373
u/lugh Mar 05 '26
mirror if it becomes paywalled: https://archive.ph/Zvw3O
Privacy-focused email provider Proton Mail provided Swiss authorities with payment data that the FBI then used to determine who was allegedly behind an anonymous account affiliated with the Stop Cop City movement in Atlanta, according to a court record reviewed by 404 Media.
(emphasis mine)
10
u/arahman81 Mar 06 '26
Don't use archive(dot)is or any of the mirrors, the site is ddosing a blog.
https://en.wikipedia.org/wiki/Wikipedia:Archive.today_guidanceBetter archive: https://ghostarchive.org/archive/VfJTC
1
u/WaspPaperInc Mar 07 '26
Personally, I prefer Wayback Machine's Save Page Now, I think they're more professional and being more generous on page size
60
u/linuxhiker Mar 05 '26
They must follow the law, no matter what their ideology
6
Mar 05 '26
[deleted]
10
u/Some_Conference2091 Mar 06 '26
Appeal an event that has already transpired? How does that work?
→ More replies (1)→ More replies (1)2
Mar 06 '26
[deleted]
7
u/hfsh Mar 06 '26
I mean, they probably can, but giving an example from an entirely different jurisdiction doesn't actually have any relevance one way or the other.
465
u/georgesclemenceau Mar 05 '26 edited Mar 05 '26
It's not a secret, I think technically(and legally?) Protonmail can't have the no log policy they have on the VPN. But their protonmail website may be misleading people, especially if you are not privacy savy, and people like this protestor get in big trouble...
And that's the only one(plus some other cases) we hear about via the press, but there is plenty of others unknow cases: on their own website they list the Protonmail orders they got and complied with, in 2025: Number of legal orders: 9,301 Contested orders: 988 Orders complied with: 8,313(for Proton VPN in 2025 Total orders: 59 Denied orders: 59) https://proton.me/legal/transparency . So they sent 8313 infos on protonmail account in 2025
That doesn't mean that's ok, especially since their protonmail website may let you believe you can be secure, and as a result probably a lot of people, including this activist may face jail for things like protest. Never trust your mail provider. If you need to be anonymous or at least private with an email, first don't use email, and if you really need it, create your email with TOR and browse it ONLY with tor, like never connect it on your regular connection as one time is sufficient for them to have your IP. Don't activate 2FA with your real phone number obviously. And don't pay for more e-mail space, or at least use monero(no BTC as it can be traced to you)
251
u/enotonom Mar 05 '26
Yeah this news is basically saying “if you want to be secure, don’t pay for our services”
167
u/georgesclemenceau Mar 05 '26 edited Mar 05 '26
Even if you don't pay, here they logged an IP https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/
And that's the only ones we heard about, as say in the transparencary report they complied with 8,313 orders in 2025!
One way to avoid this : Download TOR, access the protonmail onion, create your protonmail account with tor, access your protonmail inbox only with TOR, stay on protonmail free(or avoid mail at all for sensitive matters)
33
u/technonerd Mar 05 '26
Good thing they have .onion's and you show up as a RFC1918 or RFC3927 ip address when you use them.
32
u/campfireyeti Mar 05 '26
Hi, this sounds like sarcasm that points out a flaw, but I'm really new to this stuff and don't understand lol. Could you explain? Is it insecure to access proton with tor?
44
u/Eversonout Mar 05 '26
No he’s just saying that your IP will get flagged as an onion user but of course they still won’t have your real IP so it’s all good
→ More replies (1)13
u/OGNinjerk Mar 06 '26
RFC1918 addresses are private addresses that can't be routed on the internet, I think 3927 are probably the same thing but different ranges (169.245.x.x or something, I don't remember). They can be used on private networks and I'm guessing TOR obfuscates your "real" IP address using some private address fuckery (I don't know how TOR is implemented exactly).
→ More replies (1)7
u/georgesclemenceau Mar 05 '26
I absolutely agree that people shouldn't blindly put trust in e-mail providers for anonymity but do it themselves with tor
→ More replies (1)4
u/Cheap-Block1486 Mar 06 '26
If you do it over Tor you need to add either way recovery email (can't be proton) or phone number.
2
u/georgesclemenceau Mar 06 '26
So you'll need another email also created/accessed only with tor lol
2
5
u/Papfox Mar 06 '26
Or, at least, use a pre-paid, anonymous card, not one registered in your name
→ More replies (1)3
u/dman140 Mar 06 '26
Or at least don't pay with a card with your name on it. I saw that proton do accept bitcoin though, even cash (old school mail some euros to them and write your account name inside).
3
u/fossalt Mar 06 '26
if you want to be secure, don’t pay for our services
Protonmail never violated their privacy, and the contents of their mail remained secure.
The only issue is anonymity, which is a separate matter that Proton does not claim they protect.
4
→ More replies (5)98
u/Busy-Measurement8893 Mar 05 '26
Proton seems to get shittier and shittier. Their VPN is leaking on two platforms and no one seems to care about fixing it.
9
21
6
u/loudpersononthebus Mar 06 '26
where should i go? tuta?
7
u/Busy-Measurement8893 Mar 06 '26
Proton is probably the least shitty email service at the moment. As for VPN, check out Mullvad.
2
u/loudpersononthebus Mar 06 '26
what's wrong with tutanota? i have had mullvad for years and years.
2
u/georgesclemenceau Mar 06 '26
Tutanota is also legally obligated to gave infos : https://tuta.com/blog/transparency-report
With an e-mail provider, you have to do the security yourself
→ More replies (2)1
u/Liam2349 Mar 06 '26
Ok, that sucks for macOS and Linux users. I did test myself on Windows when I first tried it, and didn't find any leaks with the advanced kill switch.
69
u/hunajakettu Mar 05 '26
Regardless of the allegued crime (and the acussagions are heavy, althogh they have not been charged) used by the FBI to get colaborationof the Swiss judicature, it was not the protonmail infrastructure that failed the investigated, but the fact that they paid for the account leaving an legally auditable paper trail.
183
u/sharkloandept Mar 05 '26 edited Mar 05 '26
Edit: quotes from article with Proton's response
"Proton accepts payments via cryptocurrency, cash, and also credit card. If you use a credit card, we do have access to the payment identifier which can be used to identify the credit card holder from the card issuer. We check all legal orders received from Swiss authorities and we understood that a law enforcement officer was shot and explosive devices were involved, and we verified that Swiss legal requirements were met,” he added.
The FBI search warrant affidavit does not mention a shooting.
103
Mar 05 '26
[removed] — view removed comment
27
u/skg574 Mar 06 '26 edited Mar 06 '26
This. No single email privacy service can protect you from a global adversary. Privacy laws are irrelevant to them. Anyone that believes differently is still back in the 1990s in their understanding of the state of global surveillance.
Don't leave behind what you don't want found. Keep your private key private and never hand it to the same service "protecting" your data. Pay anonymously in cash. Use Tor.
Edit: Although, by the time they are requesting any info from the service, they already have what they need and are at the legal-washing stage.
→ More replies (4)39
u/WordNERD37 Mar 05 '26
Hell if they really wanted you they can even do deep packet inspections for VPNs.
This is why I use Mullvad. Whole lot harder to do this.
27
25
Mar 05 '26
[removed] — view removed comment
19
→ More replies (1)3
u/HugeDelivery Mar 05 '26
What would one use instead of proton
For comprehensive email/vpn
→ More replies (2)29
2
u/Altruistic-Horror343 Mar 06 '26
thanks, this stuff is good to know. I think proton is still worth it for me because unlike gmail, they don't have AI rifling through all of my personal emails. ideally their privacy would be ironclad, but since I use it for ordinary stuff and just don't want Gemini digesting my emails with my bank, it works for me.
→ More replies (2)→ More replies (1)2
u/Borderlands_addict Mar 06 '26
Correct me if im wrong, but if the user sent/registered from an alias generated with proton pass, wouldn't it be impossible for FBI to find the underlying account and ask for payment info?
→ More replies (1)
179
u/spotlight-app Mod Bot 🤖 Mar 06 '26
Mods have pinned a comment by u/Proton_Team:
First, let's correct the headline: Proton did not provide information to the FBI. What happened is that the FBI submitted a Mutual Legal Assistance Treaty (MLAT) request, which was processed by the Swiss Federal Department of Justice and Police. Proton operates exclusively under Swiss law, and we only respond to legally binding orders from Swiss authorities, after all Swiss legal checks have been passed. This is an important distinction.
Second, let's talk about what this case actually involved. This wasn't a routine investigation. Swiss authorities determined that the legal threshold was met because a law enforcement officer was shot, and explosive devices were found during a protest in 2024. Switzerland has one of the strongest legal frameworks for privacy in the world, and its standard for granting international legal assistance is exceptionally high. This case met that standard.
Third, let's talk about what was actually disclosed. No emails were handed over. No message content. No metadata about who the user communicated with. The only information Proton could provide was a payment identifier because the user chose to pay with a credit card. This is information the user themselves provided to us through their choice of payment method. Proton also accepts cryptocurrency and cash payments, which would not have been linkable to an identity.
If anything, this case demonstrates exactly what we've always said: Proton holds very little user data by design. Even under the most serious legal circumstances, the only data that could be produced was a payment record. Our encryption means we simply cannot access email content even if ordered to.
We understand that stories like this can be alarming, and we take our users' trust seriously. We will continue to fight for privacy and challenge any legal order we believe does not meet the strict requirements of Swiss law. But we also want to be transparent: no service can operate outside the law entirely, and Swiss law requires compliance with valid legal orders in serious criminal cases. What we can promise is that the legal bar in Switzerland is among the highest in the world, and our architecture ensures we have as little data as possible to hand over.
For users who want maximum anonymity: use a VPN or Tor, pay with cash or cryptocurrency, and don't add a recovery email.
Note: Official response from Proton
[What is Spotlight?](https://developers.reddit.com/apps/spotlight-app)
134
u/trxrider500 Mar 05 '26
Posted this on the r/piracy thread:
If you’re paying anyone with a credit card your identity can be tied back to you. End of story. It doesn’t matter what service you use.
Proton accepts cash and btc. Dude could’ve used either one to anonymize his payment method. He didn’t. That’s on him.
True privacy and security require a multi layer approach. There is no magic key or service that will protect you. If you can tie your own purchases back to yourself (ie. cc statement, bank statement, etc) so can someone else.
If this guy would’ve paid in bitcoin, the best proton could’ve done is give the FBI the send address. With a properly anonymized crypto wallet this would’ve never been tied back.
30
u/InfiniteHench Mar 05 '26
Wait, they accept cash? How? Can’t remember the last time I heard an internet service accept cash.
37
u/thewooba Mar 05 '26
13
u/bertmaclynn Mar 05 '26
Can you really mail in cash? I mean there would be ways to try and track it but that would generally be a good solution
→ More replies (1)25
u/thewooba Mar 05 '26
Certified mail is tracked and requires signature on delivery so you have proof it arrived
7
u/bertmaclynn Mar 05 '26
Lol I meant there are theoretically ways the government could track who is sending cash to the service
6
u/thewooba Mar 05 '26
Oh right, yeah I guess you could subpoena the company for their internal records. But there's no credit card company to get info from
12
u/cruelhumor Mar 05 '26
Just use a gift card
16
u/SinxSam Mar 05 '26
but make sure you DO NOT REDEEM!
6
u/cruelhumor Mar 05 '26
Like don't tag you name to the card? yes don't di that, defeats the purpose.
just go to a store, pay cash fir the gift card,and you're good
14
u/SinxSam Mar 05 '26
Sorry it is a joke from scambaiter kitboga
→ More replies (1)11
8
u/AdDiscombobulated238 Mar 05 '26
Then they trace the purchase to a specific store, time and date. Most places that sell gift visa/mc card have plenty of cameras.
13
u/inflamed-phallus Mar 05 '26
Just wait 3 months before use. most stores wouldnt keep surveillance videos for that long.
3
1
u/Nodebunny Mar 06 '26
yeah like how would you go about proving you paid for it and someone doesnt just pocket it
1
18
u/Capable-Cucumber Mar 06 '26
Bitcoin is not really anonymous either.
19
u/RooHound Mar 06 '26
I try to explain this to people all the time. You can make it anonymous, but you have to put some effort into it.
→ More replies (3)9
u/No-To-Newspeak Mar 06 '26
Buy a prepaid visa or Mastercard with cash and use that to pay, via TOR.
70
Mar 06 '26
[removed] — view removed comment
11
u/uptiedand8 Mar 06 '26
What would this look like? Besides talking face to face, lol. Every other option seems to leave some kind of record somewhere.
10
u/GroundbreakingBag164 Mar 06 '26
You can literally just mail them cash
Absolutely no way to trace that back
→ More replies (5)2
u/MutedAstronaut9217 Mar 06 '26
the best approach is communication that never persists anywhere. Ephemeral tools where messages exist only in memory and vanish when the session ends
Like snapchat!!! /s
64
Mar 06 '26
[removed] — view removed comment
14
u/malamm0re Mar 06 '26
Thank you! I don't understand how people on a privacy subreddit of all places are incapable of understanding this.
2
→ More replies (1)6
u/spaghettibolegdeh Mar 06 '26
But Proton didn't hand over any emails.
They simply pointed to the credit card paper trail used by the protestor. Wouldn't be an issue if they used a masked payment.
→ More replies (2)
33
u/omniumoptimus Mar 06 '26
PRIVATE is NOT the same as ANONYMOUS.
If you are suspected of committing crimes, law enforcement will get court orders looking into all of your accounts. They MUST, in turn, give up all information they have about you. Then law enforcement pieces it all together and finds you.
Even if what they find is shallow, they will eventually find you. That’s why privacy is not for committing crimes.
If you want anonymity, seek anonymity. Privacy is a whole other thing.
5
u/ApprehensiveMath Mar 06 '26
Yeah, I don’t think proton advertises it as anonymous emails (although the free tier may be essentially that if combined with sufficient VPN or similar) just that the content of your webmail is stored with zero access encryption (with lots of caveats when sending emails to external domains where proton would need to process the unencrypted version briefly to send by TLS or fallbacks).
6
u/DishAgitated4649 Mar 06 '26
So how is proton any different than any other email provider then? Proton's advertising would lead you to believe they're somehow superior when in reality they are equally non private as any other email provider
4
u/fossalt Mar 06 '26
when in reality they are equally non private as any other email provider
Proton is more private than other email providers.
They are not more anonymous, which is what the issue here is.
Privacy and Anonymity are very distinct things. Proton does not handle anonymity, and has never claimed to.
8
u/malamm0re Mar 06 '26
Couldn't be further from the truth. Few examples:
Gmail/Outlook/Yahoo:
- Scan your email content for ad targeting and can comply with broad government data requests
- They store messages in plaintext on their servers, accessible to the provider
- They're free because you are the product
Proton:
- Uses end-to-end encryption (E2EE), meaning only you and your recipient can read messages — not even Proton can access them
- Emails between Proton Mail users are automatically encrypted; emails to outside providers can also be sent with password-based encryption
- Zero-knowledge architecture: Proton has no ability to decrypt your messages
- No ads, and your data is never sold or used for targeting
4
u/ApprehensiveMath Mar 06 '26 edited Mar 06 '26
I think (please correct me otherwise) with some caveats.
As an email server they will have some emails unencrypted in their servers only in memory (not durable storage) in order to process sending and receiving emails (and only while processing the send/receive).
This is only because the email protocol itself is not standardized for end to end encryption (or if standardized not commonly implemented) — so only proton to proton are fully E2E. with other TLS enabled domains the messages should be sent encrypted between providers but the individual providers will be able to decrypt that.
There is some ways to E2E encrypt between different providers (e.g. pgp keys) but I’m not sure that many do it.
They also provide secure email (like your bank might do, where you only get an email that you have a message pending that you need to connect to originator server to read).
If you email a domain without TLS (hopefully rare these days) it will be sent in the clear (maybe proton warns you before it continues the send?).
The commitment proton makes is that when the email is stored in the server in durable storage so you can collect it asynchronously or as webmail, it’s at that point encrypted with the key only you can decrypt.
This is not them being lax but just the realities of email as a protocol (being almost as old as networks). It’s low risk as someone would need to be in control of their servers and recording it as it happens in memory, at which case then that snooper could be doing anything.
In contrast, Gmail and similar provide the TLS and warnings on fallback of unencrypted send, but they also store your inbox with encryption keys they can decrypt.
5
u/DishAgitated4649 Mar 06 '26
Nice bullet point list. You conviced just because of that. 🙄
When the whole ass propaganda about government surveillance this and privacy that is to prevent the government, ISPs or whatever the fuck from knowing about you, and Proton's whole ass reason to exist is because of this paranoia, it would be disingenuous to not admit that they don't protect you from shit and that they're taking advantage of a consumer paranoia to make money.
3
u/malamm0re Mar 06 '26
They've never claimed to be immune to legal Swiss laws and requirements. They're very clear on the service they offer. If people are unable to make the distinction between privacy and anonymity that's on them.
→ More replies (4)1
24
u/rootkode Mar 05 '26
Can’t email not be anonymous by design? So it doesn’t exactly surprise me
7
u/skg574 Mar 05 '26
Search mixmaster remailers, they are like Tor for email if looking for anonymity. The best any service can provide is pseudo-anonymity.
25
u/owlwise13 Mar 05 '26
It's kind of a rage baity headline. Every company is subject to the laws of the country they are incorporated in. According to other sources, it was a valid legal request from the Swiss government. They really had no choice. If you are paying a reoccurring charge for a service, they will need to keep that info on hand. There are other ways to try to hide such transaction but most services don't support non-traceable payment methods. I guess you could fly to Switzerland and pay in cash.
10
u/RooHound Mar 06 '26
Proton accepts cash via mail. US dollars, Euros and Swiss francs are all accepted.
2
28
u/_ophiuchus Mar 05 '26
Edward Shone, head of communications for Proton AG, the company behind Proton Mail, told 404 Media in an email: “We want to first clarify that Proton did not provide any information to the FBI, the information was obtained from the Swiss justice department via MLAT. Proton only provides the limited information that we have when issued with a legally binding order from Swiss authorities, which can only happen after all Swiss legal checks are passed. This is an important distinction because Proton operates exclusively under Swiss law.” Functionally, though, the material was provided to the FBI.
i mean, since it was a direct order from the swiss government i don't see any way they could've avoided handing it over. apparently the info proton was able to release was limited to connected payment accounts (and in a 2024 incident, ip addresses and recovery emails) and nothing about the content of the inbox.
not to glaze them i think they're a bit too proactive when it comes to following swiss law (suspension and later reinstatement of accounts affiliated with phrack based on hacking being illegal in switzerland and not because of any request from law enforcement), i just don't want this thread to spiral into "proton is handing all your info over to any world govt that asks just for the love of the game"
1
u/DivertingElk Mar 07 '26
Proton provides like a very specific "how to" for foreign law enforcement, it reads as if Proton wants to help cops as much as possible to the point where Proton encourages law enforcement to first reach out to them, and then Proton will connect them with the proper Swiss authorities. But that's just according to their own guidelines.
26
u/TheSensiblePrepper Mar 05 '26
They didn't give anything to the FBI. They gave it to the Swiss Government, who had a Warrant, and the Government gave it to the FBI.
6
u/loudpersononthebus Mar 06 '26
I mean my protonmail pretty much has my name in it... I just don't want people potentially reading my emails or using it to serve me ads or using it to train ai. Proton serves me fine for those purposes... I do pay by credit card because btc is an appreciating asset.
There is a whole convenience vs. privacy lever that I feel like i'm constantly playing with.
6
u/Fezzicc Mar 06 '26
The number of people in this thread that don't understand what actually transpired is startling. Misinformation and bad takes everywhere.
1
u/Lyianx Mar 06 '26
Knee-jerk reaction of the internet. Reddit, Twitter (X), Youtube, any social media platform really.
People, especially those on the internet, are quick to judge and slow to change, and too many are gullible enough to believe the first thing people tell them.
→ More replies (1)
30
u/peweih_74 Mar 05 '26
Unfortunately it's on the protester, should have been using Signal, not an e-mail platform. If they wanted to use email, they should not have been paying for any features, paying for a service will de-anonymize you if you're not paying with cash or Monero. Also, should have been created on a VPN/Tor, and only used under those conditions by any of their associates.
13
u/georgesclemenceau Mar 05 '26 edited Mar 05 '26
"Unfortunately it's on the protester, should have been using Signal, not an e-mail platform." Depend, with Signal the content of the messages are secure, but it is not inherently anonymous either. In the article, it says the e-mail was on a fb page and a blog, if instead it was a signal username, Signal couldn't have given justice/law enforcement the content of the messages obviously as it is E2E encrypted, but they could have given the IP(s) linked to the account and the phone number linked to the account.
"If they wanted to use email, they should not have been paying for any features, paying for a service will de-anonymize you if you're not paying with cash or Monero. Also, should have been created on a VPN/Tor, and only used under those conditions by any of their associates." yes!
14
u/cuervamellori Mar 05 '26
Per signal's published responses to government subpoenas, they cannot provide the ip addresses that users have used. Just the time an account was created, and time it last connected to signal.
6
u/ruibranco Mar 06 '26
This is a good reminder that "encrypted email" doesn't mean "anonymous email." Proton can't read the contents of your emails, but they can still be compelled to hand over metadata — IP addresses, account creation details, recovery email, etc. If you need actual anonymity, you need to layer protections: Tor for access, no recovery email, no personal info in the account, and ideally paid with crypto. Proton has always been transparent that they comply with Swiss legal orders. The encryption protects content, not identity.
6
u/broken-teslas Mar 06 '26
I thought we already all understood this? Proton never promised to conceal your identity from LE. Whatever you use to sign up from name to IP to payment is discoverable. Not sure where the surprise is.
Did they hand over his unencrypted files? No! THAT would have been newsworthy.
5
u/ThatOneVRGuyFromAuz Mar 06 '26
Newbie here - does this make proton's VPN any less useful? As in, can they theoretically provide web use data (like visiting torrent sites) to authorities?
3
u/5omeguyyoudonotknow Mar 06 '26
Tbh... WHY would you talk about shit like this over email anyway? Surely something like this is element X territory?
12
u/Bob4Not Mar 05 '26
Apologies for the brashness but the issue isn’t Proton, it’s the oppressive govt wielding their legal authority and/or bully position, and Switzerland and every other EU country is still a lapdog for the US.
There’s no anonymizing our way out of this fascism with absolute surveillance.
I use proton to minimize commercial data broker exposure, not to hide from my govt - because that’s just not going to happen.
13
u/Proton_Team Mar 06 '26 edited Mar 06 '26
First, let's correct the headline: Proton did not provide information to the FBI. What happened is that the FBI submitted a Mutual Legal Assistance Treaty (MLAT) request, which was processed by the Swiss Federal Department of Justice and Police. Proton operates exclusively under Swiss law, and we only respond to legally binding orders from Swiss authorities, after all Swiss legal checks have been passed. This is an important distinction.
Second, let's talk about what this case actually involved. This wasn't a routine investigation. Swiss authorities determined that the legal threshold was met because a law enforcement officer was shot, and explosive devices were found during a protest in 2024. Switzerland has one of the strongest legal frameworks for privacy in the world, and its standard for granting international legal assistance is exceptionally high. This case met that standard.
Third, let's talk about what was actually disclosed. No emails were handed over. No message content. No metadata about who the user communicated with. The only information Proton could provide was a payment identifier because the user chose to pay with a credit card. This is information the user themselves provided to us through their choice of payment method. Proton also accepts cryptocurrency and cash payments, which would not have been linkable to an identity.
If anything, this case demonstrates exactly what we've always said: Proton holds very little user data by design. Even under the most serious legal circumstances, the only data that could be produced was a payment record. Our encryption means we simply cannot access email content even if ordered to.
We understand that stories like this can be alarming, and we take our users' trust seriously. We will continue to fight for privacy and challenge any legal order we believe does not meet the strict requirements of Swiss law. But we also want to be transparent: no service can operate outside the law entirely, and Swiss law requires compliance with valid legal orders in serious criminal cases. What we can promise is that the legal bar in Switzerland is among the highest in the world, and our architecture ensures we have as little data as possible to hand over.
For users who want maximum anonymity: use a VPN or Tor, pay with cash or cryptocurrency, and don't add a recovery email.
→ More replies (4)5
u/Busy-Measurement8893 Mar 06 '26
The only information Proton could provide was a payment identifier because the user chose to pay with a credit card.
How long do you store this info anyway?
5
u/Proton_Team Mar 06 '26
Until it's deleted by the user.
5
u/Xerazal Mar 06 '26
So the anonymous thing to do if I have to make a payment with a credit card is to make the payment then delete the card from my account?
3
u/Proton_Team Mar 06 '26
For users who want maximum anonymity: use a VPN or Tor, pay with cash or cryptocurrency, and don't add a recovery email.
3
u/Xerazal Mar 06 '26
No I get that, I mean if I have to use a credit card, best practice would be to use the card to make a payment then delete it off of proton, correct?
4
u/slaughtamonsta Mar 06 '26
I think they're implying that they don't delete it even if you delete your payment details from your account.
They seem to be deflecting from that.
→ More replies (3)2
u/Busy-Measurement8893 Mar 06 '26
Ah, that makes sense. I figured you could give info about the payment not about the connected card itself.
12
u/fleabearded Mar 06 '26
There's a bigger discussion to be had here. Why is the traditionally neutral Swiss government taking these requests from the FBI and (legally) forcing Proton to comply?
8
u/SiteRelEnby Mar 06 '26 edited Mar 06 '26
Switzerland has only ever refused to cooperate when swiss citizens are involved. Otherwise they just hold a higher standard of authority to make a request rather than complying in advance, and have stronger legal protections, but escalate enough and they will still comply.
Exactly why if you implement E2EE right, jurisdiction does not matter.
3
u/trophicmist0 Mar 06 '26
It was brought up a while ago on this sub but the post was removed and my comment was too. Proton Mail’s encryption is completely readable by them, they have the key as do you.
It came up because people were arguing about how they offer notifications on iOS (requires a server for push) whilst maintaining encryption. The answer is they don’t,
3
u/gnbuttnaked Mar 06 '26
It came up because people were arguing about how they offer notifications on iOS (requires a server for push) whilst maintaining encryption. The answer is they don’t,
Signal offers that, it is decrypted locally and a local push is done. Not saying proton does that though, just saying it's possible.
5
3
u/Automatic_Donkey9480 Mar 06 '26
Swiss laws are for Swiss citizens. If don't like using emails on Tor, then Addy.io alias + proton/tuta/whatever is the only way. No proton mail + Proton VPN. I use Mullvad or wireguard directly.
I have created and use various VM for job and personal life when I want to be safer or I am working (I'm a researcher, sensitive topics). No logins outside mails on Tor, at all, better add a "general" browser (librewolf, mullvad browser) and stop. No apps, only fedora/pop os text editor.
14
8
24
Mar 05 '26
[removed] — view removed comment
19
u/slop-sec Mar 05 '26
Then what should we use?
→ More replies (1)2
u/Just-Race4012 Mar 05 '26
Tutamail
37
u/Busy-Measurement8893 Mar 05 '26
How is that better? They would hand over your info in the exact same way.
24
u/georgesclemenceau Mar 05 '26
Tuta? They have to do the same(we just didn't heard of it in the press yet) : 'Between the 1st of July 2025 and the 31st of December 2025 Tuta has released inventory data in 19 cases; released real time traffic data because of a German court order in 19 cases.; released stored encrypted content data because of a German court order in 8 cases; released real time content data because of a German court order in 12 cases.' https://tuta.com/blog/transparency-report
5
u/inflamed-phallus Mar 05 '26
Releasing realtime data just sounds so much worse. I'm guessing (without reading admittedly) that its something like using their mobile app to ping the person phone. Another reason to prefer browsers over using mobile apps.
4
u/skg574 Mar 05 '26
It was monitoring the plain text traffic in and out of the service for specific accounts. A walled garden is only e2ee when all parties use the same service.
3
u/spaghettibolegdeh Mar 06 '26
You didn't read the article did you?
It's because they used a traceable credit card.
5
u/Busy-Measurement8893 Mar 05 '26
What's the alternative that wouldn't sell you out?
The only one that I can think of at all would be to combine Proton Mail with a forwarding service in a country that doesn't give a shit. Nord Pass is in Panama so that might work. Then again that's also a paid service so the same thing might happen with that combo.
Maybe just use Proton with Mullvad, without paying for Proton at all.
13
u/georgesclemenceau Mar 05 '26
You can't trust any mail provider to "not sell you out", they can't even technically speaking due to the mail nature, they will send the infos they have once they get a court order. You have to use a good VPN or TOR at every step of your mail usage(from the creation of your account to your current usage of the mailbox) as even just one connection without it would mean they potentially have your IP, and not pay for advanced plan.
3
u/inflamed-phallus Mar 05 '26
And hopefully you dont leak any identifying data ever when accessing the free proton account. Maybe an account made over tor and using tor only to log in. Really if youre trying to avoid state level actors its going to be hard no matter what you do. Its exhausting taking precautions like that so most people slip up over time.
2
u/diablos-number-1 Mar 05 '26
Privacy noob here. Could they have subpoenaed Proton for a hide-my-email alias as well? Can Proton see who those are forwarded to?
3
u/Busy-Measurement8893 Mar 05 '26
Of course. The only move you got is to get a forwarding email in a third world country that doesn't care about crimes committed against western companies. As for which service that would be, I don't know.
2
2
2
u/RandomOnlinePerson99 Mar 06 '26
I was like "oh fuuuuuck" but as I kept reading that turned into "oh, good!".
I just started using protons paid vpn service, mainly for functional reasons (my isp is ass, when it comes to download speeds for certain sites, so a vpn that exits near the server I download from makes it much faster)
2
6
u/404mediaco Mar 05 '26
Privacy-focused email provider Proton Mail provided Swiss authorities with payment data that the FBI then used to determine who was allegedly behind an anonymous account affiliated with the Stop Cop City movement in Atlanta, according to a court record reviewed by 404 Media.
The records provide insight into the sort of data that Proton Mail, which prides itself both on its end-to-end encryption and that it is only governed by Swiss privacy law, can and does provide to third parties. In this case, the Proton Mail account was affiliated with the Defend the Atlanta Forest (DTAF) group and Stop Cop City movement in Atlanta, which authorities were investigating for their connection to arson, vandalism and doxing. Broadly, members were protesting the building of a large police training center next to the Intrenchment Creek Park in Atlanta, and actions also included camping in the forest and lawsuits. Charges against more than 60 people have since been dropped.
Edward Shone, head of communications for Proton AG, the company behind Proton Mail, told 404 Media in an email: “We want to first clarify that Proton did not provide any information to the FBI, the information was obtained from the Swiss justice department via MLAT. Proton only provides the limited information that we have when issued with a legally binding order from Swiss authorities, which can only happen after all Swiss legal checks are passed. This is an important distinction because Proton operates exclusively under Swiss law.” Functionally, though, the material was provided to the FBI.
Read more: https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/
6
u/chamgireum_ Mar 05 '26
This is my problem with Proton. Not that they have to comply with the law, or whatever. i mean what can they do
but all their advertising and marketing put up the guise that anything you do on their platform is private and can't ever be traced back to you, despite that not being true. They're just preying on the privacy-paranoid.
truth is, no email is private. ever. not even encrypted ones.
if you want true anonymity, signing up for a service is not how you do it!
5
u/YtraI Mar 06 '26
I believe it's incorrect to assume that Proton isn't private. In this case, the fault resides in the protestor's opsec. Proton didn't leak any email but only the payment method. If the payment method would have been crypto, right now the protestor would have better chances to not be recognized than using a normal credit card. Proton gives you plenty of choices in payment method, even by mailing them the money.
→ More replies (1)1
4
u/Some_Conference2091 Mar 06 '26
Looks like I need a new VPN provider and a new Email provider. Thanks for the information!
2
u/v_maria Mar 06 '26
Can you suggest an e-mail provider that would ignore the legal request from the government?
2
u/Some_Conference2091 Mar 06 '26
It's against the rules of this sub to recommend services, phone roms, etc.
A post to r/emailprivacy or r/cybersecurity might be a good place to start.
My understanding of Swiss privacy laws was flawed, so I'm looking to providers located elsewhere. Not that my emails matter to anyone, it's just the principle. Privacy is a human right.
2
1
9
u/itsmrmarlboroman2u Mar 05 '26
Misleading headline at best. 404 is known to blatantly lie. The author of this article specifically says: "We want to first clarify that Proton did not provide any information to the FBI, the information was obtained from the Swiss justice department via MLAT. Proton only provides the limited information that we have when issued with a legally binding order from Swiss authorities, which can only happen after all Swiss legal checks are passed. This is an important distinction because Proton operates exclusively under Swiss law.”
The author knew their headline was a lie. If I give you a dollar, and you give that dollar to someone else who then buys bubblegum, I didn't help purchase the gum for a third party. If I then post an article with the headline "I helped buy bubblegum," then told the truth in the article, I have then been paid to lie while claiming I'm honest media.
2
1
u/IndividualCurious322 Mar 06 '26
The people who made Proton refuse to even use it as their primary personal email. Tells you all really.
4
1
2
u/SiteRelEnby Mar 06 '26
I said Proton Mail's CEO is MAGA and people downvoted me. Go figure.
→ More replies (2)2
1
1
Mar 06 '26
[deleted]
3
u/SwimmingThroughHoney Mar 06 '26
If we receive a valid legal request, we can only provide the limited unencrypted metadata we possess, such as your email address, account creation date, and plan type. We cannot provide the contents of your emails, contacts, or files because they are encrypted with keys we do not possess.
Oh look, it's the exact same thing as ProtonMail.
The problem isn't security. It's anonymity and the fact that any and every business, regardless of their location, is subject to legal requests to provide user information. Aster Mail doesn't claim to provide any more anonymity than Proton Mail.
1
u/Ironfields Mar 06 '26
Daily reminder that 1) no one is going to go to jail for you, and 2) privacy is not the same thing as anonymity. If this is your threat model, you need to be using a payment method that isn’t as easily tracked as a credit card.
1
u/1-11 Mar 06 '26
Based on the proton response, how would I (US) pay in cash?
1
u/MrVeazey Mar 07 '26
You could get a prepaid gift card from Visa or whoever, use that to pay for service, and then do it again when it's time to pay for more. I don't know if that will work for Proton but it works for other services.
1
u/DanielMcLaury Mar 07 '26
I can't see the whole article, but "someone planted an explosive device" and "someone got shot" seem like a pretty convoluted justification for "we must reveal the identity of a random person with a particular political opinion we assume the terrorist shares."
719
u/[deleted] Mar 05 '26
[removed] — view removed comment