The 100% Secure Email Paradox

They say, ‘if something is free, YOU are the product’. And that’s the business model of the largest free online email service, Gmail, which has been around for almost 20 years.

The website’s major source of revenue is advertising, which requires targeting the right audience. The tech giant has frequently been accused – since 2007 – of peeping into users’ emails in trying to offer more pertinent and targeted advertisements. 

Google, too, acknowledged that it let app developers scan Gmail accounts for ad targeting as early as 2018. But it was only in 2019 that the company went public with the information that Google retains a list of the goods users purchased using Gmail, even after the emails were deleted.

Recently, France alleged that the tech giant had violated the ePrivacy Directive's restrictions on direct marketing by failing to get authorisation from Gmail users before showing them adverts alongside promotional emails they had voluntarily subscribed to. This alleged violation occurred as recently as August 2022.

The problem lies with the type of encryption Google uses for Gmail – TLS encryption. It gives users a sense of security that their emails are secure while being sent, but after the transmission, it gives Google and its partners easy access to scan/read them. 

The problem with TLS encryption

TLS, or Transport Layer Security, is used by Gmail and many other email service providers to encrypt emails before they are sent over the internet. However, it's not the most secure way to transfer emails, as it doesn’t provide security once the email has reached its destination. Once the email is received, it is decrypted, and its security is no longer available. It’s the same as an Amazon package, which while being delivered, is safe and secure, but, once delivered, it can be accessed by anyone. 

Emails with EtEE, or end-to-end encryption, on the other hand, are delivered securely and can only be unlocked by the owner of the key. This is similar to an Amazon delivery of a locker that includes a key to access it once it reaches its destination. The locker can only be opened by the person who has the key.

If not Google, then who?

Previously, there have been attempts to create a private email service that offers end-to-end encryption with 100% anonymity. One such project was CTempler, which tried to provide both features to its users. However, just three years after its launch in 2019, the armoured email service provider, CTempler, had to shut down. While no official reason was given for the company's shutdown, it is speculated that the low funding and continuous government intervention might be some of the possible reasons. 

https://twitter.com/ProtonPrivacy/status/1562417840413876227

Another Switzerland-based private email service provider, Protonmail, faced the similar problem of sharing data with the government when using an end-to-end encryption model for its email service. ProtonMail claims that the IP address was obtained by French authorities with the help of Europol after gaining permission from Swiss courts. ProtonMail was obliged to log IP information on a climate activist's account after Swiss courts granted the legal order. This information was subsequently sent to French police, who were able to identify and arrest the person as a result of it.

The company clarified: “Proton can be forced to collect information on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account.”

Private doesn’t mean Secure

Even while end-to-end encryption email service providers may assert that their product is best for privacy, this isn't always the case. One of the many examples of a data breach is the aforementioned case of the government requesting data.

While Google may be criticised for email monitoring, it must also be mentioned that Gmail prevents 99.9% of fraudulent email attachments. The quantity of spam that is still being received only serves to emphasise the vast majority of junk that Gmail was able to filter out of users' inboxes by scanning billions of email attachments.

While private email service providers like Protonmail might provide 100% privacy and security, it also increases the chance of users getting spam emails. Since these email service providers don’t know what’s being shared, the chance of spam or malicious emails slipping increases.