What's up with WhatsApp?

 Michael - Thursday

First a disclaimer. Although I’m still an honorary professor of computer science at the University of the Witwatersrand in Johannesburg, I’m not an expert on computer social networking technology. My area is image processing, and a rather specialised area of it at that. But I am interested in data security and the mathematics behind it, probably because I was a pure mathematician in another life and it’s fun to see the esoteric stuff I learnt at university actually being important. And, like very many people all around the world, I use WhatsApp a lot. I was a big Skype fan in the old days, but WhatsApp is just so much simpler and easy to deal with on a smart phone. (If you don’t know what WhatsApp is, you may want to skip the rest of this post.)

Brian Acton and Jan Koum set up WhatsApp as a start-up in 2009, asking for a small payment ($1 a year) to use the service. Their mantra was no advertising and absolutely secure data – your messages (and later your pictures and your voice calls) were completely private. It had a rocky start, and was at first exclusive to iphones, but when it spread to other platforms, it was soon growing nicely. I liked the service and paid them my dollar.

In 2014 when Facebook bought WhatsApp, they forked out nearly $20 billion - for a company that had never made any serious money. Facebook promised that WhatsApp’s philosophy wouldn't be changed and Acton and Koum stayed on. But they paid $20 billion and dropped the subscription…

Facebook supported their new subsidiary handsomely, and several important innovations followed. Voice, video, picture sharing. The declared ambition was to have WhatsApp on every smartphone. But some concerning things began to emerge. Telegram (another messaging service) was also growing strongly, and WhatsApp was accused of blocking their users on Android phones from connecting to it.

On May 18, 2017, the European Commission fined Facebook €110 million for "misleading" it during the 2014 takeover of WhatsApp. The Commission claimed that when Facebook acquired the messaging app, it "falsely claimed it was technically impossible to automatically combine user information from Facebook and WhatsApp." However, in the summer of 2016, WhatsApp had begun sharing user information with its parent company, allowing information such as phone numbers to be used for targeted Facebook ads. Facebook acknowledged the breach, but said the errors in their 2014 filings were "not intentional”. Huh? They paid $20 billion for a company that wasn’t going to bring them anything?

As of February 8, Facebook wants you to agree to a new privacy policy, and it’s got nothing to do with the EU rules. The new requirement that many users are up in arms about is that WhatsApp will share all the data it obtains from your phone with its parent company.

FB Data center

Okay, so Fact Number 1. WhatsApp has been sharing its users’ data with Facebook all along. And Facebook has been using it to target ads on its main platform. This fell foul of the EU policy, and it cost Facebook a substantial amount of money. (Maybe not a lot for Facebook.) So they are now requiring users to give them the right to do this (except in the EU).  This data includes all the contacts on your phone, and that’s other people’s data, provided to you in good faith. Will Facebook use that data for, say, telemarketing? It’s hard to believe, but they do something along those lines already in India.

One consequence of Fact Number 1, is that you are not much worse off using WhatsApp next month (if you agree to the new policy) than you were last month as far as privacy is concerned. But that’s pretty small comfort unless you trust Facebook not to misuse the data. (Hint: Acton and Koum left the company in 2017. Rumour has it that they disagreed with the direction the company was taking.)

Fact Number 2. They can’t read your messages. All the messaging services you may be using now use end to end encryption. This means that the messages can’t be decoded by being intercepted, not even by the messaging company itself. But they can see who you’re talking to, how often, have both parties Facebook pages (if the parties are on Facebook), and so on. Facebook knows that Stan and I talk a lot and have deduced that it’s probably about our books. They haven’t figured out yet what they could sell to two authors though…

However, with a suitably elevated court order – say the FBI suspects you of terrorist activity – the services can decode your messages, or at least the FBI can. (To their credit, Apple refused to unlock a cell phone on one occasion, but the FBI did it anyway.)

Fact Number 3. People dislike having their noses rubbed in things. It’s one thing to quietly acquire their contacts list and use it for general data gathering, it’s quite another to demand that they agree to it. Now it is a knowing breach of confidentiality. I must say I’m very uncomfortable with that, and I think Facebook miscalculated the reaction people would have. As a result lot of users have been test driving the competition.

“USE SIGNAL” That Tweet might be regarded as straight marketing, except for the fact that it came from one of the world’s leading innovators and now the world’s richest man – Elon Musk. (An amusing aside is that a group of stock market punters thought he was referring to a listed company with that name in a different area, and its shares doubled!)

Signal is a messaging service that couldn’t be more different from WhatsApp, except that it looks the same, and does the same thing. It’s free, uses open source software, uses the same encryption as WhatsApp, and got moving thanks to a $50 million donation from Brian Acton. (One of the founders of WhatsApp. About that issue of them falling out with Facebook...) Signal has no shareholders, runs entirely on donations, and is a non-profit. I’ve tried it, and it’s smooth, high quality, free, and committed to open, totally-private messaging. What’s not to like? I’m sure I’ll find something, but I haven’t as yet.

The table below gives a comparison between the messaging services, but there really isn’t much comparison, is there?

Why would one not switch? Well, what about if some of your contacts don’t switch and you can't reach them? Right now it doesn’t seem to be a problem. Next month? Who knows?

The spy without

Michael - Thursday

Tuesday was Data Privacy Day, and the Washington Post celebrated it by publishing an article titled “Facebook will now show you exactly how it stalks you — even when you’re not using Facebook.” It’s a well-written, useful article, and I advise anyone concerned about data privacy to take a look at it. What it is not, is surprising. In fact, if the article had claimed that Facebook and the other tech giants listened in to your conversations, I still wouldn’t have been surprised. My philosophy is that if you don’t want something to be public, don’t put it on the internet. Once you do that, there is always a way—legal or illegal—for someone to discover it.

For that reason, I haven’t resorted to any of the password vault software that generate passwords for all your internet accounts for you. However, I’m beginning to weaken. As the password requirements become more and more challenging—must have special characters, may not have special characters, must reach a certain level of complexity that none of my usual passwords do, etc. etc.—I have to resort to writing them on a piece of paper. (You remember? The flat, thin, white stuff?) However, I write them in code. Then I have to remember the codes. And where I put the piece of paper. I think that a password vault that takes care of all the passwords I don’t care too much about and simply remembering the few others may be the answer.

The WP article is about a new tool that Facebook offers called “Off-Facebook Activity.” The new tool allows you to discover what information Facebook is gathering from your actions, not only from its associates, Messenger and Instagram, but also in lots of other ways from lots of other internet sources. And while it won’t allow you to actually stop the collection of such information, it will allow you to prevent it being used so that advertisers can target their advertisements to you. However, the data is still there. Presumably, it’s to be used to obtain statistical information of value to…the advertisers. Neither will it reduce the number of adverts you receive. (You have to pay websites for that privilege.) So let’s understand the gain here. If we turn off this advert targeting, what we get is more random adverts. Is there not actually some benefit in at least getting adverts that you might possibly find interesting?

As you probably know, the European Union has made some efforts to prevent people being flooded with spam-like emails, and I support that strongly. You now have to explicitly sign up to receive newsletters and the like, and the default option is that you do not receive the marketing material. The penalties for violations can be severe. Like most authors, we've changed our newsletter so that it only goes out to people who explicitly asked for it. That cost us quite a few subscribers, but presumably the ones we have left actually have some interest in our books, and the others don’t have more emails to delete without opening. Good for both groups.

Sometimes data collection behaviours of websites can be uncanny. One lunchtime in Cape Town, Stan and I headed off to a restaurant he likes. We asked Google for the address, which it promptly gave to us. When we arrived, we discovered that the restaurant was closed. As soon as I returned to Google, it immediately offered restaurants near to the closed one, even though we'd never turned on the GPS option. How did it know where we were? Well, of course it can tell that from where the signal is being picked up by the cell phone towers. (Yes, I believe Google would have access to that information.) Or did it know the restaurant was closed and so we would be searching for another? Modern AI does that easily. Or maybe it was simply the most probable thing we would want after searching for the address of a restaurant that was in that part of town.

So Big Brother is watching us. And it’s not the people in Washington or London or name your favourite capital city, but Big Tech. (Of course, those other people are also watching us by using the same and other technologies. And they don’t play by rules.)

I think it’s not good, but I have to admit that it’s worth it. How many of us could live without Google let alone the internet as a whole? But how concerned should we actually be about the information we freely give away?

I don’t know the answer. What do you think? Probably Google and Facebook already know the answer to that, but I’m not smart enough to get them to tell me.