Many conversations happening on #WhatsApp (WA) groups about new #WhatsAppPrivacyPolicy .
This thread has arguments to help ditch WA & move to https://t.co/En4fe9VxUN
Share," target="_blank">@signalapp:
https://t.co/En4fe9VxUN
Share, use, copy-paste, modify with understanding as you deem fit on any platform in whole or part
1/n

Note: No affiliations, conflict of interest
Info presented with NO bias, prejudice, malice or indemnity.
Open to corrections: individual tweets may be deleted, tweets added to thread or corrected as replies.
Points that are unclear or uncertain are marked with "(?)".
2/n
CONTENT OF WA MESSAGES SHALL REMAIN ENCRYPTED END TO END.
BUT, there's data: contacts, group affiliations, co-affiliations, locations (live?), frequency of contacts, *tags* generated when we send or forward a message or file to contacts or groups, links, clicks on links, etc.
3/n
It is unclear whether this data is anonymized.
NOTHING in latest policy *prevents* the collection, retention, sharing or sale by FaceBook (FB: owner of WA) of this data in part or whole whether with identifying information or anonymized.
Meme source:
https://t.co/nMDTUlb0rl
4/n
Companies need to make money & generate profits:
To create software, install & maintain infrastructure.
Google, FB, Insta, Amazon etc sell data created from our content & data generated from our interactions (searches, clicks, purchases etc).
This makes many uncomfortable.
5/n
"If you're getting it for free, then you are the product".
Money is needed to install & maintain huge server farms to host our content & provide us with services.
So, I grudgingly accept that companies collect data & sell data in return for services.
BUT WA is peer to peer.
6/n
WA needs little infrastructure for us to use its service.
Folks tweet all sorts of stuff, even deeply personal matters.
Expectation is 100% public, including data.
Folks use WA for all sorts of stuff, even deeply personal matters.
*Expectation* is 100% private including data.
7/n
No judgements on what platform people use & what they share on it.
YET, FB now wants to mine & commodify the data generated on WA, share & sell it with no limitations or guarantees of anonymity or data protection.
THIS is a problem.
8/n
WHATSAPP
MESSAGES
SHALL
REMAIN
E2E
ENCRYPTED!

BUT I do NOT want to be profiled or profited from the *data* generated by sharing births, deaths, photos, jokes, shopping lists, passwords, the small myriad private pleasures & heartbreaks that we share with our loved ones on WA.
9/n
ergo #SignalApp
Free
Open Source
Not-for-profit
"our only investment is in your privacy.": https://t.co/LIC0RisXaV

Additional info from: @privacyint
eg:
https://t.co/4mN6fQ68W6

Respond with corrections if any.
10/n

More from Internet

Well, this should be a depressing read -- notably because the UK and the US are both terrible when it comes to data protection, but the UK appears to be getting a pass. So much for 'adequacy'.


A few initial thoughts on the Draft Decision on UK Adequacy: https://t.co/ncAqc93UFm

The decision goes into great detail about the state of the UK surveillance system, and notably, "bulk acquisition" of data, and I think I get their argument. /1

For one, while the UK allows similar "bulk powers," it differs from the US regime both in terms of proportionality, oversight, and even notice. Some of this came about after the Privacy International case in 2019 (Privacy International) v Investigatory
Powers Tribunal [2019]) /2

Whereas, other bits were already baked in by virtue of the fact that the Human Rights Act is a thing (This concept doesn't exist in the US; rather we hand-wave about the Constitution and Bill of Rights, and then selectively apply it) /3

For example, UK bulk surveillance (I'm keeping this broad, but the draft policy breaksk it down), substantially limits collection to three agencies: MI5, MI6, and GHCQ). By contrast, it's a bit of a free-for-all in the US, where varying policies /4

You May Also Like

The entire discussion around Facebook’s disclosures of what happened in 2016 is very frustrating. No exec stopped any investigations, but there were a lot of heated discussions about what to publish and when.


In the spring and summer of 2016, as reported by the Times, activity we traced to GRU was reported to the FBI. This was the standard model of interaction companies used for nation-state attacks against likely US targeted.

In the Spring of 2017, after a deep dive into the Fake News phenomena, the security team wanted to publish an update that covered what we had learned. At this point, we didn’t have any advertising content or the big IRA cluster, but we did know about the GRU model.

This report when through dozens of edits as different equities were represented. I did not have any meetings with Sheryl on the paper, but I can’t speak to whether she was in the loop with my higher-ups.

In the end, the difficult question of attribution was settled by us pointing to the DNI report instead of saying Russia or GRU directly. In my pre-briefs with members of Congress, I made it clear that we believed this action was GRU.