- Joined
- May 15, 2016
- Messages
- 15,869
- Likes
- 2,642
- Points
- 1,730
Experts warn about the possibility of bypassing encryption to track users. In March, the WhatsApp security team reported a serious threat to users of the messenger. Despite strong encryption, users are still vulnerable to government surveillance. An internal document obtained by The Intercept claims that the content of 2 billion users' communications remains protected, but government agencies can bypass the encryption to determine who is communicating with each other, the composition of private groups, and perhaps even the location of users. The vulnerability is related to traffic analysis, a network monitoring technique based on monitoring Internet traffic on a national scale. The document indicates that WhatsApp is not the only service susceptible to such a threat. Meta, which owns WhatsApp, is advised to take additional security measures to protect a small but vulnerable portion of its users, according to an internal assessment. These measures could include stronger traffic encryption, metadata masking, and other methods to counter national traffic analysis. Amid the ongoing armed conflict in the Gaza Strip, the vulnerability warning caused serious concern among some Meta employees. WhatsApp employees have expressed concerns that the vulnerability could potentially be used by Israeli intelligence agencies to spy on Palestinians as part of their operational programs in the Gaza Strip, where digital surveillance plays a role in identifying targets. Four employees, who requested anonymity, told The Intercept that such concerns occurred within the company. It is important to note that no concrete evidence of exploitation of the vulnerability was presented at that time. Meta spokeswoman Christina LoNigro said WhatsApp does not have any vulnerabilities and the document only reflects a theoretical possibility that is not unique to WhatsApp. The paper shows how government agents can use access to Internet infrastructure to monitor encrypted communications, allowing them to draw conclusions about who is communicating with whom. It's like watching a postman carry a sealed envelope. Traffic analysis allows governments to identify individuals participating in conversations, even if the content remains hidden. Metadata such as who communicates when and where is of enormous value to intelligence and military agencies around the world. The WhatsApp document does not provide specific examples of state actors using this method, but it does point to reports from the New York Times and Amnesty International showing how countries are monitoring the use of encrypted messaging apps.
As warfare becomes increasingly computerized, metadata—information about who negotiates when and where—has become of enormous value to intelligence, military and police agencies around the world. “We kill people based on metadata,” former National Security Agency chief Michael Hayden once infamously joked.
It was only after the April exposé of Israel's data-driven approach to war that WhatsApp's threat assessment became a point of tension within Meta.
A joint report by +972 Magazine and Local Call last month revealed that the Israeli army is using a software system called Lavender to automatically authorize the killing of Palestinians in the Gaza Strip. Using massive amounts of data on Gaza's 2.3 million residents, Lavender algorithmically assigns "nearly every Gazan resident a score between 1 and 100, expressing their likelihood of being a militant," the report said, citing six Israeli intelligence agencies. “A person who is found to have several different compromising qualities will achieve a high ranking and thus automatically become a potential target for assassination.”
Concerned that a vulnerability in the company's product could be used to spy on and harm civilians in conflict zones, some Meta employees organized an internal campaign called "Metamates for Ceasefire."
The group published an open letter signed by more than 80 employees who provided their names. One of the demands of the letter is to “stop censorship, stop deleting statements made by employees within the company” on this topic.
Successful traffic mining attacks require that all participants in WhatsApp group chats, or both parties to the conversation, be on the same network and country. While users in countries with adequate privacy laws may be considered less vulnerable, similar telecommunications surveillance techniques have been reported to be used even within the United States. In the Gaza Strip, the situation is particularly alarming, as Internet access is controlled by Israeli government agencies, leaving Palestinian users extremely vulnerable to such attacks.
WhatsApp is considering introducing a stronger security mode for vulnerable users, similar to Apple's Lockdown Mode. However, this can have the opposite effect, singling out such users and making them even more vulnerable to surveillance.
WhatsApp's internal document makes clear that protecting users from traffic sniffing requires a coordinated effort across the company.
__________________
As warfare becomes increasingly computerized, metadata—information about who negotiates when and where—has become of enormous value to intelligence, military and police agencies around the world. “We kill people based on metadata,” former National Security Agency chief Michael Hayden once infamously joked.
It was only after the April exposé of Israel's data-driven approach to war that WhatsApp's threat assessment became a point of tension within Meta.
A joint report by +972 Magazine and Local Call last month revealed that the Israeli army is using a software system called Lavender to automatically authorize the killing of Palestinians in the Gaza Strip. Using massive amounts of data on Gaza's 2.3 million residents, Lavender algorithmically assigns "nearly every Gazan resident a score between 1 and 100, expressing their likelihood of being a militant," the report said, citing six Israeli intelligence agencies. “A person who is found to have several different compromising qualities will achieve a high ranking and thus automatically become a potential target for assassination.”
Concerned that a vulnerability in the company's product could be used to spy on and harm civilians in conflict zones, some Meta employees organized an internal campaign called "Metamates for Ceasefire."
The group published an open letter signed by more than 80 employees who provided their names. One of the demands of the letter is to “stop censorship, stop deleting statements made by employees within the company” on this topic.
Successful traffic mining attacks require that all participants in WhatsApp group chats, or both parties to the conversation, be on the same network and country. While users in countries with adequate privacy laws may be considered less vulnerable, similar telecommunications surveillance techniques have been reported to be used even within the United States. In the Gaza Strip, the situation is particularly alarming, as Internet access is controlled by Israeli government agencies, leaving Palestinian users extremely vulnerable to such attacks.
WhatsApp is considering introducing a stronger security mode for vulnerable users, similar to Apple's Lockdown Mode. However, this can have the opposite effect, singling out such users and making them even more vulnerable to surveillance.
WhatsApp's internal document makes clear that protecting users from traffic sniffing requires a coordinated effort across the company.
__________________