Signal and Whatsapp Are As Private As the People You Talk To
In the show I’m currently on, there is a scene where the less than pleasant archdeacon of Notre Dame, Claude Frollo, tells his adopted son Quasimodo that “it takes two people to communicate.” But not only does the hunchback forget this lesson – I am surprised, but not so surprised, how easy it is to ignore this fact in everyday life.
Consider the indictment just issued by the US District Court for the District of Columbia against James Wolfe, a former member of the Senate Intelligence Committee. The indictment alleges that Wolfe lied to federal investigators about his interactions with three different reporters – sometimes via “anonymous” messaging apps such as Signal and WhatsApp.
Between September 2017 or around December 2017, REPORTER # 3 and WOLFE communicated with each other regularly using the Signal anonymous messaging app, texting, and phone calls.
“But wait,” you ask. “Shouldn’t these be secure messaging apps?”
Yes. Absolutely. Neither Signal nor WhatsApp can read messages you send through their respective services thanks to encryption mechanisms built into the entire process. If any of the services are summoned to court, they won’t be able to help investigators recover messages at all (presumably), which is much better for you and your undercover practices than simply texting your spy network through your wireless carrier’s network. (Do not do this.)
But here’s the problem: if you’re dumb and leave your messages on the device rather than delete them, investigators can find them if they gain physical access to your tablet or smartphone. The people you spoke to? Same deal.
And don’t forget, the person you are “messaging securely” with can also take screenshots of your conversations. If the application you are using does not warn you about this, like Snapchat, or does not have built-in mechanism to prevent screen capture, you’re stuck . Even so, a smarter person can simply grab an extra device and take a picture of the screen with your identification information on it.
What’s a wannabe spy to do? In Signal, consider using the service’s fading messages feature. While even Signal itself notes that it won’t stop someone from taking a photo of what you’ve sent, you can certainly use the other tools at your disposal – like recording phone numbers – to cleverly hide who you are.
(Or, simply create a bogus email account, connect to a trusted VPN, fire up Tor and send your secret encrypted message that way – which is just a head-to-toe privacy statement. There are many more advanced methods such as transferring secret information to SecureDrop .)
In WhatsApp, “disappearing messages” is a more manual method. You must delete your messages yourself , which will delete them from both your device and the recipient’s device. Don’t waste your time, however; you only have about an hour to delete what you sent.
As before, remember that information you can still be called to the court, including numbers , with whom you have contacted , so you can be creative in how you subscribe to WhatsApp in the first place, if you want to stay as anonymous as possible. … And yes, it is “as anonymous as possible” as it never feels like you are truly anonymous when using someone else’s service.