WhatsApp to offer encryption on cloud backups, a new step in privacy arms race

The new offering gives WhatsApp’s two billion users additional protections for their communications, an escalation in a growing fight over encryption technology. Companies developing privacy-preserving technologies continue to be at odds with law-enforcement organizations that want access to the vast array of digital information stored on smartphones and on computer servers known as the cloud.

WhatsApp’s new feature, which the company plans to ship in a software update later this month, will let users create an encrypted backup of their chats—including images, videos and audio—and store that data on Apple’s iCloud or Google Drive.

“If you save a copy of your messages, with Apple or Google, [you] save it in a way where they have no way to read it,” said Will Cathcart, the head of WhatsApp.

This extra layer of security could keep messages and photos shared via WhatsApp private if, for example, a user’s iCloud account is compromised, said Riana Pfefferkorn, a research scholar with the Stanford Internet Observatory, an academic research group that studies internet abuse.

Right now, WhatsApp messages are encrypted between sender and receiver, meaning that even WhatsApp itself is unable to read them as they pass through its servers. But when users back up their data to the cloud, these backups are readable by the cloud providers, Ms. Pfefferkorn said.

WhatsApp isn’t turning this encrypted backup feature on by default—people who want it will need to select it in the app’s chat settings and then come up with a password that could be used to unlock the encrypted backup. The servers that will verify this password and manage the backups’ encryption keys will reside in Facebook’s U.S. and European data centers, the company said.

While Apple has fought with the U.S. Justice Department over the strong encryption system that ships with its iPhone, backups of mobile phone data on the iCloud and Google Drive have emerged as important sources of information during investigations. WhatsApp’s new encryption system could complicate some of those searches, but the fact that it is not enabled by default will greatly reduce the number of people using it, Ms. Pfefferkorn said.

WhatsApp presents itself as a defender of online privacy in the global encryption debate, but the company experienced some backlash earlier this year when it made changes to its privacy policy reflecting the company’s future plans to offer services for business customers.

In the coming months, the company is planning to offer businesses a way of managing WhatsApp conversations with their customers. Although WhatsApp had previously said that it wouldn’t store user messages on its servers, the service for businesses would store WhatsApp messages on Facebook’s servers. Those businesses could then use that information to create Facebook ads, according to the company.

The move is seen as a key step in Facebook’s plan to generate revenue from WhatsApp, but it concerned advocates who worried that the move invaded user privacy. The controversy caused a slowdown in WhatsApp downloads during the month of January as users flocked to WhatsApp rivals Signal and Telegram, according to data from the app analytics firm SensorTower.

The announcement comes weeks after Apple delayed the rollout of new software aimed at combating child pornography on iPhones after critics said they could create broad risks for users. Through a software update, Apple plans to implement a system that would scan phones for known images of child pornography and alert Apple if a certain number of those images were uploaded to its cloud storage service.

Apple has defended the service as privacy-friendly, but critics including WhatsApp warned it could be misused by authoritarian governments to conduct surveillance on the iPhone. Last month, Apple’s engineering chief, Craig Federighi, strongly disputed this idea, telling The Wall Street Journal that the scanning system will include “multiple levels of auditability.”

The new WhatsApp backup option would give its users a way of backing up their chat messages, including images, while opting out of Apple’s scanning system, according to WhatsApp. If images are saved elsewhere on the device, however, they wouldn’t be protected by this encryption, the company said.

But the encrypted backups are “not a perfect defense against anything a phone manufacturer might do,” Mr. Cathcart said. “The people who build the phones have a lot of power over your life.”