-
Privacy-focused Proton Mail handed over payment information to Swiss authorities that enabled FBI identification of an anonymous account.
-
The revealed data linked a specific individual to the Defend the Atlanta Forest movement’s email address.
-
The case highlights what information even encrypted email providers can share with law enforcement through legal channels.
A privacy-focused email service just helped law enforcement unmask an anonymous activist. Proton Mail provided payment data to Swiss authorities that the FBI used to identify someone allegedly connected to the Stop Cop City movement in Atlanta. The disclosure reveals exactly what data even the most secure email providers can share.
This revelation comes amid broader scrutiny of tech companies’ privacy practices, including the recent $68 million settlement in a Google Assistant privacy lawsuit, highlighting the ongoing tension between user privacy and data collection across the tech industry.
Court documents reviewed by 404 Media show how authorities traced an anonymous Proton Mail account back to a specific person through payment records. The account was tied to Defend the Atlanta Forest, a group opposing the construction of a massive police training facility.
How the Swiss legal process revealed user identity
An FBI affidavit from the Domestic Terrorism squad explains the paper trail. According to the document, authorities received subscriber details through Switzerland’s Mutual Legal Assistance Treaty on January 25, 2024. The information identified a specific individual as the payment source for [email protected].
This email address appeared as the primary contact on the Defend the Atlanta Forest Facebook page. It also served as the contact for a blog documenting actions against the planned training center.
The affidavit states that authorities believe whoever controls the Proton Mail account likely has administrative privileges over the blog. According to court records, the blog actively encouraged followers to participate in events and take independent action supporting movement objectives, including criminal activity.
MLATs allow law enforcement in one country to request information from authorities in another. Companies under foreign jurisdiction typically respond only to local legal demands.
What data Proton actually provided
Edward Shone, Proton AG’s head of communications, clarified the company’s role. He emphasized that Proton provided no information directly to the FBI. Swiss authorities received the data first through proper legal channels.
Shone explained, “Proton only gives out the limited details that we can reach when served a legally binding command from the authorities of Switzerland, which can primarily take place after every legal check of Swiss are passed.” The material still reached the FBI, just through an intermediary process.
He added critical context about payment methods. “Proton collects payments through crypto assets, credit cards, and cash. If you make use of a credit card, we can access the transaction identifier, which can help trace out the holder of the credit card as well as the card issuer.”
Proton verified that Swiss legal requirements were satisfied before complying. Shone noted authorities informed them of serious circumstances. “We understood that a law enforcement officer was shot and explosive devices were involved,” he stated. However, the FBI search warrant affidavit contains no mention of a shooting in connection with this specific investigation.
For context, police killed protester Manuel Paez Terán in January 2023 during a forest demonstration. Records reviewed by The Guardian showed Terán fired at officers from inside a tent, injuring one. Police had fired pepper balls into the tent before the shooting occurred.
Broader implications for encrypted services
The court document reveals additional surveillance details. The DeKalb Police Department had arrested the identified individual for alleged trespassing at an early DTAF protest in January 2022. Authorities also obtained this person’s travel plans and intended to execute their search warrant at Atlanta’s airport.
Georgia prosecutors previously charged 61 people allegedly connected to Stop Cop City activities under RICO statutes. These laws typically target organized crime networks. In December, a judge dismissed all those RICO charges. Five defendants still face domestic terrorism accusations.
This isn’t Proton’s first cooperation with authorities. The company previously provided recovery email addresses to investigators pursuing someone allegedly linked to Democratic Tsunami. That movement advocates for Catalan independence from Spain.
The incident demonstrates a crucial reality about encrypted email services. While Proton encrypts message contents end-to-end, payment metadata falls outside that protection. Anyone seeking true anonymity online needs to understand these limitations. Credit card payments leave a trail that legal processes can follow, regardless of encryption.
The dark web itself is filled with data that criminals thought was safe, including sensitive corporate information like the Comcast network plans allegedly stolen by a ransomware gang and listed for sale, proving that no data, whether personal emails or corporate infrastructure blueprints, is truly secure once it leaves your control.
