Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: Proton Mail Suspended Journalist Accounts At Request of Cybersecurity
Agency

Link: https://it.slashdot.org/story/25/09/12/230259...

An anonymous reader quotes a report from The Intercept: The company behind
the Proton Mail email service, Proton, describes itself as a "neutral and
safe haven for your personal data, committed to defending your freedom." But
last month, Proton disabled email accounts belonging to journalists reporting
on security breaches of various South Korean government computer systems
following a complaint by an unspecified cybersecurity agency. After a public
outcry, and multiple weeks, the journalists' accounts were eventually
reinstated -- but the reporters and editors involved still want answers on
how and why Proton decided to shut down the accounts in the first place.
Martin Shelton, deputy director of digital security at the Freedom of the
Press Foundation, highlighted that numerous newsrooms use Proton's services
as alternatives to something like Gmail "specifically to avoid situations
like this," pointing out that "While it's good to see that Proton is
reconsidering account suspensions, journalists are among the users who need
these and similar tools most." Newsrooms like The Intercept, the Boston
Globe, and the Tampa Bay Times all rely on Proton Mail for emailed tip
submissions. Shelton noted that perhaps Proton should "prioritize responding
to journalists about account suspensions privately, rather than when they go
viral." On Reddit, Proton's official account stated that "Proton did not
knowingly block journalists' email accounts" and that the "situation has
unfortunately been blown out of proportion." The two journalists whose
accounts were disabled were working on an article published in the August
issue of the long-running hacker zine Phrack. The story described how a
sophisticated hacking operation -- what's known in cybersecurity parlance as
an APT, or advanced persistent threat -- had wormed its way into a number of
South Korean computer networks, including those of the Ministry of Foreign
Affairs and the military Defense Counterintelligence Command, or DCC. The
journalists, who published their story under the names Saber and cyb0rg,
describe the hack as being consistent with the work of Kimsuky, a notorious
North Korean state-backed APT sanctioned by the U.S. Treasury Department in
2023. As they pieced the story together, emails viewed by The Intercept show
that the authors followed cybersecurity best practices and conducted what's
known as responsible disclosure: notifying affected parties that a
vulnerability has been discovered in their systems prior to publicizing the
incident. Phrack said the account suspensions created a "real impact to the
author. The author was unable to answer media requests about the article."
Phrack noted that the co-authors were already working with affected South
Korean organizations on responsible disclosure and system fixes. "All this
was denied and ruined by Proton," Phrack stated. Phrack editors said that the
incident leaves them "concerned what this means to other whistleblowers or
journalists. The community needs assurance that Proton does not disable
accounts unless Proton has a court order or the crime (or ToS violation) is
apparent."

Read more of this story at Slashdot.

---
VRSS v2.1.180528