Former WhatsApp security boss sues Meta for “systemic cybersecurity failures”

In a striking counter-narrative to Meta's recent advertising blitz promoting WhatsApp's privacy features, the former head of security for the messaging platform has initiated a whistleblower lawsuit. Filed in the US District Court for the Northern District of California, the lawsuit claims that Meta has neglected significant security and privacy issues within the app, which it allegedly failed to disclose despite being aware of them. Attaullah Baig, who took on the role of WhatsApp security chief in 2021, asserts that he uncovered systemic failures in the platform's cybersecurity, which he argues compromised user data. According to Baig, an internal security assessment revealed that approximately 1,500 engineers within WhatsApp had unrestricted access to sensitive user data, a situation that he contends violates a $5 billion settlement agreement between Facebook—WhatsApp's parent company—and the Federal Trade Commission. Baig's lawsuit highlights the actions he took upon discovering these vulnerabilities, including notifying higher-ups about the risks associated with such extensive access by employees. He drafted a proposal aimed at implementing a robust data classification and handling system, intended to enhance the security of user information and comply with regulatory standards. Describing the environment at Meta, Baig criticized the company culture, suggesting it discourages questioning decisions made by higher management. Despite his continuous efforts to urge senior leadership to rectify these issues, Baig claims that no substantial measures were taken to address the security lapses he identified. Meta has publicly denied the allegations made in the lawsuit, insisting on the integrity of its security practices.