What exactly should ProtonMail have done in this case? Refuse to comply with the court order?
Not defending ProtonMail's actions mentioned in the topic, only puzzled why you seem so surprised in your comment.
Not defending ProtonMail's actions mentioned in the topic, only puzzled why you seem so surprised in your comment.
This is in fact what ProtonMail has done on multiple occasions when we believe an order to be in error.
I wonder if they could do something like the canaries we see in other legal respects (not a lawyer); log in and get an account-specific banner in your inbox telling you they've never enabled IP logging for your account.
Can a canary work with that much specificity?
I might be very wrong here but I thought canaries were legal because they were generalized. A specific person couldn't be alerted that they were a target, they'd just know someone using the service was a target.
The theoretical legal basis is typically that the government can't compel you to speak against your wishes, or at least can't compel you to lie.
That said, this is untested and controversial, and many lawyers believe that the discontinuation of a warrant canary could be interpreted as a violation of the gag order. Courts often frown upon technical workarounds, and interpret around them.
it might be an interesting idea to build a system that decrypts a small email server per user using their login credentials they interact with that system only and forward mail to the provider MTA for sending. there are still leaks here, and the provider could be compelled to reveal the user key to law enforcement, but the data would only be visible until after the user is authenticated.
Was there a court order? I was under the impression there was not.
> In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities. Under no circumstances will ProtonMail be able to provide the contents of end-to-end encrypted messages sent on ProtonMail.
To be fair, I don't know if this provision was added after they had reported the instance in their transparency report.
However, I think at some point the customer should use a bit of common sense. Anyone who believes that a government may compel a company to start IP-logging their mail should be considering that in their threat model when they are looking for an e-mail provider. I don't think it needs to be plastered on the front page - especially not with advice on how to circumvent government authorities lawful requests.