Once Someone Already Has Your Email, Does Encryption Matter?

If you are looking at encrypted email to keep it private from the world, think again. Your email is as safe and encrypted as your recipient's email provider.

I think I need to stop researching email providers. I've spent a ridiculous amount of time comparing email services, encryption, privacy policies, server locations, and just about every other detail imaginable. I've left Google, tried Proton, moved to Fastmail, toyed around with Tuta, changed back to Proton, and migrated to Fastmail (where I am today). And I have written enough about email to probably qualify for some sort of honorary degree.

If you haven't followed my email adventures, you might want to check out Email Services: A Rant, How To Choose An Email Service Without Going Insane, and Email Providers: The Final Dance (One Can Hope).

But there's one question I've never really been able to get out of my head:

What's the point of encrypted email if Google, Microsoft, or someone else's email provider probably has a copy of your correspondence anyway?

Google Has Your Email. Even If You Don't Use Google.

Back in 2014, Benjamin Mako Hill published an article with the wonderfully depressing title Google Has Most of My Email Because It Has All of Yours.

Hill had been running his own email server for years. He did this specifically to avoid giving large companies like Google copies of his personal correspondence. Then he decided to investigate just how much of his email Google was handling.

The results weren't particularly encouraging.

Looking at the emails he had replied to, he found that Google had delivered 57% of them in the previous year. In other words, despite hosting his own email, more than half of the personal correspondence he replied to had passed through Google's systems.

Why? Because the people he communicated with used Gmail.

You can move your email to Switzerland, host your own server, use Proton or Tuta, or build an elaborate email setup that would make a network administrator proud. But if you send an ordinary email to someone using Gmail, Google gets to handle that message. Same with Microsoft (if their service is up and running).  So if you want that Proton privacy and encryption, you should only write to other Proton addresses. And hope your recipients pinky-swear not to share it with others.

The same applies in reverse. If someone using Gmail sends an ordinary email to you, Google handles that message before it reaches your provider.

And it's not just Google. Microsoft, Yahoo, and every other email provider has the same fundamental position when its customers exchange ordinary email.

So, are we really escaping Big Tech by switching email providers?

Not at all!

So What's the Point of Encryption?

The problem is that we tend to think of email privacy as an all-or-nothing proposition. Either our email is private, or it isn't. But that's not really how it works.

Let's say I use Proton Mail and send an ordinary email to someone with a Gmail account.

The message is protected while traveling between providers using transport encryption (TLS), assuming both providers support it. However, once it reaches Google's servers, the message isn't end-to-end encrypted. Google can access its contents.

Now let's reverse things. Someone using Gmail sends me an ordinary email.

Google handles that message, and it may retain its own copy. But once it reaches my Proton mailbox, Proton stores my copy using zero-access encryption. Google having access to its copy doesn't mean Proton can read mine.

That's an important distinction.

And when two Proton users communicate, the message is end-to-end encrypted. Neither Proton nor an intermediary can simply open and read the message contents.

You can also send end-to-end encrypted messages to people outside Proton using password-protected emails or PGP, although that requires a little more effort.

I went into the technical details in Email & Encryption, but the important thing to understand is that encryption doesn't have to protect every single part of your digital life to be useful.

It just needs to protect something.

What Are We Actually Protecting?

Think about how much personal information sits in your email account.

Banking correspondence, receipts, family conversations, school communications, password reset links, travel arrangements, invoices, personal documents, and probably a few embarrassing conversations you'd rather forget.

Now imagine someone getting access to that entire mailbox.

If you're using a conventional email provider, that provider generally has the technical ability to access stored message contents. You're trusting its policies, security practices, employees, and legal obligations to protect that information.

With end-to-end encrypted email, things are different.

Your provider doesn't hold the keys needed to read the encrypted message contents. That matters when it comes to data breaches, unauthorized access, and certain types of legal requests.

Of course, encryption isn't a magic shield. It doesn't prevent someone from compromising your device, stealing your password, accessing an unlocked account, or simply forwarding an email you've sent them.

And metadata is another issue. Information about who you're communicating with, when, and other account details may still be available to providers.

But reducing the amount of information available to any one company is still a worthwhile goal.

Just because Google might have access to some of your correspondence doesn't mean it needs access to all of it.

Speaking Of Proton...

I've spent quite a bit of time with Proton. I've used its services, paid for its Visionary plan, left, returned, and generally put more thought into the company than I probably should have.

I still like its approach to privacy. But recent events have been a reminder that trusting a company is about more than its encryption technology.

The Stop Cop City investigation in the United States demonstrated that Proton could be compelled through legal processes to provide available account information. In that case, payment information was provided to Swiss authorities and subsequently passed to the FBI.

This wasn't Proton handing over decrypted email contents. It was a reminder that metadata and account information are different from encrypted message contents.

More recently, 404 Media reported on internal disagreements over Proton's aggressive adoption of AI-generated code, including employee concerns about security testing and the company's engineering practices. And their current CEO is ... kind of a douche.

I'm not suggesting Proton's encryption has been compromised. There's no evidence of that.

But if you're choosing a company specifically because you trust it with your privacy, you should probably care about how that company operates, too. Privacy isn't just a technical feature. It's also a question of trust.

And trust, unfortunately, isn't something you can encrypt.

Is Encrypted Email Worth It for Ordinary People?

Maybe. Not because it solves everything, and certainly not because it makes us invisible to Google or anyone else.

It's because privacy doesn't have to be perfect to be worthwhile.

If I can keep my stored correspondence inaccessible to my email provider, that's a good thing. If I can communicate with other encrypted-email users without handing our conversations to a third party, that's a good thing. If I can reduce the amount of personal information available to companies that have no particular reason to access it, that's a good thing.

And if someone using Gmail sends me an ordinary email, well, Google has probably already seen it. That doesn't mean I need to give Google the keys to the rest of my mailbox, too.

Perhaps that's the mistake we've been making: expecting a privacy-focused email service to solve a problem that extends far beyond the service itself.

As I mentioned in my earlier article, Your Email – It's Not "Swiss Safe", where a company is located doesn't automatically make your information invulnerable either. You have to look at the technology, the policies, and the people behind it.

So, choose a provider you trust. Understand what its encryption actually does. Don't assume that a Swiss address makes you invincible. And don't expect your Gmail-using friends and family to suddenly join your privacy crusade.

The fact that Google might already have a copy of some of your emails isn't a reason to give up on privacy. It's a reason to be a little more realistic about what you're protecting and why.

As for me, I've moved on to Fastmail. I don't send or receive sensitive information. I just want email to work and get out of the way. Fastmail does all of that. And you can now choose to host your info on EU servers rather than in the U.S., in case you are that flavor of paranoid.

Photo Used: magnific.com