← home

mobile messaging and anonymity: part one

Do you own a smartphone? Do you use, on that smartphone, an end-to-end encrypted messaging app like Signal, WhatsApp, or iMessage? Does that term mean anything to you?

For at least 3 billion humans¹, the answer to those first two questions is yes. Easy. For the third, many will say no, some will say yes, and of those who say yes, "anything" will encompass a dizzyingly broad variety of more or less correct understandings.

end-to-end encrypted

To start us all off on the same foundations, a straightforward explanation of what end-to-end encrypted means is: when Alice sends a message to Bob, (i) only Alice and Bob can read that message, but the messaging service, such as WhatsApp, cannot; and (ii) Bob is able to verify that the message came from Alice, and not from someone pretending to be Alice.

It can be easier to think about this by removing the digital aspect entirely. Alice and Bob live far apart, and each has a house with a mailbox. WhatsApp is the postal service. To talk to each other, Alice and Bob have to trust the postal service to physically ferry their letters from one address to the other. They want to make sure the postal service, either by itself or through some nefarious actor that can corrupt it, can't open and read the contents of their letters, or send letters pretending to be either Alice or Bob.

We call this content privacy. It is focused on protecting the contents of messages.

anonymity

Anonymity is something else entirely. If we go back to the postal service analogy, anonymity focuses not on the contents of the letter, but the delivery and return addresses written on the outside of the envelope. Even if WhatsApp can't read the contents of their messages, it can still see that Alice and Bob are talking to each other. An anonymous postal service would be one that can somehow ferry letters from Alice to Bob without knowing that Alice is sending messages to Bob.

We call this metadata privacy. It is focused on protecting everything about a message that isn't the message itself. It can include not just the identity of the sender and the recipient, but also the timing, volume, and size of sent and received messages. Importantly, metadata (and content) privacy should be defined in relation to who we're hiding the information from. In this case, Alice isn't trying to hide her identity from Bob, she's trying to hide her relationship with Bob from their messaging service (or other third-parties). This is just one possible configuration, but it's the one we'll focus on moving forward.

Hiding that relationship is important because knowing whom somebody contacts can be revealing even when every word is encrypted. A service may not know what you said to a therapist, fertility clinic, addiction counsellor, domestic-abuse service, or union organiser, but knowing that the conversation happened may still tell it something deeply private.

Unfortunately, there is currently no easy way for the average user of a smartphone to communicate anonymously with others. Many messaging services have end-to-end encryption, nearly none of them have rigorous anonymity protections.

Why? And...if I don't talk to any of those people mentioned above, should I really care?

the difficulty

The big difference between content and metadata is that the messaging service needs to know the latter in order to do its job at all. If Alice hands the postperson an envelope with no delivery address on it, the postperson is going to be presented with some rather unpleasant options to get it delivered.

One option could be to make enough copies of the letter to deliver it to every single possible address. Then Bob gets the message, and since it's also end-to-end encrypted, he's the only one that can read it. This guarantees delivery but isn't scalable, because a messaging service can't reasonably deliver every letter to everyone.

A second option could be to deliver the letter to a randomly picked recipient. In that situation, if the network contains only 10 possible recipients, Bob receives only one in ten of the messages Alice sends him. If it contains a million, his chances are one in a million. This is scalable, in that the amount of resources consumed don't grow with the number of recipients, but it doesn't guarantee delivery, and in fact the chances of delivery go down the more people join the service.

Both of these options provide strong anonymity. One is unscalable but reliable. The other is scalable but unreliable. Neither would lead to a viable messaging service.

And that is why anonymity is hard.

more difficulty

There are other reasons that anonymity is hard that have nothing to do with its implementation details. For one, delivering messages is not the only responsibility messaging services have. They live in the real world where bad people use them to send bad things, so they have to manage spam, harassment, fraud, and illegal activity. In traditional messaging systems like email, this can be handled by scanning the message contents, but end-to-end encrypted messaging services don't have access to that.

They have to rely on other signals, including, amongst others, metadata-based ones. Some clever folks realised that people who abuse messaging services tend to act in similar patterns.² For example, someone who sends spam may send thousands of messages to thousands of recipients in a very short time span, making them quite noticeable compared to normal usage. Since the messaging service knows who the sender of each message is, it can use that signal to ban the account, without ever having to read the message contents. If the service lost access to message metadata, it would weaken many of the signals it uses to detect abuse.

This is of great concern to a growing number of governments and lawmakers that wish to make online services detect serious illegal activity. Performing such detection would break important aspects of the technologies used to ensure user privacy, but its supporters believe this is acceptable for the sake of public safety.³ The result is that developers of end-to-end encrypted services currently face substantial legal and political resistance. A service that added even more privacy protections could rapidly draw the targeted ire of legislative bodies that may harm users' abilities to install and use the service, for example by preventing its installation via the Android or iOS app stores. A highly secure service that cannot make itself available to its users is no service at all. Therefore, builders of secure communications systems may find themselves needing to justify new privacy features by being able to answer the question: how is this system most useful for good people doing good things, and least useful for bad people doing bad things?

why bother?

So far we've heard a lot of negatives about anonymity. It is hard to implement in ways that content privacy isn't. Implementing it forces a messaging service to either be tiny or unreliable. It makes abuse prevention difficult or impossible. It makes politicians mad. Shouldn't we just drop this topic, accept it's a bad idea, and move on?

There is a simple reason we shouldn't just drop it: some people need it. The danger is not distributed equally. For many of us, exposed metadata may usually seem harmless, but whistleblowers, journalists, activists, and members of discriminated minority groups, amongst others, can not only put themselves at risks by revealing this information, they put at risk the lives of those around them.

In March 2022, Telenor, a Norwegian telecommunications company, transferred ownership of their Myanmar subsidiary to the junta that had taken over the country the year before. Subsequent lawsuits claim that communications metadata extracted from that sale, "...helped the military target anti-coup activists, several of whom were tortured in detention and one of whom was executed."⁴ A messaging system that concealed communication relationships could have made it harder to reconstruct activists' contact networks and identify the people around them.

This matters even in places that aren't in the throes of a violent military coup. Surveillance capabilities are not used only by ideal institutions following ideal procedures, they may also be available to individual officials who misuse legitimate access for personal purposes. A 2026 report by the New South Wales Law Enforcement Conduct Commission examined 67 cases of officer-involved domestic violence.⁵ Of those cases, 5 included officers investigated for misusing police tools to aid them in abusing their victims, illustrating that surveillance has as much a potential for evil as secure communications. Until such a time that a government can convincingly show that it is incapable of using its tools for abuse, it is no more legitimate in asking that they exist than citizens are for building secure messaging services that provide them some amount of protection.

More broadly, we know for a fact that various governments use large-scale metadata collection, and sharing, to surveil populations. This is precisely what the Snowden leaks revealed⁶, and what Gen. Michael Hayden, ex-NSA chief, confirmed when he said the US "...kill[s] people based on metadata."⁷ Of course, this sort of surveillance is always justified under the banner of fighting global terror and capturing bad people, which isn't necessarily a bad thing; however, we as a society have to decide where the line is on acceptable surveillance in exchange for the results achieved. This includes deciding how much we trust our governments not to abuse their powers or change laws to make previously legal behaviour illegal. Widely available anonymous communications is part of the arsenal of tools that allows citizens and their governments to approach that decision on even ground.

conclusion

We've established what anonymity is and how it differs from end-to-end encryption. We've shown that it's difficult to do, and that a messaging service seeking to implement it would need to find a solution that is scalable, reliable, and is somehow capable of limiting abuse without undoing its privacy protections. Finally, we've examined whether or not this is something we actually want.

Where do we go from here? Is such a solution possible? Has anyone tried already? If so, why haven't we heard about it? Will solving these issues help me resolve my crippling trust issues and find true love? Answers in the next post.

next →