Unsurprisingly, data egress to third parties is a major security vector - especially for mission critical jobs like working in the House. MS apps incorporating Copilot have faced similar blocks as well.
This requirement for data stewardship is called out in HITPOL8 as well [1][2] (the AI tool standards set by the House CAO).
[0] - https://faq.whatsapp.com/203220822537614/?cms_platform=iphon...
[1] - https://cha.house.gov/_cache/files/4/2/42dca19e-194b-481e-b1...
[2] - https://cha.house.gov/_cache/files/0/8/08476380-95c3-4989-ad...
[0] - https://cha.house.gov/_cache/files/4/2/42dca19e-194b-481e-b1...
[1] - https://cha.house.gov/_cache/files/0/8/08476380-95c3-4989-ad...
Also Government: WhatsApp has a backdoor. Don't use it.
Source?
>Also Government: WhatsApp has a backdoor. Don't use it.
If "zuck" is really in the pocket of the US government, why should they worry about their own backdoors?
It's the most hilarious thing about backdoors or collecting extensive covert intel on your own population, that any failure of opsec makes it much easier for all your adversaries to also spy on them in ways they would never otherwise be able to, then compromise them, and flip them.
Have you ever watched a Saturday morning cartoon? Minions betray their masters all the time. An effective evil overlord doesn’t underestimate their lackey’s capacity for duplicity and betrayal at a pivotal moment.
The most fun may even appreciate the gall: https://memory-alpha.fandom.com/wiki/The_Nagus_(episode)#:~:...
People: don't use Signal! It has a back door! Instead, use Telegram, it doesn't have encryption by default and is highly suspect of a foreign adversary
Also people: "I'll just send copies of all my messages to the government because they have my data anyways"
(..)
"Messages on WhatsApp are end-to-end encrypted by default, meaning only the recipients and not even WhatsApp can see them. This is a higher level of security than most of the apps on the CAO's approved list that do not offer that protection."
In Brazil even subpoenas can be sent via WhatsApp.
Go on...
The handling and metadata around encrypted messages is nearly as exploitable as the actual message contents. End-to-end encryption is necessary but not sufficient. The infrastructure has to be designed to minimize risk of other forms of exploitive analysis as well but in the case of WhatsApp that is essentially their business model.
Essentially the software creating the keys is not controlled by the same entity controlling the transmission method.
In email/matrix you have an additional protection in that you can host your own server; the best protection is the one you never have the possibility of traffic being diverted, and even if it was it would be encrypted so that the server doesn’t leak anyway, security is like an onion after all.
I assume he does. I assume moreover that most people aware of this at Meta consider this due diligence in defending shareholder value. What's that line from Dune 2, a wise hunter climbs the tallest hill? _You need to see._
Or maybe that Microsoft pays more than Meta.
This is the sticking point, because WhatsApp has now integrated Meta AI into the app, but (obviously) do not provide an on-prem data store. This is why Deepseek AI (the Deepseek app) and ChatGPT (the OpenAI app) are barred as well.
Data Stewardship and Zero Trust has been an internal initiative in the House for a couple years now.
The fact that almost no one on this thead knows these (imo overused) terms and design patterns highlights one of the various major gaps in Software Dev I've been observing for several years now - especially the North American market (given the hours that this was posted). The inability to incorporate or understand some basic security architectures is a major gap.
Edit: Keep pushing the downvotes. The truth hurts, and plays a role in jobs leaving, and funds like my employer funding cybersecurity startups in Israel, India, and Eastern Europe because the ecosystem doesn't exist in the US anymore. A similar trend happened in data layer related work.
We don't need more SKLearn plumbers calling themselves "ML Engineers" or Angular monkeys calling themselves "Fullstack Engineers" - we need people who truly understand fundamentals (or - shudders - first principles), be they mathematical (optimization), systems (virtualization), or algorithms (efficient data structures)
[0] - https://apps.apple.com/us/app/deepseek-ai-assistant/id673759...
Its not that they aren't known, but rather we just came off a long trend of thin-clients and cloud storage. Some companies merely stay in that ethereal space, while others had concerns about their data. Criticizing people for doing what experts were pushing for the past 20 years doesn't need to devolve into calling their expertise into question.
The downvotes are for that, not because "you're wrong".
Can you explain why the thinking is wrong?
Teams is more secure in my opinion.
I as an admin can control who you can/can't talk to, what you can share with them, when you can share it. Correctly configured MS Teams is a pretty secure setup.
On the flipside im not sure i can make someone else's Whatsapp not auto download anything sent to it.... The two apps aren't really comparable unless I've missed an entire 'Whatapps for government/enterprise' business arm.
MS Teams allow for offline/local storage of its video/chat conferencing.
https://www.microsoft.com/en-us/microsoft-365/government
Some other examples:
- AWS GovCloud https://aws.amazon.com/govcloud-us/
- Google Workspace for Government https://workspace.google.com/industries/government/
- GovSlack https://slack.com/solutions/govslack
sandworm101•4h ago
Use Signal.
SketchySeaBeast•4h ago
... but not for planning strikes into other countries.
sandworm101•4h ago
FuriouslyAdrift•3h ago
https://www.theemcshop.com/benchtop-faraday-tents/select-fab...
game_the0ry•4h ago
iAMkenough•4h ago
ben_w•4h ago
Zak•1h ago
Of course, the US government already has approved procedures and devices for secure communication, so senior official making up their own is reckless and unprofessional.
snickerbockers•3h ago
None of this is meant to excuse these officials for not authenticating everybody in that group or for using highly informal text messages to plan an airstrike of all things.
Ultimately there's no excuse for leaking information when you're at that level of government; I just feel like the app industry needs to take responsibility and fix several obvious, well-known and common UI issues.
mapmeld•3h ago
upofadown•3h ago
Supposedly, it was the result of a helpful Apple feature getting the wrong phone number for one of the intended group participants. Then Signal cheerfully used that wrong phone number to add the reporter to the group.
* https://www.theguardian.com/us-news/2025/apr/06/signal-group...
bee_rider•3h ago
If there are UI issues, they should be fixed because they are also annoying when planning somebody a surprise birthday party. (Or all the other stuff an encrypted chat app might be good for).
On the other hand, PGP just calling itself “pretty good” was pretty funny. Maybe that’s the level of active humbleness that everybody should aim for.
upofadown•3h ago
* https://articles.59.ca/doku.php?id=em:sg End to End Encrypted Messaging in the News: An Editorial Usability Case Study (my article)
snickerbockers•3h ago
femiagbabiaka•3h ago
snickerbockers•3h ago
janice1999•4h ago
And preferable not a hacked version of Signal that sends your messages in plain text to another country and its spy agencies.
mikehotel•4h ago
unethical_ban•1h ago
seethishat•3h ago
Signal is only as secure as the device it runs on. Cell Phones are not secure. They are blackboxes and probably track you and may have built-in backdoors (only to be used to catch 'real' criminals), etc.
The idea that you can turn a device like that into some form of secure communication platform by installing an app is not realistic.
Tijdreiziger•3h ago
ceejayoz•3h ago
https://www.fastcompany.com/91352935/pentagon-pizza-index-th...