Meta Back in Court Again: WhatsApp’s Encryption May Not Be as Secure as Claimed

A new and complex legal challenge awaits Meta in the U.S. courtrooms, raising troubling questions about one of the core pillars of its communications: the privacy of users.

At the heart of the dispute lies the real efficacy of the end-to-end encryption of WhatsApp, a technology that Mark Zuckerberg’s company has long promoted as an absolute guarantee of the inviolability of conversations.

Last Friday, at the United States District Court for the Northern District of California, a complaint accusing the tech giant of having misled billions of people about the security of their messages.

WhatsApp isn’t secure? An international front against Meta

The lawsuit does not arise from a single grievance, but immediately takes the shape of a global battle. The plaintiffs come from several countries, including Australia, Brazil, India, Mexico and South Africa, symbolically representing the app’s vast user base.

The accusation is direct and heavy: according to the complaint, Meta and its subsidiary WhatsApp would be able to store, analyze and access messages which, according to the promises made to the public, should remain private and unreadable to anyone other than the sender or recipient.

The lawyers representing the plaintiffs have asked the court to treat the case as a class action, acting on behalf of all WhatsApp users worldwide.

The argument is that the company’s internal infrastructure actively undermines that principle of secrecy which has been the cornerstone of the app since its acquisition by Facebook in 2014.

It is argued that the company holds data that should be inaccessible even to its own servers and that it allows its workforce to examine the content of communications.

Meta’s strong reply and the defense of the Signal protocol

Meta’s response did not take long and arrived in decisive terms. The company has rejected the allegations in full, deeming them unfounded.

Andy Stone, the company’s spokesperson, issued a statement via email to Bloomberg in which he labels the claims as categorically false and absurd.

The company’s defense rests on a technical fact that the company considers incontrovertible: the use of the Signal protocol for end-to-end encryption, implemented on the platform for over a decade.

Stone described the case as a frivolous piece of fiction, announcing Meta’s intention to seek sanctions against the plaintiffs’ legal team for filing what they consider to be a frivolous lawsuit.

The company reiterates that the security feature is on by default and that the technology used mathematically prevents third parties, including Meta itself, from reading or listening to users’ exchanges.

The role of whistleblowers and the technical implications

Perhaps the most intriguing aspect of the case lies in the origin of the information on which the accusation is based. According to the documents filed, the plaintiffs’ claims would rely on revelations provided by anonymous whistleblowers.

However, at this time the court filings do not identify these sources or provide specific details about the technical evidence that would demonstrate the existence of backdoors or intentional vulnerabilities.

For years, cryptography experts have cited the Signal protocol (originally developed by Open Whisper Systems and also used by the eponymous Signal app) as the standard for private, consumer messaging.

This system is based on asymmetric cryptography and the so-called “forward secrecy” to prevent third-party access.

If the accusations prove to be well-founded, the consequences would go far beyond a reputational damage to WhatsApp; it would be a seismic shock capable of shaking trust in the entire cybersecurity ecosystem and in how encryption standards are checked and communicated to the general public.

Currently, the plaintiffs are represented by lawyers from prestigious firms such as Quinn Emanuel Urquhart & Sullivan and Keller Postman LLP, together with Jay Barnett of Barnett Legal.

None of the lawyers involved has given public comments beyond what is contained in the official documents, leaving it to the court to unravel this intricate tangle of technology and law.