Encrypted messaging has become a very difficult business. Despite their reach, it’s hard to make money from messaging apps. And their key service—encryption—is under constant attack from actors across the political spectrum.

Authoritarian governments are furious because citizens are using encrypted messaging to organise dissent. In democratic countries, law enforcement agencies hate the way it facilitates criminal behavior of all kinds.

And democratically minded publics are incensed because right-wing extremists on the fringe and in the mainstream have used it to spread disinformation, to subvert elections and to organise political violence and radicalise others.

On top of that, elected politicians are increasingly addicted to using it for policy discussions and reporting, undermining basic democratic transparency and accountability.

Services like WhatsApp, Signal and Telegram are deeply entangled in high-stakes political struggles globally over fundamental rights such privacy and peaceful dissent, legitimate law enforcement imperatives, rising authoritarianism, and the existential threats to democracies from disinformation—all happening in the increasingly vulnerable and dangerous realm of cyberspace.

At the same time, encrypted messaging services are enormously popular. At least half the world’s people have at least one encrypted messaging app on their phones. Of these, WhatsApp has by far the greatest reach, used by about 90% of people in most countries ^[1].

In an interview ^[2] with the director of ASPI’s International Cyber Policy Centre, Fergus Hanson, WhatsApp CEO Will Cathcart outlined his approach to navigating hazardous political waters.

Since taking over the top job at WhatsApp in 2019, Cathcart has built a reputation as a strong advocate for encrypted messaging as a service essential to protecting against threats to privacy, democracy and cybersecurity.

Under his leadership, the company has mounted high-profile challenges in India and Brazil against government attempts to pry open the service to enable surveillance of messaging.

WhatsApp has targeted companies that assist state surveillance. In 2019, it initiated a suit in a US federal court ^[3] against Israeli tech company NSO Group. The suit alleged that NSO had developed its Pegasus spyware to penetrate encrypted messaging services ^[4], helping Mexico, Saudi Arabia, the United Arab Emirates, Bahrain, Morocco and Kazakhstan target journalists, academics and civil society activists. The case is still working its way through the US justice system.

‘This is about the fight for a secure internet,’ Cathcart says.

In his conversation with ASPI, Cathcart talked about WhatsApp’s origins. One of the company’s founders, Jan Koum, was born in the Soviet Union. Scarred by the experience of totalitarianism, he held a deep-seated belief that human beings need to be able to talk to someone in private without someone listening in.

‘Privacy, democratic values are in our DNA,’ Cathcart explains.

That DNA will be tested even further in coming years as WhatsApp attempts to enter more markets in places with varying levels of democracy. In response to a question about the service’s future in Hong Kong, Cathcart acknowledged that ‘we run the risk of being blocked everywhere we operate’.

But he goes on to say that the issue is bigger than tech companies. They can’t fight the problem of authoritarianism on their own and be profitable in a sector that demands global scalability to remain in business.

Rather, democratic governments need to be thinking about how to ‘commandeer tech companies in the fight to spread liberal values’. Partnering more closely with tech companies on combating disinformation and introducing regulation to bake more privacy into digital technologies are some of the approaches suggested by Cathcart.

WhatsApp made news this year by launching a lawsuit against the Indian government ^[5] in India’s supreme court on constitutional grounds.

‘What the Indian government wants,’ explains Cathcart, ‘is traceability. But we’re arguing that this is inconsistent with the privacy guarantees in the Indian constitution.’

WhatsApp contends that the Indian authorities are asking it to break its end-to-end encryption. The Indian government denies this, but experts support WhatsApp’s assessment ^[6].

When asked what response he expects from the Indian government, he says that WhatsApp could be blocked just like it was in Brazil. In 2015–16, the service was blocked three times ^[7] and a Facebook executive jailed, although those actions were later overturned by an appellate court decision which ruled that end-to-end encryption was important for human rights in the country.

Since then, Brazil has enacted a general data protection law and an internet bill of rights ^[8] that provide a more coherent legal framework for the preservation of encrypted messaging.

WhatsApp’s case against India is happening against a backdrop of increasingly authoritarian moves ^[9] by the Modi government to control information. However, the Indian government has argued that it is only following international precedent like Australia’s anti-encryption laws. ^[10]

Still, Cathcart hopes that WhatsApp can remain part of India’s growth story. In fact, India is WhatsApp’s largest market, with 400 million users.

This points to a fundamental tension that Cathcart has to manage. Encrypted messaging services don’t make profits on their own. WhatsApp competitor Signal—started by WhatsApp founder Brian Acton—operates as a not-for-profit ^[11]. Telegram has raised operating funds ^[12] through initial coin offerings and its own cryptocurrency, and CEO Pavel Durov has said that it won’t allow ads or sell user data to raise revenue. But, basically, both of these services rely on billionaire subsidies.

Cathcart admits that WhatsApp also has yet to make a profit, but hopes to through a mixture of business services, advertising and financial services.

For the business sector, WhatsApp’s plans include offering direct business-to-customer messaging and business-to-customer services, like getting a boarding pass delivered via WhatsApp.

Advertising initiatives include offering businesses ways to find new customers through ads on Facebook and Instagram, which could be counted as revenue for WhatsApp.

The company also will market financial services like digital banking and money transfers in emerging markets where both literacy and underbanking are widespread problems.

But if the Indian court battle doesn’t go WhatsApp’s way, a big chunk of the company’s future revenue will be in doubt. And if WhatsApp decides acquiesce to the Indian government’s position, that might irrevocably damage trust in the brand’s privacy DNA, which is already shaky ^[13] due to perceptions of data-sharing with Facebook.

Cathcart insists there’s a middle path here—that it’s possible both to have secure encryption for users and to assist law enforcement. He says the company is more than willing to work with law enforcement if it’s done through proper legal channels in accordance with human rights standards.

As an example, Cathcart says that WhatsApp doesn’t see individual messages, but it has a reporting mechanism for users to report suspicious activity. Content moderators can look at some metadata, group names and patterns of behaviour that might be indicative of criminal and inauthentic activity. They’ve also added a Google button to encourage users to factcheck information.

Another avenue for countering misinformation and disinformation is through changing the design of the product. One change that WhatsApp made in 2018 after vigilante killings in India ^[14] was to adjust the forwarding settings so that content could only be forwarded once, limiting the speed at which harmful messages could be spread. But presumably this also works to limit pro-democracy messaging too.

Cathcart says these measures have seen large decreases in forwarding across the WhatsApp system. He also points to the company’s recent partnering with Brazil’s election systems, on things like factchecking and shutting down fake accounts. Again, working with governments is key, says Cathcart, as are government-run public awareness campaigns on disinformation.

But his broader message for law enforcement is that encryption protects the internet. Just like in physical spaces, there should be a limit to how much law enforcement can do in cyberspace to solve crimes. For example, in an age of increasingly smart homes, police shouldn’t be able to get into your living room whenever they want; a warrant should be required, like it is in the physical world. Breaking encryption might help solve some crimes, but it will make us less safe overall.