They can only reveal metadata since they keep everything encrypted, but that was enough to track down this person’s Proton recovery email address? That’s disconcerting.

Trying to use a commercial privacy service to threaten election officials is definitely some dumb shit though, but I bet they could have avoided that outcome with some better opsec