ProtonMail said Swiss court order left no choice but to log activist’s IP address

ProtonMail, the encrypted email service that’s built a reputation for safeguarding user data, said it had no choice but to provide details about an activist to French authorities, amid mounting questions about the privacy protections in the popular mail client.

Swiss-based ProtonMail is an end-to-end encrypted service that markets itself as a tool that encrypts messages and other user data before the company accesses it. It’s a technique that, for more than 50 million users, aims to provide additional layers of protection than are available with more common email options, such as Gmail.

A French police report published on Sept. 2 appears to show that police used ProtonMail to collect the IP address, a specific number that pertains to an individual computer, of an unnamed French activist who was demonstrating against real estate gentrification in Paris. The case appears to undercut ProtonMail’s assurance that it does not log the IP addresses of unique users.

While the exact circumstances of the case remain murky, ProtonMail founder and CEO Andy Yen said in a series of tweets that the email firm was the subject of a legal order from a Swiss court. ProtonMail does not collect user IP addresses by default, Yen said, but “only if Proton gets a legal order for a specific account,” the company wrote in a Sept. 6 statement.

French police obtained a Swiss court order by transmitting their request through Europol, at which point ProtonMail began logging details on the IP address in question, according to TechCrunch. Authorities reportedly arrested the activist after obtaining more details about the IP address.

“We are also deeply concerned about this case and deplore that the legal tools for serious crimes are being used in this way,” the company said.

“There was no possibility to appeal this particular request,” the statement went on.

The French request did not call on ProtonMail to provide any email message data, which is encrypted in a way that the company maintains it would be unable to provide.

ProtonMail received more than 3,500 orders from Swiss courts in 2020, up from 17 in 2017, according to its transparency report.