Texas AG sues Meta over claims that Whats App doesn't provide end-to-end encryption - Ars Technica

Overview

Texas AG sues Meta over claims that Whats App doesn’t provide end-to-end encryption

Critics note a lack of factual support in lawsuit filed by US Senate candidate.

Details

The Texas Attorney General has sued Meta over allegations that the company’s Whats App messenger, used by more than 3 billion people, doesn’t provide the end-to-end encryption (E2EE) it has long claimed.

Since at least 2016, Meta (then named Facebook) has said Whats App provides robust end-to-end encryption, meaning that messages are encrypted on a sender’s device with keys that are available only to the receiver’s. By definition, E2EE means that no one else—including the platform itself—can read the plaintext messages.

In sworn testimony before two US Senate committees in 2018, CEO Mark Zuckerberg said Meta does “not see any of the content in Whats App; it is fully encrypted” and that “Facebook systems do not see the content of messages being transferred over Whats App.” The engine for this E2EE is the Signal protocol, an open source code base that multiple third-party experts have said lives up to its promises.

In a complaint filed Thursday, Texas AG attorneys said Meta’s claims are false and that the company can and does read the unencrypted contents of Whats App messages. They said they are filing the action to “prevent Whats App and Meta from continuing to willfully deceive [Texans] by misrepresenting that their private communications were just that—private and inaccessible even to Whats App and Meta—when, in fact, Whats App and Meta have access to all Whats App users’ communications in their entirety.”

“The gravity of Meta’s and Whats App’s violation of users’ privacy and trust cannot be overstated,” the attorneys wrote. “All users were entitled to believe their communications were private when Whats App and Meta unequivocally and repeatedly promised that no one—not even Whats App and Meta—can access their messages.”

In an email, Meta called the allegations “baseless” and vowed to fight the lawsuit in court.

The sole factual evidence cited for the claims is an article published last month by Bloomberg. It reported that the US Commerce Department’s Bureau of Industry and Security had abruptly closed an investigation into allegations that Meta could access encrypted Whats App messages shortly after one of the department’s agents sent an email outlining the probe’s preliminary findings.

According to Bloomberg, the January 16 email, sent to more than a dozen officials at other agencies, stated, “There is no limit to the type of Whats App message that can be viewed by Meta. The misconduct of Meta and its officers, including current and former high-level executives, involve civil and criminal violations that span several federal jurisdictions.”

Thursday’s lawsuit doesn’t indicate that the AG’s office has obtained the email itself or gathered any information from the investigators involved. Instead, it cites only the Bloomberg report for support. The complaint also noted that Meta employees receive plaintext Whats App messages that are reported to the company by fellow Whats App users. Those messages, however, are taken from the reporting party’s device only after they have been decrypted using the decryption keys available only to the reporting party.

The scarcity of factual support for the claims hasn’t been lost on technologists and encryption experts. They note that a thorough reverse engineering of Whats App would almost certainly reveal if it was somehow bypassing the protection provided by the Signal protocol.

A team of researchers that performed a detailed technical analysis of Whats App last year gave the messenger a clean bill of health, finding that it generally works securely and as described by Whats App. They found one design flaw that made it possible for a Meta employee with access to the company’s infrastructure to add new members to a group chat without permission or any interaction from existing members. But even in that case, such an addition is fully visible to all other members.

Benjamin Dowling, a senior lecturer in cryptography at King’s College in London and a co-author of the study, said in an email that his team reverse-engineered the Whats App cryptographic protocol, meaning the code that makes it work. They found no indication that it was behaving differently from what Meta described. Dowling, however, stressed that the analysis applied only to the Whats App client as available in May 2023. Their findings wouldn’t necessarily apply to versions updated since then.

He said the closed source status of Whats App makes a definitive assessment of the code impossible. He went on to say that except for the resulting lack of code transparency and the weakness uncovered in group messaging, the Meta messenger nonetheless appeared to provide the same confidentiality promised by the Signal protocol.

Our reverse-engineering of Whats App and all the evidence we are aware of points towards Whats App providing users with end-to-end encryption for their message contents. While our analysis did find design weaknesses in the protocol, such as a lack of user control over things like group membership, these weaknesses are unlikely to be the basis of the complaint as they would not allow global stealth reading of messages. As it stands, we are not aware of any concrete evidence that Whats App has broken their promise of end-to-end encryption. The contents of the complaint do not provide any evidence otherwise.

Our reverse-engineering of Whats App and all the evidence we are aware of points towards Whats App providing users with end-to-end encryption for their message contents. While our analysis did find design weaknesses in the protocol, such as a lack of user control over things like group membership, these weaknesses are unlikely to be the basis of the complaint as they would not allow global stealth reading of messages. As it stands, we are not aware of any concrete evidence that Whats App has broken their promise of end-to-end encryption. The contents of the complaint do not provide any evidence otherwise.

Three other cryptography experts I interviewed echoed similar doubts.

“The vast majority of this Texas AG lawsuit looks like general dung-throwing in Meta’s direction,” said Kenny Paterson, a researcher at ETH Zurich. “I’m no fan of Meta’s data harvesting practices, but that’s all egregious misdirection on a case that seems to me to be built on a very thin evidence base: essentially, one news article is referenced to support the actual accusation.”

Matthew Green, a professor at Johns Hopkins University, said, “The Whats App clients are all available for reverse engineering. For there to be a vulnerability like this, something very bad would have to be happening inside that app.”

Representatives in the Texas AG’s office did not respond to an email asking if its investigators had obtained any evidence laying out definitive evidence beyond the news article. As Texas Attorney General Ken Paxton heads into the final stretch of his US Senate primary runoff against incumbent John Cornyn, it’s tempting to think the lawsuit is an attempt to appeal to voters and appear to be an advocate for the people of his state.

Given Meta’s history of privacy lapses and data grabs, there are plenty of reasons not to install Whats App. Unless new evidence comes to light, the allegations in Thursday’s complaint aren’t among them.

1.          Zillow loses thousands of listings in fight over “hidden” homes
   

2.          Ground system issue scrubs first launch of Space X's Starship V3 rocket
   

3.          The Internet can't stop watching Figure AI's humanoid robots handling packages
   

4.          Uh-oh, the International Space Station is leaking again
   

5.          Doctors outraged after RFK Jr. fires leaders of key preventive medicine panel
   

Ars Technica has been separating the signal from the noise for over 25 years. With our unique combination of technical savvy and wide-ranging interest in the technological arts and sciences, Ars is the trusted source in a sea of information. After all, you don’t need to know everything, only what’s important.

Key Takeaways

• Texas AG sues Meta over claims that Whats App doesn’t provide end-to-end encryption

• Critics note a lack of factual support in lawsuit filed by US Senate candidate

• The Texas Attorney General has sued Meta over allegations that the company’s Whats App messenger, used by more than 3 billion people, doesn’t provide the end-to-end encryption (E2EE) it has long claimed

• Since at least 2016, Meta (then named Facebook) has said Whats App provides robust end-to-end encryption, meaning that messages are encrypted on a sender’s device with keys that are available only to the receiver’s

• In sworn testimony before two US Senate committees in 2018, CEO Mark Zuckerberg said Meta does “not see any of the content in Whats App; it is fully encrypted” and that “Facebook systems do not see the content of messages being transferred over Whats App