I believe he's referring to the fact that a lot of email communication is still plaintext: https://www.google.com/transparencyreport/saferemail/ https://www.goo

I believe he's referring to the fact that a lot of email communication is still plaintext: https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/ Of the communication that's nominally protected by TLS, a lot of it can probably be trivially broken by an active MITM attack that either (1) prevents a connection from being upgraded to TLS, in which case it typically remains plaintext (see STARTTLS), or (2) establishes the connection under a self-signed certificate, which will suffice since many email systems do not perform certificate path validation.