21 June 2025
Barrister Fraz Wahlah
A decade of brave citizen leaks and investigative reporting shows that email was—and remains—a prized target for surveillance and compelled access. The Snowden disclosures revealed PRISM, an NSA program collecting data from major tech platforms, with email among the most sensitive flowsGuardianWaPo.
Compelled scanning has also happened at the provider level: in 2016, Reuters reported that Yahoo built custom software to scan all incoming user emails at the request of U.S. intelligence—hundreds of millions of accountsReuters.
And when providers are breached, the blast radius is historic: Yahoo’s 2013 incident ultimately touched all three billion accountsReuters.
Today’s email AIs read threads, summarize them, suggest replies, and draft messages—which requires expanded access to message bodies and metadata. Google’s Gemini for Gmail offers thread summaries and reply suggestions; Microsoft’s Copilot in Outlook summarizes long conversations; Apple Intelligence introduces summaries and Smart Reply in MailGoogleMicrosoftApple.
Vendors stress limits—often that user content isn’t used to train foundation models—but the operational reality still involves processing, storage, and logging. Microsoft and Google describe retention and safety processing; Apple touts “Private Cloud Compute” as a hardened path for cloud-side inferenceMS LearnGoogleApple Sec.
Once an AI assistant reads emails to summarize or take action, the content of any message becomes an instruction channel to the model. Security researchers call this indirect prompt injection—malicious cues embedded in ordinary text or HTML that cause the assistant to mislead the user or exfiltrate data. OWASP now lists prompt injection and sensitive-information disclosure among the top risks for LLM applicationsOWASP.
Even vendor guidance acknowledges the issue, and independent write-ups demonstrate viable email-based prompt-injection proofs-of-concept against modern assistantsMS LearnImmersive.
Even before AI, cloud email made high-value prey. In 2023, it was reported a group Storm-0558 accessed cloud email for about 25 organizations, including government accounts; a subsequent federal review criticized preventable failures and transparency lapses. When AI adds more data flows, background services, tokens, and logs, it enlarges the terrain attackers aim forMS SecurityDHS CSRB.
AI doesn’t live in a vacuum; it thrives on integration. That’s good for productivity—and perfect for aggregation. Palantir’s government platforms are designed to ingest vast, disparate datasets and surface people-centric intelligence. However you feel about specific deployments, the capability is clear, and public debates have followed as such tools enter civic systems. The more your communications are machine-read and summarized, the more portable—and attractive—they become for downstream analyticsPalantirBMJ.
“Not used to train the model” is not the same as “not processed, logged, or retained.” Microsoft says Copilot prompts and responses aren’t used to train foundation models; Google notes short-term retention for reliability and safety; Apple emphasizes a constrained cloud pathway. The security reality: more systems now hold more derivatives of your mail—summaries, embeddings, telemetry, caches—each a potential subpoena point, breach vector, or insider-threat surfaceMS LearnGoogleApple Sec.
And legal pressure has a long history: Yahoo’s 2016 scanning episode and the Snowden disclosures show how far compelled access and collection ambitions can runReutersGuardian.
Email is a record. What you say can bind you legally, ethically, and personally. AI reply-suggestion systems demonstrably shape what people send. Google’s Smart Reply research reported that, at launch, it assisted with a significant fraction of mobile replies—evidence that models already influence communicative style and content; early behavior (like over-suggesting “I love you”) shows how defaults can steer tone and meaningGoogle ResNew Yorker.
Recent AI whistleblowers have argued for a right to warn about advanced systems and for legal protections when raising safety concerns. If insiders building the technology struggle to speak openly, users should be doubly cautious about embedding it into the most sensitive channel they own: emailRightToWarn.
Barrister Fraz Wahlah is a democracy and civil rights icon and the founder of Space Email. He was the leading force behind the Movement of Restoration of Democracy, one of the world’s greatest democratic movements against dictatorship.
Products
Company
Connect
SPACE EMAIL, SPACE POST, i.EMAIL, MARS.EMAIL, HOME.EMAIL, METAVERSE EMAIL, COSMOS EMAIL, COSMIC EMAIL, ASTRONAUT EMAIL, MEDIUM.EMAIL, APOLLO.EMAIL, ARTEMIS.EMAIL, SUN.EMAIL, WEB.EMAIL, HEY.EMAIL, ZEN.EMAIL, PANDA.EMAIL, GOLD.EMAIL, MILKYWAY EMAIL, ANDROMEDA.EMAIL, STARRY EMAIL, YOU.EMAIL, EARTHLING EMAIL, GRAVITY.EMAIL, AND OUR OTHER EMAIL CHOICES, MARKS, AS WELL AS SPACE DOCS, SPACE DRIVE, SPACE SHEETS, SPACE CLOUD, SPACE MEET, SPACE NOTES, SPACE IDs, SPACE CALL, SPACE EMAIL LOGO, SUN & MOON LOGO, MOON FACE WITH SUN & STAR LOGO, HUMAN FACE LOGO ON YOU EMAIL PAGE, AND ROCKET DOMAINS LOGO ARE TRADEMARKS OF ROCKET DOMAINS LTD.
