Home

This Message Is Instant Watchlist

A few days ago, a coworker and I were talking about the JFK assassination over iMessage.

He asked me:

“Do you want to go see where the CIA killed the president”

Then, apparently realizing how that sentence looked without context, he followed it up with:

“This message is instant watchlist.”

I laughed and replied that our conversation was end-to-end encrypted, so there wasn’t some server at Apple where somebody could simply search for our conversation and read it.

Then I thought about what I had just said.

We hear end-to-end encrypted all the time. iMessage says it. Signal says it. WhatsApp says it.

But what does that actually mean?

Because something initially seems contradictory here.

I type a message on my iPhone. That message travels across the internet, through infrastructure I don’t own or control, reaches Apple’s servers, and eventually appears on another person’s iPhone.

Apple operates the service.

So how can Apple deliver something it supposedly cannot read?

Let’s start with a secret

Forget iMessage for a moment.

Suppose I want to send you:

meet me at 8

We know somebody might intercept whatever I send, so we agree beforehand on a secret key.

I use that key to encrypt the message:

message + secret key → ciphertext

Instead of sending meet me at 8, I send what looks like meaningless data.

You receive it and use the same secret key to turn it back into the original message.

Someone between us can still intercept the ciphertext. Encryption doesn’t necessarily prevent someone from getting the data. It prevents them from understanding it without the required secret.

This is symmetric encryption, and it works extremely well.

Except we’ve moved the problem somewhere else.

How did I give you the secret key?

If I send it over the same network, someone listening can intercept that too.

A key we don’t have to hide

This is one of the problems public-key cryptography solves.

Instead of sharing one secret, your device can have two mathematically related keys:

public key
private key

The private key stays private.

The public key doesn’t have to. You can give it to me, Apple, your ISP, or put it on a billboard.

The mathematics allows us to use public information to establish secrets without sending those secrets themselves across the network.

The exact mechanics vary between cryptographic systems, but that idea gives us something remarkable: two devices that have never met can establish secret material while communicating over a network neither of them trusts.

Now we’ve created another question.

How does my phone know which public key belongs to you?

Apple is still very much involved

End-to-end encryption doesn’t mean Apple’s servers somehow disappear from the system.

When an Apple device registers for iMessage, it generates cryptographic key material locally and registers its public encryption keys with Apple’s Identity Service (IDS). With PQ3, those registered public keys include both classical elliptic-curve and post-quantum Kyber key material.

That lets something human-friendly like a phone number or email address eventually resolve to cryptographic information for actual devices.

So when I send you an iMessage, my phone needs Apple’s infrastructure to figure out which devices belong to you and obtain the information necessary to establish encrypted communication with them.

And you might have several devices.

An iPhone. A Mac. An iPad.

The message needs to reach the appropriate devices, and modern iMessage establishes secure sessions between devices rather than treating “you” as one giant cryptographic endpoint.

Apple therefore still performs an essential job:

routing encrypted information to the correct devices.

It does not follow that Apple needs the ability to decrypt the payload.

The postal service needs to know where a locked box is going. It doesn’t necessarily need the key to the box.

So what can Apple see?

This is where saying “it’s encrypted, nobody can see anything” becomes misleading.

There is the content of a message.

And then there is information required to operate a messaging system: accounts, devices, routing information, timing, and other metadata.

End-to-end encryption is a claim about the protected content between endpoints. It isn’t an invisibility cloak around every piece of information generated by the system.

Apple’s security documentation describes iMessage content and attachments as end-to-end encrypted: messages are encrypted for the receiving devices while Apple’s infrastructure handles delivery. Some information needed to operate the service, such as routing and other metadata, is a separate part of the security story.

That’s a much more precise statement than saying:

Nobody can see anything.

The endpoints are special

There’s an important clue in the name: end-to-end encryption.

Eventually, I need to read the message.

So does my coworker.

At some point, the ciphertext has to become readable text again. That happens at an endpoint.

If someone compromises my device badly enough, they may not need to break iMessage’s encryption at all. The message is already readable there.

The same basic problem exists if someone takes a screenshot, copies a message, or otherwise gets access to one of the endpoints.

This is one of the most useful ways I’ve found to think about encryption:

Cryptography doesn’t make information impossible to obtain. It changes where the attack has to happen.

If everyone’s messages existed as plaintext on one central server, compromising that server could expose an enormous amount of information at once.

With properly designed end-to-end encryption, compromising the server doesn’t automatically give an attacker the ability to decrypt everyone’s conversations.

The attacker now has a different problem.

What about a quantum computer?

This is where my reply to my coworker becomes a little more interesting.

I told him that even a quantum computer couldn’t read our conversation.

That’s directionally what I was getting at, but the real answer deserves more care.

Some of the public-key cryptography we rely on today would be vulnerable to a sufficiently capable quantum computer.

Such a machine doesn’t exist today.

But an attacker doesn’t necessarily need one today.

They could collect encrypted traffic now, store it for years, and hope that future advances eventually let them decrypt it.

This threat is known as Harvest Now, Decrypt Later.

You don’t need to break the encryption today.

You just need to save it today.

iMessage is already preparing for that world

In 2024, Apple introduced a new cryptographic protocol for iMessage called PQ3.

PQ stands for post-quantum.

Rather than throwing away existing cryptography and betting everything on a new post-quantum algorithm, PQ3 combines established elliptic-curve cryptography with post-quantum cryptography based on Kyber. Kyber later became the basis for NIST’s standardized ML-KEM, with changes in the final standard.

But there is another interesting idea hiding inside PQ3.

The keys don’t simply sit still.

Modern encrypted messaging continually evolves the cryptographic state of a conversation. New message keys are derived as the conversation progresses, old state can be discarded, and fresh cryptographic material can be introduced.

This general technique is called ratcheting.

If an attacker somehow obtains key material at one point in time, the goal is that this shouldn’t automatically reveal everything that came before it. And after fresh secret material enters the conversation, the protocol can recover security for future messages.

PQ3 periodically introduces fresh post-quantum key material too.

So the mental model isn’t really:

we exchanged a secret once → encrypted forever

It’s closer to:

establish secrets
      ↓
derive message keys
      ↓
move forward
      ↓
introduce fresh key material
      ↓
move forward again
      ↓
...

The cryptographic state is evolving while two people are casually texting each other.

I find that delightful.

Signal approaches secure messaging with many of the same underlying ideas. Its Double Ratchet protocol has been enormously influential, and WhatsApp’s end-to-end encryption is based on the Signal Protocol.

The protocols aren’t identical, but they’re solving versions of the same difficult problem:

How can two devices that may never have met, communicating through servers they don’t trust with their plaintext, continuously establish fresh secrets across the internet?

That’s much closer to what end-to-end encrypted actually means than the little lock icon we usually see.

Back to the watchlist

So could our message have been intercepted?

Sure.

Encrypted iMessage data has to travel through networks and servers neither of us owns.

Could someone sitting somewhere along that path simply look inside and read our conversation?

That’s precisely what the cryptography is designed to prevent.

Could Apple simply search its iMessage delivery servers for the plaintext of our end-to-end encrypted conversation?

That’s what the protocol is designed to prevent. Apple’s published architecture has the devices encrypt messages for the receiving devices while Apple’s infrastructure transports the encrypted data.

Does that mean our conversation is impossible for anyone other than us to ever obtain?

No.

Someone could compromise an endpoint. One of us could take a screenshot. Metadata is a separate problem. And backups matter too: the exact protection of Messages in iCloud depends on your iCloud security configuration, including whether Advanced Data Protection is enabled.

Security is rarely an absolute statement.

It’s a statement about what an attacker must be capable of doing.

And that’s the part I think gets lost when we reduce all of this to:

It’s encrypted.

Behind that ordinary blue bubble is public-key cryptography, symmetric encryption, device identity, key agreement, per-message keys, ratchets, forward secrecy, and now post-quantum cryptography.

All so my coworker can send me an objectively suspicious-looking text and have it appear on my phone a fraction of a second later.

Which, admittedly, is a lot of cryptography just to end up on a watchlist.

Sources