Proton Technologies AG

Proton Technologies AG operates in the field of secure development. ON email

History

2022: Proton VPN takes servers away from India

On September 22, 2022, Proton VPN, a popular virtual private network provider, removed its physical servers from India in response to new CERT-In requirements requiring such providers to keep user activity logs for five years.

In a statement, the Swiss-based company described the new rules, which come into force on September 25, 2022, as highly regressive and representing significant government interference in people's privacy.

How India kicked VPN services out of the country

{{quote 'Proton does not intend to obey this or any other mass surveillance law. On the contrary, we are proud to invest in technology that bypasses surveillance and censorship and ensures private access for all users to the free Internet, said Andy Eun, founder and CEO of Proton. }} However, the VPN service will still be available to users in India and those who require an Indian IP address.

Шаблон:Quote 'We can't in good conscience just leave India and leave people without free internet. So we invested and introduced new protections for Indian users, "said Edward Shone, Head of Communications at Proton AG. New protection methods include smart routing servers located in Singapore that allow users to connect to Indian IP addresses from a remote server. This will help users gain secure access to the Indian Internet, but from servers physically located outside the jurisdiction of the Indian government, and therefore they are not subject to logging rules, the company said in a press release.

India has more Proton VPN VPN servers than the rest of the world and has surpassed 1,700. The company said it had a strict policy of not maintaining logs. Proton also confirmed that its other products, including Proton Mail and Proton Calendar, will continue to be available to users in India.

CERT-In management required internet proxy companies and VPN providers operating in India to collect and store confidential user data, including IP addresses, names, contact information, timestamps and data on the nature of user behavior for five years.

Proton VPN followed the departure of other VPN providers, including Express VPN, Surfshark and NordVPN. All three removed only their physical servers from India without disrupting their services.^[1]

2019: ProtonMail accused of spying on users and helping law enforcement

In mid-May, the head of the Swiss Center for Cybercrime, prosecutor Stefan Walder, made a report at a security conference. His live speech was broadcast on Twitter^[2] Swiss lawyer Martin^[3].

According to Steiger's tweets, during his speech, Walder explicitly stated that ProtonMail voluntarily offers its help to the authorities and voluntarily monitors its users almost in real time, without requiring a warrant from a federal court. As a result, Steiger published^[4] in his blog, where he spoke in detail about exactly how IT companies should act (in accordance with Swiss law) in matters of cooperation with authorities.

And although ProtonMail is a secure service with end-to-end encryption and the administration cannot know the actual content of customer emails, developers still have access to metadata. Referring to the practice of the US National Security Agency, Steiger noted that metadata can also be extremely valuable for law enforcement agencies and special services.

Steiger emphasizes that ProtonMail is based in Switzerland and uses this as a marketing advantage, citing strict Swiss privacy laws. But in fact, the service is subject to local laws, and according to Walder, allegedly voluntarily helps law enforcement agencies.

When the community and the media drew attention to Steiger's publication, Walder contacted a lawyer and stated that he was incorrectly quoting him regarding ProtonMail, but Steiger was convinced that he was not at all mistaken.

As a result, the representatives of ProtonMail themselves were forced to pay attention to the emerging scandal, who had already published the official response^[5] to what was happening. The company assures that they really comply with the laws of Switzerland, but not contrary to the rules of the service itself. Moreover, information is provided to law enforcement agencies only as part of criminal investigations and exclusively if a warrant is available. And, of course, no one monitors users proactively. "The statement that we are doing this voluntarily is completely false," the administration of the service writes.

Notes