Meta accesses all unencrypted messages
An American agent claimed that WhatsApp encryption is fake
An American agent claimed that Meta can access all unencrypted messages, but the Department of Commerce suddenly shut down the investigation, leaving people wondering whether consumer apps are safe for making sensitive business decisions. In early 2026, an investigation took place within the U.S. Department of Commerce that has since sparked controversy in cybersecurity, privacy, and corporate governance circles. A special agent from the Bureau of Industry and Security (BIS) sent an email confirming something astonishing: Meta's WhatsApp, despite its public claims of end-to-end encryption, allows the company to access and store all user messages, including texts, images, audio, and video, in unencrypted form. Just a few months later, the investigation was abruptly ended.
TechSpot reported that after about 10 months of collecting documents and conducting interviews, the client sent an email on January 16 to more than ten officials across federal agencies, outlining the preliminary findings. It added: 'According to records reviewed by Bloomberg and verified by the recipients, the client confirmed that Meta's systems allow access to message content in ways that contradict the way WhatsApp encryption has been publicly described.' After an internal 10-month investigation called 'Project Encryption Source,' the BIS client sent an email on January 16 to more than ten federal officials. The email written by the client stated: 'There is no limit to the type of WhatsApp message that Meta can access.'
Meta can view all text messages, photos, voice recordings, and videos and store them in an unencrypted format. The email also described a 'graduated permissions system' in place since at least 2019, which grants access not only to Meta employees but also to contractors and 'a large number of overseas workers in India.' The email pointed out that the behaviour could include 'civil and criminal violations,' although it did not specify particular laws. Most importantly, this was not an official accusation, but rather a preliminary conclusion from an internal investigation that will soon be erased. However, shortly after the email circulated, the senior leadership at BIS closed the investigation. Agency spokeswoman Lauren Weber Holly said, 'The agency is not investigating WhatsApp or Meta for export law violations.' Meta strongly denied these allegations. Andy Stone, a Meta spokesperson, said: 'The claim that WhatsApp can access people's encrypted communications is clearly false.'
Meta says that only the participants in the conversation can read or hear messages on WhatsApp—not even the company itself. It has also defended this position in court, including in a 2021 case against tracking rules in India.
Not everyone agrees with the agent's claims. Alex Stamos, former head of security at Meta, said they are "almost certainly false." He pointed out that any backdoor vulnerability would have to exist in the application code that has been widely inspected, making it easy for researchers to detect. He also argued that Meta would not share such powerful access with contractor companies. Stamos said, "Security researchers would easily be able to find any large-scale backdoor." He added, "Also, having a backdoor in WhatsApp would be a huge tool for signals intelligence. There is no way Meta would share that capability with Accenture contractors if it existed."
However, two people interviewed by the agent claimed that they had extensive access to WhatsApp messages while performing content moderation work under a contract with Accenture, which did not respond to requests for comment. The closure of the investigation leaves key questions unanswered, including the evidence that was found and whether WhatsApp's encryption will be examined further, maintaining a high level of uncertainty.
