WhatsApp defends its chat encryption standard after NCB accesses Deepika Padukone’s private chats; Details

WhatsApp privacy: Facebook-owned instant messaging platform WhatsApp has asserted that the user chats are safe and cannot be accessed by any third party. The assertion by the instant messaging service comes as the Narcotics Control Bureau (NCB) has summoned actresses Deepika Padukone and Shraddha Kapoor in a drug case angle that resulted from the probe into the death of actor Sushant Singh Rajput. The two actresses were summoned based on their 2017 WhatsApp chats with talent agent Jaya Saha, who was also Sushant’s talent manager. This left users wary of their WhatsApp chats being accessible to third parties.

However, on Thursday, WhatsApp decided to step in to assay the fears of the users. It said that WhatsApp used end-to-end encryption for chats so that only the participants of that particular chat would be able to see the interaction. The access has been closed off even for WhatsApp.

It added that WhatsApp was guided by operating system manufacturers to undertake on-device storage, and further said that users must use all the security features that operating systems provide, including strong passwords and biometric IDs so that any third-party access to content stored on the devices could be curtailed.

Several people are of the view that the NCB accessed the chats using mobile phone cloning, a technique that has been in India for about 15 years now. In this technique, the data as well as the cellular identity of the phone being cloned is transferred or copied to a new device. While the process of cloning is illegal for individuals, authorities undertake the process through forensics to legitimately access user data. Cloning of phones can also transfer the International Mobile Station Equipment Identity (IMEI) number of the original phone to the new one, even though it is unique in nature.

Domain experts state that programming skills and a few minutes are all that are required to copy the entire data of one device to another. While earlier, such a process required physical access to the original phone, with smartphones, it is not required as a single app can get the process done, all without so much as touching the original phone. Once the cloning process is complete, the user’s WhatsApp chat backup can be accessed through Google Drive for Android phones and from iCloud for iPhone users.

This is possible because while on the phone, the WhatsApp chats are encrypted, and end-to-end encryption is done for the transmission process, the Facebook-owned company does not encrypt chat backups.

When a phone number is used to sign in to WhatsApp, the platform sends a verification code to the phone number SMS or phone call, which would theoretically be received by the cloned SIM. Apart from that, two-step verification can also be set up by users to prevent such an abuse.