Is the privacy of private life being disregarded: Can WhatsApp employees see our messages?

The 51-page lawsuit cites unnamed 'courageous whistleblowers.' According to these individuals, WhatsApp and Meta employees can view user messages through a simple internal process, effectively bypassing end-to-end encryption. Meta, however, has categorically denied the accusations, labeling the claims as “completely baseless and absurd.”

As reported by Bloomberg, the lawsuit was filed on Friday in a federal court in San Francisco. The plaintiffs include WhatsApp users from countries such as Australia, Mexico, and South Africa.

The lawsuit states: “It is enough for an employee to assign a task to an engineer through Meta’s internal system and state that they need access to WhatsApp messages to do their job. Meta’s engineering team often grants access permission without any oversight.”

The allegation claims that once this access is granted, a new window or widget opens on the employee’s computer, through which the messages of any WhatsApp user can be viewed via a user ID that is unique to the user but remains the same across all Meta products.

The lawsuit alleges that once access is obtained, there is no need for a separate decryption step, that messages are viewed in near real-time, and that Meta employees can even access old messages that users believe they have deleted.

END-TO-END ENCRYPTION DETAIL

The lawsuit does not provide technical details to support these claims.

WhatsApp’s end-to-end encryption has long been touted as the application’s most important security promise. In this system, the encryption keys for messages are stored only on the devices of the sender and the recipient; Meta does not have access to these keys.

In a statement to PCMag, Meta strongly denied the allegations, stating, “Any claim that WhatsApp messages are not encrypted is categorically false and absurd. WhatsApp has been using end-to-end encryption with the Signal protocol for 10 years. This lawsuit is entirely a work of fiction, and we will seek sanctions against the plaintiffs' attorneys.”

Conversely, the lawsuit accuses Meta of imposing heavy non-disclosure agreements on its employees and preventing what happens within the company from coming to light. The lawsuit claims that these agreements have “hidden the truth” for years.

HOW ARE WHATSAPP MESSAGES PROTECTED?

Meta first began introducing end-to-end encryption to its popular messaging app in 2014. Today, this encryption feature is used when users chat with another person on the app.

The end-to-end encryption feature ensures that sent content can only be read and heard by the sender and the recipient. Thus, no third party, including WhatsApp, can access the content of the messages.

This feature works roughly as follows: A pair of keys is generated for the messaging parties. Sent messages are encrypted, and this encryption can only be unlocked with the key in the recipient's possession. In other words, since third parties do not have this key, they cannot access the content of the message.

To make it clearer, let’s imagine two users named X and Y. Suppose X and Y are using an end-to-end encrypted application like WhatsApp while messaging. The keys that can encrypt and decrypt the messages remain stored on both users' devices. The application saves a key on X’s phone and a key on Y’s phone. X’s phone encrypts the message with the key and then transmits the encrypted message to Y’s phone. Y’s phone automatically activates the key and decrypts the message. Thus, Y can see the content of the message.

News Source: 12punto