Facebook is working on a backdoor on WhatsApp end-to-end encryption
Some months ago, Speigel Online reported on comments by Germany’s Interior Minister Horst Seehofer, who proposed greater governmental access to end-to-end encrypted communications, such as those by WhatsApp and Telegram.
Seehofer proposing greater governmental access to end-to-end encrypted communications, such as those by WhatsApp and Telegram. While his comments represent merely one lawmaker's thoughts and the encryption community has vehemently objected to encryption backdoors and client application access, the reality is that at its annual conference earlier this month, Facebook previewed all of the necessary infrastructure to make Germany’s vision a reality and even alluded to the very issue of how Facebook’s own business needs present it with the need to be able to covertly access content directly from users’ devices that have been protected through end-to-end encryption. Could Germany’s backdoor vision be closer that we might imagine?
More recently, Facebook announced that is working on a "edge" moderation system, that applies AI algorithms directly on the user device in order to detect policy violations: this moderation system will applies on all infrastructure, including private messages on Facebook, Instagram and WhatsApp.
According with this article by Forbes:
In Facebook’s vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These algorithms will be continually updated from a central cloud service, but will run locally on the user’s device, scanning each cleartext message before it is sent and each encrypted message after it is decrypted.
The company even noted that when it detects violations it will need to quietly stream a copy of the formerly encrypted content back to its central servers to analyze further, even if the user objects, acting as true wiretapping service.
Facebook’s model entirely bypasses the encryption debate by globalizing the current practice of compromising devices by building those encryption bypasses directly into the communications clients themselves and deploying what amounts to machine-based wiretaps to billions of users at once.
Those same back-doors are being built into Facebook’s cryptocurrency wallet, Calibra.
According to Calibra’s own terms and conditions, the wallet provider will send transaction data back to Facebook in various circumstances
So, can we assume that Facebook is working on a technical solution that would allow it to meet the demands of the German government?
Also Bruce Schneier blogged about this topic, essentially reducing the concerns:
Facebook's first published response was a comment on the Hacker News website from a user named "wcathcart," which Cardozo assures me is Will Cathcart, the vice president of WhatsApp. (I have no reason to doubt his identity, but surely there is a more official news channel that Facebook could have chosen to use if they wanted to.) Cathcart wrote:
We haven't added a backdoor to WhatsApp. The Forbes contributor referred to a technical talk about client side AI in general to conclude that we might do client side scanning of content on WhatsApp for anti-abuse purposes.
To be crystal clear, we have not done this, have zero plans to do so, and if we ever did it would be quite obvious and detectable that we had done it. We understand the serious concerns this type of approach would raise which is why we are opposed to it.
Facebook's second published response was a comment on my original blog post, which has been confirmed to me by the WhatsApp people as authentic. It's more of the same.
So, this was a false alarm. And, to be fair, Alec Muffet called foul on the first Forbes piece:
So, here's my pre-emptive finger wag: Civil Society's pack mentality can make us our own worst enemies. If we go around repeating one man's Germanic conspiracy theory, we may doom ourselves to precisely what we fear. Instead, we should we must take steps to constructively demand what we actually want: End to End Encryption which is worthy of the name.
Blame accepted. But in general, this is the sort of thing we need to watch for. End-to-end encryption only secures data in transit. The data has to be in the clear on the device where it is created, and it has to be in the clear on the device where it is consumed. Those are the obvious places for an eavesdropper to get a copy.