Citing security concerns, the chief administrative officer (CAO) of the House of Representatives today issued an order prohibiting representatives and staff members from using WhatsApp on government-issued devices. This includes smartphones along with laptop and desktop computers. Further, any individuals with WhatsApp already installed on a device must delete it. Using web-based versions of the app is also prohibited.
The CAO didn’t address any specific security issues, but said the ban was due to a lack of transparency from WhatsApp about their privacy and security frameworks. For impacted users looking for a new messaging platform, the CAO recommended that impacted staffers try Microsoft Teams, Wickr, Signal, iMessage, or FaceTime.
In an internal email obtained by Axios, the CAO said:
The Office of Cybersecurity has deemed WhatsApp a high-risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use.
In the wake of the scoop by Axios, U.S. House chief administrative officer Catherine Szpindor issued the following statement to CNBC:
Protecting the People’s House is our topmost priority, and we are always monitoring and analyzing for potential cybersecurity risks that could endanger the data of House Members and staff.
If any of this sounds familiar, it’s because it is. Back in 2022, the CAO issued a similar order preventing all House of Representative devices from running TikTok due to a “number of security issues.”
Predictably, Meta, which owns WhatsApp, isn’t too pleased with the CAO’s new directive. All the more so because it’s curiously vague.
In response, Meta spokesperson Andy Stone took to X earlier today to voice the company’s displeasure with the order:
We disagree with the House Chief Administrative Officer’s characterization in the strongest possible terms. We know members and their staffs regularly use WhatsApp and we look forward to ensuring members of the House can join their Senate counterparts in doing so officially.
Messages on WhatsApp are end-to-end encrypted by default, meaning only the recipients and not even WhatsApp can see them. This is a higher level of security than most of the apps on the CAO’s approved list that do not offer that protection.
WhatsApp has been compromised before
While WhatsApp certainly has some robust security measures in place, it’s important to note that the platform isn’t bulletproof. On the contrary, there have been a handful of reports in recent years of the platform being successfully targeted by state-sponsored malware.
Indeed, WhatsApp just a few months ago accused Paragon of developing software designed to spy on WhatsApp users. The software ended up being used by state actors who used it to monitor the devices of approximately 100 journalists across several countries in Europe. Consequently, WhatsApp sent Paragon a cease and desist order.
As for the spyware itself, it was particularly sophisticated and well-thought-out. Relying on a zero-day exploit, the spyware was able to install itself without user interaction. Rather, users who simply received a message were immediately compromised. Incidentally, the same spyware was also used to compromise iPhones. Apple ultimately released software patches for the vulnerability earlier this year.
As to the spyware’s capabilities, they are quite extensive. Specifically, it allows a malicious actor access to a user’s location data, email, messages, and even their on-device camera and microphones. More detailed and technical analysis of how Paragon operates can be found over here.
