How Encryption Actually Protects — and Doesn't Protect — You
Earlier in this series
Encryption is the most argued-about word in digital policy, and one of the least understood. Advocates talk as if it makes you invisible. Some governments talk as if it exists mainly to shield criminals. Both pictures are wrong, and the errors are not harmless: people take real risks believing they are protected, and laws get proposed that would break far more than they fix.
I defined encryption briefly in my policymaker's glossary: mathematics that scrambles information so only intended parties can read it. This piece is the honest full version — what it protects, what it cannot, and why the limits matter as much as the strengths. My interest here is not academic. My engineering thesis examined how real people in Iran used VPNs under network restrictions, and I interviewed users whose safety depended on understanding exactly these limits. Vague reassurance is a luxury; precision is protection.
Two objects: the envelope and the safe
Encryption shows up in your life in two basic forms, and everyday objects capture them well.
In-transit encryption is a sealed envelope. It protects information while it travels — from your phone to your bank, from your laptop to a website. Anyone handling the envelope along the way (your internet provider, a café's Wi-Fi, network equipment in between) can see that a message passed, but not what it says. The padlock icon in your browser means this envelope is in use.
At-rest encryption is a locked safe. It protects information while it is stored — on your phone, your laptop, a company's servers. If the device is stolen powered-off, the thief holds a safe without the combination. Modern phones do this automatically; that is why a stolen phone with a good passcode is mostly a hardware loss, not a data loss.
Now the important subtlety. When you message through most online services, there are two envelopes: one from you to the company, one from the company to your friend. The company opens the envelope in the middle — that is how it delivers, filters spam, and sometimes reads. End-to-end encryption removes the middle stop: only your device and your friend's device can open the message. The company carries envelopes it cannot open, even under pressure, because it never has the key.
Where the analogies break
I never leave an analogy unexamined, and here the breaking points are the entire policy debate.
The envelope has a readable outside. Even a perfectly sealed envelope shows the address, the return address, the postmark, the weight. Digital communication is the same: encryption typically hides content, not the surrounding facts — who contacted whom, when, how often, from roughly where, and how much data moved. This surrounding information is called metadata, and it is enormously revealing. A list showing someone called an oncology clinic, then a lawyer, then a family member tells a story with no content needed. When people say "it's encrypted, so I'm safe," they are usually forgetting the outside of the envelope.
The safe doesn't help while it stands open. A safe protects a closed door. While you are using your phone — unlocked, decrypted, on — everything is readable to the phone itself. Which brings us to the limit that dominates real-world cases.
What encryption cannot protect against
Endpoint compromise. The endpoint is the device where the message is written or read. If your phone or laptop is compromised — through phishing of the kind I walked through in Phishing Explained Without the Jargon, or malicious software installed some other way — the attacker reads what you read, over your shoulder, after decryption. The strongest envelope in the world is useless if someone is standing behind the person opening it. In my SOC years, I never once saw an incident where an attacker broke modern encryption's mathematics. I saw plenty where they simply owned the endpoint.
Metadata. As above: patterns of communication are visible even when content is not, and patterns are often enough — for advertisers, investigators, and hostile actors alike.
Coercion. Encryption resists computation, not pressure. A person can be compelled — legally or otherwise — to unlock a device or reveal a password. Security practitioners darkly call this the point where mathematics stops and human vulnerability begins. For people at real risk, threat plans must include it.
Your own trusted parties. End-to-end encryption protects the pipe, not the far end. The person you write to can screenshot, forward, or be compromised themselves. Trust in the endpoint humans is outside encryption's job description entirely.
A summary table, because decisions live in tables:
| Threat | Does encryption help? |
|---|---|
| Someone eavesdropping on public Wi-Fi | Yes — the envelope holds |
| A thief with your powered-off laptop | Yes — the safe holds |
| A service provider reading your messages | Only end-to-end encryption helps |
| Malicious software on your own phone | No — the endpoint is behind the encryption |
| Someone mapping who you talk to and when | Mostly no — metadata stays visible |
| Being forced to unlock your device | No |
Why this matters for the backdoor debate
Now the policy layer. Governments periodically propose that encrypted services include a special access mechanism — a backdoor — so authorities can read content when legally justified. Whatever you think about the goal, the technical facts constrain it, and they follow directly from the envelope logic.
A backdoor is a master key to every envelope, not a warrant for one. The mathematics does not distinguish honest key-holders from thieves; a mechanism that opens messages for one government can be stolen, leaked, or abused, and its mere existence makes every user's envelope weaker — including banks, hospitals, and the government's own communications. This is not an activist slogan; it is the same reasoning I offered executives in Explaining Zero Trust to Non-Technical Executives: systems must be judged by what happens when credentials fall into the wrong hands, because eventually some do.
And here is the often-missed other half, which the limits above supply: backdoors are also unnecessary for much of what investigators actually need. Metadata remains visible. Endpoints remain reachable through lawful, targeted means. Coercion of individual suspects remains possible under due process. The debate is routinely framed as "encryption versus investigation," when honest framing is "weakening everyone's envelope versus using the targeted tools that already exist."
The one idea to keep
Encryption is a sealed envelope and a locked safe: superb at protecting content in motion and data at rest, silent about who you talk to, helpless once your own device is compromised, and indifferent to human pressure. Individuals who understand the limits protect themselves better than those who trust the word alone. Policymakers who understand them write better law. In both cases, the limits are not the fine print. They are the map.
Comparing Global CIIP Frameworks: What Each One Assumes About You →