On April 29, 2025, the Karnataka High Court directed the Indian government to block Proton Mail, a Switzerland-based encrypted email service, across the country. The decision, driven by concerns over national security and misuse of the platform’s anonymity, has sparked debates about privacy, encryption, and law enforcement challenges. This article explores the reasons behind the court’s ruling, its implications for users and businesses, and the broader context of digital privacy in India, presented in a clear, engaging, and informative manner.
What Led to the Proton Mail Ban?
The Karnataka High Court’s order stemmed from a petition filed by M Moser Design Associates India Pvt Ltd, a Bengaluru-based architecture and design firm. The company reported that its female employees were targeted with harassing emails sent via Proton Mail, prompting legal action to address the misuse of the service’s anonymity features.
Key Highlights of the Court’s Ruling
- Court Order Issued: Justice M Nagaprasanna directed the Union government to initiate proceedings under Section 69A of the Information Technology Act, 2008, to block Proton Mail nationwide.
- Immediate URL Blocking: The court mandated the immediate blocking of offending URLs linked to the harassing emails until the full ban is implemented.
- Harassment Case: M Moser Design Associates reported that unknown individuals used Proton Mail to send vulgar, abusive emails with AI-generated deepfake images and sexually explicit content targeting female employees, damaging the company’s reputation.
- National Security Concerns: The petitioner’s counsel, Jatin Sehgal, highlighted Proton Mail’s use in sending hoax bomb threats to schools, labeling it a “national threat” due to its high anonymity.
- Proton Mail’s Non-Compliance: The service, hosted in Switzerland, refused to share sender details with Indian law enforcement, citing its end-to-end encryption and location outside India’s jurisdiction.
Why Was Proton Mail Targeted?
Proton Mail, operated by Proton AG, is known for its strong privacy features, including end-to-end encryption that ensures only the sender and recipient can access email content. While this protects user privacy, it has raised concerns among Indian authorities for enabling misuse. Here’s why the court focused on Proton Mail:
- High Anonymity: Proton Mail allows users to create accounts in 30 seconds without identity verification, making it difficult for law enforcement to trace senders.
- Bomb Threats to Schools: In February 2024, hoax bomb threats sent to Chennai schools via Proton Mail prompted Tamil Nadu police to request a ban, though it was not enforced at the time due to Swiss intervention.
- Non-Compliance with Indian Laws: Proton Mail’s servers are located in Switzerland, and the company claims it is not subject to Indian regulations. It has also removed physical VPN servers from India, guiding users on bypassing monitoring.
- Harassment and Deepfakes: The petition highlighted Proton Mail’s use in sending obscene emails with AI-generated deepfake images, which caused significant harm to M Moser’s employees and reputation.
- Global Precedents: Countries like Russia and Saudi Arabia have banned Proton Mail for similar reasons, citing security risks due to its encryption and anonymity.
Legal Basis for the Ban
The Karnataka High Court invoked Section 69A of the IT Act, which allows the government to block online content or services on grounds of national security, public order, or prevention of criminal activities. The court issued a writ of mandamus to central authorities, directing them to:
- Initiate proceedings to block Proton Mail under Section 69A and Rule 10 of the IT (Procedure and Safeguards for Blocking Access of Information by Public) Rules, 2009.
- Block offending URLs immediately until the nationwide ban is finalized.
- Consider the petitioner’s claims about Proton Mail’s role in facilitating illegal activities, including bomb threats and harassment.
The court also noted that Indian law enforcement’s inability to access Proton Mail’s servers, combined with the service’s refusal to cooperate, justified the ban.
Challenges in Enforcement and Investigation
The case revealed significant hurdles faced by Indian authorities in dealing with Proton Mail:
- Swiss Jurisdiction: Proton Mail’s servers are in Switzerland, and any request for sender information requires a Letter Rogatory through the Mutual Legal Assistance Treaty (MLAT) between India and Switzerland. The process is slow and depends on Swiss cooperation.
- Police Inaction: Despite M Moser filing a police complaint in November 2024, no effective steps were taken to trace the sender, as Proton Mail declined to share data. The police also failed to utilize Indo-Swiss legal assistance channels.
- Encryption Barriers: Proton Mail’s end-to-end encryption ensures that even the company cannot decrypt emails without the recipient’s key, making investigations nearly impossible.
- Government’s Limited Role: Additional Solicitor General Aravind Kamath clarified that the Ministry of Home Affairs or MeitY cannot directly request data from Switzerland; only criminal courts can initiate such requests.
Implications of the Ban
The Karnataka High Court’s order has far-reaching implications for digital privacy, businesses, and internet users in India:
- Impact on Proton Mail Users: If implemented, the ban will disrupt access for thousands of Indian users who rely on Proton Mail for secure communication, including journalists, activists, and businesses.
- Privacy vs. Security Debate: The ruling reignites discussions about balancing user privacy with law enforcement needs, especially as encrypted services face scrutiny globally.
- Business Concerns: Companies like M Moser, which suffered reputational damage due to Proton Mail’s misuse, highlight the risks of anonymous platforms in professional settings.
- Precedent for Other Services: The ban could set a precedent for targeting other encrypted platforms, raising concerns about overreach and censorship.
- Global Context: The move aligns with actions in countries like Russia and Saudi Arabia but contrasts with India’s democratic framework, prompting criticism about restricting privacy tools.
Criticism and Concerns
The decision has sparked mixed reactions, with some praising the court’s focus on security and others criticizing it as an overreach:
- Critics Argue Overreach: Posts on X labeled the order “moronic,” arguing that banning an entire service for the actions of a few users is disproportionate. They noted that similar misuse occurs on platforms like Gmail, which face no bans.
- Proton Mail’s Defense: In 2024, Proton Mail called previous blocking attempts “ineffective,” stating that cybercriminals could switch to other services and that bans wouldn’t work if perpetrators are outside India.
- Privacy Advocates’ Concerns: The ban raises fears about eroding digital privacy, as Proton Mail is a vital tool for secure communication in sensitive professions.
- Technical Challenges: Blocking Proton Mail may be difficult, as users can bypass restrictions using VPNs, and malicious actors could shift to other encrypted services.
What’s Next?
As of May 1, 2025, Proton Mail remains accessible in India, pending the government’s implementation of the court’s order. The Union government is reviewing the ruling and recent Delhi High Court observations on Proton Mail’s use. Key developments to watch include:
- Government Action: The Centre must initiate proceedings under Section 69A, which involves a review by a committee before blocking can occur.
- Swiss Cooperation: Indian authorities may pursue sender information through the MLAT, though success depends on Switzerland’s response.
- Public Response: Privacy advocates and tech communities may challenge the ban, potentially leading to further legal battles.
- Proton Mail’s Reaction: The company has not yet commented on the April 2025 ruling but may issue a statement or adjust its operations in India.
Conclusion
The Karnataka High Court’s order to block Proton Mail in India reflects growing concerns about the misuse of encrypted platforms for harassment and national security threats. While the decision aims to protect citizens and businesses, it raises critical questions about digital privacy and the feasibility of regulating global services. As India navigates this complex issue, the outcome will shape the future of encryption, law enforcement, and online freedom in the country. Stay updated on this evolving story as the government and tech communities respond.