Police Accessed Proton Mail User Data in Terrorism Probe

Encrypted service providers like Proton Mail and Wire provide end-to-end encryption, ensuring only the sender and recipient can read the content. However, they collect user metadata, such as IP addresses and recovery email addresses, which can be a point of contention when law enforcement agencies seek access to this information. This happened in a recent case in Spain, raising questions about the complex relationship between user privacy and law enforcement access.

According to Vilaweb, the Spanish police, Guardia Civil (National Police force of Spain), sent legal requests to Wire, Proton Mail, and Apple while investigating organized crime and terrorism link with a pseudonymous member of the Catalan pro-independence movement Tsunami Democratic.

This user was believed to have helped plan actions or demonstrations during King Felipe VI’s visit to the region in 2020. According to the Catalan newspaper El Nacional, Spanish authorities believe that the suspect who goes by the alias of “Xuxu Rondinaire,” is an officer of the Catalan police Mossos d’Esquadra.

Spanish police obtained user data from Swiss firms Proton Mail and Wire, allegedly through legal pressure, to identify the suspected Catalan separatist, possibly revealing a recovery email address associated with the suspect’s account. On the other hand, Apple also provided a full name, two home addresses, and a Gmail account linked to Apple ID when the police reached out to the company.

For your information, Proton Mail has already been accused of exposing user data under legal pressure. In 2021, Proton provided Swiss police with the IP address and device details of a French climate activist, who was later arrested by the French police after acquiring the same data from Proton.

Proton Mail defended its actions, citing its helplessness against Swiss anti-terrorism laws. “Proton received a legally binding order from Swiss authorities which we are obligated to comply with. There was no possibility to appeal this particular request,” the company said.

Proton blames a user for using their iCloud email to sign up to ProtonMail. Proton required a second email during sign up. Shift blame to Apple for then doxing the user, yet Proton is the one who gave up the user’s privacy. Proton gives this secondary email up, on command now. https://t.co/oDElBUcL4M

— Sick.Codes (@sickcodes) May 8, 2024

However, the company still maintains its strong stance on user privacy, arguing that providing minimal user data when compelled by law is a necessary compromise in adhering to legal frameworks.

The Spanish case highlights the need to balance user privacy and national security concerns. While some may seek absolute anonymity, the convenience and security of encrypted email outweigh potential risks. Transparency from encrypted service providers is crucial, and users must make informed decisions about their privacy needs.

1. ProtonMail Code Vulnerabilities Leaked Emails
2. How Facebook Helped FBI Capture a Notorious Child Abuser
3. VPN firm that claims zero logs policy leaks 20 million user logs
4. PureVPN Aided FBI to Track CyberStalker by Providing His Logs
5. Tuta Mail (Tutanota) Accuses Google of Censoring Its Search Results