The State Attorney General, Álvaro García Ortiz, thought he had eliminated messages that could help incriminate him in a crime of revelation of the secrets. It really wasn’t, because it doesn’t matter how your messages on WhatsApp: Google keeps them the same. Now we have known that these messages seem to have been successfully recovered, and the question is: how have you managed to read those messages?
Metadata to compare other data. During the investigation, the UCO also registered the electronic devices of the provincial chief prosecutor of Madrid, Pilar Rodríguez, indicate in 20 minutes. The content of the Zip folder held by the magistrate could also have been sent by goal/WhatsApp, which would not have sent the messages – it can not theoretically have no access to them – but the metadata of those conversations of García Ortiz. These metadata could serve to compare and contrast Rodríguez’s messages – which did retain those conversations – thus providing evidence for the attribution of the Attorney General.
Of deleted, nothing. As they point out in El Confidencial, the magistrate of the Supreme Court, Ángel Luis Hurtado, has indicated that the effort to try to recover the messages erased by the State Attorney General, Álvaro García Ortiz, seems to have been “successful.” The latter is charged with an alleged crime of revelation of secrets.
Google and WhatsApp lend their help. The Central Operating Unit (UCO) of the Civil Guard will be responsible for making an expert report on the messages. The Supreme Court, indicated in the country in January, made a request to the Irish delegations of Google and WhatsApp (Meta) through Eurojust, an Agency for Judicial Cooperation in criminal cases. It is not specified which has responded, but the magistrate has received documentation in a Zip folder that seems to contain the messages deleted by García Ortiz in October 2024.
How have you managed to read? The essential question is, of course, how it is possible that justice has ended up having access to those messages. The UCO already proved that García Ortiz erased his WhatsApp messages not one if not twice on October 16, 2024, when he was charged. He even changed telephone and reached the factory that he had been using until that moment. The alleged reason was to prevent such messages from incriminating him, but it turned out that this was not enough. The theory of metadata is a strong option, but there are others.
End -to -end encryption is there. To begin with, we must clarify that WhatsApp has been using an end -to -end encryption protocol for all conversations. Only who sends the message and who (or who receives it can read them, but no other person or entity can decipher those messages. Not even goal, through whose servers they are sent and forward texts, images, video or any other type of content. The key was not there, and there are other ways to access those messages.
Option 1: physical access to the device. The most obvious way to access a user’s WhatsApp messages is to have physical access to your mobile device. In that case, forensic experts can, with the appropriate tools, obtain the key to decipher the messages from the WhatsApp database, even if they have been deleted. Here García Ortiz erased the messages and restored the terminal to his factory status, which probably made it impossible to recover them from the device even having physically access. But there was another way.


Option 2: Surely Backing Copies. This is probably the key to the success of having recovered the messages of the Attorney General. In WhatsApp users can back up their messages in cloud services such as Google Drive or Apple Iloud, but attention: by default those backup copies are not encrypted. It is users who must proactively enable encryption in backups, and maybe García Ortiz did not. That would have caused Google, to which help was requested, could access that data to send them to the case magistrate.
If you want to delete your messages, be careful with backups. WhatsApp users cannot do anything with metadata, which does keep a finish line, but with the messages if they want to erase them effectively. As this case teaches us, it is not enough to delete them from our phone: if we make backup copies of our messages, it is important to activate the encryption of said backup copies.
But special notice about backup copies. Special care with the encryption of backup copies, because it does not work as extreme encryption. The copies are encrypted with a password/password that you only know, and therefore it is convenient that it is strong not to be broken with brute force attacks, for example. WhatsApp in fact gives the option to create a 64 -digit key, but … she does it. Here are suspicions about how they manage that encryption password in Google/Apple/Meta, and if they can decipher it in some way for potential judicial requests. Be that as it may, the other solution, of course, is not to back up the messages of the messages unless you consider it absolutely essential.
Image | State Council | Brett Jordan
In WorldOfSoftware | If the question is whether your company can add you to a WhatsApp group of work, the law leaves no doubt: it depends on who pays