WhatsApp Banned From US House Staff Devices Amid Questions Over Potential Vulnerabilities

WhatsApp has been banned from House staffers’ devices in the U.S., amid rising concerns about the security of the messaging app, and its potential vulnerability to certain types of hacking efforts.

As reported by Axios, the U.S. House of Representatives’ Chief Administrative Officer (CAO) has notified all congressional staffers that WhatsApp is to be removed from government devices, due to official warnings from the Office of Cybersecurity.

As per CAO:

“The Office of Cybersecurity has deemed WhatsApp a high-risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use.”

WhatsApp, which is known for its advanced data protection measures, and is built around full encryption, has been a key connective tool for government staff, with its focus on user control over their data being its key value for staff in sensitive areas.

But as the Office of Cybersecurity notes, more recently, questions have been raised over the security of the app, and the potential for hacking and infiltration by outside sources.

One of the big concerns on this front is that WhatsApp’s encryption process is not transparent, with the company’s back-end overview being taken offline after it was acquired by Meta back in 2014. That makes it harder for outsiders to see exactly how WhatsApp encryption works, and has raised questions in some circles as to its security.

WhatsApp does maintain an encryption overview, which is publicly available, as is the Signal Protocol, which its encryption system is built upon. But some security experts believe that all of WhatsApp’s functionality in this respect should be open source at all times, enabling greater visibility into its processes.

There have also been rumblings of concern based on media reports of late.

Earier this month, Iranian state media told citizens to delete WhatsApp, amid allegations that it was sending user data to Israel, while in May, the WhatsApp account of Malaysia’s home minister was hacked via a phishing scam.

WhatsApp’s security measures were not at fault in either case, though there has been some suggestion that certain vulnerabilities within WhatsApp’s encryption processes could expose lesser data points, like who users interact with, and for how long, in the app.

Last year, cybersecurity researchers also uncovered a potential issue with WhatsApp chats stored on Apple devices, though that was later addressed by the WhatsApp team.   

For its part, Meta has reiterated that WhatsApp is fully encrypted, and safe to use for government staff:

“We disagree with the House Chief Administrative Officer’s characterization in the strongest possible terms. We know members and their staffs regularly use WhatsApp, and we look forward to ensuring members of the House can join their Senate counterparts in doing so officially.”

Meta further notes that WhatsApp offers a higher level of security than most of the apps on the CAO’s approved list, and should not be subject to these warnings.

So is WhatsApp secure, and should it be allowed for government staff use?

Based on expert advice, the security of WhatsApp message protection hasn’t been questioned, but the fact that cyber groups could access information about who people are interacting with in the app is a concern, which could be the focus of this latest push.

How viable the threat on this front is depends on who you ask, but it does seem like WhatsApp will now need to reassure government officials that it is secure, and that all such potential threats are being addressed.