Proton's Andy Yen: Building Europe's Answer to Big Tech (Podcast)

Hi, Bruce. Thanks for having me. It's good to be on the show.

Well, I think Proton is much more than a VPN. It didn't start with a VPN actually. I think the connection between CERN and the web actually goes quite far back. If you back in 1991, Sir Tim Berners-Lee, when he invented the web, was actually working at CERN. So there's always been an intercession between science and technology, and CERN in particular, because of the massive amounts of data that we deal with, and the infrastructure that is built to support that, actually has a very good connection. So I would say that working in science, the topics around privacy, security, these are things that come about because as a scientist, well, you don't go into science to make money, right? I can tell you there's not a lot of money in science. You do it because you wanna work on some of the world's most interesting problems or the world's most difficult problems that you think actually benefit society. And if I look at society today, especially back in 2014, when we started the company, one of the big things was, well, you know, the web as we know it is sort of going in the wrong direction. It's something that is increasingly monopolized by a few big tech companies that really don't have the best interest of society and users at heart. So our challenge, our motivation was to figure out how can we build a different model of operating online, which goes against that and actually brings privacy, freedom and choice back to Internet users.

Yeah, actually, I was a particle physicist, and I was working on a part of particle physics called supersymmetry. And so actually, my PhD is in physics, indeed. And I guess I'm one of the many physicists that ended up in tech. It's quite interesting because had we found supersymmetry and had we found new physics of the Large-Hersion Collider at CERN back in those days, probably Proton wouldn't exist. Probably we would all be professors somewhere doing research into new physics. But it turns out that the nature of the universe was that the LHC, the machine we're working on, was not big enough to discover new physics. So in some ways, the nature of the universe caused Proton, the company, to be created because all these great scientists suddenly had a lot of free time. The field was less exciting after we did make the discoveries that we were hoping to make.

Yeah, it's correct because it's the LHC, the Large Hadron Collider, it's actually a proton-proton collider. So we were smashing protons and we thought, OK, well, that's a good name. Let's use that.

Yeah, I think that's a very interesting question. It's fascinating because if you look at the VPN industry today, I would say most of those businesses are not tech businesses, right? They're probably marketing businesses and in many cases, exceptionally good ones at that. And I think in some ways that's always been what has made Proton different. Fundamentally, when it comes to a VPN, what you're doing is you're saying, I don't trust my internet service provider. And I'm going to trust some other guys. And the other guys is the VPN company. And it's interesting because a lot of these VPN companies out there, you don't even really know who runs it. And then when you do discover who runs it, you probably think to yourself, well, these guys probably shouldn't be running a VPN because I can't trust them at all. And it's interesting, if you dig in a lot of VPN companies, there's a lot of stories of, well, people that were from the ad tech or malware space that decided to go into VPNs, right? Which, you know, doesn't make any sense. So, software at the end of the day, we think about it as code, but actually you're trusting who writes the software. So I think one of the key things that's very important is you need to look at who is building the software that you're running, what is your motivation, what is your credentials, and why they're actually credible in doing what they're doing. So I would say in the VPN space, look at who's behind a VPN company. This is the key thing, right? In a lot of cases, you can't even find it, which is the first problem. But beyond that, I think it's also important to use VPNs that are open source. So you can actually validate that it's actually working as advertised and that there's a level of transparency that comes from having clear ownership, clear disclosure of who's behind it, and clear ability to inspect the code that I think is very essential. Because VPN at the end of the day, it's a trust business. And trust comes from transparency.

Yeah, it's actually a very interesting space as well in this regard because a lot of the – well, it's just publicly out there now, right? A lot of the most well-known sites that review VPNs are actually themselves owned by the VPN companies, right? And there's a few prominent examples of this out there in the industry. Then you might say, oh, maybe I'll go to my YouTube influencers. But half of them are paid off by VPN companies as well, right? You've been on YouTube, you've seen all the ads. So I do think there's a big credibility gap about who you can believe. Because in fact, advertising is so subtle these days that you're not sure if they're saying it because it's true or they're saying it because they've been paid to say it. And yeah, so this is why I think it's important for users to be savvy. You've got to do a bit of digging, try to understand a bit of the space. And I think also do your best to research who's behind these companies, and don't just click on the first thing that you find online because odds are that it's not an impartial review. And yeah, so I think it's a bit too bad that this is the nature of internet today. It's not just VPNs, actually, but whether antivirus or any other business out there, it's kind of the same. We've sort of lost the really truly impartial reviews. And so I think it's this is why word of mouth, talking to experts that knew, I think everybody always has that one friend they know who is the person that knows all the tech things. Ask that person, because he probably has done more research. But yeah, I do think consumers say you have to be careful about who they pick, whether it's your browser, whether it's your VPN, whether it's email service. There's usually more than meets the eye.

Yes, that's correct. And actually open source, the benefit of open source is not that you personally can go and inspect the code and understand it because odds are that you can't. The benefit of open source is that anybody that wants to can go and inspect the code and look at it themselves. And even if you yourself cannot read the code, it's very likely that among the 8 billion inhabitants of Earth, there is someone out there who can read it and has done it. And if you're a big enough VPN player and there's something hiding your code that is not kosher, it's going to get found if it's open source code. So open source, even if you personally cannot read the code, is still actually valuable for that reason. And I think also, Proton's structure is also something that's quite unique in this space. Today, the main shareholder of Proton, actually the controlling shareholder, is the Proton Foundation. That's a nonprofit that's based here in Geneva, Switzerland, whose mission is actually to further online freedom, privacy, and democracy. And this is something quite important because today your data online is being sold to the highest bidder. Even a company that is a privacy company could get sold to a bigger company that doesn't care about your privacy anymore. And I think an example of this is recently 23andMe went bankrupt in the US. That's a DNA testing company. Well, guess what? In a bankruptcy, the highest bidder bought your DNA data. So I think the fact that we're a foundation means that it has a long-term guarantee that actually Proton cannot be sold because the foundation's mission does not allow it to sell it to the highest bidder. And this is sort of the strongest reassurance that you can possibly have. Anybody else out there that's in the VPN space or in the privacy space, they're going to be for sale eventually. And I think we did that structure because it's the only way to ensure in the long run, doesn't matter what happens to me or the other people in the company, the foundation will always be here, always ready to defend the mission and defend user data in the long run.

Yeah, well, I think, first of all, I'm a scientist originally. And I think no matter what you do in life, you always stay kind of a scientist. And if you know about science, the core essence of science is peer review. It is coming up with an idea, but then having other people validate it by publishing your work openly, so that the rest of the world can challenge, discuss, and validate the research that you have done. And today, if you look at Proton's office here in Geneva, for example, probably a third of the engineers here came from CERN. They're scientists as well. So I think that scientific ethos is very strongly in our culture. And this is why we're transparent. This is why we're open. This is why we publish what we have done. This is why we publish our code. Because that is simply the way that we've always lived our lives. If I zoom out a little bit more, I think there's maybe two other things that motivate me. One, I'm originally from Taiwan. And that is quite close to a neighboring country called China. And if you're neighbors to China, and technically still at war, in fact, because the war was never settled, you understand very quickly how freedom can disappear if there's no privacy, and how democracy is not something that you take for granted. So I think that background also makes me maybe a bit more sensitive to these issues. And this is why I believe strongly in privacy, freedom, and democracy, because I think actually the three things are entirely linked. So I think that's definitely one factor. The other factor that really motivates me is if I were to go out today and talk to the average online internet user, which is basically everybody today, and I were to give them Google's vision of the web and also share with them Proton's vision of the web, I would wager that probably 9 out of 10, or maybe even 99 out of 100, would say that they're more strongly aligned with Proton's vision of what the web and what the internet can and should be. And that is, for me, extremely motivating because from that alone, I think in the long run, we're going to win. And it's a lot more easy to get motivated for a fight if you believe that you can win it. And I do think that we can win it in the long run because the vision that we have of how the web should be, this is what consumers actually want. And so now we have to work hard to make it possible.

Yes.

Yeah. Well, it was almost kind of a historical accident in a sense because Proton was, in fact, built… the first version of ProtonMail was coded up in the CERN cafeteria, right? So we were already here and when we needed to decide where should we place the company in order to give the best protection for users. And you look at all the legislation that exists in the world, actually Switzerland was one of the best locations. Now you can probably find one or two random countries somewhere where there's a total lack of regulation where anything goes that maybe even more private on paper, but they're not places that you can incredibly run a business. And of course, there's also some folks that say, oh, maybe you should put your business offshore somewhere on a Caribbean island or 15 miles from the nearest landmass. But that's not practical either. So in terms of well-developed countries that have the scale, but also the legislative framework that allows privacy services like Proton, which are based on trust, to really service users globally in a very good way, Switzerland is one of maybe a handful of countries that I think meets the criteria. So that was why at that point we decided it makes sense to be here. But what I want to stress is I don't think you can build your company fundamentally around the laws. Because laws can change and governments can change. It takes just an election, as we've discovered in many countries around the world. So I would say that the protection that you get from Proton is less about the laws of Switzerland and more about the laws of mathematics, the laws of encryption, because I don't care who wins the election. The laws of math are not going to change. And that's a guarantee that we want to give to our users.

Yeah, it's an issue that we're watching very closely. What is going on is there is a proposal to revise the ordinance around surveillance. And what this revision would do is it would give the government's ability to request more data from companies like Proton. But it would also require us to retain metadata. So it would bring mandatory metadata retention into Switzerland. And for me, this is very troubling because actually today, mandatory retention, this has been ruled illegal in Europe. It's not even done in the US. So Switzerland will be introducing something that on this continent, the only country that does it actually is Russia. And I think it's the wrong direction for the country. So obviously, at Proton, together with allies, we are fighting this. And we're fighting it now through the public consultation that is being done, and we'll also fight it in the courts as well. Do I think this thing will make it all the way through, passing the consultation and also passing the court challenge that we would mount? I would probably say if I had a bet, no. But you're never sure. So you have to fight it anyways. And I do think it's important to fight measures like this because you see more and more in different countries around the world, attempts to weaken encryption, attempts to put more surveillance. And this is the slippery slope. This is quite dangerous, and it simply doesn't end well. And the way to look at this is, even if today you happen to trust your government, a couple of years from now, or a decade from now, maybe an election happens, and there's a government that you don't trust. At that point, what are you going to do? Are you going to say, oh, I don't trust you anymore. I'd like to take back this power that I gave you 10 years ago. That's never going to happen. So the only guarantee that us as citizens have that our data will stay safe is if we have a legal framework that protects us irrespective of who is in power. And this is why I think legislation changes in legislation and ordinances which weaken encryption, it's something that doesn't matter which political side you're on. It doesn't matter if your guy is in power today or not. We should all be incentivized to fight that.

Well actually, the way Switzerland works is these ordinances can come from an administrative unit and someone simply makes a proposal to change it and then it can kind of go under the radar and actually slip through all the way. So this is maybe, in my opinion, a failure of the Swiss way of doing ordinances because you could really have just one insane person sitting in Bern come up with an extreme proposal and that proposal could, if no one pays attention, go through and become adopted. And I think the way that I would look at this is if you were to ask the policeman to write the rules, it shouldn't surprise you that you end up living in a police state. So what I think happened here was people, in fact, I know exactly who, was asked to update the rules. And this is someone with a very extreme view of surveillance. This is someone that would probably be a natural to work in Russia, for example. And he simply imprinted his extreme view onto the ordinance without any consideration at all to the economic, social, and political effects. And luckily, we were able to catch this, raise the alarm, make a lot of noise. And what is amazing is almost all the major political parties in Switzerland have now come out against this revision. And so hopefully we stop this thing. But I think this is why, in this space, as citizens, we need to be constantly vigilant, because instantly we look away, something like this can slip through. And we got to pay attention. But if you let a policeman write the rules, don't be surprised to wake up in a police state. This is the simplest explanation of it.