Netanyahu Advisor's WhatsApp Linked to UAE Service, Exposing Sensitive Data

Yonatan Urich, an advisor to Israeli Prime Minister Benjamin Netanyahu, connected his personal WhatsApp account to a management service operated by a company based in the United Arab Emirates. This connection granted the service full, unencrypted access to all correspondence and media within his account. Due to UAE laws, this data could potentially be accessed by Emirati authorities without a court order.

This security lapse was revealed following a previous report by "Haaretz" about a media monitoring tool Urich developed for the Prime Minister and his wife. The tool, built using Anthropic's Claude AI model, tracked mentions of the couple in real-time and sent alerts to dedicated WhatsApp groups. Urich initially published the tool's code on GitHub, inadvertently exposing sensitive technical details, unique identifiers, and login tokens for the alert groups. This exposure could have revealed group members' identities and phone numbers, and allowed for content extraction or message sending.

After "Haaretz" contacted Urich, access to his GitHub repository was restricted, but the code had already been distributed. An examination of the code identified the service Urich used as "ultramsg." This type of third-party service is commonly used for managing numerous groups or automating message distribution. It connects to a WhatsApp account similarly to how a web browser connects, gaining complete access to messages and media, and enabling message sending capabilities.

An independent cyber researcher told "Calcalist" that Urich connected his personal WhatsApp, not a dedicated work account, to ultramsg. This means all his communications, likely including sensitive information exchanged with the Prime Minister's office and other government officials, were exposed and unencrypted. The terms of service for ultramsg indicate that user data can be shared with other entities and is stored on Amazon servers for 120 days, even if the WhatsApp account is set to auto-delete messages.

The primary concern stems from ultramsg's operational base in Dubai, UAE. While Western countries have strict privacy laws, UAE legislation is more lenient, allowing government access to data for public interest, requiring companies to share information for security or legal proceedings, and permitting security authorities real-time access to data like account identities and message content without a warrant. Urich did not respond to requests for comment by the time of publication.