WhatsApp Emerges as the Latest Security Threat

Iran and the U.S. may not agree on much (and may technically be at war with each other right now) but there is, apparently, one thing that officials from both countries seem to be on the same page about: WhatsApp, Meta’s ubiquitous chat app, is a data hazard and not to be trusted.

Since Facebook bought WhatsApp for $19 billion in 2014, Mark Zuckberg’s company has attempted to position the app as the world’s premier privacy-focused communication tool. “End-to-end encryption keeps your personal messages and calls between you and the person you’re communicating with,” WhatsApp has said. “No one outside of the chat, not even WhatsApp, can read, listen to, or share them.” At the same time, Zuckerberg has sought to make it one of the most widely used apps on the planet. His efforts have been largely successful: WhatsApp is used all over the globe (with 3 billion monthly users), including in large parts of Europe, Latin America, and the Middle East.

However, activists and researchers have continually raised questions over the actual privacy assurances of the app—questions that were thrust back into the limelight this week with the arrival of two new controversies involving the app.

Last week, Iranian state television blared out a warning to the nation’s citizens, asking them to remove WhatsApp from their phones and devices and claiming—without evidence—that information from the app could be shared with Israel. The Associated Press originally reported on the Iranian government’s claims. Such warnings from Iran about Israeli influence over Western companies wouldn’t be that unusual on its face, but government offices in the U.S. also seem to agree that there’s a problem with the app.

On Monday, Axios reported that the U.S. House’s chief administrative officer, which provides support services to lawmakers and their staff, issued guidance that forbids the use of WhatsApp on government phones. The report cites an email that was circulated among House staff, which reads: “House staff are NOT allowed to download or keep the WhatsApp application on any House device, including any mobile, desktop, or web browser versions of its products.” The email went on: “If you have a WhatsApp application on your House-managed device, you will be contacted to remove it.” The warning continued: “The Office of Cybersecurity has deemed WhatsApp a high-risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use.”

In a statement shared with Gizmodo, a Meta spokesperson said it was “concerned these false reports [spread by Iranian state media] will be an excuse for our services to be blocked at a time when people need them the most.” The spokesperson added: “We do not track your precise location, we don’t keep logs of who everyone is messaging and we do not track the personal messages people are sending one another,” it added. “We do not provide bulk information to any government.” In response to the House restrictions on WhatsApp, Meta communications officer Andy Stone said the company disagrees “with the House Chief Administrative Officer’s characterization in the strongest possible terms.” Gizmodo reached out to Meta for more information.

In the past, the House chief administration officer has issued guidance restricting Congressional use of other popular apps, including Chinese AI tool DeepSeek and ByteDance, the Chinese owner of TikTok. The Senate has issued no such guidance on WhatsApp.

WhatsApp has been criticized many times over the years for various security-related issues, although the app does use very strong E2E encryption, and there is no evidence that Meta breaks that encryption. In 2021, ProPublica detailed Facebook’s alleged efforts to “undermine” the privacy protections of WhatsApp.

Meanwhile, Meta has often been accused of siding with Israel when it comes to the Israeli-Palestinian conflict. In 2023, Human Rights Watch accused the company of systematically suppressing pro-Palestinian content on Instagram and Facebook. Last December, the BBC reported that Meta had been actively suppressing news circulation about the Gaza war inside Palestinian territories. Meta’s own oversight board has claimed that the company overstepped its bounds when it came to moderating pro-Palestinian content.

While we’ve seen no public instances of governments having a backdoor into WhatsApp, in May, the Israeli cyber-intelligence firm NSO Group was ordered to pay Meta $167 million after it hacked 1,400 of its users in 2019.