15 ms·

All those who stop using ProtonMail after this incident - could you please describe what PM should've done differently? From what I know they received a valid/l

by yaris 5y ago

All those who stop using ProtonMail after this incident - could you please describe what PM should've done differently? From what I know they received a valid/legal request from authorities in Switzerland. Since they operate under swiss jurisdiction - they had only two options: comply or cease to exist. I doubt anyone would be happier if _all_ PM equipment got seized. So it seems that they should've placed themselves (servers _and_ personnel) outside EU. Also outside USA, UK, Australia, Canada, India, Russia, China, Latin America, Saudi Arabia... There are not so many countries left. And operating in "dark web" is not helping really - physical HW has to be operated by physical people, both of which can be found by state authorities.

southerntofu 5y ago
Refuse to comply with unfair laws? That's precisely what those activists that Protonmail ratted on were doing, and that's precisely what Protonmail should have done. It's funny how some fancy cryptographers from their ivory towers will stand for privacy rights... as long as they don't actually take any risks for themselves. Unlike the actual activists who were house searched and arrested and now risk jail time for an arguably-noble cause, it's not like security researchers actually risk anything beyond a few fines (which they could crowdfund for) if they don't comply with law enforcement.
- YorickPeterse 5y ago
  > Refuse to comply with unfair laws? And do what exactly, go to prison? Expecting that is unreasonable at best.
  - southerntofu 5y ago
    When was the last time you heard of sysadmins ending up in prison, apart from obvious criminal conspiracies like Silk Road? see my other comment in this thread for more detail on how that's a misinformed argument: https://news.ycombinator.com/item?id=28434187 https://news.ycombinator.com/item?id=28434187
    - ur-whale 5y ago
      > apart from obvious criminal conspiracies like Silk Road You are being downvoted because the only person to whim Silk road is an "obvious" criminal conspiracy is you.
      - southerntofu 5y ago
        haha thanks for explaining. I'm personally not in favor of drug criminalization, i was referring to the fact that by law that is considered a criminal conspiracy. but also i'm not exactly super fan of defending Silk Road, since there was some "hitman hiring" scheme involved at some point in the operation
  - JasonFruit 5y ago
    This is exactly the point: never expect that the people running a service are going to go to prison or pay a significant fine to protect you. It's not going to happen. You need good OPSEC, yourself, because you don't want to go to prison.
    - southerntofu 5y ago
      I partially agree, and partially disagree. No i don't expect volunteer sysadmins to take huge risks for me. However, i expect huge organizations like Protonmail who claim to care for privacy to do just that. Moreover, the risks in this case are not big because this is a clear case of political repression and any form of judicial scrutiny would have raised considerable eyebrows.
- mattr47 5y ago
  PM had no idea who the users were or what criminal charges they were facing. They had to comply with the Swiss law and provide the IP address.
  - southerntofu 5y ago
    Simply using any web search engine for that address would have given them clues that this could be a case of political repression and demands more consideration than collaboration-by-default.
- ezoe 5y ago
  You can't stand a chance against 5 dollar wrench attack suggested by xkcd. Hey, that gives me an idea. Cryptographers should arm with the nuclear weapon. Owning the nukes and declare to detonate it when they detected a threat of 5 dollar wrench attack.
  - fallingknife 5y ago
    You just invented a government
    - oblio 5y ago
      He's kidding, he's referring to this: https://xkcd.com/538/ https://xkcd.com/538/
- sofixa 5y ago
  > Refuse to comply with unfair laws Are anti-squatting laws unfair? And do note we're talking about squatting to make a point in one of the most valuable cities in the world, Paris, not squatting to have a roof over your head in the middle of nowhere.
  - southerntofu 5y ago
    > Are anti-squatting laws unfair? Yes. But France doesn't have anti squatting laws (contrary to UK/Netherlands), and for good reasons. Squatting was common practice (even encouraged) after WWII ended to rebuild communities, and there's even "requisition" provisions in the law so that people don't have to squat but the mayor/préfet can seize unused dwellings to house people (although this law is rarely applied). Now, there are laws against home theft, which is a good thing. Nobody can just come into your residence while you're away for a week and squat it; only far-right media invent (from the void) cases like this but in practice, as a squatter you have exactly 0 legal protection if you do this, and you will be evicted instantly and thrown in jail. On the other hand, if you squat an abandoned building and make it your primary residence, you have all the "residence" protections any tenant enjoys, including the right to a "fair" (cough cough) trial to determine your fate, the right to the trêve hivernale (evictions are suspended in winter, except in special cases like home theft), as well as the right to a minimum 2-month delay before eviction to find yourself a new accomodation. I'd be happy to continue elaborating on why your argument is misinformed (and why people usually squat in the big cities not on the countryside) but this comment would be too long. Let me know if you have questions.
AndyMcConachie 5y ago
PM's marketing has long said they're special because they're Swiss. That's been their main marketing push every time I looked into them. Turns out that's BS. So I don't believe we should criticize PM for their handling of this situation. We should criticize PM for lying to their customers.
- masklinn 5y ago
  > We should criticize PM for lying to their customers. Lying about what exactly? They chose switzerland because it has excellent civil and privacy protection, not because it’s a lawless hellscape, and they never hid that and that they were under swiss law.
  - southerntofu 5y ago
    > They chose switzerland because it has excellent civil and privacy protection Source for Switzerland being any better than other countries when it comes to human rights? A few examples come to mind that would suggest otherwise... > not because it’s a lawless hellscape How is protecting activists who try to change society for the better "a lawless hellscape"?
    - yaris 5y ago
      While there may be examples of activists being oppressed by Swiss law, in this particular incident activists where messing with others' property which is hardly changing society for the better.
      - southerntofu 5y ago
        Two important things: 1) We're talking about Protonmail cooperating with a random foreign police (via request from their local police) without any form of judicial oversight. As a hosting provider with big money like Protonmail, the only fair thing to go is to go to court to have a judge examine the legality of the request in detail (not just as a friendly police request) before you collaborate at all with them. 2) We're talking about a bunch of anti-gentrification activists who requisitionned/squatted empty buildings to house homeless people and serve food for the neighborhood. Those buildings were owned by a landowning mafia which, as you can see, has long-reaching arms: when was the last time you heard of Europol/Interpol being involved in the repression of a squat that lasted a few months? This is a clear case of political repression, not any ordinary criminal case.
Ansil849 5y ago
> could you please describe what PM should've done differently? 1) Not kept logs so that when put in a position to provide logs, would not have been able to do so. If subsequently compelled to _start_ keeping logs, then: 2) Been hosted in another jurisdiction, and obfuscate where they are hosted.
- oauea 5y ago
  > Been hosted in another jurisdiction, and obfuscate where they are hosted. Is this a serious suggestion? No registered company will be able to do this.
- masklinn 5y ago
  > Been hosted in another jurisdiction I’m sure somalia has great infrastructure. > and obfuscate where they are hosted. Running an undeclared business with physical components sound like a stellar idea.
- mumblemumble 5y ago
  I would challenge you to find a jurisdiction where the government doesn't reserve the power to compel people to do things, or where that power exists but is never used in a way that permits criticism. I don't know the details of Swiss law, and I don't know the details of this particular case or what real or purported crimes they're investigating. It's entirely possible that this is an overzealous application of state power. But, even if we accept for the sake of argument that this is a government overreach, I would still suggest that harsh criticism of ProtonMail is misdirected. Switzerland may not be perfect, but we shouldn't expect them to be perfect. Life is messy, there are no utopias, and humanity has yet to find a way to structure civil society in a way that comes even close to achieving perfect justice. I would guess, though, that, for all the country's doubtlessly countless shortcomings, when it comes to quality of checks and balances in legal investigations, a company based in Switzerland doesn't really have anywhere to go but down.
- Youden 5y ago
  They were doing 1 [0]. OP asked what concrete options there are for 2. In what jurisdiction would they have been better located? [0]: https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/
sharklazer 5y ago
And the law is the absolute 100% honest-to-your-deity-or-lack-thereof moral authority on all things, so never ever ever disobey it.
- yaris 5y ago
  Disobeying laws can become very costly, especially when you have something that can be taken away.
southerntofu 5y ago
Also something else they could have done, from a technical perspective: they could have designed Protonmail as a free-software suite for existing non-profits and coops to run to provide more-secure email. Centralizing everything with them is what made this situation possible in the first place.
devwastaken 5y ago
"sorry we don't have IP logging. Requiring us to do so is an undue burden in costs and would threaten our customer base, costing us far more money. If you want to log addresses that's the states responsibility." They may very well lose, the problem is how much they willfully comply, and then lie or ommit the truth.
- ur-whale 5y ago
  > sorry we don't have IP logging. Requiring us to do so is an undue burden in costs and would threaten our customer base Exactly my thoughts. When you have decided to resist, there are many ways to do this, without obviously disobeying the law. They whole marketing spiel has been debunked in one fell swoop with this case.
tlogan 5y ago
I think PM should seize to exist: it is not what it says it is. But on ther hand they will not be allowed to seize to exist because govs need a way to capture “stupid criminals” (basically activists and similars) But real online criminals live in Russia… it is known who they are and they do not even hide themselves.
JumpCrisscross 5y ago
There seem to be two groups of ProtonMail users. Those offended by warrantless dragnet surveillance. And those opposed to legal demands for information. ProtonMail is effective at thwarting the first. It sees headers and IP addresses, so the risk is theoretically there. But their technology, policies and the strength of Swiss privacy law [1] make them a less-ideal coöperator for the NSA than e.g. Google or Comcast. With respect to the second, I feel like ProtonMail went out of their way to communicate their limits. They will comply with Swiss warrants. These are signed off on by a Swiss court and made pursuant to Swiss law. (They still don’t get to hand over your emails, which is an improvement over most other providers.) Disclaimer: I used to use ProtonMail. I switched to Microsoft 365 because I need integrated calendaring and delegation. [1] Third-partly doctrine doesn’t exist for e-mails in Switzerland. If the FBI asks ProtonMail for information, ProtonMail would be breaking Swiss law if they handed it over without a Swiss court signing a warrant.
- masklinn 5y ago
  > They still don’t get to hand over your emails, which is an improvement over most other providers. They do if they're asked to and you're not using their custom e2e thing (e.g. you're using the imap gateway).
  - abraham 5y ago
    Are you talking about the Bridge? That appears to run locally on your computer and wouldn't provide their servers any further access than their custom clients. https://protonmail.com/bridge/ https://protonmail.com/bridge/
- BoxOfRain 5y ago
  I agree. The fact ProtonMail exists in a world that's pretty hostile to individual privacy is hardly their fault, I think they were pretty good at explaining what their limits are compared to a lot of companies out there. It'd be churlish to leave ProtonMail for say, Gmail or another mainstream offering that makes far less of an effort to be private and transparent in my opinion. I feel there's a lot of people who are absolutists about privacy without realising the legal and technical realities of that absolutism. I don't agree for one minute with governments and corporations compromising people's privacy, but whatever we like to tell ourselves about liberal democracy all authority amounts to "might makes right" in the end, and ProtonMail doesn't have the mightiest club to swing around in this situation.
istingray 5y ago
Disclaimer: Paying Protonmail customer here Waiting on someone inspired to build something better. I spend $50/year with Protonmail. I expect Proton to communicate differently about what they offer. And to educate users about what surveillance is, and what Proton can and cannot protect from. Train the future generation to expect trustless, adversarial systems but still thrive. Promote Tor. Don't just put up with Tor. Educate users about Tor. Defend Tor. I appreciate that Protonmail specifically addressed this in the headline of their response "Important clarifications regarding arrest of climate activist". Rather than "Updates on our privacy policy" or some bs. I don't expect Proton to behave differently to law enforcement or warrants. I believe they did whatever here. No company can resist the law. You can see my response here in the other thread: https://news.ycombinator.com/item?id=28427259 https://news.ycombinator.com/item?id=28427259
- mumblemumble 5y ago
  I don't generally like to be the one to blithely trumpet about personal responsibility, in part because I tend to be more of a "civic responsibility" kid of person. This, though, seems to me to be pretty unambiguously a situation where personal responsibility needs to take over. There must be a limit to how much responsibility we try to foist off on others. As someone who's been using Proton for years, I've continuously been quite impressed about how open they are about the limits of what they can offer. As a company selling me a product, they do a great job. But they are still, at the end of the day, a company selling a product, and not my life coach or personal attorney. It is not their responsibility to anticipate and enumerate every possible way the legal obligations under which they operate could play out in real life. At some point, it's on the customer to have enough of a grasp of civics to understand what court orders are and how they happen.
  - istingray 5y ago
    Disclaimer: Paying Protonmail customer I hear you. But in that case, why not just use Gmail? For $50/year I do expect Protonmail to be more like a life coach for privacy and surveillance. Not for me personally, but for the people who really need protection. It's just email, I can get it cheap anywhere. For example, their one and only blog post about Tor is from 2017. I expect better. Promote Tor on the homepage. Publish about what percentage of your users use Tor. Fight to change norms not just pass the buck. Get with the times, Protonmail. Or someone else will do it for you.
viktorcode 5y ago
Switzerland is outside the EU.
- himinlomax 5y ago
  They are signatories to quite a number of EU treaties, such as Schengen.
404mm 5y ago
Looks like the user may have done more on their part… > However, we understand this is concerning for individuals with certain threat models, which is why since 2017, we also provide an onion site for anonymous access (we are one of the only email providers that supports this).
- istingray 5y ago
  Proton's first and last blog post about Tor was from 2017 [1] As a paying customer, I expect better. [1] https://protonmail.com/blog/tor-encrypted-email/ https://protonmail.com/blog/tor-encrypted-email/
  - masklinn 5y ago
    What do you expect exactly, that they shutdown non-tor access and force you to go through tor?
    - istingray 5y ago
      Thanks for asking. Your suggestion seems rather extreme, but I'm open to it if you make a good case. I'm curious to see more Tor-first service launch. 1. More blog posts about Tor, how Proton is supporting Tor 2. Updating their Onion link. Their original blog post still refers to a v2 address, which are being retired 3. Supporting Tor broadly for other uses 4. Support anonymous account creation through Tor. I get it, it's hard. Find a solution that doesn't require de-anonymizing users.
ur-whale 5y ago
>could you please describe what PM should've done differently There is a thing called civil disobedience [1] I think that in this instance, it was justified to take such a stance and basically fight the injunction tooth and nail, even if that meant taking fine, going to jail, whatever. In a case like this, if you really believe in your core values, you must be willing to take the hit. The whole "the law says X" isn't the highest moral standard in this case. [1] https://en.wikipedia.org/wiki/Civil_disobedience https://en.wikipedia.org/wiki/Civil_disobedience
- FireBeyond 5y ago
  Or having their servers shut down and many thousand people losing access to their email?
  - ur-whale 5y ago
    > Or having their servers shut down and many thousand people losing access to their email? There are technical solutions to this problem.
deleted 5y ago
[deleted]
teawrecks 5y ago
> they had only two options: comply or cease to exist. You mean like Lavabit?
- ncphil 5y ago
  Lavabit was (and is, they're back in business as of 2017) physically located at imperial dead center, in a state where most people were fully supportive of their country's imperial ambitions. It was naive for its founder (or its customers) to expect a different result. They paid a high price for that. I think it's similarly naive to expect a different result in the case of ProtonMail. CH isn't an island. It's at least as tightly coupled with the global economy as TX. It has longstanding treaty obligations that come with that, including some covering criminal law enforcement (e.g. an extradition treaty with the US). See this Forbes piece about what Lavabit's founder said about email some time ago: Kashmir Hill. "Lavabit's Ladar Levison: 'If You Knew What I Know About Email, You Might Not Use It'". _Forbes_, 9 August 2013, https://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-ladar-levison-if-you-knew-what-i-know-about-email-you-might-not-use-it/ https://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits....
drummer 5y ago
They should have refused and shut dowm the company instead. There is another provider who did just that.
tomjen3 5y ago
It is obvious: ensure you have no logs. No IP logs, no sender logs, no logs.
- oblio 5y ago
  The thing is: can you run an actual company with paying customers and do this, from an operational perspective? Do you know <<any>> commercial company doing this? I think it's pretty much impossible. How do you debug issues? How do you track and prevent abuse?
2OEH8eoCRo0 5y ago
Everyone seems to expect Protonmail to take the fall for them.
sluggosaurus 5y ago
> All those who stop using ProtonMail after this incident - could you please describe what PM should've done differently? Somebody no longer valuing what ProtonMail provides is not mutually exclusive with thinking ProtonMail could have done differently. I expect many ex-ProtonMail customers realize ProtonMail could not have done differently, but nevertheless no longer value the service ProtonMail provides. How could this be? It's simple: They previously had mistaken beliefs (namely, that ProtonMail could have done differently), and decided to no longer be customers of ProtonMail when the truth became clear to them. If you sell me electricity from your cold fusion power plant, I am going to cancel my subscription as soon as I figure out that cold fusion isn't possible and you were selling me coal power all along. That I now realize it was impossible for you to sell me cold fusion power in the first place doesn't change the fact that I no longer see any value in doing business with your power company.
Berobero 5y ago
I've never used PM, but just ran through sign-up for their free service. What could they do differently with regards to this issue? Simple. Make the legal limitations of their service -- or at least their understanding of them -- explicit, transparent, and above all, utterly conspicuous to anyone looking to use their service.
smsm42 5y ago
> what PM should've done differently For starters, disclose prominently that they could be forced - and have been in the past, and will be in the future - to disclose all the information about the client that comes into their possession, including IP connection information, and they can provide no protection at all from the point the police took interest in you forward.
- protonmail 5y ago
  We understand where you are coming from, but this information is disclosed in our privacy policy, threat model, and transparency report (updated annually since 2015). All 3 pages are linked from every single page on our website. They are also included in the welcome/onboarding email sent to every single Proton user. At the end of the day, we cannot force people to read, but we do take your comment to heart and will try to be even more explicit.

by yaris 5y ago

southerntofu 5y ago

Refuse to comply with unfair laws? That's precisely what those activists that Protonmail ratted on were doing, and that's precisely what Protonmail should have done. It's funny how some fancy cryptographers from their ivory towers will stand for privacy rights... as long as they don't actually take any risks for themselves. Unlike the actual activists who were house searched and arrested and now risk jail time for an arguably-noble cause, it's not like security researchers actually risk anything beyond a few fines (which they could crowdfund for) if they don't comply with law enforcement.

YorickPeterse 5y ago
> Refuse to comply with unfair laws? And do what exactly, go to prison? Expecting that is unreasonable at best.
- southerntofu 5y ago
  When was the last time you heard of sysadmins ending up in prison, apart from obvious criminal conspiracies like Silk Road? see my other comment in this thread for more detail on how that's a misinformed argument: https://news.ycombinator.com/item?id=28434187 https://news.ycombinator.com/item?id=28434187
  - ur-whale 5y ago
    > apart from obvious criminal conspiracies like Silk Road You are being downvoted because the only person to whim Silk road is an "obvious" criminal conspiracy is you.
    - southerntofu 5y ago
      haha thanks for explaining. I'm personally not in favor of drug criminalization, i was referring to the fact that by law that is considered a criminal conspiracy. but also i'm not exactly super fan of defending Silk Road, since there was some "hitman hiring" scheme involved at some point in the operation
- JasonFruit 5y ago
  This is exactly the point: never expect that the people running a service are going to go to prison or pay a significant fine to protect you. It's not going to happen. You need good OPSEC, yourself, because you don't want to go to prison.
  - southerntofu 5y ago
    I partially agree, and partially disagree. No i don't expect volunteer sysadmins to take huge risks for me. However, i expect huge organizations like Protonmail who claim to care for privacy to do just that. Moreover, the risks in this case are not big because this is a clear case of political repression and any form of judicial scrutiny would have raised considerable eyebrows.
mattr47 5y ago
PM had no idea who the users were or what criminal charges they were facing. They had to comply with the Swiss law and provide the IP address.
- southerntofu 5y ago
  Simply using any web search engine for that address would have given them clues that this could be a case of political repression and demands more consideration than collaboration-by-default.
ezoe 5y ago
You can't stand a chance against 5 dollar wrench attack suggested by xkcd. Hey, that gives me an idea. Cryptographers should arm with the nuclear weapon. Owning the nukes and declare to detonate it when they detected a threat of 5 dollar wrench attack.
- fallingknife 5y ago
  You just invented a government
  - oblio 5y ago
    He's kidding, he's referring to this: https://xkcd.com/538/ https://xkcd.com/538/
sofixa 5y ago
> Refuse to comply with unfair laws Are anti-squatting laws unfair? And do note we're talking about squatting to make a point in one of the most valuable cities in the world, Paris, not squatting to have a roof over your head in the middle of nowhere.
- southerntofu 5y ago
  > Are anti-squatting laws unfair? Yes. But France doesn't have anti squatting laws (contrary to UK/Netherlands), and for good reasons. Squatting was common practice (even encouraged) after WWII ended to rebuild communities, and there's even "requisition" provisions in the law so that people don't have to squat but the mayor/préfet can seize unused dwellings to house people (although this law is rarely applied). Now, there are laws against home theft, which is a good thing. Nobody can just come into your residence while you're away for a week and squat it; only far-right media invent (from the void) cases like this but in practice, as a squatter you have exactly 0 legal protection if you do this, and you will be evicted instantly and thrown in jail. On the other hand, if you squat an abandoned building and make it your primary residence, you have all the "residence" protections any tenant enjoys, including the right to a "fair" (cough cough) trial to determine your fate, the right to the trêve hivernale (evictions are suspended in winter, except in special cases like home theft), as well as the right to a minimum 2-month delay before eviction to find yourself a new accomodation. I'd be happy to continue elaborating on why your argument is misinformed (and why people usually squat in the big cities not on the countryside) but this comment would be too long. Let me know if you have questions.

AndyMcConachie 5y ago

PM's marketing has long said they're special because they're Swiss. That's been their main marketing push every time I looked into them. Turns out that's BS. So I don't believe we should criticize PM for their handling of this situation. We should criticize PM for lying to their customers.

masklinn 5y ago
> We should criticize PM for lying to their customers. Lying about what exactly? They chose switzerland because it has excellent civil and privacy protection, not because it’s a lawless hellscape, and they never hid that and that they were under swiss law.
- southerntofu 5y ago
  > They chose switzerland because it has excellent civil and privacy protection Source for Switzerland being any better than other countries when it comes to human rights? A few examples come to mind that would suggest otherwise... > not because it’s a lawless hellscape How is protecting activists who try to change society for the better "a lawless hellscape"?
  - yaris 5y ago
    While there may be examples of activists being oppressed by Swiss law, in this particular incident activists where messing with others' property which is hardly changing society for the better.
    - southerntofu 5y ago
      Two important things: 1) We're talking about Protonmail cooperating with a random foreign police (via request from their local police) without any form of judicial oversight. As a hosting provider with big money like Protonmail, the only fair thing to go is to go to court to have a judge examine the legality of the request in detail (not just as a friendly police request) before you collaborate at all with them. 2) We're talking about a bunch of anti-gentrification activists who requisitionned/squatted empty buildings to house homeless people and serve food for the neighborhood. Those buildings were owned by a landowning mafia which, as you can see, has long-reaching arms: when was the last time you heard of Europol/Interpol being involved in the repression of a squat that lasted a few months? This is a clear case of political repression, not any ordinary criminal case.

Ansil849 5y ago

> could you please describe what PM should've done differently? 1) Not kept logs so that when put in a position to provide logs, would not have been able to do so. If subsequently compelled to _start_ keeping logs, then: 2) Been hosted in another jurisdiction, and obfuscate where they are hosted.

oauea 5y ago
> Been hosted in another jurisdiction, and obfuscate where they are hosted. Is this a serious suggestion? No registered company will be able to do this.
masklinn 5y ago
> Been hosted in another jurisdiction I’m sure somalia has great infrastructure. > and obfuscate where they are hosted. Running an undeclared business with physical components sound like a stellar idea.
mumblemumble 5y ago
I would challenge you to find a jurisdiction where the government doesn't reserve the power to compel people to do things, or where that power exists but is never used in a way that permits criticism. I don't know the details of Swiss law, and I don't know the details of this particular case or what real or purported crimes they're investigating. It's entirely possible that this is an overzealous application of state power. But, even if we accept for the sake of argument that this is a government overreach, I would still suggest that harsh criticism of ProtonMail is misdirected. Switzerland may not be perfect, but we shouldn't expect them to be perfect. Life is messy, there are no utopias, and humanity has yet to find a way to structure civil society in a way that comes even close to achieving perfect justice. I would guess, though, that, for all the country's doubtlessly countless shortcomings, when it comes to quality of checks and balances in legal investigations, a company based in Switzerland doesn't really have anywhere to go but down.
Youden 5y ago
They were doing 1 [0]. OP asked what concrete options there are for 2. In what jurisdiction would they have been better located? [0]: https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/

sharklazer 5y ago

And the law is the absolute 100% honest-to-your-deity-or-lack-thereof moral authority on all things, so never ever ever disobey it.

yaris 5y ago
Disobeying laws can become very costly, especially when you have something that can be taken away.

southerntofu 5y ago

Also something else they could have done, from a technical perspective: they could have designed Protonmail as a free-software suite for existing non-profits and coops to run to provide more-secure email. Centralizing everything with them is what made this situation possible in the first place.

devwastaken 5y ago

"sorry we don't have IP logging. Requiring us to do so is an undue burden in costs and would threaten our customer base, costing us far more money. If you want to log addresses that's the states responsibility." They may very well lose, the problem is how much they willfully comply, and then lie or ommit the truth.

ur-whale 5y ago
> sorry we don't have IP logging. Requiring us to do so is an undue burden in costs and would threaten our customer base Exactly my thoughts. When you have decided to resist, there are many ways to do this, without obviously disobeying the law. They whole marketing spiel has been debunked in one fell swoop with this case.

tlogan 5y ago

I think PM should seize to exist: it is not what it says it is. But on ther hand they will not be allowed to seize to exist because govs need a way to capture “stupid criminals” (basically activists and similars) But real online criminals live in Russia… it is known who they are and they do not even hide themselves.

JumpCrisscross 5y ago

There seem to be two groups of ProtonMail users. Those offended by warrantless dragnet surveillance. And those opposed to legal demands for information. ProtonMail is effective at thwarting the first. It sees headers and IP addresses, so the risk is theoretically there. But their technology, policies and the strength of Swiss privacy law [1] make them a less-ideal coöperator for the NSA than e.g. Google or Comcast. With respect to the second, I feel like ProtonMail went out of their way to communicate their limits. They will comply with Swiss warrants. These are signed off on by a Swiss court and made pursuant to Swiss law. (They still don’t get to hand over your emails, which is an improvement over most other providers.) Disclaimer: I used to use ProtonMail. I switched to Microsoft 365 because I need integrated calendaring and delegation. [1] Third-partly doctrine doesn’t exist for e-mails in Switzerland. If the FBI asks ProtonMail for information, ProtonMail would be breaking Swiss law if they handed it over without a Swiss court signing a warrant.

masklinn 5y ago
> They still don’t get to hand over your emails, which is an improvement over most other providers. They do if they're asked to and you're not using their custom e2e thing (e.g. you're using the imap gateway).
- abraham 5y ago
  Are you talking about the Bridge? That appears to run locally on your computer and wouldn't provide their servers any further access than their custom clients. https://protonmail.com/bridge/ https://protonmail.com/bridge/
BoxOfRain 5y ago
I agree. The fact ProtonMail exists in a world that's pretty hostile to individual privacy is hardly their fault, I think they were pretty good at explaining what their limits are compared to a lot of companies out there. It'd be churlish to leave ProtonMail for say, Gmail or another mainstream offering that makes far less of an effort to be private and transparent in my opinion. I feel there's a lot of people who are absolutists about privacy without realising the legal and technical realities of that absolutism. I don't agree for one minute with governments and corporations compromising people's privacy, but whatever we like to tell ourselves about liberal democracy all authority amounts to "might makes right" in the end, and ProtonMail doesn't have the mightiest club to swing around in this situation.

istingray 5y ago

Disclaimer: Paying Protonmail customer here Waiting on someone inspired to build something better. I spend $50/year with Protonmail. I expect Proton to communicate differently about what they offer. And to educate users about what surveillance is, and what Proton can and cannot protect from. Train the future generation to expect trustless, adversarial systems but still thrive. Promote Tor. Don't just put up with Tor. Educate users about Tor. Defend Tor. I appreciate that Protonmail specifically addressed this in the headline of their response "Important clarifications regarding arrest of climate activist". Rather than "Updates on our privacy policy" or some bs. I don't expect Proton to behave differently to law enforcement or warrants. I believe they did whatever here. No company can resist the law. You can see my response here in the other thread: https://news.ycombinator.com/item?id=28427259 https://news.ycombinator.com/item?id=28427259

mumblemumble 5y ago
I don't generally like to be the one to blithely trumpet about personal responsibility, in part because I tend to be more of a "civic responsibility" kid of person. This, though, seems to me to be pretty unambiguously a situation where personal responsibility needs to take over. There must be a limit to how much responsibility we try to foist off on others. As someone who's been using Proton for years, I've continuously been quite impressed about how open they are about the limits of what they can offer. As a company selling me a product, they do a great job. But they are still, at the end of the day, a company selling a product, and not my life coach or personal attorney. It is not their responsibility to anticipate and enumerate every possible way the legal obligations under which they operate could play out in real life. At some point, it's on the customer to have enough of a grasp of civics to understand what court orders are and how they happen.
- istingray 5y ago
  Disclaimer: Paying Protonmail customer I hear you. But in that case, why not just use Gmail? For $50/year I do expect Protonmail to be more like a life coach for privacy and surveillance. Not for me personally, but for the people who really need protection. It's just email, I can get it cheap anywhere. For example, their one and only blog post about Tor is from 2017. I expect better. Promote Tor on the homepage. Publish about what percentage of your users use Tor. Fight to change norms not just pass the buck. Get with the times, Protonmail. Or someone else will do it for you.

viktorcode 5y ago

Switzerland is outside the EU.

himinlomax 5y ago
They are signatories to quite a number of EU treaties, such as Schengen.

404mm 5y ago

Looks like the user may have done more on their part… > However, we understand this is concerning for individuals with certain threat models, which is why since 2017, we also provide an onion site for anonymous access (we are one of the only email providers that supports this).

istingray 5y ago
Proton's first and last blog post about Tor was from 2017 [1] As a paying customer, I expect better. [1] https://protonmail.com/blog/tor-encrypted-email/ https://protonmail.com/blog/tor-encrypted-email/
- masklinn 5y ago
  What do you expect exactly, that they shutdown non-tor access and force you to go through tor?
  - istingray 5y ago
    Thanks for asking. Your suggestion seems rather extreme, but I'm open to it if you make a good case. I'm curious to see more Tor-first service launch. 1. More blog posts about Tor, how Proton is supporting Tor 2. Updating their Onion link. Their original blog post still refers to a v2 address, which are being retired 3. Supporting Tor broadly for other uses 4. Support anonymous account creation through Tor. I get it, it's hard. Find a solution that doesn't require de-anonymizing users.

ur-whale 5y ago

>could you please describe what PM should've done differently There is a thing called civil disobedience [1] I think that in this instance, it was justified to take such a stance and basically fight the injunction tooth and nail, even if that meant taking fine, going to jail, whatever. In a case like this, if you really believe in your core values, you must be willing to take the hit. The whole "the law says X" isn't the highest moral standard in this case. [1] https://en.wikipedia.org/wiki/Civil_disobedience https://en.wikipedia.org/wiki/Civil_disobedience

FireBeyond 5y ago
Or having their servers shut down and many thousand people losing access to their email?
- ur-whale 5y ago
  > Or having their servers shut down and many thousand people losing access to their email? There are technical solutions to this problem.

deleted 5y ago

[deleted]

teawrecks 5y ago

> they had only two options: comply or cease to exist. You mean like Lavabit?

ncphil 5y ago
Lavabit was (and is, they're back in business as of 2017) physically located at imperial dead center, in a state where most people were fully supportive of their country's imperial ambitions. It was naive for its founder (or its customers) to expect a different result. They paid a high price for that. I think it's similarly naive to expect a different result in the case of ProtonMail. CH isn't an island. It's at least as tightly coupled with the global economy as TX. It has longstanding treaty obligations that come with that, including some covering criminal law enforcement (e.g. an extradition treaty with the US). See this Forbes piece about what Lavabit's founder said about email some time ago: Kashmir Hill. "Lavabit's Ladar Levison: 'If You Knew What I Know About Email, You Might Not Use It'". _Forbes_, 9 August 2013, https://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits-ladar-levison-if-you-knew-what-i-know-about-email-you-might-not-use-it/ https://www.forbes.com/sites/kashmirhill/2013/08/09/lavabits....

drummer 5y ago

They should have refused and shut dowm the company instead. There is another provider who did just that.

tomjen3 5y ago

It is obvious: ensure you have no logs. No IP logs, no sender logs, no logs.

oblio 5y ago
The thing is: can you run an actual company with paying customers and do this, from an operational perspective? Do you know <<any>> commercial company doing this? I think it's pretty much impossible. How do you debug issues? How do you track and prevent abuse?

2OEH8eoCRo0 5y ago

Everyone seems to expect Protonmail to take the fall for them.

sluggosaurus 5y ago

> All those who stop using ProtonMail after this incident - could you please describe what PM should've done differently? Somebody no longer valuing what ProtonMail provides is not mutually exclusive with thinking ProtonMail could have done differently. I expect many ex-ProtonMail customers realize ProtonMail could not have done differently, but nevertheless no longer value the service ProtonMail provides. How could this be? It's simple: They previously had mistaken beliefs (namely, that ProtonMail could have done differently), and decided to no longer be customers of ProtonMail when the truth became clear to them. If you sell me electricity from your cold fusion power plant, I am going to cancel my subscription as soon as I figure out that cold fusion isn't possible and you were selling me coal power all along. That I now realize it was impossible for you to sell me cold fusion power in the first place doesn't change the fact that I no longer see any value in doing business with your power company.

Berobero 5y ago

I've never used PM, but just ran through sign-up for their free service. What could they do differently with regards to this issue? Simple. Make the legal limitations of their service -- or at least their understanding of them -- explicit, transparent, and above all, utterly conspicuous to anyone looking to use their service.

smsm42 5y ago

> what PM should've done differently For starters, disclose prominently that they could be forced - and have been in the past, and will be in the future - to disclose all the information about the client that comes into their possession, including IP connection information, and they can provide no protection at all from the point the police took interest in you forward.

protonmail 5y ago
We understand where you are coming from, but this information is disclosed in our privacy policy, threat model, and transparency report (updated annually since 2015). All 3 pages are linked from every single page on our website. They are also included in the welcome/onboarding email sent to every single Proton user. At the end of the day, we cannot force people to read, but we do take your comment to heart and will try to be even more explicit.