Marcus Hutchins Mar 8

It feels like Proton are being intentionally misleading in their statements. They know that most of their customers aren't familiar with how legal process actually works, so are happy to spread half-truths.

Under US law, a US law enforcement agency (LEA) typically has to apply for a subpoena or search warrant with a US court. The court is then responsible for deciding if the legal bar for search a request has been met, then either grants or denies it.

The problem is, if a company has no real US footprint (no US corporate entity, offices, servers, etc.), then a US court typically doesn't have the jurisdiction to compel the company to hand over customer data (except in some rare circumstances). Even if the court approved the warrant anyway, it wouldn't really be legally binding.

Which is why the Mutual Legal Assistance Treaty (MLAT) exists. MLAT enables law enforcement agencies in one company to send requests for information to law enforcement agencies in another. Switzerland has such a treaty with the US. This means that the FBI can request that Swiss authorities hand over a Swiss company's data on their behalf.

Any country requesting information held by a company in a foreign jurisdiction would typically do so via MLAT. Which means from Proton's perspective, the legal request would appear to originate from their local law enforcement, not the FBI. Which they clearly understand based on their Reddit post.

Saying "we don't respond to legal requests from anywhere other than Swiss authorities" seems very intentionally worded to give the impression that the company does not cooperate with foreign law enforcement. But since it'd be the Swiss authorities handling any such requests, they'd have to comply, since as they admitted, they have to comply with local laws.

There is, however, some useful (but more nuanced) information here:

Firstly, MLAT requests are handled by local law enforcement according to local law. So if there is a difference between the law of the sending and recipient country, that might mean the MLAT request is denied. That probably doesn't mean much, because if you're on the FBI's radar, the chances are you did something that is also massively illegal in Switzerland too.

Secondly, they are 100% correct in saying that no other service provider is going to do any better. They're all beholden to local laws, and the ones that think they're not tend to get their doors blown off by SWAT like CyberBunker did. The only exception is if the company resides in a country which does not cooperate with US law enforcement (which Proton does not).

But the part that's extremely disingenuous is that the "we only respond to requests from the Swiss authorities". That statement is likely intended to imply they don't cooperate with law enforcement in any other countries, which is simply not true. Switzerland has MLAT agreements with over 30 counties.

People really need to understand that no company is going to shield you from the FBI (or any reputable law enforcement agency). They'll use misleading statements to make it sounds like they don't cooperate with law enforcement, but they do. They have to.

Show threadMarcus Hutchins Mar 9
lol, this post really brought out all the insufferable fanboys. I'm not gonna pretend like I didn't know which of the 3 platforms I posted this on would have a bunch of people deeply personally offended by criticism of a corporation
Show threadTroed SångbergMar 9

@malwaretech Maybe the users of one of those three platforms are slightly more tech savvy and simply don't agree with your feelings?

I've been a paying Proton user (Visionary) since nine years and I've never felt they're misleading me.

Maybe you shouldn't react to that by considering those than don't agree with you as being fanboys, but rather knowledgeable.

Show threadStanislav OchotnickýMar 9

@troed @malwaretech so your take is that #proton doesn't have to follow Swiss law? Or that the cooperating doesn't happen? Or that FBI wouldn't lie to Swiss authorities to get them to request the data?

There's only one way for companies to protect your data - if they don't have it in the first place. If they have to collect the data to provide the service, you need to assume they might hand it over and act accordingly.

Show threadTroed SångbergMar 9

@drizzy

Even though I am on Mastodon I guess I would be one of those domain experts Marcus is talking about. I used to sit on the board of and be a politician for the Swedish Pirate Party - where knowing exactly what the current legal system affords when it comes to privacy was pretty much a requirement.

There are two takes on this story: 1) Do Proton misrepresent their offering and 2) How did the FBI end up with the name behind the account.

For 1 it's simply no. Proton are correct in that the Swiss judicial system doesn't lay flat when a request comes in from an international partner so their marketing is honest. Providers in some other jurisdiction would be much more eager to hand out account owner data.

For 2 it's unfortunately bad OPSEC on the account owner's part. If you rely on being anonymous you can't hand out your credit card details - regardless of where you sign up. Proton offers both cash and crypto as payment options - which is the best anyone can do.

... but facts spread much more slowly compared to hot takes.

@malwaretech

Show threadStanislav OchotnickýMar 9

@troed @malwaretech But see - this is not about experts (legal, technical or otherwise) being able to understand what Proton *actually* means when they say "We do not respond to legal requests from anywhere other than Swiss authorities".

I'll write their asterisk for them:
Except if the other side convinces Swiss authorities (even by lying) a serious crime has occurred in which case we might be compelled to give them whatever we have so use TOR/VPN and pay with cash/crypto.

Show threadTroed SångbergMar 9

@drizzy

Where has Proton not been honest with that?

https://proton.me/blog/protonmail-threat-model

The claim is that Proton somehow should have done something different. I have yet to see what that something is. They clearly state all over the place that privacy != anonymity and that if you're going up against government adversaries maybe Proton isn't what you need.

@malwaretech

The Proton Mail Threat Model | Proton

Learn more about the Proton Mail Threat Model.

Proton
Show threadStanislav OchotnickýMar 9

@troed @malwaretech Let me clarify a bit. Proton's great. I'd have no issue recommending it.

But it *is* hard to communicate threat models to ordinary folks. The threat model blog post is great - do they link to it when people sign up? I don't think so. How would people even know? To be clear I know that communicating this clearly is hard.

The distinction between using "MLAT" and "Helping FBI directly" is of course there but in the end - the result is the same for the affected individuals.

Show threadTroed SångbergMar 9

@drizzy

This page is linked from their front page, as the reason why their whole "Swiss privacy laws" matters:

https://proton.me/blog/switzerland

I'm not sure those who bring up MLATs realize that there's a huge difference in what other countries do when those come in and what the Swiss judicial system does - see under the "Legal differences between Switzerland and other countries" heading.

I still don't know what Proton should do differently.

@malwaretech

Why is Proton based in Switzerland? An analysis of Swiss privacy laws | Proton

Switzerland has a strong reputation for privacy, dating back over 100 years, but is this reputation actually backed up by strong laws?

Proton
Show threadStanislav Ochotnický
@troed @malwaretech All of this is really just about their "we do not respond to legal requests from anywhere other than the Swiss authorities" bit. The actual work they're doing is great and I don't think many people would question that.
Mar 9 at 11:36amWeb
Show threadTroed SångbergMar 9

@drizzy Sure, but it's a fact that that in itself means something. Switzerland doesn't just rubberstamp MLATs and off they go. I'm not sure what sentence you find it proper for Proton to use then whilst still being able to market their Swiss jurisdiction.

See "4. Grounds for refusal" here: https://www.eurojust.europa.eu/sites/default/files/assets/requesting-mla-in-criminal-matters-from-switzerland.pdf

I'm still trying to figure out what it is those that deride Proton want instead.

@malwaretech