WhatsApp's Former Security Boss Alleges Meta Appraisal System Targeted Criticism

A former security head at WhatsApp has initiated legal action against its parent company, Meta, for alleged privacy violations and retaliation against him for reporting flaws. The lawsuit alleges that Meta failed to address significant security vulnerabilities within the messaging service, potentially exposing billions of users to risk. 

The ex-security chief at WhatsApp, Attaullah Baig, alleges that Meta failed to comply with cybersecurity rules and retaliated against him after he raised concerns about these issues, according to a Guardian report.

Baig, who led WhatsApp’s security division between 2021 and 2025, has alleged that around 1,500 engineers were able to view user information without adequate checks in place. He suggests this lack of control may have breached a 2020 US ruling that had already fined the company $5 billion for privacy violations.

In his lawsuit, Attaullah has also alleged that Meta manipulated its employee review process, the Performance Summary Cycle (PSC), and used it as a tool to penalise him. As reported by Business Insider, commenting on the retaliation, he said, “It was almost immediate.”

According to the lawsuit, Baig raised concerns with Meta’s senior leadership, including CEO Mark Zuckerberg, warning that flaws in the system were putting users at risk. 

He claims that instead of addressing the issues, his superiors pushed back against him and eventually dismissed him under the company’s performance-related job cuts. He argues that his inclusion in those layoffs was a direct consequence of speaking up.

The federal complaint filed at the Northern District of California argues that WhatsApp’s incentive system encouraged engineers to focus on producing vast amounts of code to demonstrate constant activity, rather than addressing serious underlying issues. Since performance ratings were tied to output that could be easily measured, the claim suggests, staff were effectively dissuaded from working on long-standing security vulnerabilities that were less apparent in evaluation metrics.

Baig’s lawsuit suggests that Meta’s performance review system fosters a workplace culture where staff prioritise safeguarding their own appraisals over issues concerning users. He claims that instead of addressing risks properly, employees are driven to produce surface-level quick fixes and low-value tasks that look good in evaluations but fail to resolve bigger problems.

“Meta's culture is to attack the messenger, not the message. The reason this whole thing is big is because of user harm,” Baig was quoted as saying by the Business Insider.

In response to the lawsuit, WhatsApp spokesperson Zade Alsawah called the claims ‘false’, the Business Insider report mentioned.

"These are a mixture of distorted and false claims that misrepresent the hard work of our team. We pride ourselves in building on our strong record of protecting people's privacy,” Alsawah said.