Ask HN: Complaint from Proton AG – what should I do? | Hacker News Reader

Ask HN: Complaint from Proton AG – what should I do?

49 pointsjimsi15 comments

Recently my domain register has received following abuse complaint. Honesty, I'm very shocked why they are even caring about 'groundless "facts"' and trying to take down such small amateur blog.

What do you guys think regarding this situation?

--- Dear Madam or Sir,

Our Company, Proton AG, is a provider of secured Internet services, including ProtonMail, and end-to-end encrypted email service.

We have recently been made aware of an article hosted on the website encryp.ch, and accessible via the following link: https://encryp.ch/blog/truth-about-protonmail/.

This article is highly defamatory. It claims untrue and groundless “facts” about our Company and our services, which can cause great damages to our reputation and the conduct of our business.

After investigation, it appears that the website is held by your Company.

We would be very grateful if you could take down the content of this article, and provide us with all available information regarding its author.

We remain at your disposal for further questions.

Best regards,

[redacted] Legal Counsel Proton AG ---

I don't know if it was the intent, but I read your entire article twice.

Overall, point 2 is the most interesting/troubling. I'm glad to have read it.

However, point 9 is beyond ridiculous. You claim that Protonmail devs don't use Protonmail. That's an interesting claim.

I was expecting a quote from devs making this claim.

Instead, it links to an article and uses the fact that Protonmail devs don't have an explicit @protonmail.com email address on GitHub as evidence (of the 13 devs inspected, the most common case is not having an email address public).

The article even makes this snarky remark when the dev is using Protonmail with a custom domain: 'Does not use Protonmail.com (No pride in “@protonmail.com”)'.

That's a very weak point to make compared to the seriousness of your other claims.

IANAL, but I believe .ch is Switzerland, which has freedom of speech and press. So you can say whatever you want, whether or not it is true, and are not legally obligated to take it down.

So this seems like a great opportunity to open a dialogue with a company you are complaining about and have direct discussion over your concerns. You could even update your article with their responses, and have a better post at the end of it all.

This is not my area of expertise but I am a Swiss lawyer.

- Switzerland does indeed have freedom of speech and press but this does not mean that you can say "whatever you want", not to the same extent as in the US at least.

- What could follow here is either civil or criminal litigation or both. Relevant are Art. 28 ff. of the Civil Code [1] or Art. 173 of the Penal Code [2].

- However low the chance of success for Proton AG might be here, do not "open a dialogue" and do not "explain" or "justify" your arguments further, as other commenters have suggested. I cannot stress this enough, OP.

- Faced with a lawsuit, your best option by far would be to consult with a lawyer. If that is too expensive or disproportionate for such a small blog, your second best option would probably be to ignore them to see if they acutally file a lawsuit. In this case you will still have ample time to seek counsel later.

[1] https://www.fedlex.admin.ch/eli/cc/24/233_245_233/en#book_1/...

[2] https://www.fedlex.admin.ch/eli/cc/54/757_781_799/en#art_173

Thanks for clarifying - I appreciate the correction to my admittedly non-local knowledge.

But I'd love to hear more rationale why it would unwise to open a dialogue? Not specific to this scenario, of course, but in general what risk does that expose?

All of the dialogue will probably be admissible should this eventually be litigated, OP will be corresponding with a lawyer, OP is not a lawyer, OP has substantial risk to consider about whether this dialogue would make their situation worse through e.g. admitting some of the article isn’t factual or is defamatory.

Any statements made in writing could end up being admitted as evidence. Since OP might have to prove that what they stated was factual or that they had reason to believe it was factual, they should exercise utmost caution in their correspondence. What is beneficial and what is not is almost impossible to evaluate for a "non-lawyer". People are often naive when it comes to the legal process and end up dumbfounded when the opposing party twists their every word.

Amendment to my original comment: It just crossed my mind that the federal law against unfair competition (UWG) could also be applicable.

Do not reply without a help from a lawyer unless you know how to handle a defamation case. As you ask for help, it appears you don’t.

Talk to your own legal counsel. End of story, really. Don't respond until you've had a chance to do that.

Secure email is snake oil, and Proton is the one company that tries the hardest to sell it. So I agree with your general sentiment here.

Your statements may not all be convincing arguments, but Proton they say which exact part(s) they take offense at? Because you are entitled to your opinion and your interpretation of facts.

Ignore them, or take down the post, depending on how much this situation impacts you. It’s not worth suffering or fighting uselessy, and if your blog is not that popular, this suffering is probably useless.

Choose your fights wisely.

I would respond, justifying my claims and make correspondence with Proton also public.

That will lend credence to your claims if true.

If you respond to them, you might ask them which specific statements in your article they claim are untrue.

However, you may want to consult a lawyer, since they may sue you for defamation if you don't take the article down, and you want to be aware of what the risks are. For example, even if your article's claims are justified, they can probably afford to pay lawyers much more than you can, so you may run out of money before you can even argue your case in court.

NEVER REPLY! Not unless your lawyer advises you to, it can only cost you. If you don't have a lawyer, just don't reply.

I never trusted Protonmail to begin with but i don't find your arguments so convincing, mostly because they lack evidence:

- an office building for whatever is located 1 mile away from whatever else... by that standard any NGO based in Paris or Washington cooperates with intelligence services ;)

- some shares of this private company are owned by reputable bad actors... by that standard any private corporation is malicious ;)

But yes they did behave like a honeypot ("all your data is safe and anonymous with us") all the while using "custom" (well openpgp.js i believe?) encryption strategies relying on good-faith servers. Moreover, i found it weird that a research project would have such marketing power... it's famous in IT circles that uni projects have great code but the worst PR :) (ever heard of GNU/Net? :D)

Overall, i think you may be imagining things and a title claiming "TRUTH" about proton doesn't help your case because you have little evidence. However, i believe no matter the conclusions you draw from them, the correlations you present in that article are of public interest because we may learn in the future that there were indeed hidden connections to intelligence services (of which you don't yet provide proof).

If i were you, i would certainly rename the article to "Disturbing facts" or "Alleged truth" but not claim it's an absolute truth, because you don't have hard evidence. And i would certainly add two new bullet points about:

1) Protonmail collaborating with EUROPOL in a clear case of political repression against anti-gentrification activists in Paris (and apparently they are the ones who suggested french police requested via EUROPOL), and setup IP logging specifically for that user... so even in the clearest violations they are not standing up for users if it means taking legal risks for them

2) Prontonmail joining the long list of censor trolls asking registrars about identity of domain owner?! (see also previous threads about Njalla and Peter Sunde disappointed in Proton) They broke away from a tradition of free speech (debunk claims publicly), and from a traditional form of law enforcement (first contact website owner, if it fails contact the host if the contact is obviously illegal [0], or just sue against X for defamation)

Time for some Streisand Effect?

[0] Yes contacting the registrar to obtain information or censor information is rather unusual. And let's be honest, beyond usual corporate trolls with armies of lawyers, contacting anyone to censor such vague claims on a random blog in a dark corner of the internet is also rather unusual. It's not exactly like the website is reachable at protonmailtruth.ch or whatever.

Just take it down and move on with life is probably your best option.

If it really matters, hire a lawyer familiar with such matters.

If it doesn't matter, then it doesn't matter.

Good luck.

Just ignore them.

Reply on news.ycombinator.com