Reports that Meta is able to secretly read encrypted WhatsApp messages have led to a US government investigation, and new concerns have been raised about the privacy guarantees offered by the world’s most popular messaging service.
The scandal broke last week when law firm Quinn Emanuel Urquhart & Sullivan filed a lawsuit alleging that Meta “can access virtually all of WhatsApp users’ purportedly ‘private’ communications.” The law firm claims that the allegations have been made by whistleblowers in Australia, Brazil, India, Mexico, and South Africa, although their identities have not been revealed.
Meta has strongly denied the allegations, with spokesperson Carl Woog describing them as “categorically false and absurd.” Meta appears to believe that the lawsuit is a tactic to support NSO Group, an Israeli spyware company that recently lost a significant legal battle with WhatsApp.
Why Security Experts Are Doubting the New Allegations Against WhatsApp?
The circumstances surrounding the timing and parties involved make this particular lawsuit quite interesting. Quinn Emanuel is actually representing NSO Group in an appeal of a $167 million judgment.
This lawsuit arose from NSO’s use of Pegasus spyware against over 1,400 WhatsApp users, including journalists and government officials.
Meta is now seeking sanctions against Quinn Emanuel, claiming that the law firm has filed a “meritless lawsuit designed purely to grab headlines.”
But Adam Wolfson, a partner at the law firm, rejected this characterization. He said that their representation of NSO has absolutely no connection to this lawsuit, as the denials of WhatsApp have been “carefully worded in a way that stops short of denying the central allegation.”
Security researchers are treating these allegations with a great deal of skepticism. Steven Murdoch, a professor of security engineering at University College London, called the lawsuit “a bit strange.” He noted that the lawsuit is based on the testimony of unnamed whistleblowers whose claims cannot be checked.
Murdoch also said that if WhatsApp were indeed reading users’ messages, this kind of huge breach of privacy would probably have already come to light. “It’s very hard to keep secrets inside a company,” he said. “If there was something as scandalous as this going on, I think it’s very likely that it would have leaked out from someone inside WhatsApp.”
Assessing the Limits of WhatsApp’s Privacy
As reported by Bloomberg, US Department of Commerce officials have been looking into whether Meta has the ability to read messages on WhatsApp. But a spokesperson for the department called such claims “unsubstantiated,” adding more confusion to the mix.
WhatsApp claims to be an end-to-end encrypted messaging service, which means that messages can only be read by the sender and the recipient. No server in between, including WhatsApp’s own, should be able to read the messages.
This is different from other messaging services like Telegram, which encrypt messages between users and the company’s servers. Although this makes it impossible for anyone else to read messages, it is theoretically possible for Telegram to do so.
A technology executive admitted to The Guardian that the privacy features of WhatsApp are not foolproof. The service provides a lot of metadata, such as profile data, contact information, and information about whom users communicate with and when. Nevertheless, the executive insisted that “the idea that WhatsApp can selectively and retroactively access the content of individual chats is a mathematical impossibility.”
What the Meta Encryption Lawsuit Portends for Global Tech?
This controversy has implications for wider concerns about digital privacy and corporate accountability. WhatsApp has billions of users across the globe, and many of them trust the company’s encryption claims to safeguard their most private communications. Any proof that this is not the case would be a staggering betrayal of trust.
For now, Meta insists that the encryption on WhatsApp is still safe and will “continue to stand up against those trying to deny people’s right to private communication.”
As this lawsuit continues to play out, it is likely to heighten concerns about encryption, privacy, and the role of tech companies in safeguarding user data.
Whether or not the whistleblower claims are found to be true or the lawsuit is simply a publicity stunt, this situation illustrates the conflict between privacy advocates, tech companies, and those who seek to break into encrypted communications.
