WhatsApp says it will leave the UK rather than weaken encryption under Online Safety Bill

The head of WhatsApp says the messaging app will depart the UK if it’s forced to weaken its encryption standards under the country’s upcoming Online Safety Bill.

WhatsApp chief Will Cathcart briefed reporters on Thursday (as reported by The Guardian, Politico, and Wired), criticizing the legislation as the most concerning set of online regulations in the Western world.

“We’ve recently been blocked in Iran, for example. But we’ve never seen a liberal democracy do that,” said Cathcart, reports The Guardian. “The reality is, our users all around the world want security. Ninety-eight per cent of our users are outside the UK. They do not want us to lower the security of the product, and just as a straightforward matter, it would be an odd choice for us to choose to lower the security of the product in a way that would affect those 98% of users.”

WhatsApp’s warning follows similar threats from another encrypted messaging app, Signal. The president of Signal, Meredith Whittaker, said last month that the company “would absolutely 100 percent walk [away from the UK] rather than ever undermine the trust that people place in us to provide a truly private means of communication.”

Both Whittaker and Cathcart are responding to a provision within the Online Safety Bill that requires companies use “accredited technology” to scan users’ messages for child sexual abuse material or CSAM. The bill does not say how these scans would be implemented, but security researchers say they’re impossible to introduce without breaking end-to-end encryption (a privacy standard adhered to by WhatsApp and Signal that means the content of a message is viewable only to the recipient and sender). Supporters of the bill deny this.

Apple unveiled plans to scan users messages for CSAM in 2021 but dropped the project the following year after sustained criticism from the security community. Critics warned that once any system to scan users private messages is introduced, governments will slowly force companies to add more forms of prohibited content to their scans, eroding the standards of private communication.

The UK’s Online Safety Bill has already been criticized for embodying fuzzy distinctions between illegal and unwanted content. The legislation originally required tech platforms to moderate what it called “legal but harmful” content, but this language was removed from the draft last November. In its current form the bill will still drastically expand the powers of the UK government to moderate online platforms, though politicians and lawmakers continue to tweak its wording. The bill is expected to pass later this year.