Surveillance: Proton relocates parts of its infrastructure from Switzerland

The planned amendments to the Swiss Ordinance on the Surveillance of Postal and Telecommunications Traffic (VÜPF) and the associated implementing provisions continue to make waves. Proton has now confirmed that the provider of encrypted communication services has begun withdrawing IT infrastructures from Switzerland due to the legal uncertainty associated with the project. The AI chatbot Lumo, which was launched in July and is supposed to offer more data protection than ChatGPT & Co, is the first product to change its location.

In a blog post on the launch of Lumo, Eamonn Maguire, Head of Anti-Abuse and Account Security at Proton, explained that the company had decided to invest outside Switzerland for fear of the impending legislative changes. In light of the Swiss government's plans "to introduce mass surveillance", which is prohibited in the EU, the provider is moving "the majority of its physical infrastructure" out of the Alpine republic. The start was made with the chatbot.

Following the launch, Proton's CEO Andy Yen told the Keystone-SDA news agency that the company had chosen Germany as the location for Lumo's servers due to the planned VÜPF reform. The company is also setting up locations in Norway. However, Proton does not want to completely pull up stakes in its Swiss homeland. "Investing in Europe does not mean leaving Switzerland," a company spokesperson told TechRadar. He did not confirm rumors that Proton would be leaving the country for good.

The EU is also pushing ahead with surveillance

According to the controversial initiative of the Swiss Federal Council and the Federal Department of Justice and Police, online services with at least 5,000 users would also have to store metadata such as IP addresses and port numbers for six months and help the police and intelligence services to decrypt content. According to the plan, there will also be a new requirement for such operators to identify users. They would have to present a copy of their ID or driving license or at least provide a telephone number.

However, the EU Commission also launched a draft regulation for mass online surveillance years ago under the banner of combating child sexual abuse (chat control). Recently, the Brussels government institution also presented a roadmap for "decryption" and a new version of data retention under the "ProtectEU" banner. The Proton spokesperson countered that the mandatory retention of electronic user traces had already been declared unlawful by European courts on several occasions. He emphasized: "However, we will of course continue to monitor developments in the EU closely. We are also doing this in other jurisdictions."

Petition with over 15,000 signatories

Proton is not the only provider to have spoken out loudly against the feared "war on online anonymity" in Switzerland. NymVPN, another provider of virtual private networks, threatened to leave Switzerland back in May if the extended surveillance requirements came into force. "You can't invest in data protection in Switzerland at the moment," Nym co-founder Alexis Roussel complained to TechRadar. The company has also already developed a strategy to locate its VPN activities outside of Switzerland and the EU. However, this would be the last resort. Due to its decentralized infrastructure, the company is not directly affected by the anti-encryption rule, as it does not store any keys itself.

Meanwhile, the Swiss civil rights organization Digitale Gesellschaft and the campaign website Campax presented the government in Bern with over 15,000 signatures of the petition "Democracy instead of the surveillance state!" against the outlined VÜPF amendment on Thursday. They warned of a massive attack on fundamental rights, data protection and digital freedom and called for the plans to be stopped immediately. The organizers also criticized the Federal Council for wanting to implement this expansion of mass surveillance by decree without parliamentary debate and democratic legitimation. All of this is more reminiscent of "Russia, China or Iran" than European countries.

(nie)