The catch with everything that implements E2EE is that, at the end of the day, the humans at each end of the message have to decrypt the message to read it. And that process can leave trails, with the most sophisticated being variations of Van Eck phreaking (spying on a CRT monitor by detecting EM waves), and the least sophisticated being someone that glances over the person’s shoulder and sees the messages on their phone.
In the middle would be cache files left on a phone or from a web browser, and these are the most damning because they will just be laying there, unknown, waiting to be discovered. Whereas the techniques above are active attacks, which require good timing to get even one message.
The other avenue is if anyone in the conversation has screenshots of the convo, or if they’re old-school and actually print out each conversation into paper. Especially if they’re an informant or want to catalog some blackmail for later use.
What E2EE would do is prevent an internet or other service provider from viewing the data in transit. So without a warrant or other means, they’d have no ability do access these emails. Its also not how these emails were accessed, as far as we know.
The catch with everything that implements E2EE is that, at the end of the day, the humans at each end of the message have to decrypt the message to read it. And that process can leave trails, with the most sophisticated being variations of Van Eck phreaking (spying on a CRT monitor by detecting EM waves), and the least sophisticated being someone that glances over the person’s shoulder and sees the messages on their phone.
In the middle would be cache files left on a phone or from a web browser, and these are the most damning because they will just be laying there, unknown, waiting to be discovered. Whereas the techniques above are active attacks, which require good timing to get even one message.
The other avenue is if anyone in the conversation has screenshots of the convo, or if they’re old-school and actually print out each conversation into paper. Especially if they’re an informant or want to catalog some blackmail for later use.
In short, opsec is hard to do 100% of the time. And it’s the 1% of slip-ups that can give away the game. As an example, we need only look to the group chat of cabinet members using a knock-off Signal client to discuss military operations, and accidentally added the editor of The Atlantic to the chat. Although that scenario highlights more PEBKAC than SIGINT.
What E2EE would do is prevent an internet or other service provider from viewing the data in transit. So without a warrant or other means, they’d have no ability do access these emails. Its also not how these emails were accessed, as far as we know.