We Know the Term “Encryption”. But Do We Understand What It Protects?

We have grown used to the expression “encrypted communication”. It appears in messaging apps and in descriptions of digital services. Much less often are we told exactly which information that encryption protects, and under what circumstances.

That may sound like a technical detail. In security, however, it makes a fundamental difference. One mechanism may protect a file stored on a phone; another protects the contents of a message sent between two people.

One word, several kinds of protection

Encryption of stored data helps protect information held on a device or another storage system. On a mobile phone, it matters particularly if the device is lost or stolen. Its effectiveness also depends on how the phone is configured, how it is locked and how the cryptographic keys are managed.

End-to-end encryption (E2EE), by contrast, concerns access to the content of messages exchanged between participants. It is designed so that a service provider without the relevant decryption keys cannot read those messages.

Both use cryptography. But they do not automatically cover the same situations, the same copies of data or the same threats.

What happens in a real situation?

Consider three everyday situations:

• A phone goes missing. Encryption of stored data and access controls may make local files harder to read. The presence of encryption alone, however, does not tell us everything about the device’s security.
• We send a private message. End-to-end encryption can protect its content from intermediaries while it is being delivered. It does not eliminate every way in which a phone itself might be compromised.
• The recipient reads the message. Encryption cannot stop an authorised recipient from copying, photographing or forwarding the content.

Examples like these help us distinguish a technical feature from a general expectation of safety. A description of the technology can be accurate without explaining all the limits of its protection.

Recognising a term is not the same as understanding it

In a questionnaire, it is relatively easy to ask whether people have heard of a particular term, or whether they believe they could explain it. That is useful information, but it remains a self-assessment.

Whether someone can correctly identify when protection applies in a particular situation is a different question. Establishing that would require tasks that test understanding, rather than simply asking respondents how familiar they feel with a term.

This distinction also matters in interface design. If an application assumes that users understand a technical abbreviation, it may leave them to make a decision whose consequences are not fully clear.

Explain the consequences, not just the technology

A useful security explanation should do more than name a mechanism. It should answer a simple question: What does this protection mean for my data?

Instead of displaying only the label “end-to-end encryption”, an app could explain who can read message content and which other copies or features have separate settings. Likewise, when describing device encryption, explaining what happens if a phone is lost is more useful than making a vague promise of complete security.

I discuss the related distinction between messages and their stored copies in The Message Is Encrypted. The Backup Might Not Be.