Spanish police requested information from Apple, and encrypted services Proton and Wire, about a pro-Catalan independence activist.
By the way, the earlier posted article https://restoreprivacy.com/protonmail-discloses-user-data-leading-to-arrest-in-spain had an update starting at the paragraph with title Update: Statement from Proton and additional commentary
You must log in or register to comment.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.96K Posts
- 74.6K Comments
- Modlog
removed by mod
https://proton.me/legal/law-enforcement
They never said they will fight law enforcement, this is the 1000th time this happens.
OpSec fail, never ever use any personal info when you are dealing with something you don’t want to be indentified for, it include obviously recovery emails, usernames and passwords.
Do not trust companies.
Obligatory reminder:
Email is not a secure medium! If you need truly secure and/or anonymous communications, DON’T USE EMAIL!
Use a platform/protocol designed from the ground up for those things!
I love that proton kept referring to the user as the “terror suspect” repeatedly so we would know they’re really the good guy here.
Exactly. What makes this a bit complicated and maybe interesting from a historical point of view is that this is about Spain. A country which has been very slow with removing some of the “relics” from the fascist Franco era (Franco died in 1975) and at the same time having regions that long for independence like Basque country and Catalunya (and the post topic is related to that, Catalunya aiming for independence). Since the Twin Towers attacks in 2001 the words “terror suspect” and “terrorists” have been used much more often (also by ordinary “normies” people that I knew) and maybe not always rightly so.
Thanks very much for the clarification to the context, I really appreciate it as someone who had no idea.
You’re welcome.
Well it was anti terror laws that were invoked…
If you sign up for a service using real information that can be traced to you (as in this case: home address, personal email) and then do illegal* things with the account, don’t.
The * here is that what the alleged protester allegedly did or said is irrelevant. And the article is pretty clickbaity, unless the author was unaware of how online accounts work.
“helped” is very misleading. Companies can’t refuse to provide information they have when served a search warrant / court order. These companies DID NOT choose to provide the info on their own.
Yep, which I think is why it’s more important to see what data is being collected and stored, rather than giving up data based on how trustworthy an entity seems
If the tool doesn’t collect or log the data to begin with, then there’s nothing that can be stolen/taken/demanded
The solution in this case might be for Proton (and the other companies) to list out risks and data collection information along the way.
Yep, also using “requests” when they were not at all, they were demands.
You are suggesting all these companies are completely helpless against legal requests. That is not correct. A company should first make clear that the legal request is actually completely legitimate and correct. After that they can look at whether they should provide the information or not.
See the data here :
What makes you think they didn’t do that?
There is a great talk from the Lavabit CEO who discusses what happened to him and his company when they found out Snowden had an email at his company. I won’t link it since it’s YouTube but it’s an hour long but he talks about his experience with the FBI and the courts. You can search for M3AAWG 2014 Keynote, I highly recommend it.
👍 Here’s a written piece from Lavabit founder : https://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email
Are you suggesting they didn’t do those things? Good info either way.
Also there IS another alternative, the lavabit way… just go out of business /s
As someone who has worked fraud and online investigations, and both written and served search warrants; it is not an option. A probable cause affidavit is presented to a judge and if the judge agrees there is sufficient probable cause, a search warrant is issued. This is an order by the judge and not optional. The judge can hold the company in contempt if they refuse to obey his/her order.
Read the blog by the guy behind cock.li , he refused multiple illegitimate warrants so far.
What matters is the jurisdiction of the service, not the one of the warrant author, otherwise china would have already warranted all data of all other world citizens lol
Proton complies with Swiss law, and has to be channeled through Swiss official channels who rely the request.
So there’s jurisdiction.
That is true. But I wasn’t debating about this specific case, but rather the generalized statement.
The comment I replied to implies “If there is a warrant, it is always legitimate and you have to follow it, because a lawyer said so”. That is not true and if it were the world would quickly go to shit, which I pointed out.
I would say your interpretation was a bit extreme. Nobody implied a warrant from anywhere in the world.
Again, it doesn’t matter where the warrant fomes from. What matters is where it goes to.
And that detail is pretty important, while being completely left out. They say:
But yes it is, depending on the jurisdiction.
deleted by creator
I mean, there are better options, but you can also use Proton anonymously. Just have to use it appropriately. If you use it to send your name to the FBI, there ain’t nothin Proton can do about that. Same if you link a recovery email linked to a personal account.
Imagine talking about opsec and iCloud in the same sentence 🫣🤭
Oh it is for you, but you have to be careful. Proton won’t try to find out info you didn’t give them, but they can’t pretend that they don’t have info that they actually have. They run an onion service, and account recovery is made possible without a recovery contact.
Although lavabit did…
deleted by creator
I do not blame Proton for complying with a request - it is a completely expected action from a company. However, I would blame them for advertising that makes them seem safer than they are for people who don’t know better.
What kind of advertising are you referring to exactly?
Lavabit did, back in the day.
This makes me feel old.
deleted by creator
“Encrypted”
Proton and Wire didn’t share any decrypted ciphertexts, Wire shared a ProtonMail address and Proton an iCloud Address that they had set as a recovery method.
Personal info like where they live came from Apple.
I know wire and proton are encrypted. Apple services certainly aren’t though.
They didn’t require any encrypted data. Apple has your name and payment details unencrypted, as they need them to charge you.
A lot of them are, actually
Most Apple services can be encrypted including iCloud. Basically email and calendaring are not covered.
https://support.apple.com/en-us/102651#advanced
If you set it up as “advanced” then only you hold the recovery keys.
Yes. They never gave away content of emails, because they couldn’t even if they wanted to. It’s encrypted.
They gave the recovery email for the account to the authorities, which was an iCloud account tied to the user’s real name.
I know you’re correct about proton. Didn’t realize they were all like that.