Indian government moves to ban ProtonMail after bomb threat
androidcentral.com
androidcentral.com
The protonmail ID is actually my main Email-Id and is used everywhere, even on government sites.
Hope https://internetfreedom.in/ steps in or some other organization.
You are no longer locked into any one provider :) You can always transfer your domain and you can always transfer your email host.
I recall a blog post where an attacker got access to the blogger's domain through a social engineering attack on the registrar, and subsequently got access to their emails.
I'm curious if anyone knows the article I'm mentioning and how to prevent such an attack. I couldn't find the article back.
1. The registrar has offices in your country, so you can take legal action against them. Of course, this also means that your despotic government can force the registrar to ban you, etc.
2. The registrar is not in your country, so you depend on their benevolence to reverse the social engineering.
https://www.indiatoday.in/technology/news/story/vlc-player-h...
For example, They also banned tinted windows in cars after an assualt happened in a car. Then, there was a time where they banned something or the other on a daily basis.
Even right now there is Section 144 imposed in multiple cities - which means a "ban" on "unlawful assembly" of 5 or more people. 5 or more people in multiple cities which have a population of millions! Now, how do they enforce / check these "assemblies of people" depends on the people you ask. I have already spoken too much.
Reminds me of how India's leading research institute removed ceiling fans to prevent student suicides
https://www.indiatoday.in/education-today/news/story/iisc-ba...
This should change with the new India-Switzerland FTA though.
[0] - https://carnegieendowment.org/files/ParsheeraJha_DataAccess....
[1] - https://www.dataprivacyframework.gov/framework-article/1%E2%...
If you make an anonymous bomb threat using Gmail in India, Google will hand off all information to the Indian government as they have operations in India and will be held liable, just like they would in the US.
This is the reason why Proton AG honors American law enforcement requests - the US and Switzerland have an agreement that data platforms in both countries need to honor each other's law enforcement requests.
If Proton AG won't give User metadata without litigation in Switzerland, it will get blocked in those jurisdictions it doesn't play ball with.
This is why most piracy platforms and data platforms will honor metadata requests from US Law Enforcement - you will become a toxic financial liability if you choose to flout US litigation.
If all the available platforms allow for data sharing and tracking on judicial orders, then a perpetrator does not have a safe way to give threats, without the risk of being identified.
In my opinion, this is a deterrent in itself, the fear of getting caught.
Yes, personally even I would feel disturbed and anxious when somebody threatens me, but it would be too broad to classify mental disturbance as a safety issue. I am saying this having survived an episode where my father was threatened for life.
I agree that it's a half assed patched, but if a platform isn't responding to litigation or law enforcement requests, there is always the chance of bad actors weaponizing that loophole.
And it's not like Proton AG hasn't been linked to terror attacks. The perpetrator of the Bataclan Massacre used Protonmail to communicate with handlers, leading to the French government to require email platforms like Proton AG to honor French law enforcement requests [1].
[0] - https://www.wired.com/2015/11/isis-opsec-encryption-manuals-...
[1] - https://www.ejn-crimjust.europa.eu/ejnupload/DynamicPages/Fr...
Say what now?!
Why should you use am E-Mail provider to send an electronic postcard. Since when would you need a third party to send E-Mails?
To the best of my memory, sending emails did not require external infrastructure.
The article clearly states that all was a hoax and there weren't any bombs. The Indian government is setting up a nice slippery slope here for total political control of the Internet.
Perhaps ProtonMail would be better off if they just pulled out of the country.
Agreed. Indian jurisprudence has not kept up and is still stuck in an authoritarian mindset found in the Colonial British legal system (same problem in Pakistan, Malaysia, Kenya, and Singapore as well btw)
> setting up a nice slippery slope here for total political control of the Internet
The Indian government has always had the authority to control electronic communication due to the Indian Telegraph Act, 1885 [0] and it's equally authoritarian successor the Telecommunications Act, 2023 [1].
India always has been, and sadly, always will be an Illiberal Democracy, and for the exact same reasons that Malaysia, Kenya, and Pakistan will be as well.
It's the original sin of the British Colonial legal system.
[0] - https://en.m.wikipedia.org/wiki/Indian_Telegraph_Act,_1885
[1] - https://en.m.wikipedia.org/wiki/Telecommunications_Act,_2023
It's not for Switzerland's data sharing with the US that folks in the US have access to ProtonMail.
I assume police officers enforce / check them when they need to fill their ticket quota, want to get money through a bribe, or just want to punish someone who personally annoyed them? That's how it usually works with half-enforced laws.
In every law, there should be a requirement that it either gets enforced equally, or it loses power.
Which has 'good' uses too I suppose, as in where everyone agrees it was correct even if technical process a bit silly. (Not just cop on the street arresting 'obvious' drug dealers or whatever for unlawfully assembling, but charging mafia with tax evasion, or sexual assaulter CEOs with securities fraud.)
But.. I'm guessing the majority of unlawful 5 or more assembly cases are not 'good'.
The evil twin of this is maximized enforcement where enforcement and punishment have become a strong focus and shaping societal behavior is maybe a justification. It is the point at which we have lost our way.
If a law in place is found to be overly strict or general, then it should be changed or removed, and doing so should be simple and swift.
This would be a sweet world to live in. We'd have to change many reward systems to get there.
Pointedly, we'd have to improve public thinking - but most folks have already made their easy, positive changes. What's left are difficult positive changes and easy negative changes.
Stupidity is everywhere.
That doesn't work, either, because they tend to be rather dismissive of human concerns, and, at its heart, government is all about humans.
I don't have a solution, but I don't think that declaring that only one-or-another "class" of humans is fit to govern, is it.
It’s not perfect of course, but in my opinion it’s better than a fully democratic system.
It's probably more likely around the hyper rational types, but my boss is the most empathetic engineer I've ever worked for. This is anecdotal but your comment seems fairly clearly overbroad
That's the deal, though. Engineers and scientists don't have a monopoly on "deep thinker™".
My sister is a "deep thinker." She has an economics degree from Princeton, and has been working at very high levels, for decades.
Very decent human being. Not sure if she'd be interested in being a "leader," though.
That's part of the problem; it's almost as if wanting the job, automatically disqualifies you.
But you are right. It's an overbroad statement.
My personal favourite is "Death Stars", since it creates the mental image of some constable trying to confiscate a superlaser-equipped battlestation.
> the weapon sometimes known as a “shuriken”, “shaken” or “death star”, being a hard non-flexible plate having three or more sharp radiating points and designed to be thrown;
The argument is about proportional gain vs proportional loss and she is not aware of the devastating loss of privacy that would come from banning strong safe encryption.
Good unbiased Thinking requires effort. To optimize this there are caching mechanisms at multiple levels, from inside your brain to the societal level to save the energy required to do the thinking. If you deem that cache and all future ones to be invalid(untrustworthy) you'll have to do a lot of thinking from scratch.
If you want to practically brick such agent you'll just need to do a denial of service by bringing a huge deluge of claims that they have to spend more than their lifetime thinking through all of them critically.
Instead I'll just point out that difference in information is not difference in ability. She just wasn't aware encryption was used basically everywhere, and so could be forgiven for not having at hand the information to refute the assertion that some back doors in one algorithm or system is harmless.
Only an education in these subjects will help, or a widespread awareness campaign by educated folks. Or even a law protecting it as a fundamental right.
Just as I criticize her field all the time, and am quickly embarrassed by my presumption of hyper rational super powers. Or at least I was for years.. I'm getting better.
It is bad regulation, but it's just overzealous. Email ban is borderline censorship.
We have laws for stealing cars, we don't need to ban specific tools that, among a multitude of other uses, might be used to steal a car.
Remember to always put someone with no knowledge of guns in charge with making gun laws.
I think every jurisdiction should put limits on how tinted the windshield and front windows can be. Being able to see where a driver is looking is important in many situations in order to avoid collisions. It's especially important for pedestrians and cyclists that have to cross the path of cars.
This is not about protecting the person tinting their window, but everyone around them. As such, it doesn't even qualify as government hand holding. Your not protecting someone from themselves.
This is the classic reaction of any government. I assure you Indian one is not in any way unique. That's why you need a strong constitution and an independent constitutional court - hardly possible, but at least it's a goal.
They are controlling it because they absolutely understand, and can give a narrative of how anonymity can be used for nefarious purposes.
I support banning of tinted glasses, because, for the population and education level here, these measures are necessary. Because one rape is too many, and what is to be done ought to be done. For those unaware, this ban on tinted glasses in a car or a vehicle came about when there were a spate of rapes and assaults on women done in a moving car with tinted windows.
Unlawful assembly laws are there in many countries.
https://en.wikipedia.org/wiki/Unlawful_assembly
In India, it is used often, but generally when there is a communal angle involved. India sees many rallies and protests (there is one massive one going on right now).
A moving car? Gee, wonder why they didn't ban moving cars as well.
Protonmail can only end-to-end encrypt email when the receiver is also using Protonmail. The email spec has no support for a universal encryption method, one of the reasons we'd be better off not using email at all today.
They also don't explain how the inability to track the sender's IP is specific to Protonmail. Unless I missed a key feature, Protonmail doesn't do anything to hide or obscure the sender's IP.
The issue is India doesn't have a judicial agreement with Switzerland over data sharing (which includes User IP Addresses) for criminal investigations [0] while the US does [1], and Protonmail only honors Swiss litigation [2]
This should change with the new India-Switzerland FTA though.
[0] - https://carnegieendowment.org/files/ParsheeraJha_DataAccess....
[1] - https://www.dataprivacyframework.gov/framework-article/1%E2%...
My point was just that singling out Protonmail doesn't make sense and misses the point on how email works.
A platform is default allowed until it denies to comply with Law Enforcement Requests. When that happens, a platform can by denied/blacklisted.
This is why Protonmail is blocked in India and not Gmail or Yahoo.
If Proton AG decided to ignore US Law Enforcement requests, it would get shut down the same way. This exact thing happened to Lavabit in 2013.
I don't know for sure if India is Common Law, though given its history with the British Empire I would guess that it isn't.
Former British Dependencies like India, Malaysia, Singapore, Canada, South Africa, New Zealand, Ireland, and Australia are ruled under Common Law with additional colonial authoritarian flourishes, as these dependencies could be overruled by Westminster until the mid-late 1900s.
England, Wales, and North Ireland are themselves Common Law, and it's somewhat common for Indian lawyers to cross apply to join the English Inns of Court as well. That said, modern India is starting to transition towards an American style common law system over the British one, as America has way more of an impact in India today.
Civil/Roman/Latin Law is a continental thing. You'll see influences of it in former Spanish, French, and Russian colonies.
Email supports end to end encryption between any two servers. You set each server up with a list of supported protocols and denied protocols.
If either side can't agree on the encryption algorithm, then the email does not go through.
If both sides do agree, which is almost always the case if both sides are using industry standard encryption methods, then the email is end to end encrypted.
On top of that, we have PGP encryption which allows the user to encrypt the email from everybody including the email provider. Only the recipient email address and possibly the subject line would be readable to the email providers.
As for the IP, if protonmail removes the sender's origin IP then it's removed and that's it.
Email is one of our best methods of international communication available today.
Regardless, if I'm not mistaken encryption protocols are layered on and not part of the official email spec. I'm not 100% on that so may it was added to the spec as an optional feature, but by no means is it common (especially with the market share Gmail owns).
If you want end to end encryption, both ends can just run their own email servers.
But there's also server side encryption that is end to end. If both the sender and recipient uses a trusted mail server that uses encryption then nobody between the two can see the email.
Considering how tech aware they are, I'm sure there are hundreds of thousands of indian gov email acounts with passwords like 1234...
https://apnews.com/article/india-chinese-spy-pigeon-f3543790...
Not in Canada. Google has been very clear they don't give anything to law enforcement without a warrant.
Where are you getting your information from? Because its very scary if true.
I grew up in India when it was a relatively secular state. For example, when the Babri Masjid (mosque) was destroyed by Hindus in the early 90s, the national magazine, India Today and major newspapers led with the headline, "India's Shame" and acknowledge how bad that was for Indian secularism.
Less than a month ago the same mosque was now converted into a Hindu temple and the press and government led the cheerleading.
https://www.aljazeera.com/news/2024/1/22/why-is-indias-ram-t...
2. Ethno-nationalist state: what ethnicity are we talking about here? BJP loses often in elections locally, and majority of their opponents are Hindus.
What India has always been is illiberal. You are weakening your point by exaggerating the current conditions.
Moreover this prosed ban is because we have an overzealous bureaucracy that doesn’t understand technology and does not care to. It’s got nothing to do with what India has become.
Indian administrations have always have had an authoritarian bent regardless of who has been in power.
Not all the facts provided, just a one sided view that is parroted repeatedly in online forums with the intention of claiming a moral high ground when the facts are far more complex and intricate.
Exactly.
Thankfully, religion as a whole is becoming increasingly irrelevant among new generations as Western individualism takes over. This incident will hopefully be remembered just as an appeasement tactic for old to middle-aged people and not an escalation.
Many would say that doesn't change anything because they think that Indian supreme court is just another tool in the hand of Modi's government [1] [2] [3].
[1] https://www.lemonde.fr/en/international/article/2023/12/27/i...
[2] https://www.theatlantic.com/international/archive/2024/02/wh...
[3] https://www.lawfaremedia.org/article/india-s-justice-system-...
Whether or not Modi's government has undue influence over the judiciary is still up for debate, but in this particular case, I fail to see how it could have made a difference either way.
Give a judgenent that offends least number of people, be it right or wrong.
You know how that sounds like? A corrupt judiciary that's at the whims of satisfying the ego of masses.
Btw
>The incident, which resulted in heavy casualties, had shaken the entire nation and the collective conscience of the society will only be satisfied if the capital punishment is awarded to the offender.
This quote from an actual judgment made by supreme court of India literally says so. To satisfy collective consciousness of masses, a man must die
Part of the factors they have to consider is for the people to be sufficiently satisfied that justice was done. After all, the system relies on the people having confidence that the system works. The perpetrator of a brutal rape and murder not being given the death penalty when the entire country is out on the streets demanding his blood, would be a grave miscarriage of justice (as long as he was indeed the perpetrator).
Especially with the case of the masjid, there wasn't going to be a right answer either way, as Hindus also made a historical claim to the land.
Arguably the most diverse country in the world is an ethno-national state?
Has such a time ever existed?
Plus, India has a long record of kneejerk censorship. There was the incident with GitHub back in 2014, and even before then there have been many cases of the national or state governments censoring material that could be construed as criticizing them or material they could construe as supporting a terrorist movement.
I don't understand, some people here just really have a beef with India/Hindus.
ProtonMail is accessible over Tor, but they don't allow registration/verification over Tor.
They do now.
This is at the request of a state police of Tamilnadu.
This particular state in India is ruled by a Party that's against Modi and his party.
Question here, why can't Protonmail cooperate with the police investigating bombing threat against schools ?
- practically nobody uses the service in the country (especially when dealing with hundreds of millions connected on the internet), and for some this might have a streissand effect. - those using such services for nefarious reasons would have little to no reason to abide by it. IT law enforcement is already very ineffective as it is, and would only be used as a lever when dealing with cases the administration has special interest in. - this is not really a matter of encryption but about data sharing arrangements with other countries (as correctly pointed out in the comments). funnily enough it is against the law to refuse decryption (https://en.wikipedia.org/wiki/Information_Technology_Act%2C_...).
Is this native advertisement? There are many other choices, some of them being as good if not better. A few of them are small mom-and-pop businesses which didn't take on investment, and won't enshittify ( https://en.wiktionary.org/wiki/enshittification )
* https://www.privacytools.io/privacy-email * https://github.com/pluja/awesome-privacy?tab=readme-ov-file#...
As a PM user, would I stop receiving a ton of spam from Indian addresses?
Unable to trace the IP address of the sender and failing to get assistance from Interpol, the Tamil Nadu police put in a request to India's Ministry of Electronics and Information Technology to block access to ProtonMail within the country"
Ban the phone system!
Every state has a Anti-Swatting Litigation Task Force within their AG now to take Telcos to court over swatting incidents.
On the other hand, India doesn't have a judicial agreement with Switzerland over data sharing for criminal investigations [1] (while the US does [2]), and Protonmail only honors Swiss litigation [3]
This should change with the new India-Switzerland FTA though.
[0] - https://portal.ct.gov/AG/Press-Releases/2022-Press-Releases/...
[1] - https://carnegieendowment.org/files/ParsheeraJha_DataAccess....
[2] - https://www.dataprivacyframework.gov/framework-article/1%E2%...
In practice it means that it's a massive pain to get a local number when visiting family.
VOIP intra-country is also illegal, but it's not clear if that's regulatory capture or for similar "national security" grounds.
The reason given doesn't matter that much... they give whatever reason they think most people will approve.
If you are Uighur ethnicity you need to use a special government issued “phone” or force installed app. They really use it as a tracking device.
https://www.hrw.org/news/2019/05/01/interview-chinas-big-bro...
so apparently a child was abducted and one thing led to another and the child was recovered so the child revealed how he was shown tom and jerry cartoon.
the police then went on a fishing trip and literally cross referenced which user in a particular area watched tom and jerry on youtube at a particular time/date to find the cuprits.
if this wont get your antenna up, i dont think anything else will
proton thing is normal compared to this
What do you use to by-pass censorship ?