Mark Zuckerberg, CEO of Meta, recently admitted that United States intelligence agencies, such as the CIA, can access WhatsApp messages by compromising users’ devices. The revelation was made on 11 January 2025, during his appearance on the podcast "The Joe Rogan Experience".
According to Zuckerberg, although WhatsApp’s end-to-end encryption prevents Meta from viewing the content of messages, it does not protect users from direct attacks on their phones. The executive explained that spyware such as Pegasus, developed by the Israeli company NSO Group, allows access to messages and other data in plain text. These tools are often used by governments and security agencies to monitor specific targets.
In addition, the Meta CEO pointed out that the FBI can collect metadata and other relevant information by means of court warrants. This metadata, although it does not reveal the content of messages, is considered valuable in investigations.
Vulnerable platforms
According to documents released by the website Property of the People, in January 2021, the FBI acknowledged in an internal report its ability to collect information from several instant messaging applications, even if they use end-to-end encryption. The report, entitled "FBI Infographic re Lawful Access to Secure Messaging Apps Data", lists several platforms that can be targeted for surveillance by court warrants or by compromising devices. The applications mentioned include, for example, WhatsApp, iMessage, Signal, Telegram, Facebook Messenger, Line and others.
According to the report, although messages protected by encryption cannot be accessed directly, the agencies can collect metadata, contacts, usage records and, in some cases, messages stored in the cloud or on the applications’ servers.
Threema: the exception
Among the main messaging platforms analysed, Threema emerges as the only application where agencies such as the CIA or the FBI cannot access significant information. The application is designed to operate without the need for personal data, such as phone numbers or e-mail addresses, and does not store messages on servers. Furthermore, the minimisation of metadata and the use of rigorous end-to-end encryption make Threema one of the most secure options for those who prioritise privacy.
Threema stands out for its unique combination of anonymity, minimal data retention and independence from big corporations. For this reason, it is widely used by organisations that require high levels of security, including:
International companies: Such as Mercedes-Benz Group AG, which adopted Threema Work for secure internal communication, and the German supermarket chain EDEKA.
Public administrations: The city of Frankfurt and the Bavarian Ministry of Justice, which use Threema Work for official communications.
Armed forces: The Swiss Army banned the use of applications such as WhatsApp and Telegram, adopting Threema exclusively for sensitive communications, owing to the company’s rigorous data protection policies and its headquarters in Switzerland, where the laws offer greater protection against outside interference.
These characteristics make Threema an essential tool for those who cannot compromise on privacy, even in high-security environments.
A warning about digital privacy
Zuckerberg’s revelations rekindle the debate on digital privacy and expose the fragility of communication tools, even those regarded as secure. Cybersecurity experts point out that, although encryption is a significant advance, it is not enough when devices are compromised by sophisticated spyware.
To mitigate the risks, it is recommended to use operating systems that are always up to date, to take care when installing applications from unknown sources, and to choose messaging platforms that maximise security and privacy. In an increasingly interconnected world, protecting personal data has become a critical concern, and users’ technological choices play a fundamental role in their security.
