Many messaging apps boast privacy features. Marketing language is used to describe “end-to end encryption” or “private messaging” in almost every communication app.
Although encryption is a great selling point, it doesn’t mean that every encrypted messaging service will be the same. Your message app could leak metadata, contact information, or even the contents of your messages, depending on how it’s set up.
Un recently discovered FBI document, obtained by Property of the People. It was then shared with Rolling StoneIt is clear how vital it can be to choose the right private messenger. Think again if you are assuming that Apple’s iMessage, Meta and Facebook’s WhatsApp are FBI-proof. Top cops in the country can get a lot of information about popular options, including “subscriber, message sender, receiver data, device backup”, IP address, encryption keys and date/time data.
A day after January 6’s chaos, the document describes the legal ways that the FBI may use (as at November 2020) in order to acquire evidence as part of criminal investigations. While this document is not intended to be used for “warrantless wiretapping”, it could still be misused.
There are nine messaging apps that have been popularized: iMessage from Apple; Line from Japan; Signal, an encrypted message platform developed by Edward Snowden; Telegram (which originated in Russia) and Telegram with servers based at Dubai. Threema is a paid encryption chat, which I also used; Viber was originally created in Cyprus; Viber was then purchased by Rakuten in Japan; WeChat’s Chinese Swiss Army knife app WeChat; Meta’s WhatsApp; Wickr [Me]Amazon Web Services owns the Chat service.
Bottom line, FBI snooping is most likely to be used on WhatsApp and iMessage. According to FBI documents, Signal and Telegram score much better. According to FBI documents, Line and Viber also score poorly. My formerly favorite Threema also scores less than I would have expected. But, since they’re not as popular, this is probably irrelevant for you.
The FBI has the following information about iMessage: Basic subscriber information and device backup.(!), message sender-receiver and contact information, dates and times, registration time data, encryption keys, and contacts. The whole thing.
I made sure that these items were listed in the correct order. This ordering is not consistent with the key’s at-the-bottom ordering. It could either be based on effectiveness or strength, or completely random. This is important to note.
It is both because it challenges popular notions of security and the extent of data that it can unlock, that “device backup” part stands out. The FBI has not been granted access by any other messaging app. This is because iMessage is unique in that it is part of the iPhone ecosystem—the others are not tied to a particular OS.
This is where the problems begin: if the iPhone autobacks up iMessage data in iCloud as the default, the FBI may be able to obtain communications by asking Apple decrypt the backup. Apple is to be commended for trying to enable users to have fully encrypted backups without any company keys that could decrypt data. The FBI objected to the plan and the company was forced to stop. This can be done by turning off iMessage Backup on iCloud. However, you might want to look into all data in iCloud.
You should check your iCloud settings if WhatsApp is used by you. According to the document, “target” may be using an iPhone with iCloud backups enabled. iCloud returns could contain WhatsApp data that includes message content.
Apart from the asterisk in WhatsApp, the FBI is able to get, in the following order: subscriber information, registration time data data message sender-receiver, user contacts and data and times information. WhatsApp’s ability to quickly get the FBI information is what makes it unique. Rolling StoneThe document describes the system as “practically instantaneous.” It can give metadata every fifteen minutes according to the “pen register,” which is used to find out who has been speaking to whom and when. WhatsApp is unable to crack the encrypted content of messages. However, it can report the feds that suspect A has been talking to suspect A for many months. This can be a huge clue in an investigation.
We now turn our attention to encryption’s winners. Signal performed well in comparison to the FBI’s preferred methods. Signal is open-source, free and independent with some unexpected partnerships. It has been praised by privacy-focused public figures. I still expected more metadata from the FBI than it appears. You are doing a great job Signal.
Telegram was the best, and I am especially impressed by their score. Telegram does not use end-to-end encryption as its default. To get full protection, you will need to choose a secret chat with an individual. Telegram users choose group chats as they provide the highest level of encryption. Both the FBI document as well as the TSA documents are not encrypted. Rolling StoneArticle mentions this.
Weirdly, Rolling StoneTelegram is not mentioned at all in the FBI document, even though it’s the most FBI-proof app and far more widely used than Wickr. While the FBI documents does mention that Telegram might choose to reveal IP addresses and telephone numbers for terrorist investigation, it refers to Telegram’s policy over any secret backchannel.
Interesting and not mentioned is the timing of this document. While January 6 may appear like a distant memory, it was actually a time when people began to talk about the events and intone that they were worse than 9/11. All of us know the extent to which secret surveillance became more common and increased in response to that incident. The FBI was also enthusiastic about hunting down those who were in or around Capitol during the second worst attack. The FBI has used phone tracing and biometric scanning to find the targets. Could this have been in preparation anyway? This could have simply been an overview for the many new people who suddenly came on board? Either way, it would have been useful.
Telegram has become a very popular option for right-wing extremists. You can see the headlines about Telegram’s rise as a place for hatred and misinformation by using this search query. Telegram’s viral messages are not encrypted private messages. It’s “broadcasts” or group chats which aren’t protected the same. These dimensions are not mentioned in the FBI documents that were uncovered.
It doesn’t matter what the reason, users should be able to see the potential privacy issues in these apps. This will allow people to make informed decisions regarding the apps they use, as well as seek other encrypted communication tools, like Session and the Matrix protocols, that offer better privacy protections.