Encrypted email provider Proton AG has come under renewed scrutiny after it provided payment-related information to Swiss authorities in connection with an investigation tied to the “Stop Cop City” protest movement in Atlanta. The information ultimately helped law enforcement identify the individual behind an anonymous email account used by activists.
The case involves the privacy-focused email service Proton Mail and an account reportedly associated with the address (email protected)which was linked to organizing and communication related to protests against the planned police training facility in Atlanta. Protesters have widely referred to the project as “Cop City,” and the movement opposing it has attracted national attention in the United States.
Authorities were able to trace the identity behind the account not through the encrypted emails themselves but through financial data tied to the account’s subscription. The development has sparked renewed discussion about the practical limits of anonymity offered by privacy-focused online services.
Investigation Initiated Through International Legal Request
The data request originated with the Federal Bureau of Investigation, which sought assistance from Swiss authorities as part of an ongoing investigation related to protest activity in Atlanta. The request was made under the framework of a Mutual Legal Assistance Treaty, a legal mechanism that allows governments to obtain evidence from foreign jurisdictions during criminal investigations.
According to available information, the request was submitted on January 25, 2024asking Swiss authorities to obtain records associated with the Proton Mail account believed to be involved in the protests.
Swiss authorities reportedly reviewed the request before approving it, determining that the case involved allegations of serious criminal activity, including references to violence during demonstrations. Once the legal basis of the request was verified, Swiss officials authorized the release of limited data connected to the account.
The information that was ultimately shared consisted of payment details related to the account’s subscription. Investigators were able to use this information—specifically a credit card identifier—to trace the account back to a real individual.
Proton Says It Followed Swiss Legal Procedures
Proton AG has emphasized that it did not provide information directly to U.S. investigators. Instead, the company stated that it responded to a legally binding order from Swiss authorities, which were handling the request under their own legal system.
Because Proton is headquartered in Switzerland, it is subject to Swiss law and must comply with court orders issued by local authorities. In cases involving international investigations, requests from foreign governments are typically processed through treaties such as MLAT agreements before companies are required to respond.
In this instance, Proton provided the requested data to Swiss authorities, who then passed it along through official international channels.
While the distinction is technically significant from a legal standpoint, privacy advocates note that it does not necessarily change the outcome for users whose information may ultimately reach foreign law enforcement through international cooperation.
Encryption Protected Emails but Not Billing Information
Proton Mail has built its reputation around end-to-end encryption, a technology designed to ensure that email content remains unreadable to anyone other than the sender and recipient—including the company itself.
In this case, there is no indication that investigators gained access to the actual content of emails sent through the account. The encryption system appears to have functioned as intended, protecting the messages from outside access.
However, the case illustrates an important limitation of encryption-based privacy services: while communication can be protected, other types of data connected to an account may still be accessible.
Billing information, for example, often involves traditional financial systems such as credit cards or payment processors. These transactions leave records that can be accessed through legal channels.
As a result, even when communications remain encrypted, the identity of a user may still be revealed through financial data linked to the account.
Alternative Payment Options Exist but Are Not Always Used
Proton has previously acknowledged that payment methods can affect the level of anonymity users maintain. For that reason, the company offers several alternative ways to pay for its services, including cryptocurrency and cash payments.
These options are intended for users who wish to minimize the financial paper trail associated with online services.
Credit card payments, by contrast, typically require identifying information and create transaction records that can be accessed by financial institutions and, in some cases, by law enforcement through legal requests.
The Stop Cop City investigation highlights how such records can become a key piece of evidence in identifying users who might otherwise appear anonymous online.
This is not the first time Proton has been compelled to share limited user information as part of a criminal investigation.
In a previous case involving the Catalan independence movement, authorities obtained information connected to an activist linked to the group known as Democratic Tsunami. In that instance, Proton reportedly provided a recovery email address associated with the account after receiving a legal order.
In another widely discussed case, a French climate activist became the subject of an investigation in which authorities required Proton to begin logging the individual’s IP address. That request reportedly involved cooperation with the European law enforcement agency Europol.
Both incidents followed a similar legal process in which foreign law enforcement agencies submitted requests through official channels, Swiss authorities reviewed and approved them, and Proton complied with the resulting orders.
Comments are closed.