WhatsApp recently announced that users will soon be able to backup all of their data to Google Drive without that storage eating into their allocated Drive storage. What the company ommitted to say at the time was that the data backed-up to Drive will be stored in plaintext, without any encryption.
Google Drive Backups Not Encrypted
Starting November 12, WhatsApp backups to Google Drive will not be counted towards users’ storage quota. This is the result of a deal made between Google and Facebook, which owns WhatsApp. Google already analyzes its users' Drive accounts for targeted advertising purposes, so it was to be expected that if Google is going to store WhatsApp’s data for free, the company is going to get something in return (such as access to WhatsApp users’ data).
WhatsApp confirmed in its FAQ that the data that is backed up to Google Drive will not benefit from the same default end-to-end encryption implemented for real-time conversations, with the following line: “Media and messages you back up aren't protected by WhatsApp end-to-end encryption while in Google Drive.”
How WhatsApp Could Have Encrypted The Data
When a communications service is end-to-end encrypted, the users are in full control because they own the private key that is used to encrypt the communications. This key normally stored locally on the device in a secure environment such as a hardware security module. However, if the users want to change their devices and then access that data, they’d first need to transfer their private key, too. The vast majority of users don’t know how to do that or don't want to do it.
Data stored in the cloud isn’t normally encrypted with the user’s private key for the same reason. It's easier to transfer and access unencrypted data. This may also be part of the reason why WhatsApp disabled end-to-end encryption for backed-up data.
However, WhatsApp had another option here it could have easily implemented, which is allowing the user to encrypt the data with a password, just like you would normally encrypt a .zip file. The password could be required only during the setup of the Drive backup, and then it could be stored safely on the device, the same way private keys are stored, so that new messages are backed up automatically. In this case, neither Google, nor anyone else breaking into your Google Drive account would have access to that data.
On the other hand, if WhatsApp had done that, Google would have had little reason to negotiate this deal with the company. We suspect WhatsApp not encrypting the backups was likely not a technical issue primarily, but a business one.
Moving on From End-to-End Encryption
WhatsApp’s last remaining co-founder, Jan Koum, quit earlier this year after allegedly clashing with Facebook leadership, which apparently wanted to cripple the app’s encryption in order to implement more business-friendly tools into the app.
With both co-founders and many of the original employees quitting WhatsApp, Facebook may start looking to recuperate its $22 billion investment. End-to-end encryption could be in the way of doing that, as it doesn’t allow Facebook to look into users’ private messages or for the company to interpose itself in between users’ conversations. Time will tell how far Facebook will be willing to go with its plans.
