WhatsApp has suddenly been caught in a damaging fight with Elon Musk—and unfortunately for Meta’s mega-messenger, the battleground is on X, where Musk with his 185 million followers is hard to beat.
The Musk/WhatsApp fight, which started this weekend, relates to whether WhatsApp exports user data to its own servers. Musk initially responded to a post claiming “WhatsApp exports user data nightly, which is analyzed and used for targeted advertising, making users the product, not the customer.”
Musk’s reply was characteristically short and vague—and open to misinterpretation. “WhatsApp exports your user data every night. Some people still think it is secure.”
For WhatsApp, this ambiguity is a major concern, seemingly suggesting user content might be at risk from Meta’s world-beating data harvesting machine. “Many have said this already, but worth repeating: this is not correct,” WhatsApp boss Will Cathcart replied to Musk. “We take security seriously and that’s why we end-to-end encrypt your messages. They don’t get sent to us every night or exported to us.”
But sometimes it’s best to leave well alone, because these arguments have a habit of amplifying themselves. And security researcher Tommy Mysk picked up on Cathcart’s reply, clarifying that:
“WhatsApp messages are end-to-end encrypted, but user data is not only about messages. That also includes the metadata such as user location, which contacts the user is communicating with, the patterns of when the user is online, etc. This metadata according to your privacy policy is indeed used for targeted ads across Meta services. So @elonmusk is right.”
Still, all should have been fine for WhatsApp. Mysk is well followed within the security community, following high-profile reports into data vulnerabilities with TikTok, iPhone and Facebook, but most of those following Mysk understand the nuances of metadata versus content and the post would have raised little concern.
But unfortunately for WhatsApp, Musk then doubled down, awarding Mysk’s post a bullseye emoji. And so the stakes were raised—because Mysk’s post touched on WhatsApp’s biggest vulnerability, its Achilles’ heel, data sharing with Meta, aka Facebook.
We all know there’s an awkward data-based Faustian Pact between WhatsApp and Facebook/Meta, where the former shares as little as it can to balance its slightly tricky ownership status with its security creds. Lurking in the background, always, are Signal (good) and Telegram (bad), to pick up any waifs and strafes, spooked enough by data sharing for understandable reasons or no reasons into making a switch.
WhatsApp is very wary of anything that casts doubt on its integrity and security—as we saw with its response to the report last week that its own engineers had criticized its unwillingness to adopt counter-measures to prevent government network analysis building WhatsApp user relationship maps.
Metadata is complex and little understood, and while it’s nothing as compared to content compromise, it will worry users all the same. There are no real concerns about WhatsApp’s actual message encryption, notwithstanding Telegram’s Pavel Durov suggesting otherwise earlier in the month. But as I commented over the weekend: “Let’s keep this stupidly simple. If you have reason to fear an agency of any sort tracking you, your location or your contacts, then probably don’t use a platform owned and operated by Meta, aka Facebook.”
So, should you worry and contemplate switching WhatsApp for something else. For most, no. Metadata analysis when it does not harvest actual content is of far less value. It will tailor ads for your location and device and maybe—maybe—to reflect some of the groups or people you are connected with and message. It will also link to other data held on you in your wider profile. But that should be of marginal concern as compared to analyzing unencrypted content.
But for those worried by user tracking—even from metadata, or those who simply want to use the most private, secure and cleanest platforms, then there’s always a case to switch WhatsApp for Signal.
As for Musk versus the messengers, this is the second such battle in just a few weeks, following his echoing Telegram’s serious allegations against Signal and its alleged links to the US government. That fight was quickly shut down given the total lack of evidence and the spurious claims being made. But when it comes to WhatsApp, Meta and metadata, the risk is this will be harder to make disappear.
WhatsApp has not yet responded to my request for comment on Musk’s post.
