Proton Mail Incident Highlights Encryption Limits

In April, Proton AG, the Swiss company known for its encrypted email service Proton Mail, faced criticism for complying with a Spanish police request for user information. This information was about a Catalan pro-independence activist. The company’s decision was controversial because Proton Mail is renowned for its privacy commitments, and many users felt betrayed. It’s essential to reassess expectations about privacy technology in light of this incident.

Encryption is a valuable tool with many idealistic attachments, but it isn’t a cure-all. As more data becomes encrypted, metadata, which is necessary for email services, becomes more meaningful. Privacy-focused services like Proton Mail strive to minimize metadata collection, but there are inherent limits to how much they can reduce it. Despite these limitations, Proton Mail has made significant strides, requiring only an optional recovery email from its users. The recovery email in this case led the police to the user’s Apple account, which many found disheartening.

The incident triggered a significant backlash, with some users threatening to cancel their subscriptions and raise alarmist questions about Proton Mail’s reliability. The public often imagines a privacy company standing up to legal requests defiantly. Such fantasies are unrealistic and potentially damaging. If a company like Proton refused to comply with legal requests, it would face substantial legal challenges that could jeopardize its existence. This outcome would be detrimental not just to Proton Mail but also to the broader privacy technology landscape.

Proton Mail’s compliance with almost 6,000 legal requests in 2023 is a testament to their understanding of the legal landscape. Once the initial outrage subsided, more level-headed commentators recognized that condemning Proton Mail was neither useful nor justified. Some defenders of Proton Mail attributed the situation to the user’s operational security, suggesting that better practices could have prevented the deanonymization. This perspective is not entirely productive and glosses over broader issues that need addressing.

The core question remains: Can we enhance the security and privacy of our communication tools? Encryption is a foundational element, but it’s not the only part of the solution. Using Proton Mail through a VPN or Tor and paying for services with cryptocurrency are good practices but are not foolproof. As long as users have to manually fortify their security, some will inevitably fall through the cracks, making it crucial to build more robust systems by default.

The mistakes made in the Catalan case were relatively minor — an email used for an end-to-end encrypted app and a recovery email linked to a secure email service were among the few pieces of metadata that led to deanonymization. These simple errors highlight the need for better-built privacy tools that minimize such risks from the start.

Potential solutions for better metadata protection might involve parts of the system being decentralized. Decentralization can significantly reduce the amount of data a centralized company needs to handle. For instance, decentralized networks can manage data storage and routing for services like email, protecting sensitive metadata such as timestamps and subject lines through advanced techniques like onion routing. This approach could enhance user privacy, even if they don’t use additional tools like VPNs.

While some decentralized networks, like Tor, already exist, blockchain-secured networks such as Nym offer further possibilities. These networks can be integrated into applications using existing software development kits, but their slower speeds may limit their practicality for instant communication services. Despite these limitations, they show promise for applications where speed is less critical, such as email.

Legal requests from authorities are an unavoidable reality, and compliance from companies is necessary. The introduction of decentralized solutions could provide an added layer of protection for those needing enhanced security. These methods and technologies are not just theoretical; they are available and ready for integration. Companies like Proton could benefit from exploring and adopting these innovations to better protect their users going forward.