WhatsApp in focus: Lawsuit questions encryption

WhatsApp is an integral part of everyday life for many. For years, a key selling point of the app has been its end-to-end encryption, designed to protect private communication. However, a recent class-action lawsuit calls this promise into question. The allegation is that, contrary to all claims, WhatsApp and its parent company Meta could access all messages. If this proves true, it would have significant consequences for trust in the messaging service.

End-to-end encryption has been politically and socially controversial at WhatsApp from the very beginning. While users see it as protecting their privacy, authorities criticize the lack of access to content. The lawsuit now filed addresses this tension and claims that the encryption doesn't even exist. A renowned professor of cryptography has publicly commented on the matter and put the allegations into perspective.

How WhatsApp describes end-to-end encryption

WhatsApp founders Jan Koum and Brian Acton developed the messenger with the goal of transmitting communication using end-to-end encryption. According to this principle, only the respective chat participants possess the necessary keys. While messages do pass through WhatsApp servers, they are stored there exclusively in encrypted form. According to WhatsApp, neither the company itself nor its owner, Meta Platforms, can decrypt or read this content.

The allegations in the lawsuit

The class action lawsuit fundamentally contradicts this account. It claims that WhatsApp stores encrypted communication in such a way that Meta still has access to it. According to whistleblowers, there are internal processes through which Meta employees can relatively easily gain access to WhatsApp messages.

According to the lawsuit, an internal request to an engineering team is sufficient to gain access to messages. This access is said to be possible in near real-time, valid indefinitely, and even include messages that users believe to have deleted. The lawsuit thus does not allege a single security vulnerability, but rather a systematic model by which content can be accessed within the company.

If these claims are true, WhatsApp's end-to-end encryption would be virtually worthless and the trust of billions of users would be massively shaken.

Assessment by a cryptography expert

Cryptographer Matthew Green of Johns Hopkins University addressed the allegations in a detailed blog post. He first confirms a known point: While WhatsApp uses an encryption system based on the Signal protocol, the specific WhatsApp code is not open source. A complete, independent review is therefore not readily possible.

Nevertheless, Green considers the allegations highly unlikely. He argues that such a system would have to be exposed sooner or later. Even without open source code, numerous older versions of the WhatsApp app exist that can be decompiled. If keys or messages were being secretly intercepted, traces of this would have to be found in the code.

Furthermore, he points out the enormous risk Meta would be taking. Lying about such a crucial security promise, while technical analyses are fundamentally possible, would make the company extremely vulnerable both legally and financially. Green essentially describes such an approach as extremely unwise.

Trust as an unavoidable factor

In conclusion, Green picks up on the ideas of computer science pioneer Ken Thompson from his lecture "Reflections on Trusting Trust." The core message: In complex systems, a degree of trust always remains because not everyone can personally verify every line of code.

The crucial question, therefore, is not whether trust is necessary, but whether it makes sense in the specific case. Green concludes that there is currently no concrete evidence to support the claim that WhatsApp is committing a historical fraud. Under this assumption, it is rational to believe the encryption promise – similar to iMessage and FaceTime, whose encryption implementations are also not entirely transparent.

Serious allegations against WhatsApp based on weak evidence

The lawsuit against WhatsApp makes exceptionally serious allegations, but so far provides no credible evidence. For the accusations to be true, both the WhatsApp founders and Meta would have had to have knowingly maintained one of the biggest deceptions in tech history for years. Furthermore, an allegedly established internal access to messages would require that a very large number of people were aware of it – something that would be difficult to keep secret in the long run. Currently, a lawsuit with far-reaching allegations stands in contrast to an expert assessment that considers them implausible due to a lack of concrete evidence. (Image: Shutterstock / Ink Drop)