The Proton Blog

Proton partners with Apertus, Switzerland’s sovereign AI model

Eamonn Maguire — Thu, 17 Sep 2026 11:56:33 GMT

Proton is partnering with the team behind Apertus to bring its new Apertus 1.5 model to Lumo, Proton’s privacy-focused alternative to ChatGPT. The partnership will also give researchers behind Apertus access to real-world feedback that can help them improve it more quickly.

Apertus is a fully open large language model developed by researchers at EPFL, ETH Zurich, and the Swiss National Supercomputing Centre (CSCS). Its architecture, training data, and methods are open, and it’s trained on publicly available data, respecting opt-out requests and filtering out personal details. It fills an important role in today’s AI landscape by providing a fully open source model with a transparent and reproducible training pipeline. In a world dominated by US and Chinese models, Apertus is instrumental in Europe’s tech sovereignty.

The world’s leading AI models have millions of people using them every day, creating real-world feedback loops that help make them better. Fully open models developed in an academic context do not have access to feedback at the same scale, limiting their ability to compete at the frontier.

With this partnership, that could start to change. Proton is introducing a feedback mechanism that connects people using Apertus in Lumo with the researchers building it. Tens of millions of Lumo users around the world can now choose to contribute feedback, helping independent, ethical, and truly open source AI become more competitive.

Building a European alternative

Europe now has the pieces of an independent AI stack: infrastructure it controls, a model open by design, and a product that puts it directly in people’s hands.

“We don’t want to spend the next decade relying on other countries for the AI we use every day,” said Eamonn Maguire, Director of AI at Proton. “Having our own AI isn’t enough. It needs to be competitive so that people actually use it. This partnership with the Swiss AI Initiative gives Europe a path to get there.”

One of the biggest advantages leading AI labs have is a constant stream of feedback from millions of people using their models. Bringing Apertus to Lumo gives the university research teams behind it access to this feedback at scale, helping level the playing field.

Apertus in Lumo today

To start using Apertus in Lumo, select Apertus 1.5 from the model dropdown, and start chatting as normal. Like other conversations in Lumo, your chats are protected by zero-access encryption and stay private by default.

If you choose to give feedback on an Apertus response, tap the thumbs-up or thumbs-down button to send in your feedback. Your contribution will be anonymized, and made available to the university research teams behind Apertus.

“Real-world feedback is the one ingredient that open models have been missing. Thanks to Proton, Lumo users will be able to voluntarily provide feedback that contributes to Apertus research. For a fully open, publicly developed model, that is a game changer,” says Imanol Schlag, Research Scientist at the ETH AI Center and co-lead of the Apertus project.

“Making Apertus available in Lumo gives us valuable insights into how the model performs in real-world settings. Voluntary feedback also helps us identify where it can be made more useful and more robust,” says Martin Jaggi, Professor at EPFL and co-lead of the Apertus project. “It also means that we are enabling a broader community to contribute to the model’s further improvement.”

Why work together

Building an open and independent AI ecosystem is bigger than any one model or company. To compete in AI, Europe needs to pool its resources and build public-private partnerships that can do what no single organization can achieve alone. Europe’s future in AI depends on researchers building in the open, infrastructure governed in Europe, companies turning that technology into products people can use, and people willing to help those technologies improve.

Through this partnership, we are taking steps to make that alternative more than an idea. Starting today, fully open source AI is now something people can use and — if and when they choose to — help shape for the future.

Try Lumo now

87% of Canada’s biggest companies depend on US tech

Raphael Auphan — Thu, 17 Sep 2026 11:48:36 GMT

It’s clearer than ever that too much of the technology the world relies on is controlled by too few tech giants, most of them based in the United States and China.

Cloud storage, web hosting, email, social media, video calling, communication platforms, and the basic productivity tools that companies and governments use every day have become essential infrastructure. The modern economy cannot function without them. And control over that infrastructure gives both providers — and the countries whose laws they operate under — outsized power over everyone who depends on it.

We’ve been tracking this concentration for some time. Our previous research found that 74% of publicly listed European companies rely on US tech, fueling a wider debate in Europe about economic security, digital sovereignty, and geopolitical risk.

Now we’ve found that Canada is even more exposed than Europe. We examined 220 publicly listed companies representing 70% of the Canadian stock market’s total capitalization and found that 87% rely on US-owned infrastructure for their email. The same was true for 84% of the 100 largest municipalities. We also found that 14 out of 14 federal, provincial, and territorial government domains rely on American email infrastructure.

To be clear, the problem is not that these companies are American. The risk comes when too much of the infrastructure the world depends on sits under the control and jurisdiction of any single government. At a time of increasing geopolitical tensions and trade negotiations, we believe it’s important to fully understand the different levers that one country can hold over another behind the scenes.

How we measured Canada’s dependence on US tech

We collected the data using the same method as our earlier research in Europe. Using public DNS lookups, we identified the mail exchange (MX) records associated with each organization’s domain. These records show which companies handle an organization’s email, either directly or through an email security service.

For Canada, we looked at three parts of the economy and public sector:

Federal, provincial, and territorial governments. We examined all 14 federal, provincial and territorial domains. Of these, all 14 rely on Microsoft 365.

Companies. We analyzed the 220 companies in the S&P/TSX Composite Index, which together account for around 70% of the Canadian stock market’s total capitalization. Of the companies reviewed, 161 used Microsoft 365 and nine used Google Workspace for their email infrastructure.

Municipalities. Canada has more than 4,000 local governments, so we focused on the country’s 100 largest municipalities by population. Of those, 77 used Microsoft and one used Google.

Why this matters

The problem with this arrangement is quite simple: One company, headquartered in one country, operating under one country’s laws, carries the email of an entire G7 nation’s governments.

US law gives that country real power. Under the CLOUD Act, US authorities can compel American tech companies to hand over data they hold, including data stored outside the US. When the US placed sanctions on the International Criminal Court, for example, Microsoft cut off the email account of the court’s chief prosecutor — a move Microsoft initially told UK lawmakers was the ICC’s own decision, before acknowledging that testimony was inaccurate. Access to infrastructure can be withdrawn on political terms and virtually overnight.

AWS, Microsoft Azure, and Google Cloud serve an estimated 85% of the European cloud market — and when one of them fails, the failures cascade. A major AWS outage in late 2025 crashed apps across industries; an Azure outage followed nine days later, knocking Outlook, Teams, and dozens of enterprise services offline for eight hours.

Much of the email infrastructure used by Canadian companies and governments depends on Microsoft, leaving them exposed to the same kind of service disruption.

These risks, however, exist regardless of which country holds leverage. A world where one government can lawfully reach into the central communications of other nations is the problem, no matter who that government is, and wherever its companies are headquartered.

Canadians are already reacting

The dependence we measured in Canada’s public and private sectors comes amid a wider rupture in Canada-US relations, including retaliatory tariffs matched dollar for dollar and trade talks that broke down in a very public manner.

This backdrop is already shaping how Canadians see their tech dependence. Politico’s reporting on Canada’s digital sovereignty dilemma describes a country forging its own path to reduce reliance on American tech, noting that its smaller economy and US-tied tech industry severely limit its bargaining power. This mirrors the shift we documented in Europe over the last year, where our research found 73% of Europeans believe their societies rely too heavily on US tech and 56% now say local infrastructure matters more to them than a year ago.

Canada’s position differs from Europe’s in one important way: European institutions have moved from diagnosis to legislation, with the European Commission’s tech sovereignty package committing major funding to local alternatives. Canadian institutions haven’t announced migration plans, and we’re not the ones to call for it. Proton is a Swiss company. What we can do is show what the data says and what it implies for anyone who depends on these systems, including what Europe’s slow, imperfect transition reveals about how hard these moves are in practice.

What any organization can do about it

For Canadian businesses and institutions assessing their own exposure, the starting steps are concrete:

List every third-party tool you use: Flag which are headquartered outside Canada and which of those fall under a foreign government’s legal jurisdiction.

Identify what would stop your operations: Which tools, cut off tomorrow, would halt work? This belongs in business continuity planning.

Check where your data sits: Which country’s laws govern it? Who can access it, and through what legal process?

Test the alternatives: For most critical tools, Canadian and European alternatives are available, and some offer built-in tools that make switching easier, such as Proton’s Easy Switch.

Move the highest-risk services first: Full migration takes time. Start with the systems you can’t operate without.

When your business email relies on US tech companies, you’re exposing your organization to strategic risks that, at the end of the day, are out of your control.

8 more privacy tools experts actually use

Proton Team — Tue, 15 Sep 2026 18:02:32 GMT

Privacy technology does not have to mean replacing every device you own or learning how to build your own computer.

There are plenty of smaller changes you can make to adjust the way you use technology. You can keep information offline, block trackers across your home network, choose software that gives you more control, or even carry an entire operating system on a USB drive.

The tools below take different approaches to privacy, but they share a common idea: you get to decide how your technology works instead of simply accepting its default settings.

Build a smartwatch that only does what you want

Many smartwatches are designed to work alongside an app and an online account. Your activity data is collected by the watch, transferred to another device, and potentially sent onwards to a company’s servers.

You can take a different approach with Watchy, a small programmable computer designed to be used as an open-source smartwatch. Because you can program the device yourself, you get to decide what it does and what information it collects. You could use it for something as simple as counting your steps without requiring an account or constantly syncing your activity to a remote service.

The data can either stay on the device or transfer it to your computer. You can also customize the watch with your own features, information, and displays. This makes Watchy an interesting alternative to more ubiquitous smartwatch brands if you want the functionality of a wearable without automatically handing control of the experience to a third party.

Use Flipper Zero to understand wireless technology

A surprising amount of everyday technology communicates wirelessly. Your garage door opener, office access system, television remote, and other devices all rely on different kinds of wireless signals to communicate. Most of the time, you never see any of this happening.

Flipper Zero gives you a way to experiment with some of those signals. It can read, save, and replicate certain wireless communications, depending on the technology and security involved.

For example, you can use it with a compatible infrared remote. The device can capture the signal sent by the remote, store it, and transmit the same command itself. That does not mean it can unlock or control everything around you. What it can interact with depends on the particular technology being used.

The real value is educational. Instead of treating wireless communication as something invisible happening in the background, you can use a Flipper Zero device to understand how some of it actually works.

Keep Wikipedia in your pocket with Kiwix

Kiwix lets you download large collections of information so you can access them offline. One of the best-known examples is Wikipedia, which you can store locally and search without being connected to the internet.

That can be useful when you’re travelling somewhere with unreliable connectivity, spending an extended amount of time in a remote location, or simply want access to information without constantly requesting it from an online service.

There is one obvious limitation: your offline library is only as current as the version you downloaded. But once the content is stored on your device, you do not need a live connection to access it.

It is a useful reminder that you do not have to depend on the internet for every piece of information you need. Sometimes, you can simply keep the information yourself.

Turn an old iPod into a dedicated music player

You probably already have a device that can play music. Your phone can stream millions of songs, recommend something based on your listening habits, and keep your entire library in the cloud. But if all you want is a device that plays your music, an old iPod Classic can still do the job.

With alternative software such as Rockbox, you can give an iPod Classic a new lease on life. Hardware modifications can also bring it up to date with features such as USB-C. The result can be deliberately simple. You load your own music onto the device, much like copying files to a USB drive, and listen without needing a streaming subscription or account.

That way, there are no recommendations for deciding what you should listen to next. Nor is there a need for a service to track your listening habits as your music library can simply remain on the device. You can even use the extra storage for things such as important phone numbers or other information you might want available when your phone is unavailable.

Sometimes privacy means choosing a device that does less.

Block trackers across your home network with Pi-hole

Your phone is not the only device that can connect to advertising and tracking services. Your laptop, smart TV, tablet, and other connected devices can all make requests to servers around the internet.

Pi-hole lets you filter some of those requests at the network level. You can run Pi-hole on a small computer like a Raspberry Pi. It sits between the devices on your network and the wider internet, checking where they are trying to connect. Requests to destinations on your blocklist can then be stopped before they leave your network.

Because Pi-hole operates at the network level, you can use it to cover multiple devices at once. This can be particularly useful for devices such as smart TVs, where installing conventional ad-blocking software may not be possible. You can also see the requests being made by devices on your network, including the ones Pi-hole has blocked.

For even more local control, you can combine Pi-hole with Unbound. Instead of relying entirely on another company’s DNS server to resolve website addresses, your own system can handle more of that work and store the answers locally. Your home network becomes something you can inspect and manage rather than a black box.

If you want to try it yourself, check out our guide explaining how to set up a Pi-hole and use it to filter DNS requests across your network.

Take your own network with you when you travel

Hotel Wi-Fi can become awkward when you have several devices. You might have to connect your phone, laptop, tablet, and other hardware individually, and some hotels place limits on how many devices you can use. A travel router gives you another option.

Instead of connecting every device directly to the hotel’s network, you connect the router to the hotel Wi-Fi. Your devices then connect to your router. That means you only have to deal with the hotel’s network once. Your own devices can stay connected to the network you’ve configured, even if you’re travelling with several of them.

You can also run a VPN directly on the router. Traffic from the devices connected to it can then pass through the VPN connection before reaching the internet. A travel router is a small piece of hardware, but it gives you considerably more control over how your devices connect when you’re away from home.

Our guide to setting up a VPN on your router explains how router-level VPN protection works and how it can cover devices across a network.

Choose a laptop you can repair and customize

A laptop does not have to be a closed system that gets replaced when something goes wrong. Framework laptops are designed so you can open them up, replace components, upgrade parts, and customize the hardware. Even the ports are modular, allowing you to swap one type for another when your needs change. That philosophy extends to the software if you run Linux.

Linux gives you more control over what is running on your computer and most Linux distributions are largely open source. That means the underlying code can be inspected by developers and researchers rather than requiring you to rely entirely on a company’s description of what its software does.

Open-source software is not automatically private or secure. But having access to the underlying code gives you another level of control over the technology you use.

Together, repairable hardware and open-source software let you take greater ownership of both the physical computer and the software running on it.

Carry a privacy-focused operating system on a USB drive

You can carry an entire privacy-focused computer environment without carrying another computer.

Tails is an operating system designed around privacy that you can boot from a USB drive on a compatible computer. Instead of using the operating system already installed on the machine, you can start the computer using Tails.

Internet traffic is routed through the Tor network, which sends connections through multiple relays to make it harder to determine where they originally came from. Tails is also designed to be amnesic. When you shut it down, it aims to leave as little trace as possible on the computer you were using.

That makes a USB drive containing Tails something like a portable privacy setup. You can carry your preferred operating system with you and use it on a compatible computer without relying on the machine’s usual operating system.

It is an extreme example of the same principle behind many of the other tools here: you can have more control over the technology you use, even when you are away from your own devices.

If you want to understand how Tor and VPNs differ, Our guide to Tor over VPN explains how the two technologies provide different layers of privacy.

Start with one change

You do not need a programmable smartwatch, a modified iPod, or a privacy-focused operating system on a USB drive to take more control over your technology.

Each of these tools represents a different way to change a default. You can keep your data locally instead of automatically syncing it. You can block trackers at the network level. You can store information offline, choose open-source software, or create your own network when travelling.

You can also start much smaller. Check which permissions your existing apps have. Think about whether an app actually needs access to your location, microphone, or other device features. Look at which services require accounts and which information is being stored remotely.

You also do not have to change everything at once. One deliberate choice can reduce the amount of information you hand over by default.

Privacy does not require completely changing how you use technology. It can start with deciding that one part of your technology should work differently.

What does CC mean in emails? To, CC, and BCC explained

Alanna Alexander — Fri, 11 Sep 2026 18:57:00 GMT

CC (carbon copy) and BCC (blind carbon copy) are standard email features that control who receives a message and what information they can see.

Understanding the difference between To, CC, and BCC is crucial in a business context. CC the wrong person and your client sees an internal aside they shouldn’t have. Forget to CC a decision-maker and they never see an email thread they really needed to.

Keep reading to find out which option to select to communicate clearly (to the right recipient/s), avoid unnecessary replies, protect recipients’ email addresses, and safeguard sensitive information.

What does CC mean?

CC stands for Carbon Copy, a throwback to a time when physical, handwritten memos or letters would be replicated using a sheet of carbon paper.

CC allows you to send a copy of an email to multiple recipients who are not the primary recipient in the To field. The primary recipient will see the email address(es) you have entered into the CC field, and any responses from them. Likewise, the person you have CCd will see any responses from the recipient (unless they’re removed from the CC field, or the recipient clicks Reply instead of Reply all).

CC’ing is especially useful when sending business emails, because you can add as many recipients into an email as you like, all of whom will receive a copy of the same email and see each other’s addresses and responses. This keeps everyone in the loop and creates a transparent record of the conversation without requiring a response.

When to use CC in email

CC is a useful function when you need someone (or multiple people) other than the recipient to know about and follow an email thread.

For example, when you want to loop in an entire project team on something that affects everyone’s work, such as a scope or deadline change, you can simply CC them in.

CC’ing can also be helpful when you want particular individuals to have visibility of an email thread without requiring their input. When emailing a client proposal, for example, you might want to CC anyone directly involved in the project so they have visibility of their feedback and your subsequent discussion. If anything gets escalated or referenced in a review later, they’re always informed on time.

When not to use CC in email

CC’ing should be avoided when your email (or the subsequent email thread) contains sensitive or confidential information. When you email one person sensitive information, there’s a risk they could forward or store it, but CCing increases that risk by adding more recipients, often including people who weren’t the intended audience for the content in the first place.

You should also avoid using CC when you expect someone you’re CC’ing to take action. People included in CC often assume they don’t need to respond, which can lead to missed tasks or delays. This risk grows when you CC large numbers of recipients unnecessarily, which also clutters inboxes with irrelevant noise.

CC’ing an entire distribution list on a routine status update creates noise without adding accountability. Emailing your entire team about a change that doesn’t affect them can create confusion.

You should also be careful about CC’ing someone into an existing conversation without the other party’s knowledge or agreement — like, for example, adding a new stakeholder to a client thread without telling the client first. Even if you have a legitimate reason, it can look like you’re widening access to a conversation that may be confidential.

What does BCC mean?

BCC stands for Blind Carbon Copy. It works like CC’ing, without the visibility. The BCC function allows you to send copies of the same email to multiple people without revealing that they are part of a mass email, or revealing the other recipients’ email addresses or responses to your original email.

Another key difference: If you enter multiple contacts into the BCC field, when they respond it is only you who will receive their response email. It will not be received by any other BCC recipients.

When to use BCC in email

BCC should be used whenever you need to send multiple people the same email, but you do not want them to know they are a part of a mass email or to be able to see the email addresses of the other recipients.

BCC’ing is useful for protecting the privacy of people who have given you their email address with the expectation that you will not share it without their permission. For example, when sending an update about your company to a mailing list, you should use the BCC function to ensure the individual recipients cannot see the addresses of everyone else who has signed up for that mailing list.

You can also BCC yourself when sending an email from a shared or generic team inbox, to keep a personal record of correspondence sent on your team’s behalf.

When not to use BCC in email

As with CC’ing, be wary of BCC’ing when your email contains sensitive information, or you suspect that the email thread resulting from your email will contain sensitive information.

Avoid using BCC in situations where transparency matters. Covertly adding someone to the conversation can damage trust if it surfaces and be considered a breach of email etiquette. It’s better to CC them openly or send a separate note.

BCC should not be used for ongoing conversations, such as an active back-and-forth negotiation or client conversation — where you expect whoever you’ve BCC’d in to be able to follow the whole conversation. Since BCC recipients are excluded from replies, this means cutting them out of exactly the conversation you wanted them to follow.

What’s the difference between To, CC, and BCC?

Feature	To	CC	BCC
Role	The intended main contact of the email.	For people who need to stay in the loop.	To include people without others knowing.
Visibility	Visible to everyone.	Visible to everyone.	Hidden from all other recipients.
Recipient Awareness	Everyone knows they are the main contact.	Everyone knows who else is being kept informed.	Only you and the BCC’d person know they are there.
Reply All Behavior	Receives all replies.	Receives all replies.	Excluded from future “Reply All” threads.
Expectation	Response expected.	For your information (FYI) only.	Should not participate in the thread.
Best For	Direct requests, tasks, and 1:1s.	Transparency and team collaboration.	Mass emails, privacy, and discreet oversight.

What happens when you hit reply or reply all?

Reply behavior can be confusing, especially when multiple recipients are involved. What happens depends on whether you choose Reply or Reply all.

Hitting Reply all when you intended to hit Reply can lead to internal asides and information leaking to clients, or to an entire distribution list being emailed by mistake. One wrong click can stifle your team’s productivity and even threaten your company’s reputation.

If you are in the To or CC field:

Clicking Reply sends your response only to the sender.
Clicking Reply all sends your response to everyone in the To and CC fields.

If you are in the BCC field:

Clicking Reply sends your response only to the sender.
Clicking Reply all sends your response to everyone in the To and CC fields, not to other BCC recipients — but you will reveal to them that you were BCC’d

A better way to send group emails

Although using the CC and BCC functions is the main way to send an email to multiple people, our encrypted email service Proton Mail also lets you do this by putting multiple recipients in a contact group.

Contact groups are useful for emailing multiple people who all know each other, especially if you regularly email them as a group. For example, a team sending weekly updates to stakeholders can save time by using a contact group instead of adding recipients manually every time.

Once you’ve created a contact group in your Proton Mail account, you can email everyone in that group at once by typing the name of the contact group into the To field and selecting the contact group you want to mass-email from the autofill menu. This will enter all of the email addresses of the contacts in that group to the To field.

When you email people who are in a contact group with each other, they can all see each other’s email addresses, although they will not know that you have put them in a contact group, and the name of that group won’t appear in their inboxes. If you don’t want the contacts in your contact group to know the other members’ addresses, you can enter the contact group into the BCC field instead.

Key takeaways on using CC and BCC in a professional setting

To: is for the people expected to take action.
CC (Carbon Copy): is for keeping people informed (FYI).
BCC (Blind Carbon Copy): is for privacy (recipients are hidden from everyone else).

How Proton Mail protects To, CC and BCC email messages

Contact groups make CC and BCC quicker to use, but they don’t make them any safer from interception by a third party. That’s a different problem, and it’s one Proton Mail’s encryption can help with.

Proton Mail encrypts messages sent between Proton accounts with end-to-end encryption, and protects everything stored in your mailbox with zero-access encryption, meaning even Proton can’t read it — or decrypt it, even under compulsion from law enforcement. You can also add password protection to emails sent to non-Proton addresses, so they’re encrypted too.

None of this stops an email reaching the wrong person through a misplaced CC or BCC, and it doesn’t change who can see whose address in a CC or BCC field. That’s still down to you using the fields correctly. What encryption does protect is the content of a CC’d or BCC’d business email in transit, so a client proposal or an internal aside can’t be intercepted by a third party.

If your business regularly sends CC’d and BCC’d correspondence containing sensitive content like client proposals and internal decisions, Proton’s business email service applies that protection automatically, without your team having to think about it.

FAQ

Is BCC safer than CC?

When it comes to protecting your contacts’ email addresses from your other contacts, BCC is safer than CC. With BCC, there is no way for a recipient to know that they are not the only recipient of an email (as long as all other recipients are marked BCC), let alone find out the email addresses of other recipients. For this reason, you should use BCC when you do not have permission to share a contact’s email address with anyone else.
It’s important to note that neither CC nor BCC is safer when it comes to protecting your messages against interception by a third party. That protection only comes with encryption, not through your choice of field.

Is it safe to CC or BCC sensitive business information?

This depends on who you send it to: the mechanisms don’t protect you. CC and BCC control who receives a copy of an email, not what happens to it afterward. Anyone included in a CC or BCC field for a message can forward, screenshot, or store it. If you’re sending confidential information, keep your recipient list as small as possible, and consider encrypting the message itself so the content stays protected even if it ends up somewhere you didn’t intend.

Is it better to CC or BCC?

If you want to maintain a conversation with all the original recipients of your email, it is better to use the CC function, so that all contacts who were initially included in the email receive all the responses. However, if it is important that your contacts’ email addresses are not exposed to each other, and they are not expected to continue an inclusive email chain, then you should use BCC to conceal your recipients’ contact information.

Can a CC’d person see BCC’d recipients?

No. CC recipients cannot see the names or addresses of anyone who was included as a BCC on any original message. The only time the BCC recipients’ contact information will be exposed is if they respond to the email using “reply all”.

How is CC different from To?

The To field should be used for the main recipient(s) of your email, who you expect to respond or take some kind of action after receiving your email. The main recipients will usually be the ones the email is addressed to in the salutation of your email.

Can you use CC and BCC at the same time?

Yes. People in the To and CC fields can see each other, while BCC recipients are hidden from everyone else. BCC recipients can still see who is in the To and CC fields, but they do not receive replies from those recipients.

What happens if someone I BCC’d replies to all?

Their reply is sent to the sender and everyone in the To and CC fields. Their address is still not shown as a BCC recipient, but the reply can reveal that they were included in the original email.

Can you tell if you were BCC’d on an email?

Usually no. BCC recipients are hidden from other recipients. If you receive an email but your address does not appear in the To or CC fields, you were likely BCC’d.

Does CC or BCC affect email delivery?

Not directly. However, sending emails to large numbers of recipients using CC or BCC can trigger spam filters. For large groups, it’s better to use a mailing list or newsletter service.

What is cyberstalking? How to protect yourself and what the law says

Ben Wolford — Wed, 09 Sep 2026 17:18:53 GMT

Cyberstalking is fundamentally an invasion of privacy. It often starts with information you share online voluntarily, from social media posts to tagged photos.

About one in five women and one in 10 men in the US will experience stalking at some point in their lives, and a growing share of that stalking happens through a phone or a laptop rather than in person.

Most importantly, cyberstalking is a crime. But the laws that define it vary around the world.

This guide covers what cyberstalking is and how it differs from other forms of online harassment. We also examine what the law says in major jurisdictions. And you’ll learn what you can do to recognize it, respond to it, and make yourself a harder target in the first place.

What is cyberstalking?

Cyberstalking is the repeated use of the internet, email, social media, or other electronic means to harass someone with the intent to intimidate or control them. As with offline stalkers, most cyberstalkers have had some prior relationship with their target, whether as a former partner, coworker, or acquaintance.

The kinds of harassment that can be considered cyberstalking are varied. In 2025, a man in the US used an AI chatbot to lure people to the home of his victim as part of a seven-year-long cyberstalking attack. In the UK, a woman was sentenced to 28 months in prison for posting harmful, false allegations online.

“Cyberstalking” gets used loosely alongside a few related terms:

Online harassment is broader than cyberstalking. Cyberstalking laws usually require proof that the behavior caused fear of physical danger; online harassment laws often only require that the person intended to annoy or alarm you, with no legitimate reason for the contact.
Cyberbullying is a related pattern of aggressive, unwanted contact, but the term is generally associated with minors and schools rather than adults.
Doxing is the act of publishing someone’s address, phone number, or other identifying details to scare or endanger them. It’s usually a tactic within a broader stalking or harassment case, and few countries treat it as a standalone crime.

Legally speaking, the distinctions matter if you’re trying to figure out what protections apply to you.

Cyberstalking laws around the world

Cyberstalking is seldom its own standalone offense. Instead, it’s typically prosecuted under general stalking or harassment laws. Nearly every legal system covered here also shares one requirement: proof of a repeated pattern of behavior, not a single incident.

United States

There’s no single federal “cyberstalking law.” Most prosecutions happen at the state level, under stalking or harassment statutes that have been extended to cover electronic communications. California passed the first state law explicitly naming cyberstalking as an offense in 1999, and most other states have since followed.

At the federal level, 18 U.S.C. § 2261A criminalizes using interstate travel or electronic communications with intent to kill, injure, harass, intimidate, or surveil someone, when that conduct causes substantial emotional distress or a reasonable fear of serious harm. A conviction carries up to five years in prison as a base penalty.

United Kingdom

The UK prosecutes cyberstalking under Section 2A of the Protection from Harassment Act 1997, the same law that covers offline stalking. A stalking conviction can carry up to 10 years in prison. For single threatening or grossly offensive messages that don’t meet the bar for an ongoing stalking pattern, prosecutors can instead use the Malicious Communications Act 1988 or the Communications Act 2003. More recently, the Online Safety Act 2023 introduced statutory duties for platforms operating in the UK, naming stalking and harassment as among the kinds of illegal content that platforms are specifically required to address.

Germany

Germany criminalizes stalking under Section 238 of the Criminal Code (StGB), amended in 2017 specifically to strengthen protections. The law explicitly covers conduct carried out “by means of telecommunications or by using [a victim’s] personal data” — including impersonating the person — which is the direct bridge to cyberstalking. A conviction carries up to three years in prison, rising to five in severe cases. Cyberstalking cases in Germany are also often prosecuted alongside related offenses like online threats (Section 241 StGB) or insult and defamation (Sections 185–187 StGB).

France

France addresses cyberstalking under Article 222-33-2-2 of the Penal Code, which defines a form of moral harassment as repeated behavior that degrades a person’s living conditions and harms their physical or mental health. A conviction carries up to one year in prison and a €15,000 fine. France’s 2016 Digital Republic Act strengthened the law with harsher penalties for “revenge porn,” doubling the jail time and increasing the fine to €60,000.

Canada

In Canada, online stalking is prosecuted under Section 264 of the Criminal Code, the criminal harassment provision enacted in 1993. A conviction requires proving the behavior caused the victim to reasonably fear for their safety or the safety of someone they know, and it carries up to 10 years in prison. Cyberstalking can also be prosecuted under Bill C-13 (Protecting Canadians from Online Crime Act), which stipulates that the “contact was both repetitive and unwanted” and that “victims must reasonably fear for their safety or the safety of someone known to them”.

Italy

Italy criminalizes stalking as “atti persecutori” (persecutory acts) under Article 612-bis of the Criminal Code, introduced in 2009. The law covers repeated conduct that causes lasting anxiety or fear, a reasonable fear for someone’s safety, or forces a victim to change their daily habits. The provision specifically mentions email and text messages as examples. The base penalty ranges from one to six-and-a-half years in prison, and the law has been strengthened twice since, in 2019 and again in 2023. It’s necessary for the victim to file a charge within six months of the occurrence of the crime.

Brazil

Brazil made stalking a standalone crime relatively recently, through Law 14.132/2021, which added Article 147-A to the Penal Code. It defines the offense as repeatedly pursuing someone, by any means, in a way that threatens their physical or psychological safety, restricts their freedom of movement, or invades their privacy. Brazilian legal commentary treats cyberstalking as squarely covered under “by any means”. The penalty is six months to two years in prison plus a fine, increased by half when the crime targets a child, someone elderly, or a woman because of her sex.

Australia

Australia prosecutes cyberstalking under Section 474.17 of the Criminal Code, which criminalizes using a “carriage service” — any phone or internet service — to menace, harass, or cause offense, carrying up to five years in prison, and notably doesn’t require prosecutors to prove the victim actually feared physical harm.

India

India’s Section 354D of the Penal Code, added in 2013, explicitly criminalizes a man monitoring a woman’s use of the internet, email, or other electronic communication as a form of stalking — one of the more direct statutory references to cyberstalking-style conduct found anywhere. Though the law protects women from men specifically rather than applying generally, men have protection under a separate law on intimidation. A first conviction carries up to three years in prison, rising to five for a repeat offense.

The Philippines

The Philippines’ Safe Spaces Act of 2019 goes further than most, naming “cyberstalking” outright as one of several forms of gender-based online sexual harassment, alongside unwanted sexual messaging and non-consensual sharing of images. This is possibly the most direct reference to cyberstalking as a standalone crime in the world.

Rest of the world

The legal picture is uneven and often incomplete internationally. A 2020 World Bank assessment found that only 30% of economies worldwide have legal protections addressing online harassment, and just 12% protect against cyber sexual harassment specifically. Only 21 out of the 190 economies analyzed have laws explicitly protecting children from online harassment. More recent research suggests the legislative coverage hasn’t dramatically improved.

Why cyberstalking is a privacy problem

Every form of cyberstalking depends on a stalker getting hold of some piece of digital information. But whatever the case, information is what they weaponize against their victim, and there are many possible sources:

Data brokers and people-search sites. These sites scrape and resell your address, phone number, workplace, and family details, often without your knowledge, and they’re frequently the easiest starting point for a stalker building a profile of you.
Photo and location metadata. Photos taken with location services turned on carry embedded GPS coordinates in their image metadata. Stalkers have used metadata from dating-app and social media photos to identify victims’ homes and workplaces.
Stalkerware. This is commercial monitoring software installed on a device, usually by someone who had physical access to it, that lets an abuser track messages, calls, browsing, and location.
Reused or weak passwords. A single breached password from an old, unrelated account can be the opening that lets someone take over your email or social media.

Cleaning up your digital footprint is the most effective thing you can do to stay safe.

Recognize cyberstalking, respond to it, protect yourself against it

If you notice these signs, someone may be cyberstalking you:

Contact that’s excessive or arrives in sudden bursts
Engagement with old social media posts that would have taken real effort to dig up
Threats or blackmail, including threats to release private information or images
Attempts to access your accounts or devices, or a fake profile making contact after you’ve blocked the real one
Unwanted sexual messaging

The clearest signal that something has crossed from unwanted attention into stalking is if the contact continues after you’ve clearly said to stop.

If you’re being cyberstalked:

Send one clear, written message saying the contact is unwanted, then stop engaging entirely.
Document everything: dates, screenshots, descriptions of each incident.
Report the person to the platform where the contact happened.
Block them across every channel you use.
Tell people you trust rather than handling it alone.
If it continues, file a police report and consider a restraining or protective order.

A note on stalkerware: If you suspect stalkerware on your phone, removing it can alert whoever installed it and potentially escalate the situation. If you’re in an ongoing abusive relationship, it’s worth getting support from a domestic violence advocate before you act.

See this in-depth explainer on stalkerware from the Coalition Against Stalkerware.

To protect your privacy:

Search your own name to see what’s already findable, and opt out of data broker and people-search sites. (Note: This isn’t a one-time fix, since new listings resurface over time.)
Review your online privacy settings and turn off geolocation tagging on your camera and apps, so photos stop carrying GPS data.
Use a VPN to hide your IP address, keeping your general location hidden from anyone trying to trace your connection back to you — but be aware that a VPN won’t hide GPS data or protect information you willingly enter into an account.
Use a password manager to generate unique passwords for every account, and turn on two-factor authentication for an extra layer of security.
Use email aliases instead of your real email address when signing up for anything, so services and data brokers never connect a new account back to your identity.
Watch your devices for signs of stalkerware: fast battery drain, unrecognized apps, or permission changes you didn’t make.

Privacy is your best defense against cyberstalking

Cyberstalking is a crime, and many countries give you a legal path to respond to it. But the law works after the fact; the more effective move is making your personal data harder to find in the first place.

That starts with the basics: an email address that isn’t tied to your real name, passwords a stalker can’t guess or reuse from an old breach, and an internet connection that doesn’t broadcast your location to anyone watching.

Our mission at Proton is to help you protect your privacy from Big Tech surveillance. But doing so is also a good step toward protecting your personal safety.

Deepfake fraud targeting businesses: How to recognize and respond to AI-generated scams

Ben Wolford — Wed, 09 Sep 2026 16:51:11 GMT

Deepfake technology has made it significantly easier for scammers to impersonate business professionals. A scammer can now join a call on camera and respond to questions in real time convincingly as another person.

This is the third channel of AI-enabled impersonation, after email and voice, and it’s the one businesses are least prepared for: A face on a video call feels completely human and impossible to fake.

We’ve covered how AI phishing campaigns are faster and easier to launch, and how voice cloning is increasing vishing attempts. In this article, we’ll explore what happens when a person’s identity is co-opted with deepfake videos and how to prevent team members from falling for deepfake scams.

What makes deepfake video fraud different

Email deception relies on written detail: the right tone, the right context, and a reasonable-sounding but urgent request. Voice cloning relies on the ear: a familiar voice saying something urgent enough to bypass a moment of doubt. Deepfake video fraud goes a step further and compromises the one verification instinct most people never think to question: seeing someone’s face and hearing them speak, in real time, on a call that looks exactly like every other video meeting on the calendar.

Employees are trained to be skeptical of an email and to double-check an unexpected phone call. Almost nobody is trained to question a face-to-face video call, because video has always been as trustworthy as a physical meeting.

This new frontier of fraud requires a re-evaluation of what can be trusted at work, as well as how easily processes can be overridden by urgency.

How deepfake scams work in practice

Deepfake video fraud can take a few different forms. The simplest is a pre-recorded deepfake video played into a live call, sometimes with the attacker muting their own camera and claiming connectivity issues to explain why the “executive” doesn’t respond naturally to follow-up questions.

More sophisticated attacks use real-time face-swapping tools during an actual live call, letting the attacker respond, nod, and react in the moment, which is far harder to detect.

A third pattern has emerged, which relies on onboarding and compliance meetings specifically. A synthetic video persona posing as an auditor, a new starter, or an HR contact can sit through an entire meeting designed to extract system access, security answers, or credentials, precisely because those meetings are built around the assumption that a video call with a real person is inherently trustworthy.

A real-world deepfake fraud example

In 2024, a finance employee at the Hong Kong office of Arup, a UK-headquartered engineering firm, joined a video call with people who appeared to be the company’s CFO and several colleagues. Every person on that call was an AI-generated deepfake, built from publicly available footage of real executives.

Believing the request was genuine, the employee authorized fifteen transfers totaling roughly $25 million before the fraud was discovered, and only then because he happened to follow up with the company’s actual head office about the “confidential transaction” he’d just completed.

The Arup case remains the clearest illustration of what this attack looks like at scale, but it’s not a unique incident. UK Finance’s Fraud Report 2026 found that overall payment fraud losses reached £1.28 billion in 2025, and specifically flagged organized criminal groups increasingly using deepfakes, cloned voices, and synthetic identities to impersonate trusted individuals and bypass identity checks.

Separate industry research from Sumsub recorded a 94% year-on-year rise in UK deepfake attempts, and a Gartner survey of security leaders found that 62% of organizations had experienced some form of deepfake attack in the prior twelve months. Any business that still treats this as a future problem is behind where the data already is.

The Arup incident is particularly instructive of what to watch out for. The employee’s initial instinct was sound: he treated the original email as a probable phishing attempt and asked for a video call specifically to confirm it, which is exactly the verification step most security training would recommend.

The failure happened at the next step, when the video call itself was treated as sufficient proof, because nobody had told him that a convincing face on screen is no longer reliable. At that moment, the failure was caused by insufficient business training, not by the employee.

What are some potential deepfake fraud scenarios?

The mechanics described above manifest in a handful of recurring scenarios, each aimed at a different point of leverage inside a business. They share the same underlying trick; a convincing face and voice on a call that looks entirely normal, but the target and the payoff can differ.

A CFO’s face authorizing a wire transfer

A deepfake of a senior finance executive appears on a call and instructs a subordinate to process an urgent, confidential payment. The presence of a familiar, apparently live face overrides doubts that an email alone would have triggered.

A fake auditor extracting system credentials

A synthetic persona posing as an external auditor or compliance reviewer conducts a video interview with IT or finance staff, framed as a routine review, and asks questions specifically designed to surface system access details, security question answers, or login information.

A synthetic HR manager onboarding a new employee

A deepfake HR contact hosts an onboarding call with a genuinely new starter, or with an existing employee under the guise of a policy update, and uses the session to capture details about internal systems, access permissions, or credential recovery information.

Board member impersonation to a financial officer

A deepfake of a board member or senior non-executive joins a call with a financial officer to authorize a transaction or request sensitive financial information, leaning on the authority of a role that a finance team is culturally trained not to question.

Why deepfake fraud is harder to catch

Most anti-phishing and anti-vishing training programs work by teaching people to add friction to a process that someone’s trying to rush through: an email can be forwarded to IT for double-checking, a phone call can be ended in order to verify a phone number.

Video calls don’t get the same instinctive scrutiny, because for years a video call has been the closest digital substitute for being in a room with someone. Employees are rarely told to be suspicious of a colleague’s face, because the cultural assumption behind video conferencing is that it’s totally reliable.

This assumption is what deepfake video fraud exploits. An attacker doesn’t need to defeat an employee’s skepticism about the request itself. They need only supply the one thing that has always ended skepticism in the past; a familiar face responding naturally in real time.

That’s a much higher bar for an employee to meet, which is why the verification protocols for this channel need to be procedural rather than relying on someone simply noticing something is off.

There’s also a social dynamic that has to be challenged. Questioning a written request feels like ordinary diligence. Questioning a phone call feels reasonable, since impersonating a voice has been a known risk for years.

But questioning a face on a video call, particularly a senior colleague’s, can feel closer to an accusation, which is precisely why employees hesitate to do it even when something about the interaction feels slightly off. Removing that social cost, making the question routine and expected rather than awkward, is as much a part of deepfake prevention and defense as any technical control.

Verification protocols that work specifically for video

Create a code

Pre-agreed code words or gestures, established in advance through a separate channel, are one of the few things a deepfake genuinely can’t produce, because they don’t exist in any public footage an attacker could train a model on.

A simple, changeable phrase or physical signal, confirmed periodically among senior staff and finance teams, gives employees something concrete to ask for rather than relying on a subjective sense that a call feels wrong.

Set authorization rules in stone

No financial authorization or credential disclosure should ever take place via video call alone. This has to be a concrete policy, not a judgement call left to whoever is on the call at the time: any request of that kind, regardless of who appears to be asking, requires a second confirmation through a genuinely separate channel, using contact details already on file rather than anything supplied during the call itself.

Employees need explicit, repeated permission to ask “is this really you?” on any call, regardless of who appears to be on screen. They should also feel comfortable to ask for proof via another channel that the person is who they say they are.

The instinct that stops people from questioning a senior figure is precisely what this attack relies on, and that instinct only goes away when leadership makes it unambiguous that the question is always acceptable.

Keep records

Recording and logging sensitive video meetings, particularly anything involving financial authorization, credential access, or onboarding, gives a business something to review after the fact if a request turns out to have been fraudulent, and the knowledge that a meeting is logged is itself a mild deterrent against attackers who prefer to operate without a trail.

Treat video calls the same as you treat an email

Deepfake video fraud succeeds because it exploits the one channel businesses have never trained employees to question. Email deception is covered by phishing awareness, and voice deception is covered by callback verification and the training we’ve written about for social engineering more broadly.

Being aware of deepfake video calls doesn’t require employees to become forensic analysts capable of spotting a synthetic video frame by frame. It requires a business to accept that a convincing face and voice are no longer proof of anything on their own, and to build verification habits that don’t depend on anyone becoming suspicious in the moment.

Reinforcing that culture alongside the wider practices covered in our guide to building a strong workplace security culture gives a team the same instinct for video that good training already builds for email and phone calls.

The credential connection: limiting what a failed verification can reach

Whatever form a deepfake video attack takes, CFO fraud, a fake auditor, a synthetic HR contact, it’s ultimately aiming at one of two things: a financial transaction or a set of credentials. The video is simply the delivery mechanism for a request that, if it succeeds, either moves money directly or gives the attacker a login that lets them cause damage on their own terms.

This is why credential hygiene is important, even when the attack itself has nothing to do with a stolen password at first. If a deepfake call tricks someone into handing over a credential, unique passwords and multi-factor authentication limit what that single credential can actually reach.

The same containment principle we’ve covered in relation to business email compromise applies here: The goal isn’t to make every employee individually unbeatable against a sophisticated attack, it’s to make sure that when verification fails once, the damage stays contained.

A business password manager like Proton Pass for Business makes containment realistic to maintain: It removes the pressure to reuse familiar passwords across accounts and makes it easy for employees to adhere to your password policies. Paired with a secure platform for video conferencing and a workplace culture that treats pausing to verify as normal rather than suspicious, that combination is what actually limits the damage when video calls themselves can no longer be fully trusted.

Reduce your team’s exposure to impersonation fraud with a business password manager.

Password health checks: how to continuously audit your business credentials

Kate Menzies — Wed, 09 Sep 2026 16:19:49 GMT

Businesses often face many small risks like reused passwords, active accounts for ex-employees, and accounts for services you don’t use anymore. On their own they don’t seem dangerous, but as they build they create a credential environment that is harder to trust.

The antidote to this issue is regular password health checks. A one-time audit can show what needs fixing at that moment, but password risk keeps changing as employees create new accounts, teams adopt new software, and fresh breach data appears online.

Password health monitoring turns credential security into an ongoing practice your business can rely on. Instead of waiting for the next annual review, admins can keep track of weak, reused, breached, and inactive credentials across the business immediately, then fix the most urgent risks before they become an entry point.

For small and mid-sized businesses (SMEs), this visibility is especially useful because people often work across multiple disciplines and departments. They may share access to move faster, reuse passwords so there is less to remember, or leave old accounts active even though no one uses them anymore. Without continuous monitoring and strong data breach protection procedures in place, these helpful but risky habits can stay hidden for months.

What is password health monitoring?

Password health monitoring means continuously checking business credentials for signs of risk. In modern business password managers it works as a built-in feature rather than a manual process teams have to run.

Unlike a one-time password audit, monitoring is ongoing rather than limited to an annual security review or a compliance request. This gives admins a regular view of credential health, so weak password detection and breach response become part of normal, quick operations.

In practice, password health monitoring gives admins a way to see credential problems while they are still manageable. Weak and repeated passwords, exposed logins, or accounts with no clear owner can all look like separate issues. Together, they show whether a business is keeping credential risk under control or letting it accumulate quietly.

A secure business password manager like Proton Pass for Business gives teams the visibility they need. It continuously checks password strength, detects reuse across accounts, and monitors the dark web for compromised credentials, so admins see problems without running manual reviews.

The UK’s Cyber Security Breaches Survey 2024 found that half of UK businesses reported identifying a cyber security breach or attack in the previous 12 months. Not every incident begins with a password, but this finding reinforces that basic security hygiene has to be maintained continuously.

For credentials, that means checking password health often enough to catch weak, reused, breached, or forgotten, or inactive accounts before they become part of a larger problem.

The four dimensions of password health

A password health report should show more than whether credentials are stored in the right place. A password vault can keep passwords from being scattered across chats and spreadsheets (vaults can also be shared securely across the team using Proton Pass), but just because a credential is stored securely doesn’t mean it is itself secure.

Some may still be too weak, reused across services, exposed in breach data, or attached to accounts the business no longer needs. Monitoring those signals is what turns password management from a passive vault into an active security tool.

For that reason, password health is best understood across four areas:

Strength
Uniqueness
Breach exposure
Account activity

Password strength

A strong password is long, unpredictable, and difficult to guess or crack. Weak passwords often come from habit: a company name with a year, a familiar phrase with a number, or a variation of an old password that feels easier to remember.

Proton’s password strength tester can help people understand what makes a password stronger, but for business use, it’s also important to understand whether weak credentials are being created and stored across your business network.

If weak passwords keep appearing, the business may need a stronger password policy, clearer onboarding, or better employee guidance. Proton Pass for Business makes this easier: its built-in password generator creates a strong, random password whenever an employee needs one, so meeting the policy won’t create extra effort.

Password uniqueness

Password reuse is one of the most common credential risks because it feels convenient. It’s easy to create an account for a new service, reuse a password, and move on. The issue with this is that one exposed password can then open more than one door.

In a business, reuse can happen across work tools, between personal and work accounts, or across shared credentials. Monitoring helps admins see where the same password appears more than once and which accounts need to be changed first.

This is especially important for admin portals, finance accounts, email, CRM systems, cloud services, and any tool that stores customer or employee information. A reused password in a low-risk tool can become much more serious if the same password also protects a sensitive account.

Breach status

A password may be strong and unique when it is created, then become risky later because it appears in breach data. Regular password monitoring helps you identify this issue if and when it occurs.

New breaches are discovered constantly, and credential exposure doesn’t always become visible at the moment an incident happens. A password can appear in public datasets months later, an employee may have used a business email address on a service the company doesn’t manage, or a credential that was marked as safe during the last review may no longer be safe due to breach exposure.

Proton’s Data Breach Observatory shows how exposed credentials can create risk across companies, teams, and industries. Continuous monitoring shortens the time between exposure and action. It also helps admins judge urgency. A breached credential for an old newsletter platform may need to be replaced, but it does not carry the same weight as exposure tied to payroll, cloud hosting, a domain registrar, or any account with admin privileges.

Account activity

Account activity is different from password quality. A password can be strong, reused, or exposed regardless of how often the account is used; this dimension looks at whether the account itself is still active, owned, and needed. An inactive account is one that has not been used recently. A forgotten account is one nobody claims ownership of, or even remembers exists.

Both are easy to overlook. They may belong to former employees, temporary contractors, legacy software, or tools a team stopped using. Even if nobody uses them anymore, they can still create risk if the credentials remain valid.

Health monitoring can surface accounts that have gone unused for a long time, but deciding what happens to them is a management task. Based on that review, admins may remove credentials from the vault, assign ownership, adjust access, or close the account directly in the service. Others may need ownership assigned, access reviewed, or the account closed directly in the service.

Inactivity is not always dangerous in isolation. Some credentials are rarely used because they belong to backup systems, emergency accounts, or annual renewal portals. But if the business cannot explain why an account exists, who owns it, and whether it is still needed, that account deserves review.

What credentials and accounts businesses should monitor continuously

Not every password issue carries the same risk. Continuous monitoring should help separate urgent problems from lower-priority clean-up.

A practical password health check should monitor:

Weak passwords below policy thresholds. These should be replaced with strong, generated passwords, especially for accounts connected to customer data, finance, admin settings, or infrastructure.
Reused passwords across multiple services. Reuse should be removed quickly when it affects sensitive systems or accounts with broad access.
Credentials linked to breach exposure. Breached credentials should be treated as urgent, even if the account looks low risk. The same password may have been used somewhere else.
Accounts with no MFA enabled. Password health is stronger when important accounts are protected by multi-factor authentication (MFA). Monitoring should highlight high-value accounts that still depend on a password alone.
Inactive or unclear accounts. Credentials with no clear owner or current purpose should be reviewed, reassigned, archived, or removed where appropriate.
Privileged credentials. Admin accounts, finance portals, HR systems, backup services, and infrastructure logins deserve a stricter standard than everyday operational accounts.

This is where a clear policy helps. Proton’s guide to creating a password policy explains how businesses can define rules for password creation, secure sharing, MFA, and access management. Monitoring is what turns those rules into an ongoing practice. Without it, a policy can exist on paper while weak or reused passwords continue to appear in daily work.

How to build a password health monitoring cadence

Continuous monitoring does not mean every issue needs to be reviewed every day. For most businesses, the right cadence combines regular reports with faster action when a critical incident occurs.

Here’s a simple starting point for monitoring cadence:

Critical alerts as soon as possible: breached credentials, reused passwords on sensitive accounts, or weak passwords connected to admin, finance, HR, customer, or infrastructure systems.
Monthly password health reports: overall score, number of weak passwords, number of reused passwords, breached credentials, inactive accounts, MFA coverage, and progress since the previous month.
Quarterly full reviews: deeper review of shared credentials, privileged vaults, inactive accounts, and department-level access.
Event-based checks: onboarding, offboarding, role changes, vendor changes, mergers, new software adoption, or major breach announcements.

This cadence keeps password health visible without turning it into a constant manual burden. It also creates a rhythm for accountability. IT can see where risk is increasing. Managers can review credentials owned by their teams. Leadership can track whether credential hygiene is improving or drifting.

What a useful password health report should show

A password health report should help people decide what to fix first. If it only shows raw numbers, it becomes easy to ignore. If it gives every issue the same weight, it can send teams in the wrong direction.

The most useful view is one that combines status, urgency, and progress. Admins need to see where weak, reused, breached, or inactive credentials exist, but they also need to understand which of those issues create the greatest risk for the business. A weak password on an old test account still deserves attention, but it should not compete with a breached credential tied to payroll, cloud hosting, email, or a domain registrar.

Group management in Proton Pass for Business supports this kind of prioritization. IT can create groups that map to departments, teams, or client accounts and assign vault access at the group level, so when someone joins or leaves a team, their vault access updates automatically, and the health report reflects a structure that matches how the business actually works.

The report should also show whether credential security is improving. A rising number of reused passwords may point to poor adoption of the password manager. Slow remediation of breached credentials may show that ownership is unclear. Too many inactive accounts may suggest that offboarding and software review processes need work.

Overall, password health should be a clear indicator of your business’s credential hygiene: where risk is building, how quickly teams respond, and whether password policy is changing behavior over time.

How Proton Pass Monitor makes credential risk visible

Proton Pass for Business is a secure business password manager that helps teams store, generate, autofill, and share credentials securely. For password health monitoring, businesses can use Pass Monitor.

Pass Monitor gives admins visibility into weak, reused, and breached credentials across the team. Instead of waiting for a manual review, businesses can see which passwords need attention and where the most serious risks are. That makes password health easier to manage as part of day-to-day security operations.

For businesses with growing teams, this visibility is important because credential risk is rarely concentrated in one place. Some issues come from old shared passwords. Others come from personal habits, rushed onboarding, abandoned accounts, or tools adopted without IT involvement. Pass Monitor helps surface those issues so teams can act before a weak or exposed credential becomes a larger incident.

Proton Pass for Business gives teams the foundations for stronger credential management: encrypted vaults, secure sharing, strong password generation, autofill, built-in two-factor authentication, passkeys, admin policies, logs, role-based access control, SCIM provisioning, and SSO integration. For IT teams, Proton’s Pass for IT teams page explains how these features support centralized credential management across the business.

Pass Monitor should not replace policy, training, MFA, or access reviews. It makes those controls easier to enforce because admins are no longer relying on guesswork. It also closes the gap between policy and practice: rules that would otherwise exist only on paper become measurable and enforceable, and credentials spread across dozens of platforms stop accumulating invisible risk. They can see which credentials are weak, reused, or breached, then use that information to guide remediation.

Monitor your team’s credential health continuously with a business password manager.

Australia’s opt-out law could change how social media algorithms work

Edward Komenda — Wed, 09 Sep 2026 11:39:20 GMT

Australians may soon be able to switch off social media algorithms and see only posts from accounts they follow.

Australia plans to introduce new online safety laws that would give social media users ages 16 and older the option to turn off algorithm-driven feeds under a “My Feed, My Way” initiative, while also imposing a digital duty of care on platforms to better protect children from harmful content.

The proposed laws would give the eSafety Commissioner (Australia’s online safety regulator) stronger enforcement powers and expose companies to fines of more than A$100 million for non-compliance, though the legislation is expected to face political debate before passing parliament. Communications Minister Anika Wells called it “a global reckoning for big tech.”

The law raises a question every internet user lives with: what is a social media algorithm, and why does controlling it matter?

What is an algorithm in social media?
How do social media algorithms work?
What would Australia’s social media law change?
How to take back control of your social media feed
Algorithmic control starts with privacy

What is an algorithm in social media?

An algorithm in social media is the system a platform uses to decide which posts, videos, ads, or recommendations to show you, and in what order.

Instead of showing only the newest posts from accounts you follow, the algorithm may rank content based on things like what you click, watch, like, share, search for, or spend time viewing. Its goal is usually to predict what will keep you on the platform.

Early social media feeds were much simpler than today’s. They were mostly chronological and based on people you had deliberately connected with, such as friends, pages, or accounts you followed. If someone posted something recently, it appeared near the top, with older posts moved down. Today, all major platforms, including Instagram, TikTok, YouTube, Facebook, and X, use a recommendation algorithm.

How do social media algorithms work?

Social media algorithms work by constantly making predictions about what you’re most likely to engage with. Platforms keep their ranking systems secret, but the mechanics are consistent across the industry. Candidate posts are scored on signals like popularity, engagement speed, and your history with a creator. Machine learning models predict how likely you are to like, share, or watch to the end. The highest-scoring content fills your feed. Your reaction becomes training data, so tomorrow’s feed is essentially tuned to yesterday’s behavior.

The goal of a social media platform is to keep you engaged. That business model has also come under growing legal scrutiny: In 2026, Meta agreed to an $18 billion settlement over claims that Facebook and Instagram were designed to addict children and teenagers, while admitting no wrongdoing.

Generally, content that triggers outrage, envy, or anxiety generates more engagement, so it gets amplified. To find out which content is most likely to engage individual people, platforms collect vast amounts of personal data.

What would Australia’s social media law change?

Turning off the algorithm would mean seeing a simpler feed made up mainly of content from the people and groups you have deliberately chosen to follow. Australia’s social media law would:

Allow people over 16 to opt out of algorithmic feeds. Platforms must notify everyone and ask them to choose a default feed.
Require online services (including games, apps, and AI chatbots) to protect children (under 18) from specific harms, including pornography, content promoting eating disorders, misogynistic content, glorification of crime, and content causing serious mental stress.
Give the eSafety Commissioner power to issue removal notices, including for “nudify” apps used to create non-consensual intimate images (deepfakes).
Impose fines above A$100 million for non-compliance.

Australia follows in the footsteps of the EU’s Digital Services Act, which requires the largest platforms to offer users a recommender option that is not based on profiling. The rollout has not always been smooth, however, with regulators arguing that some platforms have made opting out unnecessarily difficult.

The proposed law also builds on Australia’s world-first under-16 social media ban, which took effect in December 2025. Similar measures are now being pursued in France, the UK, and New Zealand.

Whether Australia’s new approach to social media algorithms will have a similar influence remains to be seen, but if the legislation passes, other governments are likely to watch closely. “This is not about giving government control, it is about giving people control,” Prime Minister Anthony Albanese said.

How to take back control of your social media feed

You do not have to wait for new legislation to take some control over what appears in your feed. Most major platforms already offer a few ways to reduce algorithmic recommendations, although they will not be eliminated entirely:

Use Following or chronological feeds where available. Instagram, Facebook, X, and other platforms offer views that prioritize accounts you already follow rather than recommended posts.

Turn off or limit personalization. Check your privacy, ad, and recommendation settings for options to reduce personalized content, targeted ads, or activity-based recommendations.

Tell the algorithm what you do not want. Use controls such as “Not interested,” “Show fewer posts like this,” or “Mute” instead of simply scrolling past unwanted content.

Be selective about what you engage with. Watching, liking, commenting on, or repeatedly viewing a post can signal that you want more of that kind of content, even when you are engaging because it makes you angry.

Unfollow, mute, and block aggressively. Curating the accounts you follow can make following-only feeds much more useful and reduce exposure to content you never asked to see.

Disable autoplay and unnecessary notifications. These features are designed to draw you back into the app and keep content flowing with as little friction as possible.

Use the web version or alternative clients when possible. Some interfaces make it easier to avoid recommendation-heavy features such as Shorts, Reels, or For You feeds.

Explore European social media alternatives designed around greater user control and privacy rather than profiling-based feeds.

Algorithmic control starts with privacy

Australia’s proposal addresses one part of a much bigger problem. Algorithmic feeds are powerful because platforms know so much about the people using them. Giving users control over what appears in their feed is a meaningful step, but real digital autonomy also means having control over the data used to profile them in the first place.

At Proton, we believe people should be able to use the internet without surrendering their privacy, whether that means choosing what appears in their feed or choosing services that don’t build their business around tracking them.

7 privacy tools experts actually use

Proton Team — Tue, 08 Sep 2026 18:11:26 GMT

Privacy software can get complicated quickly. There are operating systems to replace, apps to swap, networks to understand, and settings buried several menus deep.

You don’t need to use all of them. But the tools below show how one privacy expert approaches everyday technology: reduce unnecessary data collection, separate sensitive activity, and make more deliberate choices about who gets access to your information.

GrapheneOS gives you more control over Android

GrapheneOS is an alternative operating system for Android phones that puts more control over privacy and security in the user’s hands. It doesn’t come with Google apps and services by default, although Google Play can be installed as sandboxed apps when needed.

One of the useful differences is how granular the permissions can be. You can control whether an app has access to your location, camera, microphone, network, and other device features. An app can remain installed while having its ability to communicate over the internet turned off.

GrapheneOS also includes features designed to protect sensitive data if a device is compromised or handed over under pressure. Its duress PIN can wipe the device when entered at the appropriate credential prompt.

The appeal is simple: you can keep using a smartphone without giving every app the same level of access.

For a full list of its privacy and security features, see the official GrapheneOS features overview.

Organic Maps works without a connection

Maps are one of those phone features that can quietly involve location data. Organic Maps takes a different approach by allowing maps to be downloaded to your device for offline use.

Once a map is stored locally, you can search for places, see your position, and get directions without repeatedly sending your location to a remote server. That also makes the app useful when you have little or no connectivity.

For someone trying to reduce their reliance on Google or Apple services, it is a straightforward change. You still get a practical navigation tool, but more of the information needed to use it stays on your phone.

If you’re keeping your existing apps, it’s also worth reviewing your location services and deciding which ones actually need access to your location.

Qubes OS separates your digital life

Imagine keeping one computer for work, another for personal activity, another for banking, and another for tinkering. Qubes OS tries to provide that separation on a single machine and uses virtual machines to create isolated environments, or “qubes,” for different parts of your life.

The benefit is containment. If you open something malicious inside one environment, the goal is to stop that activity from automatically gaining access to everything else on the computer.

It’s a digital version of keeping your eggs in different baskets.

You can learn more about the model in the official Qubes OS documentation.

RSS puts you in charge of your feed

An RSS reader may seem like an odd choice for a privacy toolkit, but it solves a different problem: who decides what information you see?

Most major platforms use recommendation systems to select content for you. An RSS reader lets you choose the sources yourself. You can follow news sites, blogs, YouTube channels, and other websites, then bring their updates together in one feed.

That means you can check the sources you care about without opening several apps and letting each one decide what deserves your attention.

It is a small change, but it gives you more control over your information diet.

F-Droid offers an alternative app store

On Android, you’re not limited to the Google Play Store. F-Droid is an app distribution platform focused on free and open-source software.

Open-source software makes its underlying code publicly available. That doesn’t automatically make an app safe or private, but it gives researchers and other developers the opportunity to inspect how it works. They can potentially spot security problems, identify unexpected behavior, and contribute fixes.

F-Droid also doesn’t require an account just to download apps. That makes it another example of a small default you can change if you want more control over how software reaches your phone.

Proton has also made its Android app available through F-Droid, explaining that the repository provides another way to download the app without registering for a Google account. Learn more about Proton VPN on F-Droid.

Cape puts privacy at the carrier level

Your mobile carrier sits in a sensitive position because it has to handle information needed to provide cellular service. That makes the carrier itself part of your privacy equation.

Cape is a mobile carrier designed with privacy and security as major considerations. Its approach is to minimize the personal information it collects and retains. For example, Cape says it doesn’t require details such as your name or home address when you sign up.

The underlying idea is broader than one carrier. Your phone company needs enough information to provide service. That doesn’t mean it needs every detail about you.

Tor Browser adds another layer of anonymity

Tor is often associated with the dark web, but its privacy uses are much broader. Journalists, activists, and people facing serious threats can use the network to make it harder to connect their identity with their online activity.

Tor Browser sends traffic through multiple relays. Each relay has a limited view of the connection, so no single relay needs to know both where the traffic originated and where it is going. The route also changes rather than relying on the same three servers every time.

Tor Browser takes another step by making browsing sessions look more alike. Techniques such as letterboxing standardize the browser window, while consistent settings make individual users harder to distinguish.

There is a trade-off. Tor can be slow, and it’s designed for a different privacy model than a conventional VPN. That extra privacy can come at the cost of speed and convenience.

The Tor Project’s explanation of Tor Browser goes into more detail about how the browser works and why it is designed this way.

Where a VPN fits in

A VPN and Tor can both improve online privacy, but they solve different problems.

A VPN creates an encrypted connection between your device and a VPN server and hides your IP address from the websites you visit. That makes it useful for everyday browsing, particularly when you want to protect traffic on an untrusted network or keep your IP address private.

A VPN can also help reduce IP-based location tracking. This is handy as just relying on turning off GPS and other device-level location services doesn’t prevent websites from estimating your location from your IP address.

Tor uses a network of relays to make it harder to connect your identity with your destination. It’s generally slower and is primarily designed for anonymity rather than everyday convenience.

For most people, a VPN can be a practical privacy layer that works across the device. Tor is an option when you need stronger anonymity and can accept the performance trade-off.

Start with one change

You don’t need to replace your phone, abandon every major platform, or build a computer full of virtual machines to make a difference.

The more useful lesson from this toolkit is that privacy improvements can be incremental. You might start by switching to an offline maps app, using an RSS reader, installing apps from a different source, or reviewing which permissions your existing apps have. Even a single change can reduce the amount of information you hand over by default.

A Gmail scam is exploiting Google Account recovery emails

Edward Komenda — Fri, 04 Sep 2026 11:59:42 GMT

One morning in August, a member of our team answered a call from a California number.

The caller, polished and speaking with a flawless American accent, claimed to be from Google. An attempt had been made, the caller said, to change the account recovery address on the employee’s Gmail account, and an email about it was sitting in his inbox at that very moment.

Upon further investigation, however, our team member soon learned things were not as they seemed.

This was a phishing scam, and a more sophisticated form of social engineering. It used a carefully scripted conversation designed to build just enough trust that you believe the caller really is Google, ultimately persuading you to hand over some form of access.

Our colleague ended the call before reaching that moment, so the exact ask went unheard. But the structure of the scam tells you exactly where it was headed.

How this Google account recovery scam works
The tells, annotated
Why this Gmail scam is so convincing
How to protect yourself from account takeover attempts
A safer inbox starts with better email security

How this Google account recovery scam works

The setup

Before the phone rings, the scammer creates a fresh, anonymous Gmail address, which consists of random letters and digits. Using Google’s legitimate “add a recovery email” flow, they try to add the victim’s address as the recovery email for the scammer’s own throwaway account.

The first real email

Google’s system needs the victim’s confirmation, so an authentic message arrives asking them to verify the recovery email. The sender, branding, and code are real. (Figure 1 below)

The call

The scammer makes a call, poses as a member of Google’s security team, and describes a suspicious account access attempt that was supposedly blocked, even claiming to have intercepted the victim’s authenticator code. The word “blocked” casts the caller as the hero. In reality, the attack is the phone call.

The second real email

Still on the line, the victim receives a genuine “Security alert” announcing that a recovery email was changed on a linked Google Account. Skimmed, it looks like a compromise. Read carefully, the fine print reveals it’s a copy of an alert sent to the scammer’s address. (Figure 2 below)

The vanishing act

The first email offers a legitimate escape: removing your address from the stranger’s account. But the moment our colleague hung up, the scammer withdrew the recovery request, erasing the trail, and likely moved on to the next target.

The tells, annotated

Figure 1 shows the first Google email, which contains a security code needed to confirm your address as the recovery email for the scammer’s account.

The genuine Google sender — real, which is precisely what makes it dangerous.
“Wants to use your email address as their recovery email” — the reversed logic, as this is about someone else’s account.
The anonymous throwaway address — no way to verify who’s behind it.
The expiring code — manufactured urgency, keeping you stressed and compliant.
“Remove email” — the one action that stops it, and exactly what the scammer cancels when you hang up.

Figure 2 shows how a genuine Google security alert can appear alarming at first.

The subject addresses the scammer’s inbox, not yours — the first sign this alert isn’t about you.
“A copy of a security alert sent to” the throwaway address — the biggest tell, and the easiest to miss on a skim.
The alarming headline — designed to scare before you read the fine print.
“If you didn’t change it, check what happened” — planted doubt that primes you to trust the caller.
The “Check activity” button — a prompt to act fast instead of read carefully.

Why this Gmail scam is so convincing

Both phishing emails come from Google’s real servers, so every conventional anti-phishing check passes.

Each element corroborates the others: real notifications, plus a caller who knows exactly what just landed in your inbox. At the same time, the conversation can discourage any attempt you may have to click “Remove email”, keeping you focused on the caller’s instructions.

A Google data breach can make scams like this more convincing if exposed information gives attackers details they can use to personalize vishing or phishing attacks. Even when passwords aren’t leaked, names, contact details, or account-related information can help scammers sound more credible and build trust.

How to protect yourself from account takeover attempts

You can protect yourself by slowing the interaction down and verifying what’s happening through Google directly:

Hang up and verify independently. If someone calls claiming to be from Google, end the call and check your account directly rather than following their instructions.

Read Google security emails carefully. Pay attention to which account the alert actually refers to, especially any line saying the message is a copy of an alert sent to another address.

Do not share verification codes. Google will not need you to read out an authenticator code, recovery code, or other sign-in credential over the phone.

Use “Remove email” if you do not recognize the account. If Google says someone wants to use your address as their recovery email, remove it from that account.

Do not let the caller rush you. Scammers rely on urgency to keep you reacting instead of checking what the notification actually says.

Review your Google Account security directly. Open your account settings yourself and check recent activity, signed-in devices, recovery details, and security alerts.

Report suspicious calls and messages. Reporting the attempt can help Google and your phone provider identify repeated abuse.

Review your Google privacy settings. While privacy settings won’t stop this particular scam, regularly checking what data you share and which apps and services have access to your Google Account can reduce your exposure.

A safer inbox starts with better email security

Scams like this are a reminder that even legitimate security emails can be turned into tools for social engineering. Staying skeptical of unexpected calls, checking account activity independently, and reading alerts carefully can help you avoid falling for them.

Looking for a better alternative to Gmail? Proton Mail gives you a secure email service built around protecting your data and communications with end-to-end and zero-access encryption.

If someone tries a similar scam while pretending to be Proton, there’s a simple rule to remember: Proton will never call you about an account security issue. You can protect your account from takeover by enabling two-factor authentication. On paid plans, Proton Sentinel combines automated detection with human security analysis.

Proton Mail also includes protections against more conventional phishing attempts, such as cloud storage email scams. PhishGuard blocks and flags suspected phishing emails, while link confirmation prompts you to verify before opening external links from an email.

No email service can provide perfect protection against account takeover. However, if someone does manage to break into your Proton account using email or SMS recovery, they won’t automatically gain access to your emails and contacts, thanks to separate data recovery protections.