reader comments
22 with 20 posters participating, including story author
Yesterday, independent newsroom ProPublica published a detailed piece examining the popular WhatsApp messaging platform’s privacy claims. The service famously offers “end-to-end encryption,” which most users interpret as meaning that Facebook, WhatsApp’s owner since 2014, can neither read messages itself nor forward them to law enforcement.
This claim is contradicted by the simple fact that Facebook employs about 1,000 WhatsApp moderators whose entire job is—you guessed it—reviewing WhatsApp messages that have been flagged as “improper.”
End-to-end encryption—but what’s an “end”?
security and privacy page seems easy to misinterpret.”>/ This snippet from WhatsApp’s security and privacy page seems easy to misinterpret.
The loophole in WhatsApp’s end-to-end encryption is simple: The recipient of any WhatsApp message can flag it. Once flagged, the message is copied on the recipient’s device and sent as a separate message to Facebook for review.
Messages are typically flagged—and reviewed—for the same reasons they would be on Facebook itself, including claims of fraud, spam, child porn, and other illegal activities. When a message recipient flags a WhatsApp message for review, that message is batched with the four most recent prior messages in that thread and then sent on to WhatsApp’s review system as attachments to a ticket.
Although nothing indicates that Facebook currently collects user messages without manual intervention by the recipient, it’s worth pointing out that there is no technical reason it could not do so. The security of “end-to-end” encryption depends on the endpoints themselves—and in the case of a mobile messaging application, that includes the application and its users.
found more than a dozen instances of the Department of Justice seeking WhatsApp metadata since 2017. These requests are known as “pen register orders,” terminology dating from requests for connection metadata on landline telephone accounts. ProPublica correctly points out that this is an unknown fraction of the total requests in that time period, as many such orders, and their results, are sealed by the courts.
Since the pen orders and their results are frequently sealed, it’s also difficult to say exactly what metadata the company has turned over. Facebook refers to this data as “Prospective Message Pairs” (PMPs)—nomenclature given to ProPublica anonymously, which we were able to confirm in the announcement of a January 2020 course offered to Brazilian department of justice employees.
Although we don’t know exactly what metadata is present in these PMPs, we do know it’s highly valuable to law enforcement. In one particularly high-profile 2018 case, whistleblower and former Treasury Department official Natalie Edwards was convicted of leaking confidential banking reports to BuzzFeed via WhatsApp, which she incorrectly believed to be “secure.”
FBI Special Agent Emily Eckstut was able to detail that Edwards exchanged “approximately 70 messages” with a BuzzFeed reporter “between 12:33 am and 12:54 am” the day after the article published; the data helped secure a conviction and six-month prison sentence for conspiracy.
