Scandale : l'affaire Protonmail

Hello, my friends. Today I would like to talk to you about the ProtonMail scandal. So, ProtonMail is a Swiss email provider based in Switzerland that has a characteristic. It means that on their website they do not present themselves as a regular email provider, or as Gmail or something else would present itself. No, they present themselves as a particularly solid email provider when it comes to privacy. And in particular, they stated on their page that they do not store customers IP addresses. When customers come to Protomil and take out a service there, they have a form of assurance that their identity is preserved. So they are based in Switzerland. Banking secrecy, or at least what remains of it. There has been no banking secrecy in Switzerland for a very long time. The servers are in vaults, aren't they? Under the Alps and all that. But in fact, a few days ago, in September 2021, they gave the IP address of a user to the French police. An IP address that wasn't even supposed to have. Okay, it's crazy. The user in question, a climate activist. Anyway, the guy got arrested following this revelation. Okay, so what can I tell you today on this subject? First, when we think about it, forgetting the digital plan, forgetting the Internet plan, let's imagine that we are in physical life. I almost said the girl. Real life. We mustn't think in terms of location, we must think in terms of jurisdiction. For example, let's imagine that someone is wanted in France and he goes to a hotel in Lyon, a discreet hotel, right? A hotel known for its discretion. We didn't see anything. At 3am, the police come upon him. He's being picked up. Right? Despite the fact that the hotel is discreet. But the hotel is in France. It is under the jurisdiction of the French police. This same person could have ended up in a country with which there is no legal agreement with France. He wouldn't even have had to be discreet. He could have been on a terrace in a public square, doing a live broadcast on social media without risking anything. Okay? It's the same for online providers. The fact that you have an online provider, whether it's ProtonMail or something else, as long as they are in Europe, they are subject to European law. And in particular they are subject to legal agreements and extremely easy legal exchanges that can come from any European country. So wanting to move away from French jurisdiction by going to Switzerland is a dream. It's an illusion. What I criticize ProtonMail for is that for marketing reasons, they launched this idea that they don't keep the IP address when in fact they do, which is what they could have done. Which is what they should have done. And I hope if they want to exist in the future, what they could do is do the following. It's make it technically impossible on their network to capture and save the IP address. Let me give you an example. When Apple, when Apple received a subpoena from the FBI, it was during a terrorist attack in the United States. They found an iPhone on the terrorist. They gave it to Apple. They said, we demand that you open this phone and tell us what's inside. They were particularly interested in the images, the contacts and other content. Apple doesn't feel defended by saying we don't want to do it. It's a defense that doesn't work. I don't want to. They said we can't do it. Technically we don't have the ability to do it. You see the thing, there's a difference. If Apple had planned a backdoor on their iPhone, of course the various states, whether American or otherwise, for whatever reasons, for reasons of terrorism and also for purely ideological reasons and others for political reasons, for reasons of persecution, could have demanded practically, perhaps thousands of times a day that Apple open iPhones. But Apple has clearly indicated that they do not have this possibility. Where mail is screwed is that they have the possibility on demand to identify. So their system allows them to identify who did what, what IP address and it allows them to store the IPs and track them at the request of the authorities. Do you see the thing? If they had created a robust system by Design, if the ProtonMail system was designed to be robust in the sense that one day they receive a legal injunction, they can say, listen, this would cost us millions. We would have to redesign it. We would have to bring in architects and redesign our system. It might take us two years to set it up to meet your injunction. So your request is not reasonable and is not technically feasible. It is not technically feasible. You see, since their system is ultimately just a run of the mill system and we just have their words that do not keep or share the ip, well, that's it. The guy in question would have been in the United States on Gmail for example, probably. Given that, the cooperation. I'm not saying that the authorities might not have been able to obtain his ip, but what I am saying is that cooperation with American companies is more complicated than with European companies. On the European sun it would probably have been. If he had been with an American or Brazilian or Colombian or South African operator, it would have been much more complicated to obtain the ip. I will say something else. I invite you if you are an activist and you are persecuted for your ideas, you are persecuted for your political opinions, and you are afraid that someone who takes mail or other books on demand will hand over your contact details, your IP address and what they know about you to the authorities. And, well, it's a very simple thing. I'll tell you this once, I won't repeat it 1000 times, but I'll tell you this. Go to Russian operators, okay? Russian, because there's no judicial cooperation between Western Europe and Russia. It's cut off. Russia is even a country under embargo. Do you see what I mean? It means that when there is an investigation today and we try to determine who is behind this system at the moment, the moment they see that the email address or the IP address or the server or the domain or whatever is in Russia or hosted in Russia, the story ends there. Don't even bother. The story ends there. They're not going to file a letter rogatory in Russia. It doesn't work. It will be rejected, it won't be processed. So if the guy had gone to Yandex, for example, just to give you an example, Yandex, which is a huge system, if he had been at Yandex without any hassle, I'm not saying that he wouldn't have found it otherwise through other traces that he would have left elsewhere, but in any case, he wouldn't have been able to obtain his email address. So there you have it. And to tell you about Switzerland, Switzerland is not at all a reference in terms of secrecy and protection of people's data. I invite you to look it up. I can perhaps make a video one day on a company called Crypto ag. Crypto ag, okay? A company created literally in the aftermath of World War II, and which recently closed for decades. They sold encryption systems with the Swiss made label. We are in Switzerland. Data protection, secrecy. The Alps. Okay? All this crypto had been the property of the CIAE for a very, very long time, okay? And the German services, it had been infiltrated for decades and it sold its equipment to governments and armies in 120 countries. That means that 120 countries were buying infected equipment that they used for their government, for ultra confidential communications for their military. And the Americans could get in there and read it like a book. Their encryption was completely open to the Americans. There you go. And then the customer pays, okay? So Switzerland, once again, is not a reference at all. So in general, what I recommend if you are an activist, is to avoid anything related to the European Union. To start with, avoid anything related to the European Union. That's to simplify things. Uh, if you want to make it complicated, really complicated, Go to Russia. Go to Russia. You have a kind of peace of mind with regard to this kind of abusive letter rogatory. A country like France is literally the black sheep of Europe today. That's France. It's the whole of Europe. It's even the world champion today. France has letters rogatory to find out who says what in line. It's finally the new China somewhere. Okay, I'll leave you my friends, and we'll see you on another occasion, mister.