Buried in an update to X’s privacy policy is a sentence that has upset the people who read such things: the company may manually review direct messages — that is, have a human read them — to look for violations of its rules and to respond to requests from governments. Kim Dotcom, the Megaupload founder and a loud presence on the platform, posted a screenshot and asked Elon Musk directly: what happened to encrypted DMs? Musk did not answer the question. Encryption, he replied, “currently works in a complicated way”; X was working to simplify it and to extend it to group messages, and audio and video calls were already encrypted.
What X’s encryption actually covers
Very little. X launched encrypted DMs in May 2023 with conditions that most users never met: both parties must be Premium subscribers (or verified organisations), the conversation must be one-to-one, both must have the feature enabled, and media attachments are not covered. Metadata — who messaged whom, and when — is not protected, and X’s own documentation warns that the company does not yet defend against a man-in-the-middle attack. Everything else, which is nearly every DM on the platform, is stored in plain form on X’s servers and can be read by anyone with access to them. The new policy simply states that X intends to.
Why users are worried
The concern is the second half of the clause. Enforcing rules against spam and abuse is what every platform does with unencrypted messages. Reviewing them on the request of a government is different, and X under Musk has complied with more such requests than Twitter did — in India, in Turkey, and in the run-up to elections elsewhere. One user put it plainly under Dotcom’s post: why is X cooperating with governments to inspect our private messages?
What it means here
X is small in Bangladesh next to Facebook, but it is where journalists, activists and diaspora politics live, and 2024 has been a year in which governments in the region have leaned hard on platforms for user data. The rule to apply is simple and does not depend on X: a DM on X is a message the company can read, and may hand over. For anything sensitive, use an app where end-to-end encryption is the default and not a Premium feature — Signal first, WhatsApp second — and remember that neither protects a message from the person you sent it to.
Source: News18, via Prothom Alo.
