In India and around the world, the low credibility he and his businesses have earned for themselves are causing people to flee WhatsApp in droves, not because of something he has just done, but because they have finally realised what he has been doing all along.
Facebook, as it says, is not proposing to share the content of WhatsApp chats with Facebook. It can’t. WhatsApp has no access to the content of the messages on its own system. WhatsApp uses an excellent end-to-end encryption system developed by Moxie Marlinspike and his colleagues at Signal, which is free software and which WhatsApp has adopted for its own use.
WhatsApp is not proposing to begin sharing the information of its users with Facebook, because it has been doing that all along. Once, in 2016, for a limited time, it offered a chance to opt out. Anyone who was not using WhatsApp in 2016 or who didn’t take advantage of that offer at the time has already been ratted out by WhatsApp to Facebook.
WhatsApp is not changing to require everyone who messages a business on WhatsApp to allow their WhatsApp profile data and their phone number to be stored on Facebook servers for use in ad-targeting activities. That already happens, everywhere except in Europe, where it is prohibited by European privacy law unless users explicitly opt in.
Facebook was “only” disclosing that it already does all this pillaging of WhatsApp users’ privacy, and forcing its users to acknowledge that they know it too, or stop using WhatsApp.
A very regrettable misunderstanding, according to Facebook. Or perhaps a regrettable understanding, which is why Zuckerberg’s capacity for the appreciation of irony is now under test. All WhatsApp is sharing with Facebook and the businesses who use it as a privacy-invasion contractor is “metadata”, which means data about your identity, not the content of your family chat.
We’re supposed to think of “metadata” as less than “data”, but it isn’t: often it is more. Your mobile number and your profile information is far more valuable to them, and more dangerous to you, than what you said to your sister. Signal protects your conversational secrecy just as well as WhatsApp, because WhatsApp copies from Signal. Signal also protects your identity information, while WhatsApp and Facebook do what they can to monetise it, and if you don’t like that you can leave. So millions of people are leaving.
Basic messaging – in the style of Signal, Telegram, or WhatsApp – is technically very simple. The protocols involved are standardised. This means anyone can implement them. Protecting the secrecy of messages – so that only the intended recipients can read them and the server in the middle cannot access them – is more sophisticated, but that’s now free software published by Signal that other services can use.
So WhatsApp’s primary innovation lies in not protecting the metadata. WhatsApp is Signal with metadata spying. Inadvertently – caught up in their endless churning of the misleading language of privacy policies – Facebook just highlighted what it is they really add to the mix, as they offered their usual “my way or the highway” deal.
In India, and in much of the global South, WhatsApp has become the most important form of not only general communication but also political communication. For Facebook, that’s an immense direct subsidy to political parties and governments. Facebook tightly integrates between Facebook, Instagram and WhatsApp because targeted commercial communications are its primary business. Global changes in privacy rules occasionally cause it to reveal what it would prefer to hide.
Governments that want to control their people and crush dissent want metadata. They want to know who talks to whom, when, where, and for how long. Access to content, to the messages themselves, is also desirable, so they never cease to agitate for it, seeking backdoors, trapdoors, infiltration points, trying to make it impossible for citizens to have secrets from government. It’s not just Elon Musk who has decided that escaping the spying service for the service without spying is a good, perhaps a life saving, idea.
Could Indian data protection law be written to reduce these dangers? Yes. A law prohibiting companies from offering targeted advertising services from consumer facing messaging systems (such as Gmail, WhatsApp, and WeChat) and requiring technical protection for metadata as well as message content would be an excellent start. But the interests, commercial and governmental, that will fiercely resist such measures are likely to prevail in the near term.
People power, in this context, means using technology in ways that protect you, rather than threatening to harm you. Signal is a centralised service operated for the good of its users. This is an excellent way to start cleaning up the environment.
But for all the value that we get from a centralised pro-privacy Signal, we get more value still from decentralising further. A RaspberryPi costing less than Rs 4,000 can do the work of the messaging server. It will allow everyone in your family to do all their messaging, just as they do now, without any WhatsApp or Signal in the picture at all.
Such “federated” services reduce centralised power and increase autonomy and self-development. Every family benefits more from having one of its 12 year olds running its messaging infrastructure than from increasing Zuckerberg’s power. The ultimate irony for him is that he has now accelerated precisely this process of making him obsolete.
Mishi Choudhary is legal director of Software Freedom Law Centre, New York. Eben Moglen is Professor of Law and Legal History at Columbia Law School.