Zuckerberg’s WhatsApp End-to-end Encryption Policy, Unsafe

Adeyemi Abdulkareem, Abuja

Of late, Facebook founder Mark Zuckerberg posted a record 2.5 million messages per second on WhatsApp during the World Cup football match. His post on twitter however sparkled some debates about how Mark Zuckerberg is able to see how many messages was sent on WhatsApp and the possibility that those messages could be decrypted as against WhatsApp’s policy of end-to-end encryption.  

Earlier, WhatsApp provided digital security for data exchange called end-to-end encryption. WhatsApp’s end-to-end encryption is used when you chat with another person using WhatsApp Messenger. End-to-end encryption ensures only you and the person you’re communicating with can read or listen to what is sent, and nobody in between, not even WhatsApp.

In this case, however, the football player Messi’s World Cup post is currently the most liked post in the history of Instagram, and during the World Cup finals, WhatsApp had a record 2.5 million messages per second.

In response to this, a user commented, “How does he know since he claims that WhatsApp messages are end to end encrypted, thus Facebook cannot see or read them”. Another said, “the amount of requests to server were trackable for sure, doesn’t mean he can see the encrypted messages, also doesn’t mean he can’t.” Another said, “When resources are used up, the admins keep track of it. They can see how fast they are used up as well as other metrics. WhatsApp has E2E encryption so the team there can’t see your messages, just the server usage.”

The incessant debate has led to a lot of doubtful questions. To what end is our messages encrypted? Can WhatsApp still access users’ messages? Are there conditions to encryption and decryption that we don’t know about? Is there any exemption that could warrant certain decryption by Meta? Here are a few things to note:

Further, WhatsApp provides a way for people to report spam or abuse, which includes sharing the most recent messages in a chat. But does that mean they (meta) can or cannot read user’s messages? Read further…

In a 2018 Senate hearing, Mark Zuckerberg stated unequivocally that “we don’t see any of the content in WhatsApp, it’s fully encrypted.” Today, upon opening the app, a privacy policy and ToS update reads: “We can’t read or listen to your personal conversations, as they are end-to-end encrypted. This will never change.”

However, a report from ProPublica on WhatsApp’s content moderation system finds that that is simply not true. WhatsApp moderators do actually exist; that WhatsApp hands over metadata to law enforcement; and that the company has long shared user data amongst its ecosystem of data-thirsty apps. This report gives a vibrant picture of the practices which, until now, Facebook has deliberately obscured in its attempt to sell users on a privacy-oriented platform, i.e. WhatsApp can read some of your messages, if the recipient reports them. WhatsApp’s end-to-end-encryption means that messages are scrambled before being sent and only unscrambled when they’re received by the intended user. But when a user reports abuse, unencrypted versions of the message are sent to WhatsApp’s moderation contractors.

This leads to a lot of confusion about what the company means when it says “end-to-end encryption” – which by definition means that only the recipient and sender possess digital marks allowing a message to become readable.

ProPublica further notes that at least 1,000 moderators employed by Facebook’s moderator contract firm Accenture review user-reported content that’s been flagged by its machine learning system. They monitor spam, disinformation, hate speech, potential terrorist threats, child sexual abuse material (CSAM), blackmail, and sexually oriented businesses among others. Based on the content, moderators can ban the account, put the user “on watch,” or leave it alone. (This is different than Facebook or Instagram which allows moderators to remove individual posts).

Note that WhatsApp discloses, in its terms of service, that when an account is reported, it “receives the most recent messages” from the reported group or user as well as “information on your recent interactions with the reported user.” This does not stipulate that such information, accessible by moderators, could include phone numbers, linked Facebook and Instagram accounts, profile photos, their IP address, and mobile phone ID. And, the report notes, WhatsApp does not disclose the fact that it amasses all users’ metadata no matter their privacy settings.

WhatsApp didn’t offer much clarity on what mechanism it uses to receive decrypted messages, only that the person tapping the report button is automatically generating a new message between themselves and WhatsApp. That seems to indicate that WhatsApp is deploying a sort of copy-paste function, but the details are still unclear.

Facebook told Gizmodo that WhatsApp can read messages because they’re considered a version of direct messaging between the company and the reporter. They added that users who report content make the conscious choice to share information with Facebook; by their logic, Facebook’s collection of the material doesn’t conflict with end-to-end encryption.

Ultimately, Mark Zuckerberg’s post during the World Cup may be referring to the fact that they can easily trace messages traffic on their data, but it still doesn’t rule out the fact that they can easily have access to user’s messages even with the end-to-end encryption policy.

So yes, it would be safe to say WhatsApp can see your messages without your consent.

Read more from Adeyemi Abdulkareem: Outlook for Android and iOS Gets Two New Features from Microsoft

Agency Report

PIJAlance Magazine, is an independent public-centric journalism arm of PIJA Foundation that stands to tell stories connecting the masses to community justice and development. We always rebel against social injustice. Got a story you'll like us to publish, tip us in contact us.