Prosecutors say Google accessed private WhatsApp messages — but the evidence is thin
On Wednesday, the Texas attorney general announced a far-reaching antitrust case against Google’s ad business. The complaint makes a lot of eye-opening allegations, including a long-running conspiracy between Google and Facebook to defuse the threat of header bidding, but one of the strangest allegations had to do with WhatsApp. According to the complaint, Google made a deal with Facebook to access millions of private messages, and photos from WhatsApp users, shortly after the app was acquired.
The specific allegation comes 57 pages into the complaint. The passage is heavily redacted, but it unmistakably alleges an exclusive agreement between Google and Facebook, granting Google access to users’ WhatsApp messages.
This is an extraordinary claim for a couple of reasons. WhatsApp is end-to-end encrypted, which means Facebook did not have centralized access to user messages at the time of the acquisition. (This is in contrast to a service like Gmail, where Google retains all of the messages on its servers and can scan them en masse.) That should make it impossible for Facebook to cut this kind of access deal to another company since it doesn’t have access itself. The whole point of end-to-end encryption is that it’s impossible for a company to trade away user privacy in this way.
So… what is Texas talking about here? The clearest explanation — put forward by Stanford’s Alex Stamos, among others — is that the passage is actually referring to backup files, which are initiated by the user and lie outside the service’s end-to-end encryption. But even then, the claims don’t quite hold water. Google does make it easy for Android users to store WhatsApp backups on Google Drive — but there’s nothing exclusive about the deal, and it’s not clear why it would have required a written contract. iOS users can store backups on iCloud too, and in each case, the backup is only created if the user initiates it.
Neither Google nor Facebook would provide an on-the-record statement, citing the sensitivity of the ongoing legal proceeding, but on background, both denied any exclusive deal to share WhatsApp user data. Google also pointed to a previous statement from Sundar Pichai, where the CEO committed to not using Drive data for advertising.
“We don’t sell your information to anyone,” Pichai wrote in June, “and we don’t use information in apps where you primarily store personal content—such as Gmail, Drive, Calendar and Photos—for advertising purposes, period.”
That leaves us in a difficult place. This complaint was the result of months of probes to both Google and Facebook, which almost certainly turned up information that hasn’t been made public. But the redactions and general confusion around the case make it difficult to tell how much is actually there.
The idea of a backroom deal to unlock millions of private messages is too alarming to ignore, but it’s also too alarming to accept at face value — especially when it contradicts so much of what we know about how these systems work. Along with the other claims of Facebook collusion, this will place a massive burden of proof on prosecutors as the case goes forward. But for now at least, it seems as if Texas has dropped a bombshell claim without backing it up.
On Wednesday, the Texas attorney general announced a far-reaching antitrust case against Google’s ad business. The complaint makes a lot of eye-opening allegations, including a long-running conspiracy between Google and Facebook to defuse the threat of header bidding, but one of the strangest allegations had to do with WhatsApp. According…
