Debunking Proton and CIA/NSA fake news
https://www.reddit.com/r/ProtonMail/com … fake_news/
For a while, there have been rumors alleging essentially that Proton Mail or Proton VPN are CIA/NSA honeypots. It's an incredible claim, and while it’s generally not worth debunking conspiracy theories, this one makes it pretty easy due to how bad the claims are, so let’s do it once and for all.
The claims are essentially the following:
Proton’s onion site redirects to the non-onion site for sign-up.
This hasn’t been the case since the new Proton Tor site launched: https://proton.me/blog/updated-tor-site. But even if it was the case, this does not compromise any of Tor's security guarantees. You're still connecting via Tor Browser (we all know Tor Browser is capable of browsing clearnet sites without compromising anonymity).
2. Proton Mail does not provide “End-to-end encryption”.
This is incorrect, Proton provides E2EE. What it doesn't provide is a zero-trust security model (which no other app provides) as you still must trust the web or mobile apps. But if that’s your threat model, compile the open-source mobile apps on your own, use Proton’s open-source desktop bridge software, or one of the independent clients out there.
3. Proton Mail was created by the CIA/NSA.
The basis for this allegation seems to be the fact that some people at Proton have links to MIT, and some MIT people (not the same people) have links to the CIA/NSA. This claim is of course absurd. For instance, RSA encryption was also invented at MIT. Proton, as a company created by scientists, has connections to most of the world’s top research universities, but that doesn’t make Proton a CIA/NSA front.
4. Proton is partly owned by CRV and the Swiss government.
This is easy to refute also. Proton is supported by FONGIT, a Swiss non-profit foundation. As a private non-profit foundation, FONGIT is not owned by the Swiss govt (a non-profit foundation by definition has no owners). Charles River Ventures once held a small stake in Proton, but this is no longer the case today. Even if it were true, it’s a stretch to claim that receiving funds from venture capital compromises user security/privacy, particularly for open-source software.
5. CRV is linked to In-Q-Tel & the CIA.
There’s no link between CRV, In-Q-Tel, and the CIA.
6. Proton Mail follows the CIA Email format.
Proton Mail uses *.eml for email storage? Wow, amazing! Proton Mail uses a common, standard format for email storage used by every email service. It must be the CIA! :D
There are also some claims about email metadata. Email metadata is, as a protocol limitation, not protected by end-to-end encryption. This is a limitation of email and OpenPGP itself, not Proton Mail doing something shady.
7. Swiss MLAT law gives the NSA full access.
This is simply false and no such thing appears in the Swiss MLAT treaties.
8. Proton Mail uses Radware for DDoS protection.
Allegedly, because Radware is an Israeli company, Mossad has access to Proton Mail. This is technically impossible due to the way DDoS protection works (the GRE tunnels cannot bypass encryption). End-to-end encryption also means Proton itself can’t decrypt user accounts. Finally, Proton has not used Radware since 2018.
9. Proton works with law enforcement
Arguably, if Proton was a CIA/NSA honeypot, there would be no need for law enforcement cooperation. On a more serious note, Proton is based in Switzerland, not in international waters, so yes, Proton will follow Swiss court orders, but the power of Swiss authorities is limited (especially compared to say the US), even more so after Proton won in the Swiss court in 2021: https://proton.me/blog/court-strengthens-email-privacy.
In short, these claims can all be easily debunked with publicly available information. And while it is impossible to conclusively prove the opposite (that Proton can 100% be trusted), there are many indicators of trust, as outlined in the following link, particularly for VPN where trust is paramount: https://protonvpn.com/blog/is-protonvpn-trustworthy/.
