WhatsApp’s built its reputation on one big promise: your messages are locked down with end-to-end encryption, so nobody (not even Meta) can read them. A new lawsuit says that’s all a lie. The WhatsApp encryption lawsuit claims Meta engineers can access pretty much any message with a simple internal request.
Quinn Emanuel Urquhart & Sullivan filed the case on behalf of users from Australia, Brazil, India, Mexico, and South Africa. Unnamed whistleblowers say Meta’s been able to decrypt and access WhatsApp messages since 2016. The process allegedly works like this: an employee sends a “task” request to a Meta engineer explaining why they need access. The engineer then grants it, often without any real verification.
Meta’s response has been blunt. A spokesperson called the allegations “categorically false and absurd.” The company’s now seeking sanctions against Quinn Emanuel. Meta says the lawsuit is designed to grab headlines and support NSO Group, an Israeli spyware company that recently lost a $167 million judgment to WhatsApp. Quinn Emanuel is also representing NSO Group in their appeal of that case.
Security experts aren’t convinced
That being said, some experts don’t believe the lawsuit holds merit. Matthew Green, a cryptography professor at Johns Hopkins University, wrote a blog post questioning the entire lawsuit. He pointed out that reverse-engineering would’ve discovered any backdoor by now. Green called the WhatsApp encryption lawsuit a “nothingburger” that’s heavy on accusations but light on actual evidence.
Other security researchers agree. Steven Murdoch, a professor at University College London, told reporters he’d be “shocked” if the whistleblower claims were true. The lawsuit doesn’t provide any technical evidence of a backdoor. It just relies on anonymous sources making broad claims.
WhatsApp’s end-to-end encryption uses the Signal protocol, in place since 2016. Bloomberg reported that US Commerce officials looked into whether Meta could access messages. But a Commerce spokesperson later said those assertions were “unsubstantiated” and confirmed there’s no formal investigation happening.
