WhatsApp for sensitive work information

[worriedworker121]

Hi, I have an odd question. Recently started a new job where all work information is communicated via a WhatsApp chat. I have concerns about how secure this is as lots of private information is shared this way. We work with vulnerable people. Is this a reliable platform or is this as problematic as I fear?
i am used to internal emails or teams for such communication so this feels unusual to me but am happy to be told it’s safe and secure.

Anyone?

I'd ask to see your company's policy. WhatsApp is encrypted but it means the company does not have access to an audit trail - as you say, email/Teams would be more usual.

Thank you, that’s useful. I was concerned data could be leaked this way. Coming from the nhs where similar data was treated very securely, I was surprised they used WhatsApp. I have concerns with a lot of the management style so this may be clouding my judgement, I also don’t understand much about tech so possibly listened to too much hysteria.

It definitely doesn't feel right, does it? I think your concerns about the management are probably reasonable. But if they have an actual policy that covers WhatsApp at least then it's on then if anything goes wrong. I'd be worried about this data being on personal devices (assuming this is the case), being backed up to personal cloud storage, the risk of a device being stolen or messages accidentally forward to a non-work contact.

At my company, we have a strict electronic comms policy and periodical mandatory training. At the most, on WhatsApp, we can say things like ‘I’m running late’ but couldn’t say ‘I’m running late for meeting with X client’. Everything has to be done by company approved comms like teams and outlook which most people have on their phones. However, it’s a financial institution so different industry.

WhatsApp is end-to-end encrypted, which means that no-one other than the sender and recipient of a message can read it. Even the security services and law enforcement cannot read your messages. As a means of communication, it is completely secure. As another poster points out, even your employer can't see your messages (unless they are sent to a group including your employer). Other means of communication such as email are less secure but can allow your employer easy access to messages, thereby creating an audit trail.

I work for local authority and we work with vulnerable people. What's app (on phones) is approved for communication with clients themselves and used for simple communication between colleagues (ie running late etc). Our majority of information though is shared is via email or teams.

No technically true. End to end encrypted could mean that it is encrypted from receiver to sender but I believe in WhatsApp’s case it is encrypted from sender to their servers and then reencrypted from their servers to receiver. Data can still be leaked by means of WhatsApp hijack or compromising the target device.

I've got a disabled child and the local disabled children's team at social services carry out entire video assessments of families via WhatsApp... I was a bit at first but they explained to me that it's considered secure due to being encrypted, they only use it on work phones, and it's a platform that pretty much every family have access too.

Just want to pick up email being less secure. Most email is now sent using TLS unless you opt for PGP (what WhatsApp uses) but PGP is rarely used nowadays outside of geeky security circles for email.

Yes it is technically true. WhatsApp is encrypted from end-to-end. See About end-to-end encryption | WhatsApp Help Center. Even WhatsApp cannot read your messages.

Would the issue be as much about the device than the method of communicating? Like can your phone be remotely disabled if you lose it? That kind of thing?

The issues are lack of oversight, audit trail and privilege management. People seeing information they shouldn't be party to in a group chat, and the company having no visibility or control. Someone could leave and still have access to personal info. Someone could delete records. There's so many reasons it's not acceptable.

If you are a professional who needs to be registered with HCPC (so occupational therapy, psychologists etc.) then they have strict social media policies. They are really clear about what is and isn’t ok. The thing that people so often forget in these circumstances is that WhatsApp is social media. This is clear in HCPC and how they’ve got to look at various MPs WhatsApp messages. So if it shouldn’t be on social media then that includes WhatsApp