ProtonMail Danger!

2021

ProtonMail advertises itself as the world's largest secure email service, and yet it recently shared the IP address and device details of a customer with Swiss and French authorities, which led to an arrest.

Etienne Maynier, an activist, hacker, and security researcher, shared details on Twitter of the information sharing carried out by ProtonMail. It was triggered by a legal request from Europol through the Swiss authorities and targeted a climate activist from Youth for climate action in Paris. As TechCrunch reports, the request was in relation to a group of activists occupying premises in Paris rented by the restaurant Le Petit Cambodge, which was targeted in the 2015 Paris terrorist attacks. The ProtonMail account was being used by the group for communication, so French authorities were determined to find out who created it.

Inevitably, the information sharing and subsequent arrest has raised a big question mark over how secure the email service really is if information can be so easily shared, especially when ProtonMail states on its homepage that "No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first."

ProtonMail founder and CEO Andy Yen responded to the questions being raised in a blog post, explaining that the service "received a legally binding order from Swiss authorities which we are obligated to comply with." The order could not be appealed and forced the service to "collect information on accounts belonging to users under Swiss criminal investigation." In other words, ProtonMail doesn't collect your information unless it's forced to (as it was in this case).
Your case could easily be on this list!

Its privacy policy now says: "If you are breaking Swiss law, ProtonMail can be legally compelled to log your IP address as part of a Swiss criminal investigation."
'Serious crime'

ProtonMail blogged it had received a "legally binding" order from Swiss authorities to collect data.

2022

Onion stores/services and vendors have lost their email addresses. They have been blocked. When trying to authorize, a message was displayed:
"Your email address has been blocked at the request of the police. "
This email will never be anonymous again and is fully under the control of the Swiss police. But on request from another country, your data will also be provided.

P.S.

Consider your OPSEC

It’s also important to consider what data you provide when you sign up for a service. In the ProtonMail cases we mentioned above, the data that exposed the users was the user’s IP address (French activist) and the “recovery and associated email addresses” (US suspect investigated by the FBI recently).

By protecting the data you provide when interacting with the email service, you can make your email account even more private and secure.

    IP address – Use a good VPN service to hide your IP address whenever using the email service (or anytime you are online for that matter)
    Recovery email – Consider using a disposable email for a recovery email, or a new and unused recovery email address that is not linked to your identity
    Payment methods – Email is fundamentally different from a no logs VPN service in that there is always personal data stored (your inbox contents and other account data). Therefore it’s more important to use an anonymous payment method if you want more privacy. Example: BTC, XMR, LTC

Having good OPSEC is a crucial consideration whenever you are using privacy tools.