WhatsApp and privacy: recipients, content and objectives.

2021 – the year of digitalization.

From the first few days, 2021 has shown a clear intention to establish itself as “the year of digitalization,” a year devoted to managing human relationships almost entirely virtually. This was done through the dissemination of an information note in which the most popular social media platform of all, WhatsApp, communicated the update – even with a sense of urgency – of its terms of service, fixing it on February 8, 2021.

This is how the information note read, in a pop-up alert before accessing the social media platform’s chat home: “WhatsApp is updating its terms and privacy policy.” And again: “By tapping ‘Agree,’ you accept the new terms and privacy policy, which will take effect on February 8, 2021. After this date, you’ll need to accept these updates to continue using WhatsApp. You can also visit the Help Center if you prefer to delete your account and want more information.”

However, what raised the level of attention was not just the substantive issue of the update but rather the severe procedural condition contained in the second part of the message’s text. It can be compared to the second paragraph of an article in a decree issued by the Italian government, which makes the letter of the law even more specific. Let’s see what this means.

Reactions.

The average customer, who is typically unaware of the internal dynamics of Big Data, did not react well to the demand to comply with WhatsApp’s updates, under penalty of service interruption: by checking “Agree,” would they lose their privacy? What risks would they be exposed to from that point forward? Thus, within a few weeks, there was a rapid migration to the major instant messaging competitors, including Viber, Signal – which, in this case, represents a major innovation – and finally Telegram.

The core theme of this misunderstanding revolves around the fact that Facebook’s intentions were everything but to revolutionize the user’s practice established until now for WhatsApp, to which they had rightfully become accustomed.

Perhaps it would have been more appropriate to create a different communication that had revealed the real intentions of the social network and, above all, that had done so in much less stringent times. In fact, putting themselves in the shoes of the consumer, Facebook could have imagined how unsettling it could be to know whether, and where, to move their conversations.

Privacy.

The second alarm bell concerned privacy. What did the phrase “accepting the new terms” mean?

Again, confusion quickly arose, and the fake news spread that WhatsApp would have access to the contents of individual conversations from February 8 onwards. Perhaps the issue could have been dealt with less superficially, and it could have been resolved by specifying from the outset that the social network would only have access to users’ message metadata. But what are these “metadata”? To understand this, let’s take an example.

If you have dialed a COVID testing center’s number, WhatsApp will know that you have spoken to a service that performs COVID tests or collections, but it will not know exactly what you said.

However, Romain Aubert, Associate Manager and Strategist for Accenture, explains that WhatsApp can access all the contacts’ numbers in our smartphone’s address book “recurrently” and including “both those of users of our Services and those of your other contacts.”

This is even more logical in light of the fact that it would not objectively be possible, and it would be unfair for obvious privacy reasons, to collect such a massive amount of data to manage the entire traffic of approximately one and a half billion people worldwide.

Metadata – The Wealth of Companies

For companies, metadata represents the humus through which they can fully develop their value, a kind of context of reference. Through the storage and analysis of valuable tools, there is an opportunity to understand relationships, to know consumer preferences, and even to guide their choices. Furthermore, monitoring the content and quality of metadata has become essential for those companies projecting themselves onto the online market, while keeping in mind the advantages but also the risks associated with their conveyance, especially in the context of the Covid-19 pandemic.

Metadata becomes even more valuable if they are active, enriched by machine learning, expanded by human knowledge, and integrated. This is why data management plays a central and strategic role in the approach to Digital Transformation today.

Therefore, WhatsApp simply wanted to tell us that the change in terms was aimed at a more intelligent and inclusive management of truly useful data and not at the subtraction of our discretion over them or our undeniable privacy. In fact, thanks to the end-to-end encryption service, the latter would be guaranteed in any case.

Encryption – The Strong Point

End-to-end encryption is an encrypted communication system in which only the people communicating can read the messages. It prevents third parties, including Internet Service Providers, from being able to read or alter messages exchanged between two people.

The advantages of new encryption techniques can be seen by looking at the first of these processes, symmetric encryption. In fact, if the latter required two users to use the same code, known as a “key,” to encrypt the messages they exchanged, in asymmetric encryption, the people communicating use not one, but two pairs of keys: a public and a private one.

This means that if A wants to send a message to B, A will encrypt the message with B’s public key, which in turn will encrypt the message with his private key. In this way, complete user security is intended, since security depends solely on the private key pair.

However, this method does not guarantee absolute security: on the contrary, it has limitations that, in the worst-case scenario, could translate into a lack of preparedness in the face of a man-in-the-middle attack.

A man-in-the-middle (MITM) attack is a widespread type of cyber threat that allows a cybercriminal to intercept and manipulate the internet traffic that the user believes is private.

More technically, the offender inserts himself into the ongoing communication between two entities: a client (the victim) and the server. In this way, not only does he have immediate access to messages, but he can also modify them or impersonate one of the two parties. But beware: the attack can only work if neither party is able to know that the connection that connects them has actually been compromised by a third party, something they could find out by communicating with a different uncompromised channel.

Most encryption protocols include some form of endpoint authentication specifically to prevent MITM attacks.

It is probably one of the first goals that the creators of this new form of encryption have focused on in order to apply it, not to all, but certainly to the major instant messaging services. It is interesting to note that Facebook Messenger, Google Hangouts, Skype, Snapchat, Viber, and Yahoo are not equipped with it.

Therefore, let us try to explain the migration of Internet users to new shores and we believe it is debatable that this screening was the springboard for the average user who, in the silence of the law, rushed to download Signal first of all.

Signal – An example of encrypted messenger.

Born in 2013, Signal Private Messenger – its full name – stands out in a particular way from its competitors because conversations are always end-to-end encrypted.

The application queues encrypted messages on its servers to deliver them to temporarily offline devices. Therefore, the message history is stored on users’ devices and not on servers.

This not only allows for significant protection of text, audio, and video messages, but it also means that privacy is not an optional mode: it is the only way Signal works.

WhatsApp – Competition’s spread.

In light of these arguments, WhatsApp’s information, which was presented with a somewhat ambiguous text, has had at least a positive impact on the promotion and spread of alternative platforms.

However, we believe it is appropriate to emphasize how the inertia of the social network has not given any margin of maneuver to the expertise, which found itself having to avert, from the outset, any doubts about the loss of its privacy and to reassure the user who was about to click “accept” on the information banner.

Privacy Guarantor & Edpb.

For this reason, the Privacy Guarantor has brought the issue to the attention of the Edpb, the Board that brings together European privacy authorities, and with an urgent intervention aimed at clarifying the scope of the information, it has deemed it necessary to postpone the deadline for accepting the update to May 15, thus granting a wider assimilation slot to those who were about to read it.

These are the words, on the official website, of the Privacy Guarantor: “The Guarantor believes that from the terms of service and the new information, it is not possible for users to deduce what changes have been made, nor to clearly understand what data processing will actually be carried out by the messaging service after February 8. The message is very clear! And it continues: “This information is therefore not suitable for allowing WhatsApp users to express their free and informed will.”

GDPR.

New consequences have arisen, mutatis mutandis, also on the opportunity to give value back to the GDPR.

The shield of the General Data Protection Regulation, with particular reference to the stringent rules on the transfer of extra-EU data, would not have allowed the application of “American-style” information in European countries. Thus, a real crasis has been created between the text issued by Facebook authorities and the document, with a strong guarantee character.

In extra-European countries, where the virtuosity of the GDPR does not apply, the information on the use of personal data is decidedly less stringent.

This can be easily deduced from the “collaboration with other Facebook companies,” one of the highest points of the information, aimed at the intelligent and inclusive use of the information that WhatsApp receives from incoming and outgoing traffic. The ultimate goal is, as expressly stated in the information in the section mentioned above, to “improve, understand, personalize, support and market WhatsApp services and Facebook company offers.”

It was a strong global traction era.

I am about to summarize, briefly and concisely, the objective of this research.

Without wanting to take away space from the individual, understood as a leading character and product of his time, the era we are currently living in is one of strong global traction. Therefore, individual users operating on the network will now have to confront the new undisputed protagonists of the international scene: Facebook, Google, Amazon, as well as large industrial groups that emerge and establish themselves in the fifth dimension of the global arena, better known as cyberspace.

In this context, even the legal profiles of these companies have undergone significant changes, being forced to adapt their privacy policies to the new environment.

In these times, economic transactions have abandoned traditional methods to make room for digital liquidity.

Blockchain – Bitcoin – cryptocurrencies.

The new frontier of international payments, Bitcoin, is gaining more and more ground and has become a privileged object of study for experts in computer finance.

It is our duty to clarify that, despite its numerous pros, Bitcoin presents risks associated with its use that have literally paralyzed public opinion and created such an incisive prejudice that it has distributed its effects also on the Blockchain system – to a large extent understandable, given that it operates through the exchange of cryptocurrencies on the network.

However, this concept would deserve a separate in-depth analysis in a more appropriate setting entirely dedicated to its discernment.

For the moment, it suffices to dispel the myth of the unreliability of the Blockchain system by bringing to attention an exemplifying assumption: Blockchain is a shared ledger of digital data, based on consensus.

From this postulate, two demonstrations can be derived: the first explains that, based on the sharing of a database, the register removes the need for intermediaries who, previously, were required to act as trusted third parties to verify, record and coordinate data. The second, closely related, highlights how, unlike a distributed database, there is no central administrator.

Without going into the merits of an issue that deserves a reserved treatment space, the hope that we propose for the moment is a change of mindset that occurs through the promotion and facilitation of futuristic alternatives.

Firstly, it is necessary to promote the abandonment of any prejudice about the use of proprietary and shared registers devoid of any scientific foundation, and together with this, that barriers to the free circulation of data are gradually broken down to allow for more agile communication, which is always based on respect for the constitutional principles of freedom, equality and protection of the individual.

The issue of web regulation also deserves attention: we remember, in fact, that outside the GDPR, the use of the network is not regulated by any current legislation.

Therefore, it is a right-duty of the individual user to equip themselves with a series of guarantees that automatically protect them from the effects of their virtual operations in their personal legal sphere.

It will be a long process, but it has excellent premises for its momentum in the near future.