Exploring the Proton controversy: From toxic management to the AI-first future
Dear reader,
It appears that Proton controversies have become a yearly occurrence. To nobody’s surprise, it’s CEO Andy Yen who has once again found himself at the center of a scandal.
Last week, 404 Media reported that Proton was going to do re-interviews to better understand how its employees are utilizing AI tools in the job. The message was clear: if you don’t use AI in a way that pleases the management, you could get fired. After a backlash from the community, Proton reversed the decision.
While this incident had many people concerned, it was this article by 404 Media that painted a disturbing picture of the current leadership at Proton and its vision for the future.
Andy Yen’s toxic communication style
According to the people at Proton who 404 Media interviewed, Andy Yen has a tendency to insult people and abuse his power position in a way that makes employees afraid to challenge him. An exchange between Yen and a security engineer is one notable example. It shows Yen responding to a request to test the code before pushing it into production:
That’s bullshit and loser thinking. Of course it’s possible to be fast and secure. Stop thinking always of how to be slower, and focus more on how to be faster.
In another interaction with employees, Yen wrote the following message after being unhappy with the launch of their post-quantum cryptography feature:
In the future there are two options. Either you guys are confident enough to not fuck this up, or you get my advice to make sure it is not fucked up.
In the same message thread, Yen urged employees to go to Reddit to fix the situation because, according to him: “Perception is more important than truth, the truth doesn’t matter if you don’t win on perception.”
These comments highlight severe leadership issues and reveal that Yen is ready to prioritize speed over security. I’m also unsure if we can trust his word again since for him, it’s the perception that matters, not truth.
The situation is unsettling, and like many people in the Proton community have pointed out, dismissing security concerns is not what people expect or want from Proton. People use Proton’s services because of the robust security and privacy features — not because of fast development speed. Being slow has been Proton’s calling card for a long time. While frustrating, people are willing to accept the compromise because they get to use a product they can trust.
The race to transfer Proton into an AI-first company
According to the 404 Media article, Yen started to push AI at the end of August with the aim of using it as much as possible. One employee had this to say about the situation: “The CEO is in full AI psychosis and has been for a while now.”
I have been critical of AI in my writing before, but I understand it can be useful in software development. For a security company, abstaining from AI-tools could mean giving hackers an advantage in discovering security vulnerabilities in the code.
My issue with the situation is the rush and recklessness with which Proton’s management is pushing AI-use across the company. When Andy Yen stated that Proton won’t hire engineers anymore, it’s no wonder people got concerned. When he said that Proton stops reviewing code by hand, this concern gets amplified.
The train is coming, get onboard or get crushed. Don’t be the professional fax machine operator in the internet age. I think by the end of this year most developers stop programming and start writing specs for tests that AI will code and run, to validate AI written code that humans will no longer be able to review. This will be the last year that we hire engineers, and starting next year we hire what we used to call product managers, to build things with AI.
Proton’s AI manifesto lays out the company’s plans regarding AI and confirms my worries. From declarations of how programming and human-code review will end, the vision for Proton’s future looks appalling:
Your job has fundamentally changed. It is no longer to write code, and LLMs are not here to help you write better code faster. Your job is to help the LLM write better code faster.
Embracing AI is also a question about finances. Proton has always appeared more corporate than many of its competitors in the privacy space. While all companies care about their finances, not all of them are obsessed with growth or trying to become the next Google by any means necessary.
Integrating AI across the company is an attempt to cut costs that comes from hiring engineers. Instead, the money gets redirected to big tech AI companies like Anthropic, whose tools Proton is using. The internal documents reveal this as well: Proton is worried about its growth and annual revenue targets. The following quote is quite telling: “By all metrics that matter, we’re an underperforming company.”
Not everyone is worried
Last week’s controversy is probably the biggest one Proton has faced yet, and it has left many people feeling frustrated. Yet there remain some who have defended Proton or tried to downplay the severity of the situation. Others have accused 404 Media of having an agenda against Proton — an absurd argument that continues the worrying trend of people discrediting quality newspapers.
Naomi Brockwell, a well-known privacy advocate and one of the defenders, published a tweet that missed out the whole point of the controversy or purposefully didn’t mention it while mocking people who may not like the fact that Proton is using AI.
To clarify, the problem isn’t Proton’s use of AI tools in its development, and I haven’t seen people argue that. The problem is the abusive management, and the security compromises it is willing to accept in order to transfer Proton into an AI-first company.
What I’m doing
As some of you may know, I have reduced my dependency of Proton this year, when I moved my email, calendar, and contacts to Posteo, a company that has existed 17 years without controversies.
However, since I’m managing our family’s Proton Pass plan, I’m left in a challenging position. After considering my options, I don’t think that I will cancel the subscription, at least for now. After all, it was a big accomplishment to get my family members to use a password manager, and switching to another provider could backfire if things don’t go smoothly.
Proton Pass is also a great product, and its mix of password and alias management is something its competitors cannot match. I’m not particularly eager to embrace any VC-funded alternatives, such as the often praised Bitwarden and 1Password, that have both received questionable attention in recent years.
While I’m concerned about Proton’s future, I’m willing to trust that the talented engineers and other people can ensure that the product remains secure despite the demands of management. Ultimately, I’m entrusting the non-profit Proton Foundation to hold its promise — as the primary shareholder — to intervene if the company attempts to move away from its mission. Getting rid of Andy Yen would be a great place to begin. 🌔