“A first step in Europe” – Proton slams Switzerland's new surveillance bill at the United Nations Forum

• Proton Mail has reiterated its opposition to Switzerland's new surveillance bill
• The bill will force VPN and messaging apps to identify and retain user data
• Proton also considers the EU Chat Control proposal as a threat to its services

Privacy firm Proton hasn't shied away from its opposition to a controversial amendment to Switzerland's surveillance law – and Proton Mail's Head of Legal has reiterated this during the War, Peace and Neutrality forum hosted at the United Nations in Geneva on October 10.

Swiss lawmakers want to expand data retention obligations in the country. These are currently limited to mobile networks and internet service providers (ISPs), but would be expanded to all internet service providers with at least 5,000 users, including virtual private networks (VPNs), messaging apps, and social networks.

The measures would force these services to identify their users and collect a large amount of their data, with the details being stored for up to six months. Providers will also be required to decrypt the communication upon the authorities' request should they own encryption keys.

By introducing such an "indiscriminate data retention model," Marc Loebekken, Head of Legal at Proton Mail, said "Switzerland is taking a first step in Europe."

"This is something quite unprecedented, which we strongly believe would lead to a severe difficulty for Swiss businesses to compete, especially in the sector of digital trust, where it is fundamental to give customers power over the data," adds Loebekken.

Proton, the firm behind the highly popular Proton VPN, is not alone in feeling this way. As Loebekken pointed out, almost everybody who expressed an opinion on the matter is against, fueling a debate around what critics have deemed as "a war against online anonymity." These include other Swiss privacy providers, such as NymVPN, Threema, and Session.

"No choice but to leave"

Proton Mail first entered the market in 2014, offering a privacy-first and secure alternative to Big Tech services like Google's Gmail or Microsoft's Outlook.

Over 10 years later, much has changed. Proton now also offers one of the best VPNs on the market, a reliable password manager, and encrypted cloud storage and calendar apps. The company has also entered the world of AI chatbots recently, unveiling its own private iteration, Lumo.

All Proton's services operate under a strict no-log privacy policy, meaning that the company should never collect details that can identify users. This model can therefore not survive a requirement to de-anonymize users and store their names, email addresses, IP address logs, and other personal data.

Hence, Loebekken has reiterated Proton CEO Andy Yen's previous claim when he said that this law would make Proton less confidential than Google: the company has "no choice but to leave" if the amendment passes.

Proton has already begun to cut some ties with Switzerland over "legal uncertainty." Lumo is the first product to change home, with Germany currently hosting its servers.

The company has also confirmed it's developing facilities in Norway, while investing over €100 million to build a "sovereign European stack" for its services, ensuring it "can’t be held hostage by Switzerland" if the laws change for the worse.

Proton's goal is clear – users' privacy cannot be compromised. "Whatever problem we have today with the reliance on those [Big Tech] providers is not solved by regulation. It’s solved by having our own emerging companies competing to get viable alternatives," said Loebekken.

Beyond Switzerland

The threats against online anonymity and private, secure communications do not come only from Switzerland, though.

A push to create an encryption backdoor is also spreading across Europe, especially with the fierce debate surrounding the EU Chat Control proposal and client-side scanning technology.

"These frameworks that are being pushed are not helpful," said Loebekken.

Despite coming from noble intentions, Loebekken argues that weakening encryption under the guise of security is a dangerous trade-off that ultimately harms everyone’s security, as it cannot work from a technological perspective.

"They simply are not solutions and will create more problems," he added. "I'm not saying there shouldn’t be anything done about crimes on the platform, but it should be done in a targeted way."

You might also like

• Is Proton leaving Switzerland? "Legal uncertainty" of proposed surveillance laws is pushing them to make several changes
• "A war against online anonymity" – why Switzerland wants to change its surveillance law and what's at stake
• Encryption backdoors: privacy can be misused, "but the cost of a world without is so much higher"