Proton AG — the Swiss company behind Proton Mail, the popular encrypted email service — came under fire in April for complying with a request from Spanish police for information about one of its users — a Catalan pro-independence activist.
It’s obvious why that was a controversial move. It feels gross when the “good guys” get “sold out” by a company that promises privacy. But if you’re pissed off at Proton for complying with legal requests, you need to reassess your fantasies about privacy tech.
We all love encryption and its attached ideals. But encryption isn’t a panacea, and the more we encrypt, the more metadata matters. When it comes to privacy, metadata is an exercise in minimization — but centralized services have natural limits on how mini they can make their metadata collection.
Related: Big miners pose a growing existential threat to Bitcoin
Proton has done an amazing job limiting access to user metadata. They should get a pat on the back for building a system where all they can provide is an optional recovery email. (In this case, the company provided their user's recovery email address, which led police to their Apple account.) Instead, they’ve been met with online anons brandishing “Cancel Subscription” buttons and ominous headlines that begin with “Is Proton…” and end with question marks.
The Platonic ideal of privacy tech
The fantasy goes like this: privacy company receives formal legal request from authorities, privacy company flips off authorities, privacy company delivers news of triumph to the frenzied cheers of their fans. This expectation has reared its head multiple times, including another ProtonMail case from just a couple of years ago.
But the fantasy is delusional and self-destructive.
If Proton took this route, they’d be met with crippling legal pressure which would set the sun on the entire company rather quickly — and then we’re down to just a couple of established encrypted email providers. That’s not a useful outcome for Proton, Proton users, or privacy at large.
Proton is well aware of this, so the reality is they complied with almost 6,000 legal requests in 2023 alone. Once the shock of the news wore off and steady hands like SethForPrivacy weighed in, more people accepted that outrage wasn’t really warranted nor was it helpful.
Blaming opsec is a copout
As the story cooled down, Proton defenders pointed out that deanonymization was only possible in this case because an opt-in recovery email was provided. They say it’s actually the activist’s fault for having leaky operational security (opsec) — but this is just another unproductive iteration of the blame game.
We can’t just end this story with, ‘Oh well, you just have to have better opsec than that.’
The core question is: Can we do better?
Encryption is our baseline. We should use it, we should advocate for it, we should protect it. Proton has this and minimal metadata collection, so we’ve got a good foundation to work with here.
On top of this, the sage advice is to access Proton with a VPN/Tor (importantly, not ProtonVPN) and pay for your subscription using crypto. This message spread far and wide over the last couple of weeks — but it’s not new advice, and we’re still seeing cases like our Catalan activist pop up. People will get left behind if services require manual user hardening, and sometimes they’ll be the same at-risk people we’re trying to protect.
In the Catalan case, an email provided to sign up for an E2EE messaging app, a recovery email provided to a secure email service, and an iCloud email were the puzzle pieces required for deanonymization. These are small mistakes that anyone could make, but together they create a metadata breadcrumb trail that can be followed with relative ease.
Potential for decentralization in limiting metadata collection
Our goal should be to create tooling which is hardened out of the box, and to make damn sure any options that might jeopardize privacy are clearly described in-situ.
Perhaps decentralizing parts of the system could help us take things a step further than Proton. Decentralization is a meaningful way to reduce the amount of data that a centralized company actually needs to process in order to offer a service.
For example, building applications on top of decentralized networks capable of storing or routing the data required for a service. For an email service, that would mean storing and forwarding the mail itself — including vulnerable metadata such as subject lines and mail timestamps. That decentralized network layer would employ more advanced privacy-preserving techniques like onion routing, too. This way, a user’s IP would be better protected even if they’re not using a VPN. There are already some networks like this — such as Tor — but we’ve got similar networks that are secured and incentivised by blockchain, like the Nym mixnet.
Related: Welcome to the United Kingdom — Please hand over your crypto
Networks like Nym are generalisable for data-routing needs, and they already provide software development kits (SDKs) for integrating into third-party applications. Mixnets are pretty slow, so this might not be a good solution for instant messenger or conferencing services, but for email — it might work.
The storage side of things is more complicated, app-specific networks, like the Session Network (used by the messaging app I work on), offer ephemeral message storage in a decentralized way, but this won’t suit email — which is a de facto record-keeping utility for a lot of people.
This limitation combined with spam filters and the email mafia might make a top-to-bottom decentralized email service impractical — although it won’t stop people from trying — but we can absolutely make this work for other communication tools, like messaging, video and voice conferencing, and team communication platforms (like Slack and Discord).
In the end, legal requests are going to keep on coming — and companies are going to keep complying. It’s the way it has to be. But in cases where safety and security is critical, purposeful decentralization could offer an extra layer of protection that is vital for at-risk people.
Proton — people have already designed and built solutions that could be useful for you and your users. We can help, all you have to do is call (or, I suppose, send an email).
This article is for general information purposes and is not intended to be and should not be taken as legal or investment advice. The views, thoughts, and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.