Metadata Is the Message: What End-to-End Encryption Does Not Hide

End-to-end encryption is one of the great privacy achievements of the last decade. It means the words, photos and voice notes you send can be read only by the people you send them to. It does not mean nobody learns anything. Around every sealed message sits a shell of information that is often just as telling: who sent it, who received it, when, how often, how large it was, and from which network.

That shell is metadata. At VOIDEX we think every serious conversation about private communication has to include it, because a platform that is honest about encryption should be equally honest about what encryption leaves exposed.

What metadata actually is

Think of a sealed letter. Encryption is the envelope that nobody can open. Metadata is everything written on the outside and everything the postal service can observe:

• Who: the sender and the recipient, or the members of a group.
• When: the exact time each message was sent and delivered.
• How often: the rhythm of a relationship, daily, hourly, or suddenly at three in the morning.
• How much: the size of a message, which can hint at a photo, a document or a short reply.
• From where: the IP address, the network, sometimes the rough location of a device.

None of these reveal a single word of what was said. Together, over weeks, they can reveal almost everything else.

"We kill people based on metadata"

The clearest statement of how powerful metadata is came from someone who used it professionally. In a 2014 debate at Johns Hopkins University, General Michael Hayden, former director of both the NSA and the CIA, agreed that metadata can tell a government a great deal about a person, and then added: "We kill people based on metadata." The exchange was reported by law professor David Cole in The New York Review of Books in May 2014.

The same article quotes Stewart Baker, a former NSA general counsel, making the point in gentler words: with enough metadata, you do not really need content.

These were not activists overstating a risk. They were insiders describing a tool.

Why patterns reveal so much

The reason is simple. People are consistent. We call the same few people, sleep in the same place, commute along the same route and message the same colleagues during working hours. Break from routine, a late night call to a clinic, a burst of messages to a lawyer, a new contact who suddenly appears every evening, and the break itself becomes a story.

Researchers have measured how little it takes. A 2013 study in Scientific Reports looked at mobile phone location records for 1.5 million people and found that just four points in space and time were enough to uniquely identify 95 percent of them. No names were needed. The pattern was the name.

Salt Typhoon: a live demonstration

In 2024 the risk stopped being theoretical for millions of people. US officials disclosed that a state-sponsored hacking group known as Salt Typhoon had broken into major American telecommunications networks. The intrusion gave the attackers access to call records and other data flowing through carrier systems, which is to say metadata at national scale.

In December 2024, officials from CISA and the FBI responded with unusually direct advice to the public: use end-to-end encrypted messaging. CISA later formalised this in its mobile communications best practice guidance, aimed at people in government and politics whose communications are most likely to be targeted.

The lesson cuts two ways. End-to-end encryption protected the content of conversations that used it, even when the network underneath was compromised. But carriers still held vast quantities of records about who contacted whom, and those records were exactly what an intruder could collect. Encryption narrows the damage. It does not make metadata disappear.

Metadata is collected in more places than you think

The telecom network is only one collector. Every app on a phone can see some metadata about its own use. Advertising software development kits embedded inside apps can report device identifiers, rough location and usage times back to networks that combine them across thousands of apps. Websites load tracking pixels that tell third parties which page you opened and when. Search engines record what you asked and from which address.

Individually, each stream looks harmless. Combined, they produce a timeline of a life, which is precisely what the data broker industry sells. The strongest encryption in the world does nothing about data that was never inside the encrypted envelope in the first place.

The honest limit: a server must route messages

Every messaging service, however private, has to deliver messages. To do that, some system has to know that a message from one account is meant for another account, and it has to hand it over at some point in time. There is no version of internet messaging in which the delivery network knows nothing at all.

So the right question is not whether a platform sees any metadata. It is how much it collects beyond what delivery requires, what it keeps, who else it shares it with, and whether it has built a business on it. That last point is where most of the damage happens. Much of the metadata economy exists because advertising pays for it.

How VOIDEX limits what it can see

VOIDEX is designed around a simple principle: collect what is needed to run the service, and remove the incentives and the pathways that turn metadata into a product.

Content is end-to-end encrypted. Direct messages in VOIDEX Messenger use a hybrid post-quantum key agreement and a double ratchet, so each message has its own key. Groups and private channels use MLS. Keys are created on members' devices, and VOIDEX servers store public keys and ciphertext. Call setup is sealed under the conversation key, so the server cannot swap the encryption fingerprint, and calls run through VOIDEX's own relay rather than a third party's.

No ads, no trackers, no data sales. VOIDEX carries no advertising, no third-party trackers or ad pixels, and does not sell data. Nobody can pay for reach. That removes the commercial reason most platforms have for building detailed behavioural profiles, and it means no advertising network receives a signal every time you open the app.

Private search. Ask VOIDEX sends searches to the web through VOIDEX, so the sites and search engines on the other end never see who is asking. Search history is encrypted with a key that only the member's own devices hold. Pages open as clean Space Notes, without the trackers and ads that usually follow a click.

Media without hidden passengers. Before a photo or video goes public, VOIDEX removes capture metadata such as GPS coordinates, device model and creation time, and refuses any file it cannot clean. We cover this in detail in photo metadata and GPS.

Separate public identities. In VOIDEX Space every member has a public Face and an anonymous Phantom. VOIDEX never publishes a link between the two, and Phantom content is stored under the Phantom only. You can read more in real anonymity with the VOIDEX Phantom.

What VOIDEX does not claim is equally important. The service still knows which accounts exist and has to route messages between them. We say so plainly in our public security report, which sets out what VOIDEX can and cannot read.

Practical habits that reduce your metadata

Technology does part of the work. Habits do the rest.

1. Keep sensitive conversations on end-to-end encrypted services. Ordinary SMS and carrier calls pass through systems that, as Salt Typhoon showed, can be compromised.
2. Prefer services without advertising. An ad-funded platform has a structural reason to collect more than it needs.
3. Strip location from media before sharing. Most phones let you remove location in the share sheet. Better still, use services that remove it for you.
4. Separate your identities. Use different accounts for different parts of your life, and do not reuse profile photos across them.
5. Search privately. Search queries are among the most revealing metadata a person produces.

The takeaway

Encryption protects what you say. Metadata describes how you live. A private platform has to take both seriously: seal the content completely, collect as little around it as the service allows, and refuse to turn what remains into a business.

That is the standard VOIDEX holds itself to, and it is written down for anyone to check.

VOIDEX is an invite-only encrypted world. Request access, or read what VOIDEX can and cannot see before you join.

Sources

• David Cole, "We Kill People Based on Metadata", The New York Review of Books, 10 May 2014: https://www.nybooks.com/online/2014/05/10/we-kill-people-based-metadata/
• de Montjoye et al., "Unique in the Crowd: The privacy bounds of human mobility", Scientific Reports, 2013: https://www.nature.com/articles/srep01376
• CISA, Mobile Communications Best Practice Guidance: https://www.cisa.gov/resources-tools/resources/mobile-communications-best-practice-guidance