Security

Encrypted services Apple, Proton and Wire helped Spanish police identify activist

Comment

Students protest in Barcelona, Spain, on 17 October 2019 demanding the Freedom of jailed separatist leaders. Thousands of students have taken to the streets to publish their outrage with the ruling of the Superior Court towards the independence leaders. (NurPhoto / Contributor/Getty Images)
Image Credits: NurPhoto / Contributor / Getty Images

As part of an investigation into people involved in the pro-independence movement in Catalonia, the Spanish police obtained information from the encrypted services Wire and Proton, which helped the authorities identify a pseudonymous activist, according to court documents obtained by TechCrunch.

Earlier this year, the Spanish police Guardia Civil sent legal requests through Swiss police to Wire and Proton, which are both based in Switzerland. The Guardia Civil requested any identifying information related to accounts on the two companies’ respective platforms. Wire responded providing the email address used to register the Wire account, which was a Protonmail address. Proton responded providing the recovery email for that Protonmail account, which was an iCloud email address, according to the documents.

In the request, which listed “organised crime” and “terrorism” as the nature of the investigation, Spanish police wrote that it wanted to “find out who were the perpetrators of the facts taking place in the street riots in Catalonia in 2019.”

Once the Guardia Civil obtained the iCloud email address, the documents show that it requested information from Apple, which in turn provided a full name, two home addresses and a linked Gmail account.

TechCrunch is not revealing the alleged full name of the activist, given that it is unclear if that person is really behind these activities, nor that they have committed any crimes.

Apple did not respond to a request for comment.

Encrypted online services typically aim to reduce the amount of user data they can access by encrypting it with keys that only the user has, effectively preventing the companies from handing over user data subject to a court order. Police instead tap companies for their metadata, such as identifiable information about the user, including email addresses.

Spokespeople from Wire and Proton confirmed to TechCrunch that they received legal requests from the Swiss police, and that they complied with the requests.

“Upon a formally correct request by the Swiss authorities, Wire provided basic account information about a user. Wire is not able to see or disclose the content of any data transmitted over its service,” Wire spokesperson Hauke Gierow told TechCrunch in an email.

Proton spokesperson Edward Shone told TechCrunch that, “Proton has minimal user information, as illustrated by the fact that in this case it was data obtained from Apple that was allegedly used to identify the terrorism suspect.”

“Proton does not require a recovery address, but in this case the terror suspect added one on their own. We cannot encrypt this data as we need to be able to send an email to that address if the terror suspect wishes to initiate the recovery process,” said Proton’s spokesperson in the email. “This information can in theory be requested by Swiss authorities in cases of terrorism, and this determination is generally made by the Swiss Federal Office of Justice. Proton provides privacy by default and not anonymity by default because anonymity requires certain user actions to ensure proper [operational security] such as not adding your Apple account as an optional recovery method, which it appears was done by the alleged terror suspect.”

Neither the Guardia Civil, nor the Spanish court where the case is being investigated, responded to TechCrunch’s requests for comment. A spokesperson for the Swiss Federal Police said that it is “not allowed to share any details about possible ongoing investigations and information exchange with our partners.”

The legal requests sent to Wire, Proton and Apple are related to a case where Spanish authorities believe that a pseudonymous member of the Catalan pro-independence movement Tsunami Democratic was helping the group plan some kind of actions or demonstrations at the time when King Felipe VI was planning to visit the region in 2020.

“Explain what you want to do and I will tell you whether it’s worth it or you will waste time like at the Camp Nou,” the activist, who goes by Xuxu Rondinaire, told another activist in a chat on Wire, which is included in the court documents.

According to the Spanish authorities, Xuxu Rondinaire was referring to a botched protest involving drones that was supposed to happen during the 2019 soccer game between F.C. Barcelona, whose stadium is called Camp Nou, and Real Madrid.

According to the court documents, in those Wire chats, Xuxu Rondinaire “explained in detail” several elements of the potential security protocols of “a public figure,” clearly referring to King Felipe VI.

The case of Xuxu Rodinaire was previously reported by Spanish and Catalan media.

Catalan newspaper El Nacional reported on April 23 that the Spanish authorities believe Xuxu Rondinaire is an officer of the Catalan police Mossos d’Esquadra.

A spokesperson for Mossos d’Esquadra told TechCrunch that it has no information about the case and referred questions to the Guardia Civil and the relevant Spanish court.

TechCrunch reached out to Xuxu Rondinaire via Wire, via their Protonmail email address and their iCloud email address, but received no response. We also reached out to a cell phone number listed in the court documents as being linked to the home address where Xuxu Rondinaire allegedly lives, which was provided by Apple to the Spanish police.

When TechCrunch reached out to the cell phone number and asked whether the user behind it was the person with the full name identified in the court documents, the person responded “no,” and added they would report the message as spam.

More TechCrunch

Fisker is just a few days into its Chapter 11 bankruptcy, and the fight over its assets is already charged, with one lawyer claiming the startup has been liquidating assets…

The fight over Fisker’s assets is already heating up

A hacker is advertising customer data allegedly stolen from the Australia-based live events and ticketing company TEG on a well-known hacking forum. On Thursday, a hacker put up for sale…

Hacker claims to have 30 million customer records from Australian ticket seller giant TEG

Welcome to Startups Weekly — Haje‘s weekly recap of everything you can’t miss from the world of startups. Sign up here to get it in your inbox every Friday. Elon…

Tesla makes Musk best-paid CEO of all time and Fisker bites the dust

Dot is a new AI companion and chatbot that thrives on getting to know your innermost thoughts and feelings.

Dot’s AI really, really wants to get to know you

The e-fuels startup is working on producing fuel for aviation and maritime shipping using carbon dioxide and other waste carbon streams.

E-fuels startup Aether Fuels is raising $34.3 million, per filing

Fisker was facing “potential financial distress” as early as last August, according to a new filing in its Chapter 11 bankruptcy proceeding, which the EV startup initiated earlier this week.…

Fisker faced financial distress as early as last August

Cruise, the self-driving subsidiary of General Motors, has agreed to pay a $112,500 fine for failing to provide full information about an accident involving one of its robotaxis last year.…

Cruise clears key hurdle to getting robotaxis back on roads in California

Feel Therapeutics has a pretty original deck, with some twists we rarely see; the company did a great job telling the overall story.

Pitch Deck Teardown: Feel Therapeutics’ $3.5M seed deck

The Rockset buy fits into OpenAI’s broader recent strategy of investing heavily in its enterprise sales and tech orgs.

OpenAI buys Rockset to bolster its enterprise AI

The U.S. government announced sanctions against 12 executives and senior leaders of the Russia-based cybersecurity giant Kaspersky. In a press release, the Department of the Treasury’s Office of Foreign Assets…

US government sanctions Kaspersky executives

Style DNA, an AI-powered fashion stylist app, creates a personalized style profile from a single selfie. The app is particularly useful for people interested in seasonal color analysis, a process…

Style DNA gets a generative AI chatbot that suggests outfit ideas based on your color type

Rates of depression, anxiety and suicidal thoughts are surging among U.S. teens. A recent report from the Center of Disease Control found that nearly one in three girls have seriously…

Khosla-backed Marble, built by former Headway founders, offers affordable group therapy for teens

Cover says what sets it apart is the underlying technology it employs, which has been exclusively licensed from NASA’s Jet Propulsion Laboratory.

A new startup from Figure’s founder is licensing NASA tech in a bid to curb school shootings

Spotify is introducing a new “Basic” streaming plan in the United States, the company announced on Friday. The new plan costs $10.99 per month and includes all of the benefits…

Spotify launches a new Basic streaming plan in the US

Photographers say the social media giant is applying a ‘Made with AI’ label to photos they took, causing confusion for users.

Meta is tagging real photos as ‘Made with AI,’ say photographers

Website building platform Squarespace is selling Tock, its restaurant reservation service, to American Express in a deal worth $400 million — the exact figure that Squarespace paid for the service…

Squarespace sells restaurant reservation system Tock to American Express for $400M

Featured Article

Change Healthcare confirms ransomware hackers stole medical records on a ‘substantial proportion’ of Americans

The February ransomware attack on UHG-owned Change Healthcare stands as one of the largest-ever known digital thefts of U.S. medical records.

18 hours ago
Change Healthcare confirms ransomware hackers stole medical records on a ‘substantial proportion’ of Americans

Google said today that it globally paused its experiment that aimed to allow new kinds of real-money games on the Play Store, citing the challenges that come with the lack…

Google pauses its experiment to expand real-money games on the Play Store

Venture firms raised $9.3 billion in Q1 according to PitchBook data, which means this year likely won’t match or surpass 2023’s $81.8 billion total. While emerging managers are feeling the…

Kevin Hartz’s A* raises its second oversubscribed fund in three years

Google is making reviews of all your movies, TV shows, books, albums and games visible under one profile page starting June 24, according to an email sent to users last…

Google is making your movie and TV reviews visible under a new profile page

Zepto, an Indian quick commerce startup, has more than doubled its valuation to $3.6 billion in a new funding round of $665 million.

Zepto, a 10-minute delivery app, raises $665M at $3.6B valuation

Speak, the AI-powered language learning app, has raised new money from investors at double its previous valuation.

Language learning app Speak nets $20M, doubles valuation

SpaceX unveiled Starlink Mini, a more portable version of its satellite internet product that is small enough to fit inside a backpack.  Early Starlink customers were invited to purchase the…

SpaceX debuts portable Starlink Mini for $599

Ali Rathod-Papier has stepped down from her role as global head of compliance at corporate card expense management startup Brex to join venture firm Andreessen Horowitz (a16z) as a partner…

Brex’s compliance head has left the fintech startup to join Andreessen Horowitz as a partner

U.S. officials imposed the “first of its kind” ban arguing that Kaspersky threatens U.S. national security because of its links to Russia.

US bans sale of Kaspersky software citing security risk from Russia 

Apple has released Final Cut Pro for iPad 2 and Final Cut Camera, the company announced on Thursday. Both apps were previously announced during the company’s iPad event in May.…

Apple releases Final Cut Pro for iPad 2 and Final Cut Camera

Paris has quickly established itself as a major European center for AI startups, and now another big deal is in the works.

Poolside is raising $400M+ at a $2B valuation to build a supercharged coding co-pilot

The space industry is all abuzz about how SpaceX’s Starship, Blue Origin’s New Glenn, and other heavy-lift rockets will change just about everything. One likely consequence is that spacecraft will…

Gravitics prepares a testing gauntlet for a new generation of giant spacecraft

LTK (formerly LiketoKnow.it and RewardStyle), the influencer shopping app with 40 million monthly users, announced on Thursday the launch of a free direct message tool for creators to instantly share…

Influencer shopping app LTK gets an automatic direct message tool

YouTube appears to be taking a firm stance against Premium subscribers who attempt to use a VPN (virtual private network) to access cheaper subscription prices in other countries. This week,…

YouTube confirms crackdown on VPN users accessing cheaper Premium plans