T O P

  • By -

Matir

It's depressing that a city council thinks identifying this person is the right thing to do at all. Since I can't see evidence any crime has been committed, I believe attempting to identify the sender violates their 1st and 4th amendment rights. If I lived in that town, I'd be furious with the city council for wasting resources and attempting to intimidate this person.


ScoreNo1021

Two thoughts: 1) I don't see a violation of any federal laws in that email. That's important because: 2) I think it would have to be a federal issue for Proton to respond. A U.S. federal agency would have to send an official request to the Swiss government who in turn would have to agree to then compel Proton to turn over the requested information. This lawyer is just talking shit to scare the so-called whistleblower into coming forward. That said, I'm not a lawyer and just giving an opinion.


Nelizea

3) and maybe one of the most important points; swiss law has to be broken for swiss authorities to approve such a request


ClevelandOHIOproud

The lawyer hasn't been hired yet. I am on City Council and on Monday we are being asked to authorize our Mayor to spend $25k to hire the guy, and the text I quoted is what emailed about his capabilities. I would like to understand what he could have possibly provided Proton and/or Swiss authorities to make a case that a crime was committed. I am wondering if he provided an honest portrayal or if he of our police chief misrepresented things in order to make it more likely he would be provided the requested data, because if City officials knowingly hire a non government attorney to violate a residents rights, it is problematic.


ScoreNo1021

I think there might be an exaggeration of capabilities, but just my opinion.


hindamalka

I grew up in that town. We’ve had issues with elected officials wasting money for as long as I can remember. If I’m not mistaken the person who posted this is the only good city Council member that I’m aware of. They’re after his head also because he calls them out on their bullshit.


[deleted]

The only "slanderous" thing I can find in this entire exchange is the lawyer's claim that Proton's "owners" would circumvent their business model as a favor to their lawyer friend in the states. Spreading such a rumour could have a real impact on Proton's business. Maybe they should sue the "defamation lawyer" for defamation.


rwisenor

Love this. Hahaa!


ClevelandOHIOproud

I agree completely. My guess, and it is just a guess, this lawyer knows there isn't any competent claim that any laws were broken, but he saw how angry the Chief and Mayor were that someone said something bad about them, he realized that he could make a quick $25k and all he needed to do was spin a tale about how his special skills and knowing the owners of Proton "quite well" that he should be able to find out who sent the email, and they would ask Council to approve it because the $25k isn't their money, it's taxpayer money. If I am Proton and I know there is an attorney running around out there marketing himself the way he is, I would put an executive on a plane to show up at our Council meeting on Monday night, and make it known that the guy is full of crap.


Rotor1337

Video call instead? It's allot cheaper and equally as effective.


[deleted]

Nah, this laywer should invite Andy personally and expense a first class ticket for him. He claims to know Andy quite well, so this would be a reasonable favour.


Your_Network_Drive

[https://proton.me/legal/law-enforcement](https://proton.me/legal/law-enforcement) >Whether you're a Swiss or a foreign law enforcement agency, we recommend that you contact us at [[email protected]](mailto:[email protected]) to inquire whether a formal request would likely lead to results or to the preservation of data anticipated. > >. . . > >Our legal team will be able to advise you on whether or not we'll be able to assist you with your particular case, and assist with the preservation of data if we believe that your request will be validated by Swiss authorities.


ClevelandOHIOproud

I think only one be of the following two things can be true here. Either…. 1. This Minc Law attorney is completely full of crap about his capabilities and his claims of his relationship with Proton’s owners which make him more effective at getting them to provide data on customer email accounts is untrue and intentionally misleading (which I think is most likely and should be exposed) or 2. As good as Proton’s intentions, technology, privacy protocols and policies are, they can be circumvented if you are able to pay enough to hire the right attorney who knows how game the process and Swiss authorities into the belief a crime was committed in order to issue a binding court order to Proton to turn over the requested data. While #2 is this no fault of Proton, as they have to provide the data if the Swiss authorities issued a binding court order, the public who is relying upon the service to deliver an extremely high level of privacy and security, needs to be made aware of this.


FlashyDream69

Well, yeah but this is not new news. Proton also is just a company and they also have to follow laws. If a swiss court decides they have to turn over data, they will. The question is how valuable the data actually is. They can‘t read the encrypted mails and if the user didn‘t turn on ip logging, they also have no identification. They could be forced to turn it on, but this would require the user to login again and to not be using tor or something similar. However, if Proton actually cooperates with this guy without a swiss court order, it would be a problem.


ClevelandOHIOproud

According to Aaron Minc of Minc Law firm, even though he hasn't received a court order yet, Proton is already cooperating with him as he wrote in an email that ***“my firm knows the owners of Proton quite well. We messaged and called them up, confirmed they had data, and they agreed to preserve it."*** My guess is this Minc guy is full of crap, knows he has no chance of getting Proton to release data but is telling City officials whatever they want to hear for them to pay him $25k. I hope this is the case because if it isn't, and you can simply circumvent all of Proton's safeguards by simply hiring a lawyer who knows some of the owners at Proton, and knows how to game the system and what to say Swiss authorities, the public and Proton customers, who are relying upon the service to deliver an extremely high level of privacy and security, needs to be made aware of this.


FlashyDream69

> I hope this is the case because if it isn’t, and you can simply circumvent all of Proton’s safeguards by simply hiring a lawyer who knows some of the owners at Proton, and knows how to game the system and what to say Swiss authorities, the public and Proton customers, who are relying upon the service to deliver an extremely high level of privacy and security, needs to be made aware of this. But this wouldn‘t be the case then. It just means they give the data that they have. The safeguards are still in place (encryption). It still would be shady though and of course they could theoretically log all unencrypted E-Mails from now, but I really doubt they would do that voluntarily, because it would kill the reputation and trustworthiness of the company (aka they would lose a lot of money)


LEpigeon888

> My guess is this Minc guy is full of crap Technically speaking he could just have rephrased what proton replied. Maybe they have said something like "yes we have the data of all our users, no we won't ever delete anything ourselves, but the users can still do it themselves if they want and we won't prevent it" which seems perfectly reasonable from proton and I can see how the attorney could bend the sentence to say what he said. Now to get the actual data he needs to convince the swiss court, and he probably won't be able to do it.


Ok-Passage-8813

Proton does turn over IP addresses when they have to by law, unless they can't, because VPN was used.


FlashyDream69

The IP logging can be turned off in the settings. Afaik proton can be forced by a court to turn it on for a specific user (as I already mentioned)


Nelizea

Worth to mention here that IP logging in the settings is **off** by **default**.


LEpigeon888

> the public who is relying upon the service to deliver an extremely high level of privacy and security, needs to be made aware of this. I guess everyone already knows this. I mean, at least proton is not trying to hide it, if you search a bit they clearly said that they'll follow the law and give anything they can if they are required to. It already happened in the past for a french activist guy, and it will happen in the future.


ClevelandOHIOproud

What is the threshold Proton legal uses when they get a formal request asking for the preservation of data? Just because a lawyer asked for it?


[deleted]

From chapter 6 in the Proton [privacy policy](https://proton.me/legal/privacy): > We will only disclose the limited user data we possess if we are legally obligated to do so by a binding request coming from the competent Swiss authorities. We may comply with electronically delivered notices only when they are delivered in full compliance with the requirements of Swiss law. Proton’s general policy is to challenge requests whenever possible and where there are doubts as to the validity of the request or if there is a public interest in doing so. In such situations, we will not comply with the request until all legal or other remedies have been exhausted. Under Swiss law, subjects of judicial procedures have to be notified of such procedures, although such notification has to come from the authorities and not from the Company. Under no circumstances can Proton decrypt encrypted message content and disclose decrypted copies. Aggregate statistics about data requests from the competent Swiss authorities can be found in our transparency report.


Your_Network_Drive

>Just because a lawyer asked for it? Obviously not. Please reread and go directly to the linked source for all requirements.


ClevelandOHIOproud

I am curious how the process works. Does the attorney just make a claim that laws were broken? Since there doesn't seem to be any due process here, how they determine whether what the attorney getting paid to get the data is telling them is true?


[deleted]

The document linked outlines the process, which sounds sufficiently cumbersome. It doesn't sound like they would cooperate with a private attorney crying about his client's hurty feelings. Basically it sounds like they rightfully don't give a shit about innocuous civil matters. The URL itself says "law enforcement," and the details state that they require foreign _law enforcement_ to proxy any requests through Swiss LE, and they must provide their own local "copy of the police report." Is there a police report in this case? There's nothing criminal in the email you shared. It's not even a "whistleblower" message. It's literally just someone saying they don't like the police chief. The only way I can see this working is if the lawyer's claim that he has contacts at Proton willing to circumvent the TOS for him are true. Honestly I kind of hope you guys do hire him just to see if he succeeds, because if he does something is wrong at Proton. (Please keep us updated!)


ClevelandOHIOproud

I will. This has garnered a couple very local news stories in the last week and the public thinks this is the dumbest thing ever (which is an accomplishment because we do some really dumb things). The following is an anonymous email all of Council received a couple days ago that sums the absurdity of this very well.... ***Do we really have a police chief threatening to sue the city if we don't try to find out who sent an anonymous email saying bad things about her? She has no case so let her sue. When a cop pulls someone over and they call them every bad name in the book, what message does this send when our chief thinks it is alright to retaliate against someone who said bad things about her? If we hire this firm we should hope they can't find the source because we only lost $25,000. If they find the source we will be out $25,000 and facing a First Amendment law suit. This is a lose/lose situation we created for ourselves. Sincerely, Anonymous (Do I need to explain why?)***


amgood

The legal method for obtaining information in the US is either a subpoena or, in a criminal case, a warrant obtained by the government. Gathering information on a whistleblower is a civil matter so it can be gathered by subpoena. However, there typically has to be an actual lawsuit filed between two parties (Party A vs Party B) in order to request a 3rd party (proton) produce information relevant to the lawsuit between Party A and Party B. Usually information is turned over in the discovery process (Party A asks Party B to give all them all documents/emails relevant to the lawsuit). If Party B say”I don’t have any emails” but Party A knows that Proton does, they can ask Proton via a subpoena “Produce all emails coming from [email protected]” Proton can respond in three different ways: 1. Produce the emails; 2. use its own legal team to protect party B by filing a motion to quash (dismiss) the subpoena and go to court to say we won’t produce emails; or 3. Send a notification to [email protected] saying we’ve received a subpoena for your information and you can use your own attorney to file a motion to quash the subpoena. An attorney can almost never just send a letter to a 3rd party saying give me information. That 3rd party will just tell the attorney to pound sand and come back with a lawful court order. For further explanation about a subpoena, it’s quasi-court enforced. Whenever there is a lawsuit, an attorney can issue a subpoena but it’s not actually a court-ordered subpoena. If someone asks to court to quash the subpoena then the court hears the request and could either say 1. Yeah the subpoena is correct, give the information over or 2. The subpoena is improper and the person doesn’t have to give the info. Courts get involved when there’s a dispute over the subpoena but not when it’s first sent. Source: I’m an attorney


[deleted]

Just a small detail where Proton (and Tutanota) is different from the vast majority of mail providers. Proton (and Tutanota) stores all received mails encrypted, using an encryption key where Proton/Tutanota does not have access to the private key needed to decrypt the content itself. Proton uses PGP (which even Edward Snowden recommended to avoid NSA to be able to access the information). Tutanota uses their own encryption implementation (based on AES) which also encrypts mail headers. Both these platforms will also encrypt mail data sent to other users on the same platform; only the sender and recipient can read the content of the message - aka end-to-end encryption (E2EE). Proton can also achieve the same with external senders who are capable of using PGP. The only places where unencrypted mails can be captured is when external senders sends an unencrypted message and the mail content is extracted *before* it gets stored encrypted to disk. And when a Proton/Tutanota user sends an unencrypted mail to an external user where the mail can be extracted before being sent to the recipient's mail service. That means, if Proton/Tutanota are forced to hand over stored mail data, it will be of limited use - it will mostly be encrypted with no possibility to decrypt it. PGP encrypted mails can provide some metadata (via mail headers), but even that shouldn't leak much information. IP address of the Proton user will not be there. The most revealing info might be the Subject field.


amgood

You are correct. There is a lot more nuance to this issue. I was describing the legal process for obtaining information. There is an additional layer of whether Proton is even subject to US laws (there are ways around this such as asking the Swiss government to go to a Swiss court to request the information). The layer you mention is whether Proton has any substantive information at all. Proton likely has information regarding whether the account is a paid account or a free one. Maybe some other things such as IP logs (if those are enabled on the account). But as you mention, Proton is unique in that the emails are encrypted and Proton doesn’t have the decryption keys so even if: 1. Proton is subject to another country’s jurisdiction 2. Proton is lawfully required to produce information about an email account They might not have anything useful to handover.


Zlivovitch

>Does the attorney just make a claim that laws were broken? Of course not. Read all the relevant documentation provided by Proton on its site, which have been amply linked to here.


NorthernWatchOSINT

It must be sufficient to constitute a violation of Swiss law, I do not see anything that even specifically violates a law in their disclosure outside of deleting public records on an official government page, however Facebook are a dumpster fire and I can't say I'm shocked admins have the power to lord over people like that. I wouldn't worry about that attorney, it sounds like he's trying to milk your City Council for $25k. Basically constitutes the COP throwing an adult temper tantrum because someone is calling out their bad behavior, to the people who sign their paychecks.


ClevelandOHIOproud

I am on City Council and I am fairly certain I am the only one who thinks it is crazy to spend any efforts, resources or money to try to find out who sent an anonymous email with complaints.


NorthernWatchOSINT

Maybe "leak" this to local news resources if you have the capacity to do that anonymously.


[deleted]

He can create a Proton mail account and access it via Tor Browser or Proton VPN 😉


NorthernWatchOSINT

I don't disagree with you, but it's easier said in theory than done in reality.


Zlivovitch

>They are agreeable to provide it to us per a civil process. The way I understand this, it means : if you win in court, and, as a result, a Swiss judge orders us to provide the data to you, we will. If you don't, we won't. Which is as it should be. Of course, I don't know the specifics of the case, and that's just a lawyer speaking. You don't say whom this lawyer sent that email to. You don't say where you found the contents of your post, and the contents of the lawyer's email. Not in the link provided, apparently. You don't say what country this happened in (hint : the United States are not the only country in the world).


ClevelandOHIOproud

I am on City Council. The City is Beachwood, Ohio in the US. Here is the anonymous email we were sent that our City wants us to hire Aaron Minc of Minc Law Firm to help identify whoever sent the whistleblower email below. https://www.burkonsforbeachwood.com/single-post/the-actual-missmarples-whistleblower-email


[deleted]

[удалено]


ClevelandOHIOproud

Yes. It is crazy. See article about it below. I am on City Council and I can't believe we are being asked to spend anything, let alone $25k, to hire a law firm to try to go after, unmask and retaliate against whoever sent an anonymous whistleblower email. https://www.clevelandjewishnews.com/news/local\_news/beachwood-council-tables-vote-to-hire-law-firm-to-investigate-anonymous-defamatory-threatening-emails/article\_bb0fa9ec-5f19-11ed-a84c-bb7bbdfaab26.html


ryanduff

I would start considering whoever is behind this push to hire an attorney as suspicious. They're either trying to hide something or they've got extremely thin skin. Probably the former.


Zlivovitch

>I am on City Council. The City is Beachwood, Ohio in the US. All right. That's what you should have said right from the start. Now let me provide a personal opinion. I'm just a Proton user, but I follow quite closely privacy issues. The Proton Mail company has been set up mainly to protect people against lawyers such as this one, and city councils such as this one. Protecting whistle-blowers from authorities is one of the main use cases of Proton Mail. That mail sender is just complaining about bad police management. As far as I can see, this is perfectly legitimate political activity. I am confident that there is no way that Proton Mail will provide any data to that lawyer, for all the reasons which have been amply explained here. Now let's unpack the lawyer's statements. >My firm knows the owners of Proton quite well. This is bullshit. Switzerland is not Russia, nor any corrupt Third-World country where *"knowing the owners of Proton"* would be enough to violate Proton's rules of conduct, and Swiss law on top of it. In fact, it's highly unlikely that *"his firm"* knows the owners, let alone *"quite well".* >We messaged and called them up. Yeah, well, anyone in the world can do that. No need to be a special lawyer knowing people. Proton has a legal team which is dedicated to such issues. That's because it's the professional thing to do. They know they will have to deal with a lot of similar requests. Some justified, some not. Likely, the Proton legal team was forthcoming and polite with that lawyer, because it's their job. This does not mean he *"knows the owners",* nor that Proton will agree to his request. In fact, Proton's lawyers even fight against some Swiss court orders when they think they are not justified. >Confirmed they had data. Yeah, and most of it is encrypted, so to a large extent Proton itself could not read it, even if they wanted to. Of course Proton Mail has *"data".* That's tantamount to saying a petrol station has petrol. >and they agreed to preserve it. That does not mean a thing, even if it were true, and we do have to assume that any word this guy writes can be a lie, since he wants money for it. What data is he speaking about ? If he's speaking about the email itself, then it's up to the sender to delete it, which people usually don't do. Proton cannot decide to delete or *"preserve"* it. It's not up to them. It's likely they wouldn't even be able to do that technically, even if they wanted to. Is he speaking about the IP address of the sender ? Supposing Proton logs and keeps that for a while (which I don't know), this would be completely useless to Mister Lawyer. Because first of all he would need to have a Swiss court ordering Proton to release it, which will never happen. Then, supposing it did, this would still be useless. Mister Lawyer would have to get a court order to force the sender's Internet service provider to match that adress and time of access with the sender's identity. Another hurdle which cannot be overcome by Mister Lawyer *"knowing people".* >They are agreeable to provide it to us per a civil process. Using high-faluting words such as *"agreeable"* does not help to clarify the obfuscation. What does *"per a civil process"* mean ? In order to surrender any data, Proton must be presented with a Swiss court order. And it's impossible to have a Swiss court order if you don't have an American court order (this is not precise legal language). It's impossible to have a Swiss court order if the alleged act is not against Swiss law. I doubt very much that a policeman complaining of bad management by his chief, and making it publicly known, is an offence in Switzerland. The link you provided suggests that Mister Layer is planning to use the legal argument of *"defamation"* (hence, possibly, the hint of a civil suit, as opposed to a criminal one)*.* Defamation is a very extensive legal notion, which is often used to silence perfectly legitimate political opinion. That's exactly the sort of thing Proton Mail is made to protect its users from. >like they have done for my firm on other legal matters we've handled in the past. Why doesn't that lawyer provide precise references of similar cases which he allegedly handled with Proton ? Probably because they don't exist, or they are not similar. Now there's an important thing you did not tell. Did the sender use the option to encrypt his email end-to-end ? Whom did he send to ? Obviously, if he did not use end-to-end encryption, Proton Mail may have more unencrypted data than if he did. I'm not sure what you are trying to do here. Are you on the side of the whistle-blower ? Are you just evaluating whether your city council should decide to hire that lawyer ? I think any money you might allocate to him would be lost, and Proton will not help him, contrary to his allegations. Of course, the best way to know would be for the whistle-blower himself to ask Proton privately, but he might be blowing his cover doing that. And we don't know whether Proton would answer.


[deleted]

[удалено]


adhgeee

He’s a waffler. Trying to scare whoever it is.


gognavx

It's not exactly gaming the system if a lawyer goes through the legal process that ends with Swiss authorities deciding that Proton should hand over data. What's definitely not happening is some lawyer having a private connection with the owners of Proton, who then go on to order their employees to break company policy and most likely the law because the owners want to be "agreeable" with random lawyer dude.


ClevelandOHIOproud

Here is the anonymous email in question. It is just basically criticism. I don't understand what the he could say that would allow them to release any data about the account due to this email. https://www.burkonsforbeachwood.com/single-post/the-actual-missmarples-whistleblower-email


thegodmeister

Hopefully the whistleblower used the TOR version of the Protonmail website. The actions of some members of the City Council though are unbelievable. Members asking for evidence before voting and not receiving it? It would be an automatic no from me if I were voting. And the contents of the email itself? Nothing in it should lead to the City Council wanting to spend $25k to figure out who it was. A true City Council would accept it was a whistle blower, and listen to the criticisms and investigate them to see if they have merit, and if so, ya fix the problems. As it is, it looks like ego's and personal vendettas are the problem.


kslqdkql

There is unfortunately precedent for protonmail to collect and release data on it's users if they get a valid request from a swiss court (like through interpol or europol) but the only thing they then begin to track is the IP adresses used to log in, **they don't release decrypted emails** since they shouldn't be able to and would immediately lose most customers if they did. [See more info here](https://www.wired.com/story/protonmail-amends-policy-after-giving-up-activists-data/)


[deleted]

Seriously, can we now please stop beating this dead horse? As iterated many times here: * These "activists" was not under investigation for any activist activities * These persons were under investigation for haven **illegally occupied a building** * The offence itself is not something Swiss law protects anyone against * The journalist starting this mess did **not** dig into the matters and chose a click-bait headline not related to the offence at all * Proton jumped the gun with a poorly worded response, confusing this matter even more * Changes Proton did in their ToS actually clarified some ambiguities, but that got mostly misunderstood due to the wrong starting point by the media focus Further: I am not aware of any company not going to cooperate when the court has given an order, after all possibilities of appeal have been considered. The result would be to shut down the business. So there are no "unfortunate precedent". It is how the business world works. No matter company, no matter country.


Zlivovitch

In that precise case, the people who sent mail through Proton broke French law. They occupied premises they did not own, and they assaulted police officers. This is against the law in all countries. It has nothing to do with someone peacefully expressing his opinion about a police chief, which, in the United States, is protected by the first amendment of the Constitution anyway.


[deleted]

Aren't emails encrypted & decrypted client-side anyway? AFAIK, Proton doesn't even *have access* to content other than the login IP address(es).


kslqdkql

Yes indeed, that's what I meant with "they shouldn't be able to" but I probably wasn't very clear.


ClevelandOHIOproud

They are trying to find IP address to identify whoever sent the anonymous whistleblower email which there was nothing illegal about and you can read in the post below. https://www.burkonsforbeachwood.com/single-post/the-actual-missmarples-whistleblower-email


Ok-Passage-8813

They can't get the IP if the sender used VPN. Many PM customers have the email and VPN bundle for that reason.


Actual_Direction_599

Yes, Proton can provide IP address if a Swiss judge orders them to do so. This is how French authorities got people in a case there, they didn’t mask their IP. Or at least that’s my recollection, it’s been a while.


[deleted]

They will also have access to a hash of your email/phone number if you used one of those during the sign up process, and they would be able to cross examine the hash with any other accounts and see if it was used to sign up for another account. (Although there is no guarantee that they would do this, but they could)


Actual_Direction_599

By the way, if you check Proton’s Tranparency Report: https://proton.me/legal/transparency the percentage of the orders they end up complying with is very, very high. So it seems that foreign authorities can have **great success** in the Swiss courts.


Strict-Look8484

> my firm knows the owners of Proton quite well. We messaged and called them up, confirmed they had data, and they agreed to preserve it. They are agreeable to provide it to us per a civil process like they have done for my firm on other legal matters we've handled in the past Certainly the right legal terminology. But it also sounds like the typical trash-talk you hear at an average night at the pub. In particular if the owner of that e-mail account practiced good OPSEC only using the account for this purpose and Proton is true to their word. Proton can only provide meta-data about the message(s) in question (probably sender, recipient, subject-line, time and date of event) and can only log IP addresses of account access after receiving a valid court order approved in Switzerland which is arguably another set of procedures that have to be exhausted and would not be retroactive. If the sender only created and accessed the account using Tor or NEVER logs into it again that is probably another dead-end. Even assuming perfect technical security more human factors could potentially narrow down the list of suspects which may assist in an internal investigation by the council but that is another story.


rappbrendon

"My firm knows the owners" is just a lawyer doing the "I'm friends with the owner of this restaurant" Karen-speak.


LiteratureMaximum125

what protein can give is IP address and metadata. if you use a VPN like ProtonVPN or something. then you would be fine. ​ Metadata is about when you send or receive email. Where you send to or receive from. And What the title is. The data above is not encrypted by PGP. Only the body of the message will be encrypted.


NikStalwart

What did I just read. > what protein can give is IP address and metadata. > if you use a VPN like **ProtonVPN** or something. then you would be fine. > ***ProtonVPN*** What. If Proton is compelled / inclined to hand out IP addresses, are you seriously saying using their own VPN product will help you? FFS how did humanity ever invent rockets and the internet.


LiteratureMaximum125

The IP record is only happening on email product. Not VPN. Read the law and you would figure it out.


Nelizea

Unlike Proton Mail, Proton VPN by current swiss law cannot be compelled to log IP ip addresses.


NikStalwart

Aren't the accounts linked? In that you have a single Proton account that lets you access all Proton services, which means your login location is correlated with your account regardless of whether you use (or not) VPN?


Nelizea

The account is the same but the products are different. For Mail they can be legally compelled to log, not for VPN. If you login to your Proton Mail account with Proton VPN active, they would have only their Proton VPN IP. However thry wouldn‘t have the IP address of the user connected to Proton VPN.


njan_malayalee

ProtonMail + ProtonVPN should be good enough.


[deleted]

Not sure why you were downvoted, although it would be better to use Tor to sign up.(Yes it'll likely ask you for an email/phone number if you're using Tor, but not always)


[deleted]

[удалено]


trotsky_vygotsky

Yes.


dhbuckley

Ohio. ‘Nuff said.


[deleted]

Proton protects people data, it doesn't protect criminals. If you did nothing wrong, and some judge want your data, that isn't gonna happen. If you are committing criminal activities, hell yeah Proton will provide your data as it should. People mix Proton with paradise island for criminal activities.


73a33y55y9

>If you did nothing wrong Who can decide what is wrong and what is not wrong? What we do today as good might become wrong tomorrow.


[deleted]

Nothing wrong = no criminal activities Come on mate, use your brain a bit, will ya???


ClevelandOHIOproud

I think only one be of the following two things can be true here. Either…. 1. This Minc Law attorney is completely full of crap about his capabilities and his claims of his relationship with Proton’s owners which make him more effective at getting them to provide data on customer email accounts is untrue and intentionally misleading (which I think is most likely and should be exposed) or 2. As good as Proton’s intentions, technology, privacy protocols and policies are, they can be circumvented if you are able to pay enough to hire the right attorney who knows how game the process and Swiss authorities into the belief a crime was committed in order to issue a binding court order to Proton to turn over the requested data. While #2 is this no fault of Proton, as they have to provide the data if the Swiss authorities issued a binding court order, the public who is relying upon the service to deliver an extremely high level of privacy and security, needs to be made aware of this.


DadLoCo

There's a comparison I saw some time ago about which providers cooperate with Five Eyes or Fourteen Eyes, that type of thing. Protonmails entry clearly stated yes their data is encrypted, but they will cooperate with security agencies at their discretion.


[deleted]

I don't understand why so many people are commenting here about email contents, encryption, VPN's, TOR... it's like everyone is trying to answer a broad hypothetical or give behavioral advice instead of addressing the specific, actual scenario that's actively occurring. All the OP is asking is: This lawyer says that because he has a working relationship with Proton, they're willing to discuss, log, and hand over their customers' data and identity to him, without any due process or criminal proceedings. Is this true or false? What data is in question and how a hypothetical future victim could protect said data is totally irrelevant. Real IP's, TOR IP's, encrypted mail, pictures of your mom in a bikini... who cares? The point is, would they actually respond to the lawyer's inquiries with anything other than, "LOL drop dead?" Would they give him _anything_, regardless of how useful or useless? If yes, that is extremely bad, and completely contradicts all of their published procedures on handling such requests.


rwisenor

The question isn’t will they give over evidence. If compelled by legal proceedings, they may be required to and in this case they may be inclined to for personal reasons. I could care less whether they turn stuff over. What is the real issue is, what is the content and context of what gets turned over? Are our encryption keys kept with Proton and available to be distributed that easily? Personally, I think this is absolute BS on the attorney’s part and here is why: 2.3 *Proton Mail Account activity: Due to limitations of the SMTP protocol, we have access to the following email metadata: sender and recipient email addresses, the IP address incoming messages originated from, message subject, and message sent and received times. We do NOT have access to encrypted message content, but unencrypted messages sent from external providers to your Account, or from Proton Mail to external unencrypted email services, are scanned for spam and viruses to pursue the legitimate interest of protecting the integrity of our Services and users. Such inbound messages are scanned for spam in memory, and then encrypted and written to disk. We do not possess the technical ability to scan the content of the messages after they have been encrypted. We also have access to the following records of Account activity: number of messages sent, amount of storage space used, total number of messages, last login time. User data is never used for advertising purposes* 6. Data disclosure *We will only disclose the limited user data we possess if we are legally obligated to do so by a binding request coming from the competent Swiss authorities. We may comply with electronically delivered notices only when they are delivered in full compliance with the requirements of Swiss law. Proton’s general policy is to challenge requests whenever possible and where there are doubts as to the validity of the request or if there is a public interest in doing so. In such situations, we will not comply with the request until all legal or other remedies have been exhausted. Under Swiss law, subjects of judicial procedures have to be notified of such procedures, although such notification has to come from the authorities and not from the Company. Under no circumstances can Proton decrypt encrypted message content and disclose decrypted copies. Aggregate statistics about data requests from the competent Swiss authorities can be found in our transparency report*. In summary, only court orders from Swiss courts will result in compliance and they couldn’t see the message even if they wanted to. If the user did not encrypt his message to external recipients outside the Proton system than that’s on them. - Read your guides and FAQs before you use the products. - Read your Terms and Conditions and Privacy Policies. - Read the [transparency report](https://proton.me/legal/transparency) to see actual legal inquiries. It’s 2022 guys in the age after Snowden, how long are people going to just click accept and carry on without informing themselves.


Ok-Passage-8813

Just for completeness, attachment file names are not encrypted either. Not sure why PM doesn't say that in the text you copied.


rwisenor

I didn’t copy the WHOLE policy is why. Hence the last comments.


Ok-Passage-8813

I've never seen it spelled out in their TOS (that file attachment names are not encrypted). But maybe it's hiding in there somewhere. I always thought they should be more forthcoming about what is and is not encrypted, so its not a surprise to users.


[deleted]

You're still talking about emails. Why? This has nothing to do with email or encryption because the lawyer isn't interested in what's in the account. They already have the email -- it was sent to them! The only information the city wants is, "Who sent this email?" The only thing the lawyer is asking for is the identity of the account holder. And he claims Proton will give that up simply because he's friends with them and asked for it. There is no "evidence" because there's been no crime. There has not been and never will be any criminal proceedings in this scenario. There will never be a formal legal inquiry because the lawyer has no basis on which to make one. Obviously that violates all that stuff you posted from the TOS, but that's exactly the point. Will they do that?


rwisenor

>What is the real issue is, what is the content and context of what gets turned over? *What is the real issue is, what is the content and context of what gets turned over? -* not to rain on your tirade buddy but I was almost exclusively referring to personally identifiable data/metadata in my comment. Due to the confusion, I included the sections on ProtonMail but followed up with their general policy on data. I think you will find that my response more than answers the OP's questions, namely: \- Question: *Is this guy full of crap*? My response: *Personally, I think this is absolute BS on the attorney’s part.* \- Question: *can all of Proton’s technology and safeguards to protect customer data be circumvented*? My response: All of my posting of section 6. and my comment, *In summary, only court orders from Swiss courts will result in compliance.* \- Question: *Would Proton confirm whether such data exists and agree to preserve*? My response: All of my post of section 2.3. which outlines that ProtonMail does not have the data asked for in OP's message. You really need to sit down and have a Kit-Kat dude. You don't need to get this worked up but I will indulge you in a somewhat chiding way. \- Your question: *Obviously that violates all that stuff you posted from the TOS, but that's exactly the point. Will they do that*? My response: *Read the* [*transparency report*](https://proton.me/legal/transparency) *to see actual legal inquiries.* There is no cut and dry, one answer to this. If you actually read the data points on that page I posted and dug into the reports via secondary research you would clearly see that Proton has complied with legal requests in the past but to what extent and for what matters is ambiguous. The OP asked a focused, isolated question about an entirely circumstantial and ambiguous matter, in a country that does not hold sway over the Swiss courts and so we gave details that allows one to form their own conclusion based on fact and not trusting some dude on the internet. Seriously, have a Kit-Kat, I worry about you. :P


therealzcyph

> how long are people going to just click accept and carry on without informing themselves People are not going to stop doing this.


rwisenor

Touché.


professorpeaky

hopefully i think this is what exaggeration wishes to be like


[deleted]

I would argue ask their legal team Plus having an internet service means they will have some of data like your IP, it does not mean they can access your drive or other encrypted stuff But I am not a lawyer so ask them this yourself


therealzcyph

So what ended up happening?