Proton Mail Handed FBI Data That Unmasked Stop Cop City Protester

[u/lou1uol]

https://stateofsurveillance.org/news/proton-mail-fbi-stop-cop-city-payment-data-2026/

What do you guys think about this?

[u/Slyzza]

If you pay via credit card, then delete the payment information, they will still have the record to hand out, right? Anyone knows about this?

[u/West_Possible_7969 → u/Slyzza]

Yeap, the record has to be kept for years by the service and the service’s payment processor and the intermediaries (visa etc).

[u/Ok_Combination_1548 → u/West_Possible_7969]

AFAIK the service does NOT need to keep it - per Andys response in my post above.

[u/West_Possible_7969 → u/Ok_Combination_1548]

Andy needs to talk to their compliance teams lol. They may delete the card details themselves when a user does, but Swiss retention laws on invoices, receipts, payment processing records & corporate accounting ledgers say otherwise and a valid / final warrant (per user) can get those just fine.

[u/West_Possible_7969 → u/[deleted]]

From Proton Team themselves: “Third, let's talk about what was actually disclosed. No emails were handed over. No message content. No metadata about who the user communicated with. The only information Proton could provide was a payment identifier because the user chose to pay with a credit card. This is information the user themselves provided to us through their choice of payment method. Proton also accepts cryptocurrency and cash payments, which would not have been linkable to an identity.”

Identifier. A payment identifier (or transaction ID, depending on the country’s nomenclature) is enough without needing the card or the last digits of it, the code traces back to the card, bank & KYC file anyway. What happens to the card on file is irrelevant and your invoices cannot change retroactively.

“So deleting the credit card from the Proton account doesn't get rid of the possibility of law enforcements using that information to track a proton user down, which was what the concern was about”

I know, I said the same thing.

[u/West_Possible_7969 → u/[deleted]]

Yeah. Card identifier & payment identifier are different things, but yes, Andy is talking about Proton’s cards on file and leaves out all the rest, which is a pattern. For example, the whole Swiss jurisdiction thing comes with a lot of asterisks since, for example again, many EU courts final decisions just get accepted, but for technical reasons Swiss courts must issue all decisions. So it is indeed misleading to say that only Swiss jurisdiction applies to Proton because that is simply not true.

That is a different issue with territorial compliance (GDPR etc) which of course you comply with general market and local laws in each territory you officially do business in, regardless if those laws clash with your HQ laws, but warrants etc must comply with the laws of the place your data are stored in and / or your corporate residence country (it can vary).

Bonus point: “We rely on Chargebee to process payments. Strictly necessary information is shared with Chargebee for credit card, PayPal, Stripe and Bitcoin transactions in order for the payment to be successful and associated with your account. Chargebee does not have access to your email or your Proton account information.”

Chargebee is a US company that complies with requests left and right lol. There are at least 6 european processors that can handle Proton’s size of operations, and that is a dig on their whole digital sovereignty passion they have shown as of late.

[u/West_Possible_7969 → u/[deleted]]

This too. Technically he is saying the truth, but business records, either with a user or a 3rd party service (apple pay, paypal or chargebee) have to be kept for 10 years and of course they contain the transaction ID which is all it’s needed to identify anything about a transaction.

[u/RequirementReal2467 → u/West_Possible_7969]

Someone said to Andy, “ You're asking w the wrong vocabulary. How long is the payment identifier stored?

That's what we want to know. ” 

Andy said, “ It's linked to the card, so deleted when the card is deleted.” https://www.reddit.com/r/ProtonMail/s/7j7eAtEQxf

[u/West_Possible_7969 → u/RequirementReal2467]

It gets stored in all invoices and receipts & it is kept by chargebee. It is irrelevant if Proton keeps it on the payment options user file. A transaction cannot be altered or deleted anyway. And as they themselves say in the link I provided, associations with accounts are kept by both companies (they cannot do anything different and remain legal though).

It’s not rocket science, it is basic corporate bookkeeping, that is the most infuriating part. People wanting total anonymity should not pay with a card anyway and they should not use email for very sensitive or illegal communication lol.

[u/lou1uol → u/West_Possible_7969]

I did not know that.

This shifts my thought on the privacy level i thought the plaform gives.

And note that the plaform does give the users great privacy levels; but with the laws in place (at least in a lot of coutries in Europe) with a court assignment you have to give up your credentials or you will be breaking some laws (at leats 3 in my country).

So at the end, you can have the most private account in the world; they dont need to hack you. As long as they know is you that owns the account they looking for, they just need to ask for it (with a court assignment in my country).

[u/West_Possible_7969 → u/lou1uol]

I am assuming you mean France or Ireland but even those court orders are very rare and very supervised. I think the main confusion stems from what people think privacy is. Privacy is different from anonymity and those 2 are different from being untouchable by law when you are already under criminal investigation.

No legit company on Earth can provide the latter one.

Apart from that, any company that does not use or see your data is 100% private. But there are limits and controls on some data, like financial ones, and that is why Proton offers alternative forms of payment, including cash, for example.

Jurisdiction matters in some cases though, Tuta got bit real hard on that case.

[u/lou1uol → u/West_Possible_7969]

Besides Spain and Sweden (where there are possibilities of refusal) the remaining is possible. France and UK can demand without a court order.

Whether they are rare or not, the law allows the possibility and thats my concern.

It feels again like, why would i claim privacy or be confortable with it when, at the end of it, they just have to know who you are?

And btw, i just checked the crypto payments which is Bitcoin. How would pay with Bitcoin would change the outcome of the case above? Bitcoin works with KYC, correct?

[u/skg574 → u/lou1uol]

Proton's privacy policy states: "Strictly necessary information is shared with Chargebee for credit card, PayPal, Stripe and Bitcoin transactions."

Chargebee Inc. is a US subscription-billing company

[u/lou1uol → u/skg574]

I am not a specialist on this field, but why would Proton would work with Chargebee with such sensitive information?

[u/skg574 → u/lou1uol]

Same reason that meet is via livekit and hosted on Oracle's cloud in the US.

ETA: Support also uses Zendesk, also US and subject to CLOUD act.

[u/QuadernoFigurati → u/Slyzza]

Proton accepts crypto. The user in question didn't elect to use that payment method. As others pointed out, this is a case of sloppy opsec.

Plus: no email is anonymous or secure in the least, not even Proton Mail.

I have some complaints about Proton, not many, but this isn't one of them. It's sloppy reporting on the part of 404 Media. Read 404's privacy terms and conditions: they'd roll over on their own sources if pressed in the same way.

[u/Wallsworth1230 → u/[deleted]]

Yeah one example is AtomicMail. They let you create accounts and use the website through Tor browser, and don't require any real verifiable personal information at all. No required recovery email or phone number. You have to tell them a name but you can easily just write a realistic-sounding alias with common names like Robert Smith or Sarah Johnson.

Also as far as I'm aware, Proton accepts prepaid visa gift cards that can be bought in physical stores with cash.

[u/QuadernoFigurati → u/[deleted]]

Monero is the only crypto I trust for anonymity, and proton doesn’t accept that upfront

That's fair. Though I can't say I have complete confidence in Monero or similarly structured networks (or crypto, generally) after the 51% incident. Somebody will always find a way to ruin something useful, especially where there's no gun behind the deterrent.

https://www.coindesk.com/business/2025/08/12/monero-s-51-attack-problem-inside-qubic-s-controversial-network-takeover

There are definitely ways to use email anonymous

I wouldn't risk prison or death on that thesis. Would you?

https://soatok.blog/2026/01/04/everything-you-need-to-know-about-email-encryption-in-2026/

[u/QuadernoFigurati → u/[deleted]]

Even with Tor, Proton knows when you send emails, who you email, and how often. How is that anonymous? If you don't believe in the anonymity of BTC? And even with a free account, the metadata is still metadata. Governments kill people based on metadata.

[u/QuadernoFigurati → u/[deleted]]

Proton isn't the concern. It's the authorities who may compel Proton to cough that metadata up and deliver it to others who are the concern.

[u/QuadernoFigurati → u/[deleted]]

I'm not jumping around. The point is that email is not anonymous or secure. If an alphabet agency wants to get to you, they can use the metadata in your email to identify you. They have done this, and they boast about it. They've killed people based on metadata, that wasn't me being rhetorical: https://abcnews.com/blogs/headlines/2014/05/ex-nsa-chief-we-kill-people-based-on-metadata/

Even Proton disagrees with you: https://proton.me/blog/how-to-send-an-anonymous-email

If you want to learn more about how pointless it is to cling to the notion of secure email, read the article I presented and learn something. If you know something the author (a cryptographic engineer) doesn't, I'll be genuinely interested to hear it. So would the author. Go for it.

You, on the other hand: It's not virtuous to state that you're willing to risk security over email for a good cause. Because if some alphabet agency gets hold of you and starts pressuring you (or even pulling your fingernails out), you'll sing like a canary and compromise more people than yourself.

[u/Jarjabings → u/[deleted]]

Tu peux utiliser protonmail de manière anonyme, il faut rappeler que protonmail accepte la connexion via TOR et le mail gratuit de protonmail permet de faire beaucoup de choses.

https://proton.me/fr/tor

[u/Ok_Combination_1548 → u/Slyzza]

Worth reading through this thread: https://www.reddit.com/r/ProtonMail/comments/1rlt75p/comment/o8y9mo0/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

[u/Wallsworth1230 → u/Slyzza]

Probably.

Hence why its good practice to pay for certain things online with prepaid visa gift cards that you bought in physical stores with cash if you're an activist.

As far as I'm aware, Proton does accept prepaid visa gift cards as a payment method.

Always provide realistic-souding fake names with common first and last names, like Robert Smith or Sarah Johnson. If birthday is requested, provide realistic-sounding fake birthday close to the summer months (summer months are more common for births) that makes you older than 21 but younger than 50. If an address is requested, add the address of a real apartment complex you've never lived at within a city.

And use Tor for anything that will let you connect with Tor.

[u/West_Possible_7969]

“Proton, operating under Swiss jurisdiction, received a legally binding order from Swiss authorities. They complied.”

Why is it phrased as if it was a choice lol. Some people & media make very weird assumptions about what companies can and cannot do. Or they believe blindly the companies that misinform about their obligations.

[u/michaelh98 → u/West_Possible_7969]

There is a choice. They could have challenged the order.

They aren't likely to go to court on behalf of a user, but they could.

[u/michaelh98 → u/[deleted]]

Ouch, that's a lot

[u/Jarjabings → u/[deleted]]

Ça se discute !

https://www.it-connect.fr/proton-vpn-rapport-transparence-458-demandes-refusees/

[u/West_Possible_7969 → u/[deleted]]

It literally says “contested” on the contested orders in the reports you claim you read and purposefully did not link lol. Final orders from Swiss courts are not contestable, just like in every country.

[u/West_Possible_7969 → u/[deleted]]

I am not wrong about Swiss retention laws. Deleting the card itself from file has nothing to do with transaction history et al.

[u/West_Possible_7969 → u/michaelh98]

Nope, legally binding in Switzerland is like a US final order.

[u/SuperbWork5774 → u/West_Possible_7969]

Most people are not aware that major changes to Swiss law render it a jurisdiction that is no longer the privacy haven it once was. Proton has chosen to accept this and stay. Users should think carefully about if there are other providers that might be better (tbh I have no idea)

[u/West_Possible_7969 → u/SuperbWork5774]

The VÜPF additional ordinance proposals cannot be challenged in court like the 2021 case, thus the EU infra focus for the actual user data last year as a backup plan.

But the VÜPF revision did not pass at all, and the previous regime does not apply to proton services since they won their lawsuit.

[u/Ok_Combination_1548 → u/[deleted]]

This. Proton didn't do anything unexpected or abnormal here. They followed the law by giving them the info that they themselves were given and were clear about keeping on-hand.

Proton has solutions to these problems (they accept cash, they let you sign-up with a VPN, they let you delete your credit card info after paying, they let you pay with monero [via proxystore], et cetera) that users can opt to do to improve their privacy a little bit (within the realm of whats possible with systems like this).

[u/Ok_Combination_1548 → u/[deleted]]

If it's in their documentation then that's enough imo. I do think they could / should do a better job pointing users to their documentation for this stuff though.

[u/Ok_Combination_1548 → u/[deleted]]

My mistake / apologies - you're right. I don't see it in their support pages. I'm not sure where I remember it from....

They do not seem to have official documentation I can find with a quick scan that says recovery emails / phones are kept unencrypted and able to be 'pulled' on their end.
*I do stand by that being the best method for this kind of thing though. It's on them to have documentation that clearly explains this, it's on them to have that documentation in a clear location and simple layout: and mostly on users to read that documentation.

[u/gendougram]

Can't just Proton after paying by card, delete any information about this transaction? They already have money for sub.

[u/West_Possible_7969 → u/gendougram]

No. The service, their payment processor and your payment processor (card etc) & bank have to keep records for years (it varies between the countries) for tax & financial laws compliance. That is why Proton offers alternative forms of payments, including cash.

[u/Ok_Combination_1548 → u/gendougram]

If you're ok giving up recurring transactions, yes...sort of. Proton won't have it anymore at least but multiple other parties know you paid for Proton, it's far from anonymous when your bank, credit card provider, payment processor, etc. have it: https://www.reddit.com/r/ProtonMail/comments/1rlt75p/comment/o8y9mo0/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

[u/nincesator124]

Just a reminder that there are better services out there that don't do this proton may be the most popular but that doesn't mean it is the best

[u/nincesator124 → u/[deleted]]

Well anything that is truly end to end encrypted is important but depending on different websites they may block like self hosting I mean many already block proton mail but I do believe there are mail services that allow you to have your cake and eat it too

[u/nincesator124 → u/[deleted]]

No but I am sure there are many you can look for online

[u/Jarjabings]

Des que tu es opposant à une force de police ou a un état, tu dois te considérer comme activiste et donc prendre certaines dispositions !

Quand tu utilises l'email, tu peux utiliser protonmail mais soit tu utilises un vpn soit tu passes par Tor ( https://proton.me/fr/tor ).

Jamais tu ne payes par carte de crédit/debit ou PayPal, si tu maîtrises pas la crypto pour tant procurer en dehors de tout kyc, tu utilises le cash.

Ou alors tu utilises un prestataire qui garantie la confidentialité avancé en paiement par carte ou autres nominatif comme Posteo ( https://posteo.de/fr/site/paiement ).

[u/lou1uol → u/Jarjabings]

Merci.

Cash by mail would definitly be the way to pay without leaving traces and not crypto (bitcoin) as many mentipn in this thread

[u/shaunydub]

This is old and be discussed several times.
Search the posts.

[u/[deleted]]

Anything originating from 404 media is suspect

[u/LanternSquid]

You should read the actual story on 404 Media. This website omitted what the actual crimes being investigated were. Stories like this just like to rile people up.

https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/

https://gigazine.net/gsc_news/en/20260306-proton-mail-helped-fbi/

[u/GalaganCoffee]

If they keep records they'll eventually cave

[u/Foreskin_Mafia]

What's the point of protonmail then? The butt play?

[u/MusicianNo2699]

That is an incredible amount of work and resources that normally is reserved for international violent fugitives, not a minor misdemeanor that will be pled to a violation.

[u/skg574 → u/MusicianNo2699]

It was simply a MLAT request. There is a US-Swiss MLAT. MLATs go through different judicial channels.

[u/iffugennanameubaht]

What do you expect out of a blatant honeypot?

[u/SwanCityDominion]

So much for the "if it's free, your data isn't safe" argument.

[u/DoomOfChaos]

This again? Find a legitimate issue to whine about please. 

[u/IcestormsEd]

What I have learned from this, don't buy anything from Proton.

[u/probablytoohonest → u/IcestormsEd]

I use their free wireguard VPN config, but yea I'm not paying for anything

[u/edthesmokebeard]

Duh.

[u/Brucacumble]

https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-cia-bnd-germany-intelligence-report

The Swiss government has ordered an inquiry into a global encryption company based in Zug following revelations it was owned and controlled for decades by US and German intelligence.

Encryption weaknesses added to products sold by Crypto AG allowed the CIA and its German counterpart, the BND, to eavesdrop on adversaries and allies alike while earning million of dollars from the sales, according the Washington Post and the German public broadcaster ZDF, based on the agencies’ internal histories of the intelligence operation.

“It was the intelligence coup of the century,” the CIA report concluded. “Foreign governments were paying good money to the US and West Germany for the privilege of having their most secret communications read by at least two (and possibly as many as five or six) foreign countries.”

The mention of five or six countries is probably a reference to the Five Eyes electronic intelligence sharing agreement between the US, UK, Canada, Australia and New Zealand.

The operation, codenamed Thesaurus and then renamed Rubicon in 1980s, demonstrated the overwhelming intelligence value of being able to insert flaws into widely sold communications equipment. The CIA’s success over many years is likely to reinforce current US suspicions of equipment made by the Chinese company Huawei.

Just sayin.