Bollywood drugs probe raises questions on digital privacy. Here are the answers

The use of leaked WhatsApp chats by investigating agencies in the Bollywood drugs case has raised concerns about the privacy of personal messages.

Representative image

The investigation conducted by the Narcotics Control Bureau (NCB) in Bollywood’s alleged drug links has relied heavily on WhatsApp chats between individuals. As leaked WhatsApp chats retrieved by investigating agencies make headlines, concerns about the privacy of personal messages have also risen. Is WhatsApp’s promised end-to-end encryption safe enough? We try and answer the questions this investigation has underlined.

Does WhatsApp store chats content on its servers?

It’s important to remember that people sign up on WhatsApp using only a phone number, and WhatsApp doesn’t have access to your message content, a WhatsApp spokesperson told India Today. The messages are sent as locked packets of data from one user to another which can be unlocked only by a key called “end-to-end encryption”, available only with the sender and receiver of the message.

Court documents filed in the United States have shown that the instant messaging service keeps metadata of the user data which includes data associated with phone numbers during a conversation, time and duration of the conversation, IP addresses and data used to identify the user’s phone details.

In the US, law enforcement agencies have obtained such data from WhatsApp through court proceedings and WhatsApp parent company admittedly accepts and rejects data requests from law enforcement. A WhatsApp spokesperson did not comment when asked about what kind of data it provides to law enforcement agencies in India.

How did NCB get WhatsApp chats?

The easiest way for law enforcement agencies to obtain such data is to seize a user’s phone and extract the data directly from their phone. Even before the NCB started its investigation into the case, another central agency Enforcement Directorate (ED) was scrutinising the allegations of money laundering in actor Sushant Singh Rajput’s death case. It was ED that first seized and cloned the cell phones of Rhea Chakraborty and later same data was used by NCB in its investigation.

Does a message get instantly deleted once a user deletes a WhatsApp message?

No, when a user deletes the WhatsApp message, it makes the message content disappear from the front interface of the app but the forensic traces of the chat remain in the phone memory for some time. Moreover, most phones are set on an automated backup of WhatsApp data, which enables users to retain their conversations even when they switch phones. While this is a useful function it also opens another window of “harvesting user’s chat data” on another platform, which can later be retrieved in some cases. These two features are often used to retrieve deleted WhatsApp data from a device.

Can law enforcement retrieve deleted WhatsApp messages easily?

“Yes, it is possible in some cases,” says cybersecurity expert Jiten Jain. “Deleted messages could be retrieved easily in some cases from device or cloud backups in case they have not been updated,” explains Jain. Additionally, security experts around the world have time and again exposed flaws in the WhatsApp system which could be exploited to retrieve deleted messages from a device.

Are there other ways to retrieve WhatsApp data?

Even if the data from the user’s phone is completely erased, there is still a chance that the second user part of the conversation has kept the message on their device. That message can be accessed by accessing the device. When it comes to group messages, the number of devices increases with each group member and any group member can be used to access the entire chat history of the group.

In the Rhea Chakraborty case, the first suspicious message on drug usage was not retrieved from a personal message, but from a group message. Similarly, a recently filed chargesheet by the Delhi Police in the Delhi riots case also relies heavily on WhatsApp group chats.

What are the covert ways to decrypt communication?

Besides accessing the user’s device directly, 10 government agencies are empowered by law to ask the operators and service providers to provide available information; NCB is one of them. According to a notification issued by the Union government, under Rule 22 of the IT (procedure and safeguards for the interception, monitoring and decryption of information) Rules 2009, in the cases involving interception or monitoring or decryption, permission has to be granted by a committee headed by the Union Cabinet Secretary.

In states, these requests are reviewed and granted by a state-level committee under the state chief secretary. There is no clarity on if or how the government agencies decrypt an encrypted communication but court documents in the US in the NSO case and an investigation by Canada-based Citizen Lab suggested that governments across the world have possibly used sophisticated technology to exploit WhatsApp’s vulnerability and intercept the communications of users of their interest.

Private threat actors have also independently used lesser sophisticated technology to install a program in the user’s device to illegally access user’s WhatsApp chats.

Are WhatsApp chats admissible as evidence before a court of law?

Yes, but legal experts believe that there are big riders attached to it. Vikrant Singh Negi, a partner at DSK Legal who specialises in white-collar criminal law and data security cases, says like any regular document it will have to pass the scrutiny of evidence act which needs to be established by the prosecution in the context of the case.

“For example, in Deepika’s case, the NCB will have to prove that the messages were sent by her and not someone else using her phone,” Negi told India Today.

Delhi-based cyber law expert Dr Karnika Seth said there is a precedent of WhatsApp chats being used as evidence. “In Ambalal Sarabai Enterprises v KS Infraspace LLP case, the Supreme Court held that WhatsApp messages, which are considered virtual communication, are capable of being considered as evidence. But the meaning and content of the virtual communication must be proved through evidence-in-chief and cross-examination during the trial. Most experts said WhatsApp chats alone may not be enough for a conviction.

What is cloning of phone? How does it work?

Forensic cloning of a mobile phone or hard disks of other devices like laptops, computers, drones, etc, is a different process than a simple copy-paste of the hard drive content. “It’s a standard procedure in all technological investigations and evidence gathering, this is primarily done to take make copies of data in seized devices and analyse them to avoid tampering of data in original devices,” Jain explains.

According to Jiten, during the cloning process “data other than what is stored in mobile phones or computers, backups from cloud storage are also collected when investigators have physical access and credentials of devices of suspects.”

Is it possible to keep WhatsApp messages safe at all?

This is a question that remains open as technology keeps opening new doors for possible back door entries. A user who doesn’t automatically back up their WhatsApp data to a cloud or one formatting their content more frequently has less chance of their data being accessed by a third party than a usual person. But there can never be a guarantee.

Responding to India Today, WhatsApp has distanced itself from the liability of user data stored in a device. “WhatsApp follows guidance provided by operating system manufacturers for on-device storage and we encourage people to take advantage of all the security features provided by operating systems such as strong passwords or biometric IDs to prevent third parties from accessing content stored on the device,” said the WhatsApp spokesperson.

Experts keep discovering possible loopholes in updated versions of electronic messaging platforms which once brought to light is fixed by the technology platforms. At the same time, the unknown back doors are consistently exploited by technology firms assisting governments or private threat actors.

Click here for’s complete coverage of the coronavirus pandemic.