Switzerland-based secure email provider Protonmail has come under fire after admitting it had to comply with a legally binding order from the Swiss authorities to collect identifying information on its users.
The information collected on an account used by a group of people, described alternatively as climate activists and anarchist squatters, was requested by the French police, who asked Switzerland to do so via the transnational Europol law enforcement agency.
After obtaining the Internet Protocol (IP) address of the person who had set up the Protonmail account, the Swiss authorities passed the information onto Europol and the French police.
French police later arrested the activist associated with the Protonmail account.
Protonmail founder Andy Yen says his company was "obligated to comply" with the Swiss order, and could not appeal it.
Yen said that Protonmail deplored legal tools for serious crimes being used in such a way, and promised to clarify the conditions under which user information will be handed over to the authorities.
He defended Protonmail's record when it comes to legal requests for user data, and said the company would never provide information to foreign governments as this is illegal under Swiss law.
Protonmail must however follow Swiss law, which Yen said provides a number of checks and balances to prevent abuse.
Swiss law also requires that users are notified if a third party requests their data to be used in criminal proceedings, Yen noted.
Protonmail also provides a virtual private networking (VPN) service that Yen said is treated differently than email under Swiss law, and the company cannot be compelled to collect user data for it.
