely that the state prosecutor spilled the beans? No, why would it be? As you point out, they've disclosed turning on logging in response to a legal request. Why then deny the event?
  - deleted 7y ago
    [deleted]
Lowkeyloki 7y ago
Thank you for the clarification. I was waiting for an official statement as this site does seem a bit suspect.
chmars 7y ago
You 'forgot' to copy the full addendum. It reads as follows: 'Public prosecutor Walder of the Competence Center Cybercrime contacted me, saying he had been misquoted. He claims that had not divulged at the above-mentioned event that ProtonMail voluntarily releases real-time data. He had merely described ProtonMail as a potential provider of derived communication services (PDCS). I was live-tweeting the event, including the interesting presentation by public prosecutor Walder. The remark that ProtonMail was a (potential) PDCS would have been too trivial to be live-tweeted. The insight on the other hand that ProtonMail voluntarily offers assistance for real-time surveillance, was spectacular and I therefore live-tweeted the statement. In its transparency report, ProtonMail – as mentioned above – itself refers to at least one case of real-time surveillance.' https://steigerlegal.ch/2019/05/23/protonmail-real-time-surveillance/#addendum https://steigerlegal.ch/2019/05/23/protonmail-real-time-surv... Important: The English text is just an unofficial translation.
- ziddoap 7y ago
  The evidence that was presented by the author can be summarized as: "I live-tweeted it, so they said it. If they didn't, I wouldn't have live-tweeted it.". I'm sorry, but that's a pretty weak argument, even when it's a he-said-she-said type conversation.
  - sebiw 7y ago
    Quote from the post: > ProtonMail even mentions a current case of real-time surveillance: „In April 2019, at the request of the Swiss judiciary in a case of clear criminal conduct, we enabled IP logging against a specific user account which is engaged in illegal activities which contravene Swiss law. Pursuant to Swiss law, the user in question will also be notified and afforded the opportunity to defend against this in court before the data can be used in criminal proceedings.“ By writing of a „case of clear criminal conduct“ and of „illegal activities which contravene Swiss law“, ProtonMail violates the presumption of innocence against the monitored suspects. Such suspects are of course not informed by ProtonMail about ongoing real-time surveillance measures.
    - 7y ago
rolltiide 7y ago
Okay now explain why I can't make a protonmail account without: - disabling javascript - verifying with a phone number that is pretty picky - getting stuck in captcha hell if I'm on TOR and if I want to pay with Bitcoin, it already needs to be an existing account
- C14L 7y ago
  > - disabling javascript How do you want to decrypt your data client-side without running a software to do just that?
- hliyan 7y ago
  > - disabling javascript Another commenter put it aptly when he said something to this effect: "It is [2019]. If you lobotomize your browser, you might find that a lot of the web doesn't work for you."
- calcifer 7y ago
  All of those sound like reasonable anti-spam/anti-fraud measures to me. If you know a JS-free captcha approach that is of similar quality to Recaptcha, I'm sure the Protonmail folks would love to hear about it.
- ravenstine 7y ago
  > Okay now explain why I can't make a protonmail account without: > - disabling javascript ProtonMail encrypts/decrypts messages in the JavaScript client, which is how messages are encrypted without the server ever having access to the plaintext. If you must disable JavaScript, then ProtonMail isn't the mail service for you(unless you use their mobile app).
- cblades 7y ago
  Where does proton mail advertise or promise to offer a service that fulfills those obligations?
- sdinsn 7y ago
  > disabling javascript Unsurprisingly, HTML cannot encrypt your data. > verifying with a phone number I never had to do that. > getting stuck in captcha hell if I'm on TOR Applies to pretty much all websites that use captcha. The purpose of captcha is to stop spammers; just suck it up or switch browsers. > and if I want to pay with Bitcoin Why would you want to do that?
afturner 7y ago
https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/
KirinDave 7y ago
The end to end encryption you provide only works for 2 parties within your service, no? Doesn't that mean the courts could compel you to just alter the JS payload to capture keystrokes for these folks? If not, how do you prove that to us?
- protonmail 7y ago
  "Doesn't that mean the courts could compel you to just alter the JS payload to capture keystrokes for these folks? If not, how do you prove that to us?" Swiss law is very clear in stating that this is not permissible, and this can be verified by checking the law itself.
  - chmars 7y ago
    Source in Swiss law?
    - penagwin 7y ago
      I too am interested in the source. Mostly out of curiosity, here in the US our laws definitely don't exclude things like building in backdoors, adding js payloads, etc (Although a few political lines have been drawn, such as Apple refusing to unlock iPhones, but these aren't written in law, they've been decided in courts and are very wishy-washy).
  - KirinDave 7y ago
    This ignores half the problem and it's telling you tried to slide past it. You certainly can and probably will deliver message content sent from a protonmail account to a non-protonmail account. I'm not an expert in Swiss law, so I have no idea. I'll wait for a 3rd party I trust to vet your claim.
    - cblades 7y ago
      What's the allegation here? The mail stored on proton's servers is encrypted. If you send that mail elsewhere, it's subject to the security of the receiving server and any intermediary servers. That's not secret, or hidden by them.
TimTheTinker 7y ago
These types of allegations keep on appearing. I know we all generally trust CERN scientists (after all, they must be smart people who care), but to keep everyone’s trust I suspect nothing less than full transparency will do. Where is ProtonMail’s data stored? Where are its web servers? Who has physical access? Who has login keys/credentials to storage and server machines? Who does security audits, how are they done, when we’re they done last, what were the results, and what steps are you taking to improve your system’s security? And most importantly, what exactly does ProtonMail do when dealing with authorities and other entities that want access to user data? Security is a process, not a destination - that’s a mantra everyone in the security world learns early on. But trust is also a process, not a destination. As an example of a company that treats both as a process, consider AgileBits, the developer of 1Password. Their white papers are case studies in transparency.
- xl10a 7y ago
  After having met numerous scientists, I haven't observed any increase in trustworthiness compared to the general population. If anything, they are more apt to plagiarize and steal other people's ideas. When they leave science to do something else, they frequently morph into ruthless businessmen.
- la_barba 7y ago
  Ideally, what you say makes sense, but at some point you're just going to have to place your trust in someone, or something. Realistically, a vendor won't be able to satisfy every single curiosity. Someone else might ask how do we know the data is actually stored where they claim its stored. How do we know if such and such employee even works there. How do we know the OS that their developers use isn't updated and/or compromised, What if they get a new employee who is incompetent and doesn't follow the established protocols, etc, etc. You can only go down one level of abstraction here. Otherwise you'll probably be writing a treatise on belief, knowledge and justified true-beliefs.
- w8vY7ER 7y ago
  This is well articulated and reflects my current feelings as a customer.
turk73 7y ago
I appreciate you fighting for us! I switched away from Gmail to your service once I discovered just how in-bed Gmail is with the intelligence agencies. We're at a tipping point right now--either privacy starts to win back ground our we're in for a very tough time. The very basis of Western style freedom is on the line. I don't want to live in China for a very good reason! What happened in Australia recently is a travesty, and watching free speech evaporate in New Zealand also made me quite sick to my stomach. We have to stand up now and tell them ENOUGH!
pergadad 7y ago
Problem ist once these allegations are out there is literally no way to dispelled them. Keep up the good works. My assumption is that you could be compelled by Swiss law to give access (a la Lavabit), but that the same would be true for literally any non-shady email provider. You get either someone trustworthy or someone who can avoid the rules, but there's no middle ground. Any of the providers sitting in Dutch bunkers or island tax havens can really be geld accountable or their trustability be verified. And any proper honest provider like posted or mailbox or Lavabit will necessarily have to comply with local laws. Swiss laws or German laws will certainly offer better legal security than American or Australian legal contexts - but everything has a limit. So please don't be disheartened by the undeserved hate here.
adetrest 7y ago
> These allegations are false. Hidden at the bottom of the article, is this: "Public prosecutor Walder of the Competence Center Cybercrime contacted me, saying he had been misquoted". In other words, the alleged source (a public prosecutor) has also supported our denial of these false allegations. Ah, what a brave new world of clickbait and amateur "journalism" we live in... The "source" was probably asked for a quote five minutes before the article went live and the "publisher" has no incentive to correct it because all they care about is that people visit the site and load the ads so they get a few cents per 1000 views. Good luck ProtonMail or any other entity caught in these "reporters" and "journalists" antics.
dinosm00 7y ago
This "article" is absolutely ridiculous. There is clear repudiation by the "source" and instead of modifying or deleting the article, the author put it in an addendum at the bottom. Lowest of the low behaviours, aiming to cause shock, alarm and attract gullible internet readers.

sebiw 7y ago

From the addendum: > I was live-tweeting the event, including the interesting presentation by public prosecutor Walder. The remark that ProtonMail was a (potential) PDCS would have been too trivial to be live-tweeted. The insight on the other hand that ProtonMail voluntarily offers assistance for real-time surveillance, was spectacular and I therefore live-tweeted the statement. In its transparency report, ProtonMail – as mentioned above – itself refers to at least one case of real-time surveillance.

protonmail 7y ago
The prosecutor in question has come on the record and said he was misrepresented. ProtonMail is also on the record as saying the "voluntary assistance" claim is false and untrue. Unless there is some massive conspiracy/cover-up involving a Swiss public prosecutor, the most likely explanation (the article is wrong) is probably the correct one.
- chmars 7y ago
  Isn't it more likely that the state prosecutor spilled the beans? The statement even matches your own transparency report where you describe a case of IP logging, a typical real-time surveillance measure: 'In April 2019, at the request of the Swiss judiciary in a case of clear criminal conduct, we enabled IP logging against a specific user account which is engaged in illegal activities which contravene Swiss law. Pursuant to Swiss law, the user in question will also be notified and afforded the opportunity to defend against this in court before the data can be used in criminal proceedings.' https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/ (You mention April 2019, the statement by the state prosecutor was made at the beginning of May, i.e., he was probably really happy about your cooperation.)
  - addicted 7y ago
    So you’re saying that it’s more likely that there is a secret conspiracy, and a prosecutor in a public televised event for which they almost certainly had pre prepared their remarks, accidentally spilled the beans, than someone who is live tweeting an event mishearing, misinterpreting, or misunderstanding those remarks?
    - chmars 7y ago
      There is no need for a conspiracy. The Swiss surveillance state is a fact. It is also a fact that the relevant laws were recently updated with a focus on services like ProtonMail. We are not talking about a public televised event. We are talking about a statement during a presentation. It happens all time time: People talk, sometimes they talk too much.
  - cblades 7y ago
    >Isn't it more likely that the state prosecutor spilled the beans? No, why would it be? As you point out, they've disclosed turning on logging in response to a legal request. Why then deny the event?
- deleted 7y ago
  [deleted]

Lowkeyloki 7y ago

Thank you for the clarification. I was waiting for an official statement as this site does seem a bit suspect.

chmars 7y ago

You 'forgot' to copy the full addendum. It reads as follows: 'Public prosecutor Walder of the Competence Center Cybercrime contacted me, saying he had been misquoted. He claims that had not divulged at the above-mentioned event that ProtonMail voluntarily releases real-time data. He had merely described ProtonMail as a potential provider of derived communication services (PDCS). I was live-tweeting the event, including the interesting presentation by public prosecutor Walder. The remark that ProtonMail was a (potential) PDCS would have been too trivial to be live-tweeted. The insight on the other hand that ProtonMail voluntarily offers assistance for real-time surveillance, was spectacular and I therefore live-tweeted the statement. In its transparency report, ProtonMail – as mentioned above – itself refers to at least one case of real-time surveillance.' https://steigerlegal.ch/2019/05/23/protonmail-real-time-surveillance/#addendum https://steigerlegal.ch/2019/05/23/protonmail-real-time-surv... Important: The English text is just an unofficial translation.

ziddoap 7y ago
The evidence that was presented by the author can be summarized as: "I live-tweeted it, so they said it. If they didn't, I wouldn't have live-tweeted it.". I'm sorry, but that's a pretty weak argument, even when it's a he-said-she-said type conversation.
- sebiw 7y ago
  Quote from the post: > ProtonMail even mentions a current case of real-time surveillance: „In April 2019, at the request of the Swiss judiciary in a case of clear criminal conduct, we enabled IP logging against a specific user account which is engaged in illegal activities which contravene Swiss law. Pursuant to Swiss law, the user in question will also be notified and afforded the opportunity to defend against this in court before the data can be used in criminal proceedings.“ By writing of a „case of clear criminal conduct“ and of „illegal activities which contravene Swiss law“, ProtonMail violates the presumption of innocence against the monitored suspects. Such suspects are of course not informed by ProtonMail about ongoing real-time surveillance measures.
  - 7y ago

rolltiide 7y ago

Okay now explain why I can't make a protonmail account without: - disabling javascript - verifying with a phone number that is pretty picky - getting stuck in captcha hell if I'm on TOR and if I want to pay with Bitcoin, it already needs to be an existing account

C14L 7y ago
> - disabling javascript How do you want to decrypt your data client-side without running a software to do just that?
hliyan 7y ago
> - disabling javascript Another commenter put it aptly when he said something to this effect: "It is [2019]. If you lobotomize your browser, you might find that a lot of the web doesn't work for you."
calcifer 7y ago
All of those sound like reasonable anti-spam/anti-fraud measures to me. If you know a JS-free captcha approach that is of similar quality to Recaptcha, I'm sure the Protonmail folks would love to hear about it.
ravenstine 7y ago
> Okay now explain why I can't make a protonmail account without: > - disabling javascript ProtonMail encrypts/decrypts messages in the JavaScript client, which is how messages are encrypted without the server ever having access to the plaintext. If you must disable JavaScript, then ProtonMail isn't the mail service for you(unless you use their mobile app).
cblades 7y ago
Where does proton mail advertise or promise to offer a service that fulfills those obligations?
sdinsn 7y ago
> disabling javascript Unsurprisingly, HTML cannot encrypt your data. > verifying with a phone number I never had to do that. > getting stuck in captcha hell if I'm on TOR Applies to pretty much all websites that use captcha. The purpose of captcha is to stop spammers; just suck it up or switch browsers. > and if I want to pay with Bitcoin Why would you want to do that?

afturner 7y ago

https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/

KirinDave 7y ago

The end to end encryption you provide only works for 2 parties within your service, no? Doesn't that mean the courts could compel you to just alter the JS payload to capture keystrokes for these folks? If not, how do you prove that to us?

protonmail 7y ago
"Doesn't that mean the courts could compel you to just alter the JS payload to capture keystrokes for these folks? If not, how do you prove that to us?" Swiss law is very clear in stating that this is not permissible, and this can be verified by checking the law itself.
- chmars 7y ago
  Source in Swiss law?
  - penagwin 7y ago
    I too am interested in the source. Mostly out of curiosity, here in the US our laws definitely don't exclude things like building in backdoors, adding js payloads, etc (Although a few political lines have been drawn, such as Apple refusing to unlock iPhones, but these aren't written in law, they've been decided in courts and are very wishy-washy).
- KirinDave 7y ago
  This ignores half the problem and it's telling you tried to slide past it. You certainly can and probably will deliver message content sent from a protonmail account to a non-protonmail account. I'm not an expert in Swiss law, so I have no idea. I'll wait for a 3rd party I trust to vet your claim.
  - cblades 7y ago
    What's the allegation here? The mail stored on proton's servers is encrypted. If you send that mail elsewhere, it's subject to the security of the receiving server and any intermediary servers. That's not secret, or hidden by them.

TimTheTinker 7y ago

These types of allegations keep on appearing. I know we all generally trust CERN scientists (after all, they must be smart people who care), but to keep everyone’s trust I suspect nothing less than full transparency will do. Where is ProtonMail’s data stored? Where are its web servers? Who has physical access? Who has login keys/credentials to storage and server machines? Who does security audits, how are they done, when we’re they done last, what were the results, and what steps are you taking to improve your system’s security? And most importantly, what exactly does ProtonMail do when dealing with authorities and other entities that want access to user data? Security is a process, not a destination - that’s a mantra everyone in the security world learns early on. But trust is also a process, not a destination. As an example of a company that treats both as a process, consider AgileBits, the developer of 1Password. Their white papers are case studies in transparency.

xl10a 7y ago
After having met numerous scientists, I haven't observed any increase in trustworthiness compared to the general population. If anything, they are more apt to plagiarize and steal other people's ideas. When they leave science to do something else, they frequently morph into ruthless businessmen.
la_barba 7y ago
Ideally, what you say makes sense, but at some point you're just going to have to place your trust in someone, or something. Realistically, a vendor won't be able to satisfy every single curiosity. Someone else might ask how do we know the data is actually stored where they claim its stored. How do we know if such and such employee even works there. How do we know the OS that their developers use isn't updated and/or compromised, What if they get a new employee who is incompetent and doesn't follow the established protocols, etc, etc. You can only go down one level of abstraction here. Otherwise you'll probably be writing a treatise on belief, knowledge and justified true-beliefs.
w8vY7ER 7y ago
This is well articulated and reflects my current feelings as a customer.

turk73 7y ago

I appreciate you fighting for us! I switched away from Gmail to your service once I discovered just how in-bed Gmail is with the intelligence agencies. We're at a tipping point right now--either privacy starts to win back ground our we're in for a very tough time. The very basis of Western style freedom is on the line. I don't want to live in China for a very good reason! What happened in Australia recently is a travesty, and watching free speech evaporate in New Zealand also made me quite sick to my stomach. We have to stand up now and tell them ENOUGH!

pergadad 7y ago

Problem ist once these allegations are out there is literally no way to dispelled them. Keep up the good works. My assumption is that you could be compelled by Swiss law to give access (a la Lavabit), but that the same would be true for literally any non-shady email provider. You get either someone trustworthy or someone who can avoid the rules, but there's no middle ground. Any of the providers sitting in Dutch bunkers or island tax havens can really be geld accountable or their trustability be verified. And any proper honest provider like posted or mailbox or Lavabit will necessarily have to comply with local laws. Swiss laws or German laws will certainly offer better legal security than American or Australian legal contexts - but everything has a limit. So please don't be disheartened by the undeserved hate here.

adetrest 7y ago

> These allegations are false. Hidden at the bottom of the article, is this: "Public prosecutor Walder of the Competence Center Cybercrime contacted me, saying he had been misquoted". In other words, the alleged source (a public prosecutor) has also supported our denial of these false allegations. Ah, what a brave new world of clickbait and amateur "journalism" we live in... The "source" was probably asked for a quote five minutes before the article went live and the "publisher" has no incentive to correct it because all they care about is that people visit the site and load the ads so they get a few cents per 1000 views. Good luck ProtonMail or any other entity caught in these "reporters" and "journalists" antics.

dinosm00 7y ago

This "article" is absolutely ridiculous. There is clear repudiation by the "source" and instead of modifying or deleting the article, the author put it in an addendum at the bottom. Lowest of the low behaviours, aiming to cause shock, alarm and attract gullible internet readers.