[edly]

This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear. In their transparency report, they state very clearly that they "may also be obligated to monitor the IP addresses" being used to access accounts engaged in criminal activity.

Privacy activists, for some reason, don't take the time to read transparency reports.

[dwild]

> This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear.

We are on a thread talking about them removing claims on their marketing material... that's abundantly clear to you?

Have we reached that level of expectation? That it's abundantly clear when marketing material are not saying the same thing as reports?

> In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities.

This is what the Transparency Report say too. In EXTREME criminal cases. Is it abundantly clear to you this case is an EXTREME criminal cases too? This was someone that manifested by squatting a building... is that extreme to you? My definition of extreme is a tiny bit higher, I would expect risk of life or at least a pretty large amount of money involved... not a bunch of kids manifesting gentrification.

[istingray]

> We are on a thread talking about them removing claims on their marketing material... that's abundantly clear to you?

As a Protonmail customer, thanks for saying this. There seems to be this idea that a blog post Proton made in 2014 is being "up front" about their policies.

Protonmail needs to do better.

[edly]

I agree that Protonmail has been dishonest in their marketing, but marketing =/= policies.

If you're storing any kind of information you'd rather keep private on a server you do not control and not diving into the policies and blog posts of said provider to make doubly sure they're all they say they are, it's no one's fault but your own when something inevitably happens. Either do your due diligence or blindly accept the risk. People took the second option and look what happened.

And yes, I would say an order from Swiss courts that was unappealable is an extreme criminal case. Anything that could threaten Protonmail qualifies.

[dwild]

> And yes, I would say an order from Swiss courts that was unappealable is an extreme criminal case. Anything that could threaten Protonmail qualifies.

So before this case, if I told you is someone in France trespassing enough for ProtonMail to log and provide IP, you would say sure?

My point is that this is not what most people would expect by reading extreme criminal case. If it's not what they expect, it is thus misleading.

I also wouldn't even agree that this is an extreme criminal case. What an non extreme one then? This is not an exception, this is simply a criminal case. It clearly doesn't need to be extreme to allow them to get the IP.

[edly]

Note that I have not even mentioned France.

Protonmail was forced by Swiss courts, period. Protonmail will not risk themselves for you. No client of Protonmail is worth fighting the Swiss courts over. Protonmail bowed down to the laws of the country they operate in, a smart move if they wish to continue legal operations.

If you still do not understand this fact, or that I am speaking strictly about the repercussions that a Swiss company could face by ignoring a court order from Swiss courts in Swiss law in Switzerland, then we have nothing else to discuss.

[dwild]

> If you still do not understand this fact, or that I am speaking strictly about the repercussions that a Swiss company could face by ignoring a court order from Swiss courts in Swiss law in Switzerland, then we have nothing else to discuss.

Where did I say they shouldn't have done this? I do understands that fact.

The issue isn't on what they did, it's on how they said they were protected against this but actually wasn't. We are talking about their marketing materials promising anonymity that they can't legally provide.

If that was a mere misunderstanding from their parts and they thought they could actually get away from providing the IP but couldn't actually, sure it was a simply mistake from their part to say that, I would agree with you, but you provided the proof that they knew, and you even said it was "abundantly clear" that it was the case.

I'll say the same as you, if you don't understands that part, we have nothing else to discuss. Even more so if you believe that it's fine to promise stuff that you can't legally provide.

[destitude]

What about the perception they gave that state if you were being monitored you would be notified? The part not made clear was that they could delay notifying you for months.

[Sebb767]

They did make it clear and did so before this outcry:

> Swiss law requires a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. However, in certain situations, notification can be delayed. This includes the following cases [...]

From https://web.archive.org/web/20210724054806/https://protonmai... (under "ProtonMail User Notification Policy", emphasis is mine).

[lrae]

I think he is talking about the CEOs blog post, where he does not make that clear and absolutely creates the impression that the French activist received a notification. It even sounds like that you get a notification as soon as somebody just requests it, even if PM declines / fights it. [0]

> Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding.

People will read this and the majority will think there is some kind of notification as soon as that happens. I mean, users here on HN thought that. Only if you click the link, the one that you shared, then you'll know that there are multiple situations where that notification will be delayed.

I think that is actually the worst part about the whole situation so far. One can argue that they should've made the potential logging more clear right under their no logs marketing. But pretty much doing the same stunt again with the notification, does feel a bit like intent... or stupidity.

0: https://protonmail.com/blog/climate-activist-arrest/