3 ms·

Suppose that I am an activist in China and I use ProtonMail to communicate with others and write about things that Chinese government is doing that I think are

by aborsy 5y ago

Suppose that I am an activist in China and I use ProtonMail to communicate with others and write about things that Chinese government is doing that I think are bad. I understand that metadata is not private in e2e email encryption. I am fine with that risk, I just want the content of my emails with another user of ProtonMail be secure, which ProtonMail has guaranteed AFAIK. A Swiss court issues an order to PM: the Chinese government has informed us of a criminal that is using PM to do activities that are considered illegal in China. You are required by Swiss law to do two things: 1. In order to bypass end-to-end encryption for this user, push a malicious update to the mobile app or desktop browser of this user at this IP address, and 2. You are not allowed to disclose this request to public. Another version of this request is that, a Swiss court would order provision of a back-door (possibly through pushing of a malicious JavaScript code) to a selective set of users provided regularly by the Swiss government, citing a law on national security of the Switzerland or the like. What would be the response of ProtonMail to such hypothetical request?

protonmail 5y ago
First, if what you are doing is not illegal in Switzerland, the Swiss govt would never approve the request in the first place. In general, the Swiss govt does not typically accept requests from countries with dubious legal and human rights records. Second, even if the request were approved, under Swiss law, it is not permissible to break end-to-end encryption. Swiss law enforcement is not allowed to make such a request. Third, all requests eventually have to be disclosed, although the disclosure may come from Swiss authorities. This also a requirement of Swiss law. Fourth, if a request were somehow approved, as the origin is China, our legal team would also scrutinize it closely, and if found to be suspect, would also fight the request.
- aborsy 5y ago
  Thanks for clarification!

by aborsy 5y ago

protonmail 5y ago

First, if what you are doing is not illegal in Switzerland, the Swiss govt would never approve the request in the first place. In general, the Swiss govt does not typically accept requests from countries with dubious legal and human rights records. Second, even if the request were approved, under Swiss law, it is not permissible to break end-to-end encryption. Swiss law enforcement is not allowed to make such a request. Third, all requests eventually have to be disclosed, although the disclosure may come from Swiss authorities. This also a requirement of Swiss law. Fourth, if a request were somehow approved, as the origin is China, our legal team would also scrutinize it closely, and if found to be suspect, would also fight the request.

aborsy 5y ago
Thanks for clarification!