Open WhatsApp or Signal and the app promises that nobody in between can read what you type. That promise holds. A message is scrambled on your phone and only unscrambled on the recipient’s, so nobody handling it in transit can unpick the words, not even the company that built the app. What the promise leaves out is everything wrapped around those words.
more
About two in five people worldwide use chat apps such as WhatsApp, Signal, Telegram, WeChat, and Messenger. For every one of them, the company still knows a good deal about who is talking, even when it cannot see what was said.
What the encryption actually locks away
A properly end-to-end encrypted message can be read only by the phones at either end of the conversation. Neither a network eavesdropper nor the people who run the app’s servers can open it. That is the specific thing the promise covers: the content of a message once it is encrypted and while it crosses the network.
It says nothing about the app itself. The app is software running on a phone, and it has to handle the plain, unencrypted message before it encrypts one and after it decrypts one that arrives. The device doing that work may also hold account credentials, encryption keys, and message history, so whoever gets privileged access to the device, rather than to the network, can still reach the conversation.
The part encryption was never built to hide
An encrypted chat still needs a working postal system underneath it. The provider has to know which account sent a message to which account, when, and how large the group was. WIRED reports that companies running these apps also collect what the outlet calls the “metadata of the metadata.” That covers how many accounts exist, where and when they were created, how a message spreads through a network, which formats travel fastest, and which messages get reported by other users. None of that requires opening a single message.
Alongside it sits a narrower, more personal kind of metadata: a name, an email address, a phone number, a contact list, and sometimes payment details. The United Nations Office of the High Commissioner for Human Rights treats this kind of data as covered by the right to privacy. This kind of data can be deeply personal. The UK’s National Cyber Security Centre lists using metadata only for its necessary purpose as one of seven principles it expects a secure communications service to meet.
When “encrypted” has a gap built into it
Encryption is a property of a specific app and a specific conversation, not of a phone or a phone number, and that catches people out. The US Cybersecurity and Infrastructure Security Agency warns that Apple’s iMessage only encrypts a conversation end to end when everyone in it is using an iPhone. Message an Android user from an iPhone and the conversation falls back to SMS or MMS, and neither carries end-to-end encryption, so its contents are open to interception on the way.
The same agency warns that a phone showing a 5G signal is no proof of a secure connection either. Networks route voice calls and text messages over older protocols such as 2G to manage capacity, even while data traffic rides the newer, faster standard. Cellular protocols do not give texts and calls end-to-end encryption. Email has its own version of the gap. A message between two Gmail accounts may travel encrypted within Google’s own network, but once it crosses to a different provider, such as an Outlook inbox, neither service can guarantee what protection the other applies.
Whoever holds the key can still open the door
Encryption is only as private as the key that decrypts it, and someone has to manage that key. The National Cyber Security Centre calls cryptographic keys the root of trust in a secure messaging service. Anyone who reached that key management function could impersonate a user or read their messages, regardless of the encryption itself. The centre also expects a secure service to log unusual account activity, such as repeated failed logins or access from an unusual location, so a compromise gets noticed rather than missed.
The fight over scanning a message before it locks
Governments have not left this alone. An amendment to the UK’s draft Online Safety Bill would have required messaging services to build technology that detects child sexual abuse material even inside an end-to-end encrypted chat. A company that did not comply faced fines of up to £18 million or 10% of global turnover. The UK’s then home secretary, Priti Patel, argued that encryption would “significantly reduce the ability for platforms to detect child sexual abuse.” She said the bill set a legal duty to remove such material regardless of the technology involved.
The method under discussion is client-side scanning. Software on the phone checks a message against known illegal material before it is encrypted, or just after it is decrypted, so the encrypted channel in between is never touched. The companies that build these apps oppose it regardless. In an open letter reported by the BBC, the heads of Signal, WhatsApp, Threema, Viber, Wire, Element, and Session warned it would open the door to “routine, general and indiscriminate surveillance” of private conversations. WhatsApp’s Will Cathcart said his company would rather be blocked in the UK than weaken its encryption, and Signal’s Meredith Whittaker said Signal would leave the country outright. Threema’s Julia Weiss added that weakening its security “in any way, shape, or form” was “completely out of the question.” Threema’s code is open source, she said, so users could spot a hidden surveillance feature themselves. Element’s Matthew Hodgson called the plan “equivalent to putting a CCTV camera in everyone’s bedroom.” Ofcom, the communications regulator, said it would need a high bar of evidence to order scanning. The Prime Minister’s spokesperson said scanning would apply only where less intrusive measures could not work.
Apple had already tested the limits of this idea and backed away from it. The company paused a plan to scan iPhones for known abuse imagery after more than 90 human rights groups warned that the same capability could later be turned toward other material a government wanted found. That is the argument still running underneath every version of this proposal: a scanner built for one purpose is a scanner that can be pointed at another.
So the message itself stays closed once it is properly encrypted. Who sent it, who received it and when stay visible to the provider. What a government may demand a scanner look for is still argued over.
