Elon Musk escalates messaging app security debate

Musk’s comments came amid legal and corporate conflict surrounding Meta’s WhatsApp, which faces a class-action lawsuit filed in a federal court in San Francisco alleging that its end-to-end encryption protections are misleading because the company can access or retrieve private messages through internal tools. Musk’s post amplified these allegations, positioning his own platform’s messaging service, XChat, as a preferable alternative for users concerned about privacy and data control.

WhatsApp’s leadership swiftly rejected the characterisation of its platform as insecure. Will Cathcart, the head of WhatsApp, labelled claims that the company can read private messages as “totally false,” emphasising that encryption keys remain stored only on user devices and that neither WhatsApp nor Meta has access to message contents under its end-to-end encryption protocol. Meta has labelled the lawsuit “no-merit” and indicated it may pursue sanctions against the plaintiffs’ counsel, arguing the case is headline-seeking rather than evidence-based.

The lawsuit itself has brought broader industry attention to the mechanics of encryption. WhatsApp has long used the Signal Protocol, a cryptographic system developed by the Signal Foundation, to provide end-to-end encryption for user chats so that only the sender and recipient can decipher content. The protocol’s open-source nature has been independently analysed by cryptographers and forms a backbone for encrypted messaging across multiple platforms.

Telegram’s chief executive, Pavel Durov, has entered the fray with even sharper language, asserting that believing WhatsApp is secure would be “braindead,” referencing his own company’s critique of what he describes as vulnerabilities in WhatsApp’s encryption implementation. Though Telegram offers optional end-to-end encryption for its “secret chats,” it does not enable it by default for all conversations, making the comparative security landscape nuanced rather than straightforward.

Security experts stress that the technical details matter deeply in such debates. End-to-end encryption, when implemented correctly, ensures that only communicating parties can read messages; however, metadata — such as who communicated with whom and when — may still be accessible to service providers or third parties under certain circumstances. The distinction between technical encryption guarantees and platform design choices fuels much of the current discourse among technologists, lawyers, and privacy advocates. Analysts note that while WhatsApp’s model has been audited and widely adopted, any trust in a platform ultimately rests on transparent design and verifiable safeguards rather than marketing claims alone.

Musk’s push of XChat as an alternative reflects his broader ambition to expand the X platform into an “everything app” that integrates social networking, private messaging, payments, and other services under one umbrella. Early reviews of XChat — which is integrated into the X app rather than offered as a separate download — describe a feature set that blends messaging with social features, though questions about its encryption model and privacy guarantees persist among technical observers.

Critics of Musk’s position argue that sweeping dismissals of established encryption technologies can mislead non-technical users. Signal’s encryption protocol, which underpins WhatsApp’s secure messaging, has undergone formal analysis in academic and industry settings and remains a benchmark for privacy-centred communication tools. Even so, no encryption system is immune to flaws in implementation or evolving threat landscapes, and ongoing scrutiny and iterative improvement are hallmarks of robust security practice.

The public debate has underscored growing user concerns about digital privacy, corporate data practices, and the limits of platform trustworthiness. Messaging apps that handle billions of users’ communications sit at the intersection of everyday social use and sensitive personal data transmission, making their security claims subject to legal, technical, and commercial pressures. Both platform operators and independent experts advocate for clearer communication to users about what encryption protects and where vulnerabilities might arise, especially as legal challenges push these issues into the spotlight.