How Private Are Messaging Apps? GlobeX Data's Alain Ghiai Weighs In

WhatsApp's announcement that it would change its privacy terms and conditions alarmed a lot of its users, and many left for rival services that were said to have stronger security and privacy policies. So many people departed that the company eventually said it would hold off on changing its policies for the time being.

By then the harm was done, and CyberSecurity ASEAN has reported separately on what followed that first decision. In the weeks since, attention has turned to the alternatives. Elon Musk tweeted a recommendation for Signal, and the app gained so many users so quickly that it briefly went down.

Telegram also picked up users. It was already popular because its group chats hold far more participants than WhatsApp's, and many government agencies and media organisations in Southeast Asia use it to reach their followers. Plenty of other messaging apps offer comparable features. The open question with all of them is whether they are actually secure and treat privacy as seriously as they say.

CyberSecurity ASEAN put that question to Alain Ghiai, founder and chief executive of GlobeX Data. His answer was blunt: "there is no such thing as privacy if you are not paying for it".

Facebook, the cloud and the phone number

WhatsApp may have postponed its policy changes, but it belongs to Facebook, and Facebook has access to its users' data whether they like it or not. What is uncertain, Ghiai suggests, is only whether that data is used with their consent or without it.

Many users will recognise the pattern of discussing a subject with contacts on WhatsApp and then being shown adverts about it on Facebook, Instagram or another of the company's apps. Ghiai said the same holds for apps running on the public cloud, whether AWS, Microsoft or Google: every one of these technology firms can get at users' data. Handing over a mobile number, in his view, makes a person traceable from that moment. He said WhatsApp has been streamlining users' data for a very long time, and that although local rules govern data transfers, most of these apps keep their servers in the US, where all the data is sent.

Are Signal and Telegram any safer?

The common assumption is that Signal and Telegram protect users better than WhatsApp. Ghiai disagrees. Signal is built by a non-profit organisation based in the US. It does not make money from users' data, but it still has to fund the service somehow, and he expects that money to come from data eventually.

He finds Telegram more worrying, mainly because it has often been used by the wrong people for the wrong ends. That is borne out in Southeast Asia, where some Telegram groups have been used to distribute illegal material such as pornography. The app itself is secured, he said, but it relies on technology that can be exposed to threats.

In his assessment, any messaging app built on open source is vulnerable. Most such apps use no proprietary technology and always ask for a phone number, which in his view rules out privacy. Apps running on a public platform also fall under the Cloud Act: on a US-based platform, "the data goes to the US and can be subpoenaed", he said.

The paid alternative

Messaging services that promise stronger security and privacy do exist. They generally run on proprietary technology and charge a modest fee.

One is the messaging service from Sekur Communication, where Ghiai is also chief executive. Sekur is a Swiss secure communications app that offers private voice messages, chat, self-deleting chat, file transfer and email on any mobile device, tablet or desktop. The company cites Switzerland's reputation for neutrality, stability, low network latency and privacy. Much like BlackBerry's once-popular messaging service, it lets users exchange highly secure, private chat messages with other Sekur users. According to the company, content is not monitored and messages are not stored on its servers.

Ghiai said Sekur needs no mobile phone number and uses no third-party platform or open-source code, running instead on its own independent proprietary technology and platform, which he called the ultimate privacy available. Businesses, governments and individuals who value privacy understand why that matters and are prepared to pay. Sekur charges because it does not earn money from customer data; the fees cover its servers, staff and similar costs.

The company has clients in Sri Lanka, India and Pakistan and plans to establish itself in Southeast Asia soon. Ghiai's parting point returned to where he began: anyone who wants privacy has to pay for it.