The letter outlined not only the improper access engineers had to WhatsApp user data, but a variety of other shortcomings, including a “failure to inventory user data,” as required under privacy laws in California, the European Union, and the FTC settlement, failure to locate data storage, an absence of systems for monitoring user data access, and an inability to detect data breaches that were standard for other companies.
Last year, Baig allegedly sent a “detailed letter” to Meta CEO Mark Zuckerberg and Jennifer Newstead, Meta general counsel, notifying them of what he said were violations of the FTC settlement and Security and Exchange Commission rules mandating the reporting of security vulnerabilities. The letter further alleged Meta leaders were retaliating against him and that the central Meta security team had “falsified security reports to cover up decisions not to remediate data exfiltration risks.”
The lawsuit, alleging violations of the whistleblower protection provision of the Sarbanes-Oxley Act passed in 2002, said that in 2022, roughly 100,000 WhatsApp users had their accounts hacked every day. By last year, the complaint alleged, as many as 400,000 WhatsApp users were getting locked out of their accounts each day as a result of such account takeovers.
Baig also allegedly notified superiors that data scraping on the platform was a problem because WhatsApp failed to implement protections that are standard on other messaging platforms, such as Signal and Apple Messages. As a result, the former WhatsApp head estimated that pictures and names of some 400 million user profiles were improperly copied every day, often for use in account impersonation scams. The complaint stated:
In particular, Mr. Baig recommended limiting users from accessing other users’ profiles unless the other user has them in their contacts, has messaged them before, or is in the same group chat with them. Mr. Baig mentioned that WhatsApp is currently leaking Covered Information on millions, if not billions, of users daily and WhatsApp is severely under reporting scraping Covered Incidents to the FTC and other regulators. Mr. Baig also cited the strong protections that iMessage and Signal offer against profile scraping compared to WhatsApp.
Meta leaders allegedly rebuffed the recommendation on the grounds that it would hamper WhatsApp user growth.
In an email, a WhatsApp representative wrote: “Sadly this is a familiar playbook in which a former employee is dismissed for poor performance and then goes public with distorted claims that misrepresent the ongoing hard work of our team. Security is an adversarial space and we pride ourselves in building on our strong record of protecting people’s privacy.”
