Why I plan to stop using WhatsApp

Gagan Saksena — Mon, 18 Jan 2021 23:50:00 GMT

I wrote this article because a number of my friends and family were asking why I was leaving WhatsApp and why they should care about the upcoming changes to WhatApp’s privacy policy. Understandably WhatsApp has announced to push back the date of these changes to May. But my reasons and plans to stop using WhatsApp at that point remain.

What you should know about metadata

When you install and use messaging applications, you give permission for them to use certain data from your mobile device. In WhatsApp’s case, this includes Phone number, make/model, battery level, signal strength, location, network carrier information, IP address, etc. It is extremely unlikely that when you send a message all this information is needed by your recipient.

When you send a message on WhatsApp

The information collected is much more extensive than I’ve illustrated here.

What is the real issue here? What has changed?

This is not a legal answer- It is my understanding that this metadata is now being stored and made available to any Facebook companies, partners, etc. and can be accessed for legal or government requests. These changes apply to the all locations except for Europe- which has much stricter privacy laws that won’t tolerate this.

The claim that your messages were encrypted end-to-end wasn’t necessarily the big concern- even though that has been brought up separately and we are to trust that Facebook isn’t reading into these messages. In fact, in response to the exodus of WhatsApp users following the ultimatum, WhatsApp issued a big campaign to reassure users that their messages were encrypted end-to-end. But that wasn’t the big issue that most users took with the policy changes- and WhatsApp has been conspicuously quiet about the metadata storage, usage and access.

The real challenge here is that as continuing to be users of WhatsApp, you and I are going to have to trust Facebook in their good-faith secure storage, access and sharing of this data. Historically, Facebook has failed to do so. And more importantly, the trust is now spread amongst Facebook business partners that can buy this data.

Facebook’s history

Managing large amounts of user data securely is a serious responsibility. Unfortunately Facebook’s history hasn’t actually built any trust that they can do this in a reliable manner.

Historically, Facebook has consistently demonstrated a strategy that’s at best described as a bait and switch of trust- Build something of value, then sneak in access to people’s data for their own financial gains. Most people at that stage are too habitual (plus there are network effects) that make it hard to leave a platform like Facebook/Whatsapp.

When Facebook started using profile pictures and activity by default for their ads, they said the user has the option to turn that off- except at launch, it was hidden deep in preferences. The convoluted nature and complexity of Facebook’s privacy policies is blatantly intentional.

These egregious violations of privacy were happening so consistently that it became hard to stay on top of for the users that cared and for the rest- they got used to it.

The Facebook app is one of the most notorious apps for collecting massive amounts of metadata. A Forbes article explains this a lot more. Here is their gist (Image credit- Forbes)-

Image credit- Forbes

But why would Facebook do such a thing? — Ultimately money. On the other end of Facebook’s business, are several “partners” and clients that will gladly pay to get the data on these users. In fact, that’s what happened with Cambridge Analytica- which used Facebook to get data on millions of users for the purpose of political advertising. And that’s not a one off, this is really how Facebook’s business model operates.

Why care about privacy?

What’s the big deal? I’m not sharing my bank details here. Why should I care?

As I explained above, the issue isn’t the content of your messages- it’s all the metadata that goes to Facebook when you use Facebook/WhatsApp. Still not clear- think of these hypothetical examples that illustrate the issue of letting metadata be exposed, but not the data itself.

Metadata shows that you chatted with your doctor, and an infectious diseases expert within the same hour. No one knows the content of your conversation, because that was supposedly encrypted. Does that worry you?
Your location metadata shows that you were in the area near a political riot while you were using WhatsApp. You may not have participated in the riot, but this data marks you as a suspected participant. Worried yet?
Your location metadata with your phone number could be used to spoof a call to neighbors with your information. Then you are left to explain how that was not you. Worried yet?

But what about Apple, Google, etc that have access into my phone’s metadata? While there may be more to these companies, the fundamental difference here is that third-parties do not have access nor can they buy that data. Whereas with Facebook, that’s the basis of their entire business strategy. Additionally, most conscientious companies would offer a clean and simple way to opt-out. Not the case with Facebook. And that’s the reason to be worried here. Not doing anything about it, is encouraging Facebook to continue with its policies.

What should I do?

While we all have individual choices in what apps we run, there is a responsibility of protecting and owning your data. Even if I choose not to use WhatsApp, the fact that I’m in your address book makes that data (my name and number) be available to WhatsApp/Facebook to use as they will. Without these companies explaining that, the onus falls on us to be more socially responsible for each others’ privacy.

For the simple task of sending a message to a friend- use free and open source software that is verified to be secure. Some examples include- Signal, Telegram, Element, etc. They all have their unique features and additional capabilities but more importantly- they all do the core task of sending a secure message from one user to another reasonably well. It’s possible though unlikely that your favorite feature isn’t on the alternative, or that the quality or robustness isn’t all perfect. But that’s all manageable and actively being worked on- and compared to the cost of the privacy implications, reasonably tolerable. The more important part is in helping your friends and family understand this move- and why they should care.

What about Peer-to-peer based systems?

Peer-to-peer based messaging apps don’t have a central server to connect to that makes them good candidates for lasting beyond the funding capabilities of an open source solution that still relies on the server farms. There are a few options here like Jami and Tox, but they have not had as much adoption as they should! Element is also making progress in moving towards P2P.

But how do we know that Signal or other open source solutions will last?

One of the benefits of open source software is that even if one implementation of it doesn’t survive, the protocol and its open source nature make it easy for another company to sponsor development on it. There are a number of free and open source applications that have followed such a model that relies on sponsorships and donations. If you do feel grateful for the efforts of these open source efforts, consider donating to them.

What could Facebook do to win back the trust?

As far as making sure the messages are secure, Facebook could make WhatsApp open source. After all, it is based on Signal’s protocol and would make it easy for independent third-parties to verify that the messages stay encrypted and that Facebook servers don’t have a way of reading them.

And for both WhatsApp and Facebook app- they can make aggregating metadata on people be an Opt-In instead of Opt-out. Same goes for all privacy features. Make them simple enough for people to understand and opt-in.

Links

There is much written about this and I’d encourage you to read and understand as much as possible for you to make a cognizant decision about continuing to use WhatsApp/agreeing to Facebook’s terms. Here are some others that explain or touch upon this-

Stories by Gagan Saksena on Medium