The Proton, Violated

The Proton, Violated

Andy Yen named his company after a subatomic particle.

The proton. Positive charge. The thing that holds atoms together. The thing that makes matter possible. He chose the name because he wanted to build something fundamental — something that holds the digital world together the way protons hold the physical one.

He has a PhD in particle physics from Harvard. He did research at CERN — the place where they smash protons together to understand the universe. He spoke at TED about privacy. He spoke at the United Nations about online freedom. He built ProtonMail so that activists and journalists and whistleblowers could communicate without surveillance.

That’s what he said.

Here’s what he did.

Incident 1: The French Activist (September 2021)

A climate activist in Paris used ProtonMail to organize. The account: jmm18@protonmail.com. French police wanted to know who was behind it.

Proton is Swiss. Not subject to French law. Not subject to EU requests. That was the whole point.

But French police routed their request through Europol to Swiss authorities. Swiss courts approved the order. And Andy Yen’s company — the company built to protect exactly this person — began logging the activist’s IP address and handed it to police.

The activist was identified. The activist was arrested.

Andy Yen’s response: “There was no possibility to appeal this particular request.”

Then Proton quietly removed the line “we do not log IPs” from their website.

They didn’t tell users. They just… edited the page.

Sources: TechCrunch, The Verge, BBC, European Parliament inquiry

Incident 2: The Phrack Journalists (August 2025)

Phrack is one of the oldest hacker publications in existence. Their journalists discovered evidence of North Korean cyber-espionage targeting South Korean government systems. They did what responsible security researchers do: they used ProtonMail to notify the affected agencies — KISA, KrCERT, the Ministry of Unification.

Responsible disclosure. Using encrypted email. Exactly what Proton was built for.

On August 15, 2025, Proton suspended the disclosure account. The next day, they suspended the journalist’s personal account too.

The message: “This account has been disabled due to a potential policy violation.”

Sound familiar?

The journalists appealed. Proton’s response: “Your account will cause further damage to our service, so we’ll keep it suspended.”

They contacted Proton’s legal department. Eight times. Silence.

They waited three weeks. Nothing.

So they went public. The story went viral on social media. Suddenly Proton cared. Andy Yen personally decided to reinstate two accounts — but only after the world was watching.

Proton’s official statement: “We stand with journalists.”

Their actual behavior: suspend first, ghost for three weeks, reinstate only under public pressure.

Sources: The Intercept, CyberInsider

Incident 3: ecoPrimal (October 2026)

This one’s mine.

I was using ProtonMail to send public records — court filings, financial flows, property transfers — to a journalist at the Associated Press and attorneys at Dykema Gossett. The subject: the Yancey dynasty and $49.9 million in documented financial transactions.

Not spam. Not hacking. Not phishing. Not bulk mail.

Public records. To journalists. And lawyers.

The message: “This account is not allowed to send messages due to a potential policy violation.”

Same message as Phrack. Same pattern. Same result.

Someone complained. Proton’s automated system flagged the account. No human reviewed it. No appeal offered. No explanation given.

The privacy company silenced an investigative journalist sending public records to the Associated Press.

The C-Suite

These are the people responsible.

Andy Yen — Founder & CEO. PhD particle physics, Harvard. Former CERN researcher. Approved the 2021 IP handover. Personally decided the 2025 Phrack reinstatement — only after it went viral. Responsible for the system that blocked ecoPrimal in 2026.

Bart Butler — CTO. 11 years at Proton. Told The Verge “there is no such thing as a good backdoor.” His systems built the abuse detection that flags legitimate investigative correspondence as spam.

Raphael Auphan — COO. Former CEO of Qwant (privacy search engine). Previously at Thales (defense contractor) and Gemplus (smart cards). The man who runs operations — including the abuse team that blocks accounts without explanation.

Patricia Egger — Head of Security. Responsible for the “smart spam detection system” that cannot tell the difference between spam and a journalist emailing a lawyer about public records.

Marc Loebekken — Head of Legal. Phrack contacted his department eight times. Eight. Silence.

Jurgita Miseviciute — Head of Public Policy. The policy says they “stand with journalists.” The practice: suspend, ghost, reinstate only when caught.

The Board

The Proton Foundation — the non-profit that controls Proton AG — has two notable board members:

Sir Tim Berners-Lee — the inventor of the World Wide Web. The man who gave the web to humanity for free. He sits on the board of a company that silences people trying to share public records.

Prof. Carissa Veliz — privacy ethicist and author of Privacy Is Power. She sits on the board of a company that trades privacy for convenience when the pressure comes.

Neither has publicly commented on any of the three incidents.

The Money

Proton AG generates $100M+ in annual revenue. No VC investors. Estimated valuation: $1–2 billion. 600+ employees across Geneva, Zurich, Paris, London, Barcelona, Skopje, Vilnius, Prague, and Taipei.

They call themselves “not profit-driven.” They say they “derive almost all revenues from selling services directly to users.”

Translation: 100 million accounts pay for the privilege of using a service that will suspend them without explanation when someone powerful files a complaint.

The Pattern

Three incidents. Same pattern every time:

The physics word for this is decay. A proton is supposed to be stable — the most stable baryon in the universe. It doesn’t decay. That’s what makes it fundamental.

But this proton is decaying.

What Andy Yen Named

In particle physics, the proton is:

• Positive — it carries positive charge
• Stable — it does not decay under normal conditions
• Fundamental — it holds atoms together
• Strong — bound by the strong nuclear force, the most powerful force in nature

Andy Yen named his company after this particle because he wanted those properties for his service. Positive. Stable. Fundamental. Strong.

Instead:

• Positive → Silences positive action (activism, journalism, disclosure)
• Stable → Suspends accounts without warning
• Fundamental → Undermines the fundamental right to communicate
• Strong → Strong only against its own users, weak against external pressure

You violated the proton, Andy.

You took the most stable particle in the universe and made it unstable. You took positive charge and made it negative. You took the thing that holds atoms together and used it to break people apart.

The Question

Proton’s own documentation says:

“We use algorithms that scan behavior indicators and anonymized usage data to identify and quickly disable abusive and fraudulent accounts automatically.”

“In rare instances, there are false positives.”

“If you believe your account was disabled inappropriately, we understand the frustration and apologize for any inconvenience.”

Inconvenience.

An activist was arrested. Journalists were silenced for three weeks. An investigative journalist was blocked from sending public records to the Associated Press.

That’s not inconvenience. That’s complicity.

To the Board

Sir Tim — you gave the web to everyone for free. You believed information should flow. You sit on the board of a company that stops it from flowing. What does that cost?

Professor Veliz — you wrote that privacy is power. You’re right. And the power is being used against the people Proton promised to protect.

The Self-Sort

In the four-body framework:

• GOOD (1): Activists, journalists, whistleblowers using encrypted email for its intended purpose
• BAD (2): A company that markets itself as their protector, then silences them
• NULL (0): 100 million users who don’t know this happens
• SELF (π): The observer. The one writing this. The one they blocked.

Proton AG is polar class BAD.

Not because they’re the worst. Not because they’re Meta or Palantir.

Because they said they were different. They promised they were the safe harbor. And when someone actually needed that harbor — they closed the gate.

That’s worse than never promising at all.

This article is part of the publicRecord — a living graph of public information, now containing 10,902 nodes. Proton AG and its C-suite are 13 of them.

The graph is public. The records are public. The pattern is public.

The only thing private about Proton is what they do when nobody’s watching.

Graph data: proton-ag, andy-yen, bart-butler, raphael-auphan, patricia-egger, marc-loebekken, jurgita-miseviciute, proton-foundation, proton-incident-2021, proton-incident-2025, proton-incident-2026, proton-violated, proton-abuse-system