How does WhatsApp’s end-to-end encryption actually work?

Amber Rudd has called for police and intelligence agencies to be given access to encrypted messaging services such as WhatsApp, sparking a row over civil liberties.

In the wake of the Westminster terrorist attack, the Rudd said that it was “completely unacceptable” that the government could not read messages sent via the app, the largest messaging service in the world.

Critics, however, have branded the Home Secretary’s calls as “mathematically impossible”.

What is Amber Rudd asking for?
Police are investigating reports that terrorist Khalid Masood, who killed four people outside of parliament before he was shot dead, had sent a Whatsapp message shortly before the attack. But since last year, the company — which is owned by Facebook — has used end-to-end encryption, meaning intelligence services can’t access the data.

Rudd, speaking on the Andrew Marr Show on Sunday, said the government needs to make sure that “organisations like WhatsApp, and there are plenty of others like that, don’t provide a secret place for terrorists to communicate with each other.” During the interview, she failed to rule out legislation to allow access, but said she was hoping to “win the argument.”

MORE: Home Secretary Amber Rudd calls WhatsApp encryption ‘totally unacceptable’
MORE: New arrest over London attack as govt eyes WhatsApp

What is end-to-end encryption?
Whatsapp, which was founded in January 2009, and now has more than one billion users, says “privacy and security is in [its] DNA”. Last year, following a high-profile battle between Apple and the FBI over access to data, it rolled out end-to-end encryption. In short, this means that no one outside of the conversation can read messages — this include intelligence services, hackers and WhatsApp itself (“Not cybercriminals. Not hackers. Not oppressive regimes,” as it puts it). When a conversation is started with a user, the app retrieves their public key from the company’s server, but not the encrypted private key, which exists only on the user’s phone. In theory, this makes snooping impossible, although some have argued that a ‘backdoor’ exists that would allow WhatsApp to grant case-by-case access to governments.

Should the government be able to access it?
Many critics, including Brian Paddick, the Liberal Democrat home affairs spokesman, say no, and have called Rudd’s plans disproportionate. “These terrorists want to destroy our freedoms and undermine our democratic society,” Paddick said. “By implementing draconian laws that limit our civil liberties, we would be playing into their hands. My understanding is there are ways security services could view the content of suspected terrorists’ encrypted messages and establish who they are communicating with,” he added.

Experts also point to the security threat from hackers, particularly in Russia, noting that end-to-end encryption protects users from this infiltration. There is also the question of whether Silicon Valley-based companies are likely to listen to the UK government.

Sam Dumitriu, from think tank the Adam Smith Institute, said Ms Rudd’s call for access was “deeply misguided”.

“It is mathematically impossible to build a back door for just the good guys,” he said.

“It means building a back door to your private messages for (Russian President Vladimir) Putin’s favourite hacker Guccifer. It means opening up your private photos to perverts like the iCloud hacker. End-to-end encryption keeps us safe.

“Khalid Masood wasn’t even on MI5’s 3000 strong list of suspected jihadis. Ending end-to-end encryption would not have stopped the Westminster attack, but it would mean a free-for-all for cyber criminals and Putin’s hackers.”

Is this what security services want?
Perhaps not. On the Radio 4’s Today programme this morning, major general Jonathan Shaw, who was in charge of cyber security at the Ministry of Defence, accused the government of “using” the terrorist attack to pushing for more control. “There’s a debate in Parliament about the whole Snooper’s Charter and the rights of the state and I think what they are trying to do is use this moment to nudge the debate more in their line,” he said. He also noted that terrorists would likely switch to a new service if they could no longer use WhatsApp. “The problem will mutate and move on. We are aiming at a very fluid environment here. We are in real trouble if we apply blunt weapons to this, absolutist solutions,” he said.

Rudd is to meet technology companies on Thursday 30 March to discuss the matter.