The former head of security for WhatsApp filed a lawsuit on Monday accusing Meta of ignoring major security and privacy flaws that put billions of the messaging app’s users at risk, the latest in a string of whistle-blower allegations against the social media giant.
In the lawsuit filed in the U.S. District Court of the District of Northern California, Attaullah Baig claimed that thousands of WhatsApp and Meta employees could gain access to sensitive user data including profile pictures, location, group memberships and contact lists. Meta, which owns WhatsApp, also failed to adequately address the hacking of more than 100,000 accounts each day and rejected his proposals for security fixes, according to the lawsuit.
Mr. Baig tried to warn Meta’s top leaders, including its chief executive, Mark Zuckerberg, that users were being harmed by the security weaknesses, according to the lawsuit. In response, his managers retaliated and fired him in February, he claims.
Mr. Baig, who is represented by the whistle-blower organization Psst.org and the law firm Schonbrun, Seplow, Harris, Hoffman & Zeldes, argued in the suit that the actions violated a privacy settlement Meta reached with the Federal Trade Commission in 2019, as well as securities laws that require companies to disclose risks to shareholders.
“There are just so many harms that the users face,” Mr. Baig said in an interview last week, adding that he had also alerted the F.T.C. and the Securities and Exchange Commission to his concerns. “This is about holding Meta accountable and putting the interests of users first.”
In 2019, the company then known as Facebook agreed to pay a $5 billion fine and strengthen its privacy policies to settle charges that it had mishandled users’ information by allowing a Britain-based political consulting firm, Cambridge Analytica, to harvest data without permission.
“Privacy is more central than ever to our vision for the future,” Mr. Zuckerberg said in a companywide meeting after the settlement was announced with the F.T.C. “And we’re going to change the way that we operate across the whole company, from the leadership down and the ground up. We’re going to change how we build products, and if we don’t, then we’re going to be held accountable for it.”
Mr. Baig is the latest whistle-blower to come forward accusing Meta — which also owns Facebook and Instagram — of wrongdoing related to privacy, child safety and the spread of disinformation on its main platforms.
On Monday, another whistle blower organization, Whistleblower Aid, said that six former and current Meta employees had disclosed to Congress and federal regulators that the company put children at harm on its virtual reality products. Two of the former employees plan to testify on Tuesday in a Senate hearing on child safety. They plan to say that Meta deleted or doctored internal safety research of children as young as 10 who were exposed to sexual abuse grooming, sexual harassment and violence on the company’s virtual reality platform, according to Whistleblower Aid.
In March, Sarah Wynn Williams, a former leader of global policy, published a book, called “Careless People,” that describes a series of incendiary allegations of sexual harassment and other inappropriate behavior by senior executives. (Meta won a legal victory blocking the promotion of the book and has denied the allegations it details.)
And in late 2021, Frances Haugen, another former employee, testified before Congress that the company had knowingly created products that harmed teenagers, among other safety concerns, presenting thousands of pages of supporting internal documents to support her claims.
Meta’s vice president for public policy at the time, Nick Clegg, said that her accusations were “misleading.” He said the platform reflected “the good, the bad and ugly of humanity” and that it was trying to “mitigate the bad, reduce it and amplify the good.”
Meta bought WhatsApp in 2014 for $19 billion. Many of its three billion users turn to the app for its perceived security benefits, including encryption, which scrambles messages so they can be deciphered only by the sender and the intended recipient.
In June, WhatsApp unveiled ads in some parts of the app, a move that included optional data sharing that some users said was at odds with its longstanding stated philosophy toward privacy.
Mr. Baig joined WhatsApp in January 2021 as head of security. Soon after, he conducted a “red-teaming” exercise, where employees posed as attackers trying to exploit the service, according to the lawsuit. Roughly 1,500 WhatsApp employees had unrestricted access to sensitive user data, which was a violation of the company’s 2020 privacy settlement with the F.T.C., according to the suit.
As part of the settlement with the F.T.C., Meta had agreed to stronger privacy practices that included regular independent auditing of its systems, limiting sharing of data and putting in place a clear and comprehensive data security program for its apps.
For over a year, Mr. Baig repeatedly tried to raise the issue to his supervisor, according to the suit, but was told to “focus on less critical application security tasks.”
In October 2022, Mr. Baig documented a list of “critical cybersecurity problems” that he considered to be violating the F.T.C. order and securities laws, according to the suit. Meta was failing to address account hacking and wasn’t keeping track of all the data it was collecting on WhatsApp users, the suit claims.
“We have a fiduciary responsibility to protect our users and their data,” Mr. Baig wrote in the document he presented to top WhatsApp executives, according to the suit. “The penalties can be severe both in terms of brand damages and fines.”
Meta blocked several security efforts by Mr. Baig’s team, according to the lawsuit, including a proposed feature that required additional login approval for account recovery and one that prevented profile pictures from being downloaded from the service.
In an interview, Mr. Baig said that every day his team saw “real world, actual harm happening,” such as “account compromises, scraping impersonation, journalists being targeted.”
In December, Mr. Baig informed Mr. Zuckerberg that he had filed a complaint with the S.E.C. stating that the company had failed to inform investors of cybersecurity risks, according to the suit.
Mr. Baig’s managers retaliated with threats of firing and withholding compensation, the suit claims. His performance reviews became more negative, and in February, he was fired.
Mr. Baig filed a complaint with the Occupational Safety and Health Administration in April against Meta for retaliation against his reporting of security problems.
Mr. Baig said in the interview that working at Meta had been his “dream job” because of the company’s scale and the ability to solve problems that affected billions of users.
But now he thinks that “Meta treats its users like they are just numbers on some dashboard,” he said.
Eli Tan contributed reporting from San Francisco.
Cecilia Kang reports on technology and regulatory policy for The Times from Washington. She has written about technology for over two decades.
The post Whistle-Blower Sues Meta Over Claims of WhatsApp Security Flaws appeared first on New York Times.
