I'm seeing a lot of comments along the lines of "there's nothing ProtonMail could have done in this case."
This is patently false. The first thing they could have done is not hosted their service in a jurisdiction susceptible to these kinds of logging requests, at least not openly. In other words, they could have concealed the location of their services.
Instead, ProtonMail is attempting to have their cake and eat it too: on the one hand, they repeatedly publicize the fact that they have 'Swiss privacy laws' as a selling point, but yet on the other hand when a privacy violation such as this occurs, they claim that their hands are tied because of....Swiss laws.
> This is patently false. The first thing they could have done is not hosted their service in a jurisdiction susceptible to these kinds of logging requests, at least not openly. In other words, they could have concealed the location of their services.
Where is that ? Which country doesn't have a law that allows authorities to request such information ? I'm not aware of any, at least not among any sufficiently developed countries with useful infrastructures.
You appear to have missed a significant portion of my post:
> at least not openly. In other words, they could have concealed the location of their services.
> Instead, ProtonMail is attempting to have their cake and eat it too: on the one hand, they repeatedly publicize the fact that they have 'Swiss privacy laws' as a selling point, but yet on the other hand when a privacy violation such as this occurs, they claim that their hands are tied because of....Swiss laws.
> at least not openly. In other words, they could have concealed the location of their services.
You can't provide a paid commercial service while hiding your business entity. And, on top of that, DNS and SMTP make this basically impossible technically as well. So what you're looking for is, at least when it comes to email, something that doesn't and can't exist.
> You can't provide a paid commercial service while hiding your business entity.
You absolutely can. This is how many entities on the dark web function. And in fact, so do many entities on the clear web (see the RBN and its successors as an example).
This is patently false. The first thing they could have done is not hosted their service in a jurisdiction susceptible to these kinds of logging requests, at least not openly. In other words, they could have concealed the location of their services.
Instead, ProtonMail is attempting to have their cake and eat it too: on the one hand, they repeatedly publicize the fact that they have 'Swiss privacy laws' as a selling point, but yet on the other hand when a privacy violation such as this occurs, they claim that their hands are tied because of....Swiss laws.
It's this two-faced behavior that is deplorable.