Skip to main content

The Guardian apologizes for flawed reporting on WhatsApp encryption

Image used with permission by copyright holder
Thanks to “misinterpretations, mistakes and misunderstandings at several stages of the reporting and editing process,” The Guardian published a story that dramatically overinflated the potential impact of a security flaw in the popular WhatsApp messaging application — and after half a year of investigating, the British news agency has finally put out a mea culpa.

Security concerns were under the microscope in December 2016, when the social media giant was accused of misleading European regulators in advance of its $22 billion acquisition of the messaging app, while WhatsApp users were displeased to find that their information was being shared with Facebook. That relationship grew more complicated after a report from the Guardian in early January, which detailed the discovery in WhatsApp of “a security backdoor that can be used to allow Facebook and others to intercept and read encrypted messages.” But was that report accurate? A group of security researchers penned an open letter a week later asking the Guardian to retract its story, calling it “the equivalent of putting ‘VACCINES KILL PEOPLE’ in a blaring headline over a poorly contextualized piece.”

The crux of the debate: WhatsApp told users last April that it had implemented end-to-end encryption for all messages sent through its platform, but the Guardian’s report suggested that the app neglected to mention a caveat: Facebook can intercept your messages. And if Facebook can do it, then so too can a government agency.

On Wednesday, six months after the controversial Guardian report, the news agency acknowledged flaws in its reporting, admitting that it was wrong to make such claims.

“The Guardian ought to have responded more effectively to the strong criticism the article generated from well-credentialed experts in the arcane field of developing and adapting end-to-end encryption for a large-scale messaging service,” wrote Paul Chadwick, the Guardian’s fourth readers’ editor (a quirky British title for a reader advocate).

The alleged backdoor was brought to light by Tobias Boelter, a cryptography and security researcher at the University of California, Berkeley. “If WhatsApp is asked by a government agency to disclose its messaging records, it can effectively grant access due to the change in keys,” he told the Guardian at the time.

Image used with permission by copyright holder

The supposed backdoor, the Guardian had explained, had to do with WhatsApp’s encryption, which depends upon a generated set of unique security keys, using the Signal protocol. These keys are traded and verified between users to ensure that their messages are protected.

However, WhatsApp apparently could generate new encryption keys for offline users without the prior knowledge of either the sender or receiver, and then have the sender re-encrypt messages with new keys to resend them. This process would essentially let WhatsApp intercept and read messages.

Boelter’s findings were further verified by Steffen Tor Jensen, head of information security and digital countersurveillance at the European-Bahraini Organisation for Human Rights. He noted at the time that “WhatsApp can effectively continue flipping the security keys when devices are offline and resending the message, without letting users know of the change till after it has been made, providing an extremely insecure platform.”

WhatsApp was indignant from the start, telling Digital Trends via email in January:

The Guardian posted a story this morning claiming that an intentional design decision in WhatsApp that prevents people from losing millions of messages is a “backdoor” allowing governments to force WhatsApp to decrypt message streams. This claim is false.

WhatsApp does not give governments a “backdoor” into its systems and would fight any government request to create a backdoor. The design decision referenced in the Guardian story prevents millions of messages from being lost, and WhatsApp offers people security notifications to alert them to potential security risks.  WhatsApp published a technical white paper on its encryption design, and has been transparent about the government requests it receives, publishing data about those requests in the Facebook Government Requests Report.

A group of security experts corroborated WhatsApp’s story shortly thereafter. Zeynep Tufekci took the charge on the open letter, which insists, “The behavior described in your article is not a backdoor in WhatsApp. This is the overwhelming consensus of the cryptography and security community,” as it is of Tufekci’s cosigners.

Moreover, the security experts criticized the lack of outside sources cited by the Guardian. “If you had contacted independent security researchers, many of whom, including the EFF, have written pieces calling your story irresponsible, they could have explained the issue to you and suggested how to report it responsibly,” the letter reads. “Your story notably lacks quotes, responses, or explanations by security experts in the field. Instead, it hinges on the claims of a single well-meaning graduate student.”

The Guardian issued its initial response in late January:

We ran a series of articles highlighting and discussing a verified vulnerability in WhatsApp and its potential implications.  WhatsApp was approached prior to publication and we included its response in the story, as well as a follow up comment which was received post-publication. While we stand by our reporting we have amended the article’s use of the term ‘backdoor’ in line with the response and footnoted the articles to acknowledge this. We are aware of Zeynep Tufekci’s open letter and have offered her the chance to write a response for the Guardian. This offer remains open and we continue to welcome debate.

The original article has been amended with the conclusions of the Guardian’s comprehensive review. The news agency also took the opportunity to highlight the strength of its journalism, following up its apology with a request for contributions. “The Guardian’s independent, investigative journalism takes a lot of time, money and hard work to produce,” the article notes.

Update: Added The Guardian’s official retraction in June.

Editors' Recommendations

Lulu Chang
Former Digital Trends Contributor
Fascinated by the effects of technology on human interaction, Lulu believes that if her parents can use your new app…
You’ll soon be able to use WhatsApp on more than one phone
Two phones on a table next to each other. One is showing the WhatsApp logo, and the other is running the WhatsApp application.

WhatsApp, one of the most used messaging services in Europe and parts of Asia, is about to close a major flaw. As spotted by the sleuths over on WABetainfo, the company is planning an update that will allow the use of a secondary device -- including another phone or tablet. Currently, WhatsApp only allows phone users to link their account via its web or desktop clients.

The new feature is dubbed companion mode. Once it rolls out, you'll have a workflow that's quite similar to setting up WhatsApp Web or WhatsApp on the desktop. Rather than entering a number, you'll be able to scan a QR code with your main phone to log in to your existing WhatsApp account.

Read more
WhatsApp down globally Tuesday morning
Close up of WhatsApp icon as seen on a smartphone display. Credits: WhatsApp official.

WhatsApp has gone down for users around the world, making it impossible to send and receive messages.

Complaints from its global community of users first started to hit social media at shortly after 3 a.m. ET on Tuesday, October 25.

Read more
What is a Facebook Pixel? Meta’s tracking tool, explained
A silhouetted person holds a smartphone displaying the Facebook logo. They are standing in front of a sign showing the Meta logo.

If you have a website for your business and you're wondering how well your ads are reaching prospective customers, you'll probably want to be able to measure that to make sure that the money you've spent on advertising for your business is money well spent. Meta (the parent company of social media platforms Facebook and Instagram) offers a tool that can measure that by capturing how your customers interact with your business' website.

At one point, this tool was known as a Facebook Pixel. But since the technology company's recent rebranding to Meta, the tool also underwent a name change and is now known as the Meta Pixel.

Read more