- Local law enforcement can force the to do so.
- Locals laws can change.
- Guys with guns might barge in and demand it.
Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.
Indymedia was widely infiltrated, I think; certainly there were some infiltrators, and they often trolled that Indymedia loggeed IP addresses.
There was a tool we could use to capture addresses; they were captured to memory only, and the tool could only be switched on for a limited time; it usually got switched on for less than an hour - long enough to find and block the addresses of particularly egregious spammers and trolls.
An SMTP server could be run without address logging; but a commercial SMTP server would be damned hard to administer without IP addresses in the logs.
[Edit] Indymedia had two servers seized in the UK; one was the property of Bristol Indymedia, and didn't run Apache. The other was run by Indy UK, and didn't log addresses. There was therefore no fallout from the seizure, except that the cops hung onto it for about 5 years. When we finally got it back, we retired it - we couldn't trust it, and it was by then obsolete kit anyway.
I believe you're confusing "is not actively logging" with "will not log, even when law enforcement takes over the server" (which a court order essentially comes down to, if you don't comply). The former is what ProtonMail also does. The latter is what no company can offer.
But then we weren't a corporation. Between us, we had little to lose. We didn't have to help the cops. Protonmail is a business, so I suppose they are much more likely to roll over. Still, I'm pretty disappointed; their whole sctick is security, and they pitch to the likes of whistleblowers. It looks pretty bad to me.
The IndyUK server was seized from Rackspace, under the directions of the FBI (this was in Manchester, UK; I guess Rackspace US were leaned on by the feds, and HQ leaned on the Manchester datacenter). I think the feds kept the disks, which were encrypted.
If Rackspace just flat out refused to follow court orders, they wouldn't be able to run a data center. A DC that will comply with a court order is better than no DC imho.
Perfect is the enemy of good, and PM is definitely good at doing email with a high degree of privacy. Should you use it from your home dial-up while leaking the definite proof that reptilians are running the show? Probably not, but that doesn't make them unusable. For a lot of other threat models, they're perfectly fine, at least until proven otherwise.
Virtually no one (besides a few trained super spies) will resist and not comply once the first finger nail is coming off. Court orders are just the friendly foreplay, and they'll escalate from there depending on how important it is for them to get them to comply. If you're betting your safety on anyone withstanding that and not giving up their password, you're setting yourself up for disappointment (and pain!).
That said, if there was a third entity that removed IPs for Protonmail, maybe that could get away with it. Kind of like how Tor is functioning.
We don't know what jurisdiction this happened in - Belarus, Switzerland, or the USA. I doubt that Switzerland or the USA empower the police to force a private company to put up a bogus service on the internet - especially on behalf of China.
We also don't know whether the activist was taking advantage of Protonmail-to-Protonmail security, or whether one end of the connection was non-Protonmail.
My guess: they were logging IP addresses, at least for SMTP, and the activist was using SMTP.
Four words: The Intercept, Secure Drop. A one-way mail (content submission) system that runs exclusively on Tor, and thus can't be supboenated for users' IP address.
While I get your premise due to concerns of law, I think it is entirely feasible - and hinges on execution, marketing ability. We already have IP-hiding technology, whether Tor or Freenet or other such. The concern is "are we good enough yet to make it a sustainable business?"
For sake of example: if a hypothetical competitor to ProtonMail was to offer sign-up and email access only over Tor protocol, it would effectively be safe from police's demands to start logging IPs - thanks to technical measures. The actual difficulty is in the business side: getting enough paying customers to install & enable relevant browser or browser plugin.
Granted, the police could try to force the hypothetical competitor to install malicious JavaScript that would try to gather & leak users' IP address or other identifying information through other means, but that's solvable in the longer run just as well.
Curiously enough, we've seen anonymous services succeed for results unrelated to privacy-from-government: places like Omegle & ChatRoulette use anonymity for fun; places like 4chan use anonymity both for fun and also to avoid certain problems common to name-posting. Anonymity has long been a viable alternative put to good use in literature, arts, and entertainment. Perhaps the proper marketing would be along those lines?
- engineer troubleshooting might do so temporarily.
Assume you're an all cash business - can governments require that you take and log every customer's ID?
Good tradecraft is hard.
Signal uses an OTR variant (I believe OTR masks the identity of the sender/receiver) -- not sure how thorough their implementation and protocol are[1]. Although if authorities already have the IP of one user they might gather a list of contacts.
So long as a company exists in a world controlled by US/European finance or is in their borders, they can be compelled to log what they are told to.