Encrypted Email
Definition
The practice of protecting email content and credentials from interception, account compromise, and metadata exposure — the everyday baseline for sensitive operational, legal, and personnel communications in a campaign.
It operates at three stacked layers. Transport (TLS, opportunistic or strict) protects the network hop but leaves the message readable on every server it touches. Stored content (OpenPGP / GPG or S/MIME end-to-end encryption with verified keys) protects the message body all the way to the recipient. Account access (unique strong password, hardware security-key 2FA, recovery keys held offline) prevents the inbox itself from being taken over.
Why it matters: email is a long-lived archive. Sensitive threads sit in inboxes, on backup tapes, and in legal-hold systems for years; a single inbox compromise or server breach can expose an entire organising history. Practitioner guides (EFF Self-Defense Surveillance, Access Now Digital First Aid Kit, security-culture) treat end-to-end encryption and hardware-key 2FA as the only durable protections against server- and host-side compromise.
It is adjacent to secure-messaging (Signal/Wire preferred for short-lived operational chats), to digital-security, and to the upstream practice of threat-modelling.
FAQ
What is Encrypted Email?
Encrypted email is the practice of protecting email content and credentials from interception, account compromise, and metadata exposure. It serves as the everyday baseline for sensitive operational, legal, and personnel communications in a campaign. It operates across three stacked layers rather than as a single technology, combining transport, stored content, and account access protections.
What are the three layers of encrypted email?
Encrypted email operates at three stacked layers. Transport (TLS, opportunistic or strict) protects the network hop but leaves the message readable on every server it touches. Stored content (OpenPGP/GPG or S/MIME end-to-end with verified keys) protects the message body all the way to the recipient. Account access (unique strong password, hardware security-key 2FA, offline recovery keys) prevents inbox takeover.
Why does email need encryption given it is everyday infrastructure?
Email is a long-lived archive. Sensitive threads sit in inboxes, on backup tapes, and in legal-hold systems for years, so a single inbox compromise or server breach can expose an entire organising history. Practitioner guides such as the EFF Self-Defense Surveillance guide, Access Now Digital First Aid Kit, and security-culture treat end-to-end encryption and hardware-key 2FA as the only durable protections against server- and host-side compromise.
What is the difference between transport encryption and end-to-end encryption?
Transport encryption (TLS, opportunistic or strict) protects only the network hop between servers, leaving the message readable on every server it touches. Stored content protection uses OpenPGP/GPG or S/MIME end-to-end encryption with verified keys to keep the message body protected all the way to the recipient. Transport alone does not guard against server-side compromise.
How does encrypted email relate to other security practices?
Encrypted email is adjacent to secure-messaging (Signal/Wire preferred for short-lived operational chats), to digital-security, and to the upstream practice of threat-modelling. It is positioned as the everyday baseline for sensitive operational, legal, and personnel communications, complementing these adjacent practices rather than replacing them.
Full page: [[encrypted-email]].