Buried in an update to X’s privacy policy is a sentence that has upset the people who read such things: the company may manually review direct messages — that is, have a human read them — to look for violations of its rules and to respond to requests from governments. Kim Dotcom, the Megaupload founder and a loud presence on the platform, posted a screenshot and asked Elon Musk directly: what happened to encrypted DMs? Musk did not answer the question. Encryption, he replied, “currently works in a complicated way”; X was working to simplify it and to extend it to group messages, and audio and video calls were already encrypted.
What X’s encryption actually covers
Very little. X launched encrypted DMs in May 2023 with conditions that most users never met: both parties must be Premium subscribers (or verified organisations), the conversation must be one-to-one, both must have the feature enabled, and media attachments are not covered. Metadata — who messaged whom, and when — is not protected, and X’s own documentation warns that the company does not yet defend against a man-in-the-middle attack. Everything else, which is nearly every DM on the platform, is stored in plain form on X’s servers and can be read by anyone with access to them. The new policy simply states that X intends to.
Why users are worried
The concern is the second half of the clause. Enforcing rules against spam and abuse is what every platform does with unencrypted messages. Reviewing them on the request of a government is different, and X under Musk has complied with more such requests than Twitter did — in India, in Turkey, and in the run-up to elections elsewhere. One user put it plainly under Dotcom’s post: why is X cooperating with governments to inspect our private messages?
What it means here
X has a fraction of Facebook’s users here, but it is the platform journalists, activists and diaspora politics run on, and 2024 has been a year in which governments in the region have leaned hard on platforms for user data. The rule to apply is simple and does not depend on X: a DM on X is a message the company can read, and may hand over. For anything sensitive, use an app where end-to-end encryption is the default and not a Premium feature — Signal first, WhatsApp second — and remember that neither protects a message from the person you sent it to.
Metadata survives every encryption scheme
Even where a message is genuinely end-to-end encrypted, the thing that worries people in practice usually is not the text. It is the record of the exchange, which no encryption scheme hides from the platform: who messaged whom, when, how often, from which IP address and which device, and how long the conversation ran.
That record answers most of the questions a government request is actually asking. Whether two named people were in contact in a given week, who is in a group, which account is operated from which location — none of this requires reading a word. Signal’s design is unusual precisely because it was built to hold almost none of it; most services, X included, hold all of it.
And X DMs were never encrypted for most people
Worth stating plainly, because the announcement implied a protection was being withdrawn. Encrypted DMs on X were limited to verified or subscribed accounts on both sides of the conversation, did not cover group messages, did not cover attachments, and were not on by default. For the large majority of users there was never anything to withdraw.
The practical rule follows from that: anything you would not want read should not be in a DM on any social platform, encrypted or not. Signal first, WhatsApp second, and nothing protects a message from the person you sent it to.
Source: News18, via Prothom Alo.
