Proton Mail handed payment data for an anonymous account to Swiss authorities, who passed it to the FBI. The account — defendtheatlantaforest@protonmail.com — was linked to the Stop Cop City protest movement in Atlanta. According to court records reviewed by 404 Media, the payment trail let the FBI identify the person behind the address.
The FBI obtained the data through an MLAT (Mutual Legal Assistance Treaty) request dated January 25, 2024. Swiss authorities fulfilled it and provided a bank card identifier tied to the Proton Mail account. That single piece of financial metadata was enough: the FBI matched the card to a name. The affidavit, written by a special agent from the FBI's Domestic Terrorism squad, states the agency planned to detain the suspect at Atlanta's airport using flight records obtained separately.
Stop Cop City opposes a $90 million police training center in Atlanta's Weelaunee Forest. The FBI and Georgia Bureau of Investigation (GBI) were investigating members of Defend the Atlanta Forest (DTAF) for alleged arson, vandalism, and publishing personal data of officials and contractors involved in the project. The defendtheatlantaforest@protonmail.com address appeared on the group's Facebook page and was listed as the primary contact for the DTAF blog, which published protest coordinates and contractor addresses.
"Proton did not provide any information to the FBI," Edward Shone, head of communications for Proton AG, told 404 Media. "The information was obtained from the Swiss justice department via MLAT. Proton only provides the limited information that we have when issued with a legally binding order from Swiss authorities, which can only happen after all Swiss legal checks are passed."
Shone is technically correct. Proton never contacted the FBI directly. But as 404 Media noted, the information "functionally" ended up with the Bureau through the Swiss legal chain: Proton → Swiss court → FBI. According to Gadget Review, Swiss authorities verified before fulfilling the request that the investigation involved incidents including a shooting and the use of explosives — a reference to a January 2023 confrontation in which police shot and killed activist Manuel Esteban Paez Terán during a forest clearing operation. The FBI's search warrant affidavit itself does not mention a shooting.
Proton's email encryption was never compromised. End-to-end encryption protects message content: neither Proton nor any government can read it. Payment data sits outside that protection. Card details are processed by payment providers and subject to financial regulations — Proton stores whatever the billing system requires to process the subscription.
The pattern is not new. In 2024, Proton disclosed the recovery email of a member of Democratic Tsunami, a Catalan independence organization, to Spanish authorities via the same Swiss legal channel. Apple then provided identifying information from the linked iCloud account to Spain's Guardia Civil, according to TechCrunch. In 2021, Europol compelled Proton to log the IP address of a French climate activist — despite the company's stated policy of not logging IPs by default. In all three cases, the users were activists. None had been convicted of violent crimes. The compromised data was metadata — payment records, recovery emails, IP addresses — not encrypted message content.
Alex Lekander, editor-in-chief of CyberInsider, wrote that the case reinforces a basic operational security (OPSEC) principle: "the importance of operational security when using encrypted services cannot be overstated." He recommended avoiding identifiable payment methods, limiting recovery information, and using network anonymity tools.
Proton accepts cryptocurrency and cash by mail as payment methods. Both break the link between account and identity. A bank card does not. As of March 6, 2026, no charges have been filed against the account holder identified in the FBI affidavit. A Georgia judge threw out all RICO charges against 61 Stop Cop City defendants in December 2025, though five still faced domestic terrorism charges at the time, according to 404 Media.
In all three known Proton disclosure cases, the affected users were activists (Catalan independence, French climate, American anti-police-facility). In none of the cases was the email encryption itself broken — the leaked data was always metadata: payment info, recovery email, or IP address. This is a structural limitation of any encrypted service that handles billing through traditional payment rails.
Have a story? Become a contributor.
We work with independent researchers and cybersecurity professionals. Send us a tip or submit your article for editorial review.
