A court record reviewed by 404 Media shows privacy-focused email provider Proton Mail handed over payment data related to a Stop Cop City email account to the Swiss government, which handed it to the FBI.

I saw this over on reddit and people complaining that they “betrayed” their user base. It’s amazing how many people think just because they’re privacy based that means they won’t respond to a lawful court order.

  • Chloé 🥕@lemmy.blahaj.zoneEnglish
    17·
    3 hours ago

    i don’t see this as “proton being the bad guy”, or them “betraying their userbase”, i see this as proton being fundamentally unable to offer the kinds of service they claim to offer

    they’re a lot better than google or microsoft, for sure, but still not fully private. if you have any important privacy requirements, don’t rely on big commercial services. this goes to others like tutanota, too (in fact there’s credible evidence that tuta is a honeypot lol)

    • Broken@lemmy.mlEnglish
      6·
      1 hour ago

      I agree with your first sentiment, proton’s not the bad guy here.

      I disagree with your second sentiment, that they are unable to services they claim to.

      They never claim to make you anonymous. They claim to offer privacy focused services, helping you stay private and not selling your information for profit like big tech does. Privacy is not anonymity.

      If you want to be a ghost you need to take far stricter measures than buying a proton account.

  • ryannathans@aussie.zoneEnglish
    33·
    4 hours ago

    You are never anonymous if you use payment information that literally has your name attached to it

  • StinkyFingerItchyBum@lemmy.caEnglish
    81·
    7 hours ago

    The term “lawful” and “court” is meaningless in this context.

    Edit: It’s like saying “Mafia Don’s Capo decided…”

  • Assassassin@lemmy.dbzer0.comEnglish
    62·
    7 hours ago

    I don’t really see how proton is the bad guy here. If they gave VPN logs, sure, they claim to not keep those. They make no claims that their email service is completely anonymous, though. If you’re going to do something that riles up the feds, use a disposable email or pay for email using a method that isn’t easily traceable. If this person had done that, proton wouldn’t have had any info to respond to the subpoena with.

    • lambalicious@lemmy.sdf.orgEnglish
      1·
      1 hour ago

      Proton is in the bad, or at least in the wrong, for keeping PII about a client to identify via payment option (and did extra wrong by not securing it enough). Honestly, this could all have been avoided if Proton offered a one-time payment service, like SDF does, so that once the payment is received the connecting information can be deleted or expired (or even better: never collected). But a rent-seeking grift model such as subscriptions likely precludes this capability.

    • ItWasntMe@discuss.onlineOPEnglish
      42·
      7 hours ago

      Honestly it’s my take. I have proton. I know i’m paying with a credit card so if they were served a warrant for my information, they’d get it. BUT they wouldn’t get anything from my email because 1) It’s encrypted and 2) it’s encrypted with my own key and not the one generated by Proton when you create an account. I casually wonder if someone didn’t fully understand the nuance of things like this in the modern surveilance state.

      • Atherel@lemmy.dbzer0.comEnglish
        14·
        4 hours ago
        1. It’s encrypted and 2) it’s encrypted with my own key

        None of this is of any use if the mailbox of the sender or recipient of the email is not also encrypted.

        • hraegsvelmir@ani.socialEnglish
          2·
          3 hours ago

          If nothing else, you don’t hand over more information to help them develop leads, and it makes more work for them having to subpoena the providers for suspected contacts and hope they get the emails they want from them. Depending on what it is they want to get you for and how many contacts you had that they would need to follow up on, that could be enough to make it no longer cost-effective to pursue.

      • KoboldCoterie@pawb.socialEnglish
        43·
        6 hours ago

        Unless I’m misreading the article, that’s not at all what happened here and even with encrypted emails, you’d still have been caught. They knew the email address that allegedly belonged to the instigator; they just needed to connect that email address to an actual person, not to see the contents of their emails. The payment data made that connection.

      • Assassassin@lemmy.dbzer0.comEnglish
        12·
        6 hours ago

        Yeah, I’m also using proton and knew about this type of situation happening before. If I was going to do something illegal/disruptive enough to attract the attention of police, I simply would not attach my personal email to it. I just don’t see why anyone would think that the police won’t have a way of tracing a service that you paid for with banking details in your name back to you. It’s just shitty opsec.

        • Snot Flickerman@lemmy.blahaj.zoneEnglish
          21·
          6 hours ago

          If I was going to do something illegal/disruptive enough to attract the attention of police, I simply would not attach my personal email to it.

          Fair, but let’s be real, protesting the Copy City in Atlanta shouldn’t be something that captures police attention since it’s well within free speech rights. Literally, as it says in the article:

          404 Media is not publishing the person’s name because they don’t appear to have been charged with a crime, according to searches of court databases.

          This is merely an intimidation campaign against people who have valid concerns with the Cop City being built outside of Atlanta.

          Broadly, members were protesting the building of a large police training center next to the Intrenchment Creek Park in Atlanta, and actions also included camping in the forest and lawsuits. Charges against more than 60 people have since been dropped.

          The blog in question documents protest events that have happened, including ones that are law breaking. There is no proof that the person who runs the blog has any direct involvement with the events they cover, despite their political stripe supporting the same goal of dropping the contract to stop the funding and building of Cop City in the forest outside of Atlanta. Calling people to action to protest is not the same as calling them to commit crimes in protest.

          Because while I agree with you, we need to be clear here. Legal protest and coverage of protest (including coverage of crimes done by individuals at a protest) are not crimes nor should those acts alone be enough to get the FBI on your ass.

          • Assassassin@lemmy.dbzer0.comEnglish
            4·
            6 hours ago

            Oh 100%. We live in a nightmare dystopian hellscape where rights are made up and the laws don’t matter. All the better reason to not publicly oppose the freaks in power in an easily traceable way.

  • myrmidexAEnglish
    20·
    6 hours ago

    Given the CEO’s tweets, this does not surprise me.