alsoooo a big, big, big digital security lesson that you absolutely have to understand while making recommendations is that if your protocol is too complicated or inaccessible, even if it's somehow perfectly invulnerable, then people will start taking shortcuts that are way fucking worse.
ok, proton handed payment info over to swiss authorities, who then helped the fbi. if you start indiscriminately fearmongering about all proton services because of it (and implying that they can send more info than they have) then what are people switching to? people have to use email. not everyone is going to switch to tuta mail or whatever. but even if they did, they have paid plans too, which would likely be susceptible to the same issue. and if they decide, fuck it, there's no point, i'll just go back to using gmail instead, that puts everyone at way more risk than continuing to use protonmail.
it's also fine and good to say that people shouldn't be putting incriminating stuff in any emails. but we don't know that the fbi tracked them down through incriminating emails. they knew somehow that the account was associated with the stop cop city protestors, which could've very well been because their handle was stopcopcity at proton dot me or something. (i don't know if that was the case!) and then the payment information associated with that account was used to track someone down.
like the whole idea is that we have to break these cases down piece by piece and then come up with easily actionable recommendations that protect most people like 80-90% of the way, because that alone will make it much much harder for others to compromise them. and then there are various additional levels of precautions you can take based on the sensitivity & admin level of what you're working on. like. that's what digital security for orgs is.
and this is kind of a tangent but. you especially need to be prioritizing a risk mitigation approach because flock & ring cameras exist lmao. regardless of whether you use any consumer technologies at all, if you live in the US, these things are tagging your license plate & other visual attributes of your car. using facial recognition on drivers & passengers & pedestrians. aggregating all that data to track your movement like on a map. what are you going to do? not live in a city? not drive a car? not leave your house?
no. you have to be aware of what these security risks are and how to manage them depending on what actions you're taking.




















