news

Privacy-focused email provider Proton Mail provided Swiss authorities with payment data that the FBI then used to determine who was allegedly behind an anonymous account affiliated with the Stop Cop City movement in Atlanta, according to a court record reviewed by 404 Media.

The records provide insight into the sort of data that Proton Mail, which prides itself both on its end-to-end encryption and that it is only governed by Swiss privacy law, can and does provide to third parties. In this case, the Proton Mail account was affiliated with the Defend the Atlanta Forest (DTAF) group and Stop Cop City movement in Atlanta, which authorities were investigating for their connection to arson, vandalism and doxing. Broadly, members were protesting the building of a large police training center next to the Intrenchment Creek Park in Atlanta, and actions also included camping in the forest and lawsuits. Charges against more than 60 people have since been dropped.

Information the FBI received showed a specific person as the payment source for a particular Proton Mail account, the record shows. “On January 25, 2024, subscriber information received from the Swiss Mutual Legal Assistance Treaty Unit, revealed [full name] (SUBJECT) as the payment source for the Proton e-mail address defendtheatlantaforest@protonmail.com,” it reads. 404 Media is not publishing the person’s name because they don’t appear to have been charged with a crime, according to searches of court databases.

The record, written by an FBI Special Agent from the Domestic Terrorism squad, is an affidavit in support of a search warrant. It says the defendtheatlantaforest@protonmail.com email address is publicly listed as the primary email address on the DTAF Facebook page. The email was also listed as the point of contact on a blog that regularly shared details about actions taken against the planned training center, including spray painting a related building with a message for executives “You will drop this contract eventually, why wait to see how far we will go?” and setting another on fire. “DTAF uses the Scenes Blog and other social media platforms to encourage followers to participate in their events, and to take independent action in furtherance of DTAF objectives, to include criminal activity,” the document says.

The document says the FBI believes that whoever manages the Proton Mail account likely has administrative access to the blog. The FBI received details about that Proton Mail account from the Swiss authorities via a Mutual Legal Assistance Treaty, or MLAT. An MLAT is when authorities in one country agree to provide information to an agency in another country. These are often used when the company or entity holding the information may only respond to local law enforcement demands for data.

Edward Shone, head of communications for Proton AG, the company behind Proton Mail, told 404 Media in an email: “We want to first clarify that Proton did not provide any information to the FBI, the information was obtained from the Swiss justice department via MLAT. Proton only provides the limited information that we have when issued with a legally binding order from Swiss authorities, which can only happen after all Swiss legal checks are passed. This is an important distinction because Proton operates exclusively under Swiss law.” Functionally, though, the material was provided to the FBI.

“Proton accepts payments via cryptocurrency, cash, and also credit card. If you use a credit card, we do have access to the payment identifier which can be used to identify the credit card holder from the card issuer. We check all legal orders received from Swiss authorities and we understood that a law enforcement officer was shot and explosive devices were involved, and we verified that Swiss legal requirements were met,” he added. The FBI search warrant affidavit does not mention a shooting. Police killed Manuel Paez Terán in January 2023 at a forest protest after he fired a gun at police from inside a tent injuring an officer, records reviewed by The Guardian showed. Before the shooting, police fired pepper balls into his tent, the records showed.

The document says DeKalb Police Department arrested the person believed to be behind the Proton Mail account for alleged trespass at one of the first DTAF protests in January 2022. The document also shows the authorities obtained the person’s travel plans, and planned to execute the search warrant at the Atlanta airport.

Prosecutors in Georgia previously charged 61 people allegedly connected to Stop Cop City activity under the Racketeer Influenced and Corrupt Organizations (RICO) Act. The RICO Act is usually reserved for prosecuting mob bosses or for arguing that an organization is entirely criminal in nature. In December, a judge threw out all of those RICO charges, but five defendants still faced domestic terrorism charges. Proton Mail previously provided authorities with the recovery email address of someone allegedly connected to the Democratic Tsunami movement, which pushes for Catalonian independence.