As part of an investigation into people involved in the pro-independence movement in Catalonia, Spanish police received information from the encrypted services Wire and Proton, which helped authorities track down a pseudonymous activist, according to court documents obtained by TechCrunch.
Earlier this year, Spain’s Guardia Civil sent legal requests through Swiss police to Wire and Proton, both of which are based in Switzerland. The Guardia Civil requested any identifying information related to accounts on the two companies’ respective platforms. Wire responded by providing the email address used to register the Wire account, which was a Protonmail address. Proton responded by providing the recovery email for that Protonmail account, which was an iCloud email address, according to the documents.
In the request, which listed “organized crime” and “terrorism” as the nature of the investigation, Spanish police wrote that they wanted “to find out who were the perpetrators of the events that took place in the street riots in Catalonia in 2019.”
Once the Guardia Civil obtained the iCloud email address, the documents show, it requested information from Apple, which in turn provided a full name, two home addresses and a linked Gmail account.
TechCrunch is not disclosing the alleged activist’s full name, as it is unclear whether this person is actually behind these activities, nor that he has committed any crimes.
Apple did not respond to a request for comment.
Encrypted online services typically aim to reduce the amount of user data they can access by encrypting it with keys that only the user has, effectively preventing companies from handing over user data with a court order. Instead, police use companies for their metadata, such as identifiable information about the user, including email addresses.
Representatives for Wire and Proton confirmed to TechCrunch that they have received legal requests from Swiss police and have complied with the requests.
“Following an officially valid request from the Swiss authorities, Wire has provided basic account information for a user. Wire is not able to see or disclose the content of any data transmitted through its service,” Wire spokesperson Hauke Gierow said in an email to TechCrunch.
Proton spokesman Edward Shone told TechCrunch that “Proton has minimal user information, as evidenced by the fact that in this case it was data obtained from Apple that was allegedly used to identify the terrorist suspect.”
“Proton does not require a recovery address, but in this case the terror suspect added one himself. We cannot encrypt this data as we need to be able to send an email to this address if the terrorist suspect wishes to initiate the recovery process,” the Proton spokesperson said in the email. “This information can theoretically be requested by the Swiss authorities in cases of terrorism, and this determination is generally made by the Swiss Federal Office of Justice. Proton provides privacy by default and not anonymity by default because anonymity requires certain user actions to ensure proper [operational security] such as not adding your Apple account as an optional recovery method, which appears to have been done by the alleged terror suspect.”
Neither the Guardia Civil nor the Spanish court where the case is being investigated responded to TechCrunch’s requests for comment. A spokesman for the Swiss Federal Police said it was “not allowed to share details about possible ongoing investigations and exchange of information with our partners”.
The legal requests sent to Wire, Proton and Apple relate to a case where Spanish authorities believe a pseudonymous member of the Catalan independence movement Tsunami Democrático was helping the group plan some sort of action or demonstration around the time King Felipe F planned to visit the area in 2020.
“Explain what you want to do and I’ll tell you if it’s worth it or you’ll waste time like at Camp Nou,” the activist, who goes by Xuxu Rondinaire, told another activist in a conversation on the Wire, which is included in the court documents.
According to the Spanish authorities, Xuxu Rondinaire was mentioned a failed drone protest This was supposed to happen during the 2019 football match between FC Barcelona, whose stadium is called Camp Nou, and Real Madrid.
According to court documents, in those Wire conversations, Xuxu Rondinaire “explained in detail” several elements of the potential security protocols of a “public figure,” clearly referring to King Felipe VI.
The case of Xuxu Rodinaire was previously reported by Spanish and Catalan media.
Catalan newspaper El Nacional mentionted on April 23 that Spanish authorities believe Xuxu Rondinaire is an officer of the Catalan police Mossos d’Esquadra.
A spokesman for the Mossos d’Esquadra told TechCrunch it had no information on the case and referred questions to the Guardia Civil and the relevant Spanish court.
TechCrunch reached out to Xuxu Rondinaire via Wire, their Protonmail email address, and their iCloud email address, but received no response. We also reached out to a mobile phone number listed in court documents as being linked to the residential address where Xuxu Rondinaire allegedly lives, which was provided by Apple to Spanish police.
When TechCrunch contacted the mobile number and asked if the user behind it was the person with the full name identified in the court documents, the person said “no” and added that they would report the message as spam.
