Can WhatsApp Messages Be Secure and Encrypted—but Traceable at the Same Time?

A new program could strengthen the security and privacy of WhatsApp, Signal, and other end-to-end encrypted messaging apps and help them better moderate online abuse

Cryptographers love an enigma, a problem to solve—and this one has it all. Indestructible codes, secret notes, encryption, and decryption.

Here’s the puzzle: someone wants to send a secure message online. It has to be so private, so secret, that they can deny they ever sent it. If someone leaks the message, it can never be traced back to the sender. It’s all very Mission: Impossible. But there’s a kicker: if that message peddles abuse or misinformation, maybe threatens violence, then anonymity may need to go out the window—the sender needs to be held to account.

And that’s the challenge: is there a way to allow people to send confidential, secure, untraceable messages, but still track any menacing ones?

Mayank Varia might have cracked the conundrum. A cryptographer and computer scientist, Varia is an expert on the societal impact of algorithms and programs, developing systems that balance privacy and security with transparency and social justice. Working with a team of Boston University computer scientists, he’s designed a program called Hecate—fittingly named after the ancient Greek goddess of magic and spells—that can be bolted onto a secure messaging app to beef up its confidentiality, while also allowing moderators to crack down on abuse. The team is presenting its findings at the 31st USENIX Security Symposium.

“Our goal in cryptography is to build tools and systems that allow people to get things done safely in the digital world,” says Varia, Co-Director, of the Center for Reliable Information Systems & Cyber Security (RISCS) at Hariri Institute, and Faculty of Computing & Data Sciences. “The question at play in our paper is what is the most effective way to build a mechanism for reporting abuse—the fastest, most efficient way to provide the strongest security guarantees and provide the weakest possible puncturing of that?”

It’s an approach he’s also applying beyond messaging apps, building online tools that allow local governments to track gender wage gaps—without accessing private salary data—and enable sexual assault victims to more safely report their attackers.

Read the full story by Andrew Thurston on The Brink.