As part of an investigation into people involved in the independence movement in Catalonia, Spanish police received information from encrypted services Wire and Proton that helped authorities identify a pseudonymous activist, according to court documents obtained by TechCrunch.
Earlier this year, Spain’s Guardia Civil sent legal requests through Swiss police to Wire and Proton, both of which are based in Switzerland. The Guardia Civil requested all identifying information about accounts on the two companies’ respective platforms. Wire responded and provided the email address used to register the Wire account, which was a Protonmail address. Proton responded and submitted the recovery email for that Protonmail account, which the documents show was an iCloud email address.
In the application, which cited “organized crime” and “terrorism” as the type of investigation, Spanish police wrote that they wanted to “find out who was responsible for the actions of the street riots in Catalonia in 2019.”
According to the documents, after the Guardia Civil obtained the iCloud email address, it requested information from Apple, which in turn provided a full name, two home addresses and a linked Gmail account.
TechCrunch is not disclosing the alleged full name of the activist because it is unclear whether this person is really behind these activities and whether he has committed any crimes.
Apple did not respond to a request for comment.
Encrypted online services typically aim to reduce the amount of user data they can access by encrypting it with keys that only the user has. This effectively prevents companies from sharing user data subject to a court order. Instead, the police resort to companies to obtain their metadata, such as identifiable information about the user, including email addresses.
Spokespeople for Wire and Proton confirmed to TechCrunch that they had received legal requests from Swiss police and had complied with those requests.
“In response to a formally correct request from the Swiss authorities, Wire provided basic account information about a user. Wire is not able to view or disclose the content of the data transmitted through its service,” Wire spokesperson Hauke Gierow told TechCrunch in an email.
Proton spokesman Edward Shone told TechCrunch: “Proton has minimal user information, as evidenced by the fact that in this case it was data obtained from Apple that was allegedly used to identify the terror suspect.”
“Proton does not require a recovery address, but in this case the terror suspect added one himself. We cannot encrypt this data because we need to be able to send an email to this address if the terror suspect wants to initiate the recovery process,” the Proton spokesperson said in the email. “Theoretically, this information can be requested by Swiss authorities in terrorist cases, the determination is usually made by the Federal Office of Justice.” Proton offers data protection by default and does not provide anonymity by default, as anonymity requires certain user actions to ensure proper functioning [operational security] For example, you did not add your Apple account as an optional recovery method, which appears to have been done by the alleged terror suspect.”
Neither the Guardia Civil nor the Spanish court where the case is being investigated responded to TechCrunch’s request for comment.
The legal requests sent to Wire, Proton and Apple are related to a case in which Spanish authorities believe that a pseudonymous member of the Catalan independence movement Tsunami Democratic helped the group plan some action or demonstration when King Felipe VI had plan to visit the region in 2020.
“Explain what you want to do and I’ll tell you if it’s worth it or you’ll waste time like at Camp Nou,” the activist, who calls himself Xuxu Rondinaire, told another activist in a chat on Wire published in Court documents are included.
According to Spanish authorities, Xuxu Rondinaire was referring to a botched protest using drones that was supposed to take place during the 2019 soccer match between FC Barcelona, whose stadium is called Camp Nou, and Real Madrid.
According to the court documents, in these wire chats, Xuxu Rondinaire “explained” in detail several elements of “a public figure’s” potential security protocols, clearly referring to King Felipe VI.
Spanish and Catalan media had already reported on the Xuxu Rodinaire case.
Catalan newspaper The National On April 23, Spanish authorities reported that Xuxu Rondinaire was an officer with the Catalan police Mossos d’Esquadra.
A spokesman for Mossos d’Esquadra told TechCrunch that it had no information about the case and referred questions to the Guardia Civil and the relevant Spanish court.
TechCrunch reached out to Xuxu Rondinaire via Wire, through her Protonmail email address and her iCloud email address, but received no response. We also reached out to a cell phone number listed in court documents as being linked to the home address where Xuxu Rondinaire supposedly lives, which was shared by Apple with Spanish police.
When TechCrunch contacted the cellphone number and asked if the user behind it was the person whose full name was listed in the court documents, the person replied “no,” adding that they would report the message as spam.