iCloud: Why "hiding email" doesn't always protect

Apple's cloud platform has stood for data protection and privacy for years. Features within iCloud+, such as "Hide My Email Address," in particular, give the impression that communication is largely anonymous. However, a recent case shows that this assumption is not always true. As soon as criminally relevant content is involved, different rules apply.

Apple regularly emphasizes the importance of protecting user data. At the same time, there are clear legal requirements that the company must adhere to. Its own terms of service explicitly state that data may be shared with law enforcement agencies if there is a legal basis for doing so.

In addition, Apple has published transparency reports twice a year since 2013. These reports reveal how frequently authorities request data and how the company responds. The report for the second half of 2025 is still pending, but a recent case is likely to be included in the next report.

The "Hide My Email Address" feature in iCloud

With "Hide My Email Address," iCloud+ offers a feature primarily designed to protect your email address in everyday use. Instead of entering your real address, random alias addresses are generated to forward incoming messages.

The focus is clearly on convenience and privacy in everyday use, such as when registering on websites or avoiding spam. However, the function is not designed to guarantee complete anonymity vis-à-vis the provider itself or with authorities.

The specific case: Threatening email despite alias function

As reported by 404 Media, a man named Alden Ruml used this very feature to send a threatening email. The message was addressed to Alexis Wilkins, the girlfriend of then-FBI Director Kash Patel.

After receiving the email, Wilkins contacted law enforcement. The case quickly took an official turn, as it involved a serious threat.

FBI request and disclosure of identity

As part of the investigation, the FBI requested information from Apple to find out who was behind the iCloud alias being used. Apple complied with this request and provided the relevant user data.

This included the user's real name and their actual iCloud email address. It was also discovered that the individual had set up a total of 134 different alias addresses. This information was sufficient to definitively establish their identity.

Confession and indictment

After being identified, the user was questioned by authorities. He admitted to sending the threatening email himself. Subsequently, a grand jury indicted him. The charge is the transmission of a threat in interstate commerce, which is a criminal offense in the United States.

Further investigations: Access to devices

The investigation was not limited to email communications. The FBI also obtained search warrants for the suspect's devices. The aim was to gain access to stored data and secure any further evidence.

The request also included permission to use biometric unlocking methods such as fingerprint or facial recognition. Additionally, the request sought permission to deactivate security features, such as protection against device theft. These measures demonstrate the far-reaching scope of investigations in such cases.

Context: What this means for iCloud

This case clearly illustrates how iCloud's privacy features should actually be assessed. "Hide my email address" reliably fulfills its purpose in everyday use and protects against unwanted contact or data sharing with third parties.

At the same time, the provider retains control. Apple can track which alias belongs to which account. This information will be shared as soon as a legally valid request is received from authorities.

iCloud Privacy: Where Anonymity Ends

The events surrounding this case clearly demonstrate that while iCloud offers a high level of data protection, it does not guarantee complete anonymity. Features like "Hide My Email Address" are intended for everyday protection, not for concealing identities during criminal activity.

Anonymity ends as soon as serious threats arise and law enforcement is involved. Apple operates within the framework of legal requirements and implements them accordingly. (Image: Shutterstock / Pixel-Shot)