Steiger Legal

It looks like multiple people consulted lawyers because of the implied legal threat. OP isn't the only one who took this somewhat seriously.

Attorney: "is this Princeton privacy study email that one of my clients received legitimate?"

https://twitter.com/jdigiacomo/status/1470756584435249152

"Wow. I actually contacted my attorney over this email inquiry to see if I actually needed to respond and if so, how."

https://twitter.com/NerdPress/status/1472340768933113859

"our clients have spent around $10k aggregate trying to understand what these requests related to, and whether this was a coordinated mass phishing attempt"

https://twitter.com/FDTaisce/status/1471970527132618757

An attorney in Switzerland: "Wir wurden von Mandantinnen und Mandanten gefragt, wie sie auf diese E-Mails mit Fragen nach ihrem Umgang mit datenschutzrechtlichen Anfragen reagieren sollen." ("We have been asked by clients how they should respond to these emails with questions about how they handle privacy-related inquiries." (DeepL))

https://steigerlegal.ch/2021/12/16/datenschutz-gefaelschte-anfragen-dsgvo/

Three *different* attorneys in this thread report having clients reach out to them:

(1) "As outside privacy counsel, these are so frustrating. First one I saw cited being a CA resident so more alarming. Now for those interested\able to learn it's more time and education as they think any request must be scams now. Plus how many clients won't reach out next time?"

(2) "As in-house counsel, my…

Martin Steiger also responded. Addendum 2 in his blog article [1]:

Tonight, on 29 May 2019, ProtonMail responded to this article with a blog post entitled „Response to false statements on surveillance made by Martin Steiger“. (This article was published on 23 May 2019 and not „earlier today“ as claimed by ProtonMail.)

ProtonMail claims that this article is „factually incorrect“ and states first and foremost that it does not voluntarily offer assistance for real-time surveillance. Apart from that, ProtonMail does not respond to the many points raised in this article.

ProtonMail essentially refers to my addendum, where I point out that the public prosecutor in question contacted me, saying he had been misquoted. ProtonMail of course „forgets“ to quote my full addendum and shows an incomplete screenshot of my addendum. ProtonMail quotes only the part with the public prosecutor’s claim and not my explanation why I am confident that the public prosecutor was not misquoted. ProtonMail also claims that the addendum is „hidden at the bottom of Mr. Steiger’s article“, although it is linked right at the beginning of this article.

In a direct email to me, ProtonMail’s legal department confirmed that real-time monitoring could be carried out. The legal counsel of ProtonMail now argues that ProtonMail is after all a provider of derived communication services and that having to tolerate surveillance carried out by the Swiss Federal Post and Telecommunications Surveillance Service…

Oh I think there was a misunderstanding here! I never intended to say FastMail was worse than Google. FastMail (IMO) is still a better choice for lots of reasons.

As for ProtonMail: Yes, I've been a ProtonMail customer for about half a year now. However I'm really dissatisfied on a number of ends:

<opinion>

- the bridge is a bad solution and it doesn't work well

- the bridge doesn't exist on Android, tying me into their own client

- their own client is proprietary and has GSF dependencies (optional, but still - privacy?)

- (this might be due to technical constraints so it might be not valid but) they generally seem to have an aversion against standards

- their technical team is slow and deadlines are (from what I've seen) meaningless

- (possibly FUD but) the recent drama [1]

</opinion>

Don't get me wrong they're doing important work. And I believe them in the sense that they can do cryptography well and they're bringing (a good amount of) privacy to the masses. But they're not less problematic than any other major provider I'm aware of.

In the end it boils down to everything sucks™.

[1] https://steigerlegal.ch/2019/05/23/protonmail-real-time-surveillance/

You 'forgot' to copy the full addendum. It reads as follows:

'Public prosecutor Walder of the Competence Center Cybercrime contacted me, saying he had been misquoted. He claims that had not divulged at the above-mentioned event that ProtonMail voluntarily releases real-time data. He had merely described ProtonMail as a potential provider of derived communication services (PDCS).

I was live-tweeting the event, including the interesting presentation by public prosecutor Walder. The remark that ProtonMail was a (potential) PDCS would have been too trivial to be live-tweeted. The insight on the other hand that ProtonMail voluntarily offers assistance for real-time surveillance, was spectacular and I therefore live-tweeted the statement. In its transparency report, ProtonMail – as mentioned above – itself refers to at least one case of real-time surveillance.'

https://steigerlegal.ch/2019/05/23/protonmail-real-time-surveillance/#addendum

Important: The English text is just an unofficial translation.

Why was this comment dead? From this article (https://steigerlegal.ch/2019/05/23/protonmail-real-time-surveillance/) it appears to be true:

>In its transparency report, ProtonMail explicitly mentions the possibility of real-time surveillance („ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities“). ProtonMail even mentions a current case of real-time surveillance:

>"In April 2019, at the request of the Swiss judiciary in a case of clear criminal conduct, we enabled IP logging against a specific user account which is engaged in illegal activities which contravene Swiss law. Pursuant to Swiss law, the user in question will also be notified and afforded the opportunity to defend against this in court before the data can be used in criminal proceedings."

Founders with US affiliation/physicist creating crypto products [1], faulty claims how the relevant Swiss law (BÜPF) applies to them [2], doing crypto in JavaScript on the client side, etc. To me, this smells like Crypto AG [3][4].

[1] https://proton.me/about/team

[2] https://steigerlegal.ch/2019/07/27/protonmail-transparenzbericht-buepf/#buepf-anwendbarkeit

[3] https://en.wikipedia.org/wiki/Crypto_AG

[4] https://en.wikipedia.org/wiki/Operation_Rubicon