- Proton Mail has reiterated its opposition to Switzerland’s new surveillance law
- The bill would force VPN and messaging apps to identify and retain user data
- Proton also views the EU Chat Control proposal as a threat to its services
Privacy firm Proton has not wavered from its opposition to a controversial change to Swiss surveillance law – and Proton Mail’s legal chief reiterated this during the War, Peace and Neutrality Forum held at the UN in Geneva on 10 October.
Swiss lawmakers want to expand data retention obligations in the country. These are currently limited to mobile networks and Internet service providers (ISPs), but will be extended to all ISPs with at least 5,000 users, including virtual private networks (VPNs), messaging apps and social networks.
The measures would force these services to identify their users and collect a large amount of their data, with the details stored for up to six months. Providers will also be required to decrypt communications at the authorities’ request if they own encryption keys.
By introducing such an “arbitrary data retention model,” said Marc Loebekken, head of legal at Proton Mail, “Switzerland is taking a first step in Europe.”
“This is something completely unprecedented, which we are convinced will lead to serious difficulties for Swiss companies to compete, especially in the sector of digital trust, where giving customers power over the data is fundamental,” adds Loebekken.
Proton, the company behind the very popular Proton VPN, is not alone in feeling this way. As Loebekken pointed out, almost everyone who has expressed an opinion on the matter is opposed, fueling a debate about what critics have deemed “a war on online anonymity.” These include other Swiss privacy providers such as NymVPN, Threema and Session.
“No choice but to go”
Proton Mail first hit the market in 2014 and offers a privacy-first and secure alternative to Big Tech services like Google’s Gmail or Microsoft’s Outlook.
Over 10 years later, much has changed. Proton also now offers one of the best VPNs on the market, a reliable password manager, and encrypted cloud storage and calendar apps. The company has also entered the world of AI chatbots recently, unveiling its own private iteration, Lumo.
All of Proton’s services operate under a strict no-logs privacy policy, meaning the company should never collect details that could identify users. This model therefore cannot survive a requirement to anonymize users and store their names, email addresses, IP address logs and other personal data.
Therefore, Loebekken has echoed Proton CEO Andy Yen’s earlier claim when he said that this law would make Proton less confidential than Google: the company has “no choice but to leave” if the change is passed.
Proton has already begun cutting some ties with Switzerland over “legal uncertainty.” Lumo is the first product to switch homes, with Germany currently hosting its servers.
The company has also confirmed it is developing facilities in Norway while investing over €100 million to build a “superior European stack” for its services, ensuring it “cannot be held hostage by Switzerland” if laws change for the worse.
Proton’s goal is clear – users’ privacy cannot be compromised. “Whatever problem we have today with the addiction to them [Big Tech] providers are not solved by regulation. That is solved by having our own new companies competing to get viable alternatives,” Loebekken said.
Beyond Switzerland
However, the threats to online anonymity and private, secure communication do not come only from Switzerland.
A push to create an encryption backdoor is also spreading across Europe, particularly with the fierce debate surrounding the EU Chat Control proposal and client-side scanning technology.
“These frameworks that are being pushed are not helpful,” Loebekken said.
Despite coming from noble intentions, Loebekken argues that weakening encryption under the guise of security is a dangerous trade-off that ultimately hurts everyone’s security, as it cannot work from a technological perspective.
“They are simply not solutions and will create more problems,” he added. “I’m not saying that nothing should be done about crimes on the platform, but it should be done in a targeted way.”
