Netanyahu Adviser Linked WhatsApp to UAE Service in Major Security Risk
Prime Minister Benjamin Netanyahu's adviser Yonatan Urich linked his WhatsApp account to a UAE-based management service, exposing sensitive government correspondence to potential foreign oversight.
Yonatan Urich, an adviser to Prime Minister Benjamin Netanyahu, linked his personal WhatsApp account to a management service operated by a company based in the United Arab Emirates, granting the service full and unencrypted access to all correspondence and media. This data could potentially be accessed by UAE authorities due to local laws that provide broad access to such content without requiring a court order. Last week, the newspaper Haaretz revealed a media tracking tool built by Urich for the prime minister and his wife, which monitored real-time mentions and sent alerts to dedicated WhatsApp groups. Urich developed the tool using Anthropic's Claude AI model and exposed it after publishing the code on GitHub. The code revealed confidential information, technical details, unique identifiers, and access tokens for WhatsApp groups, which could allow unauthorized users to extract group content and send messages. Although access to the GitHub repository was restricted following inquiries from Haaretz, the code had already been downloaded and distributed by users.
According to an independent cybersecurity researcher who spoke to Calcalist, Urich connected his personal WhatsApp account rather than a dedicated secondary account to the UAE-based service, known as ultramsg. This meant that all of Urich's correspondence—likely including sensitive and classified discussions with officials in the Prime Minister's Office—was exposed in unencrypted form to the third-party platform. Ultramsg connects to WhatsApp via a QR code scan to link an additional device, providing complete read and write capabilities alongside automation tools such as chatbots and customer service integrations. However, a review of ultramsg's terms of service reveals that collected data is stored on Amazon servers for 120 days, even if auto-deletion is enabled on the WhatsApp account, and users grant sweeping authorization to share data with third parties.
The most significant concern stems from the service's jurisdiction. Ultramsg identifies its operations as based in the United Arab Emirates, with its LinkedIn profile placing the company in Dubai and identifying its founder as Ahmed Kumar, though he maintains virtually no online presence. While Western democracies enforce strict privacy laws limiting government access to data held by private entities, UAE legislation is considerably less restrictive. Local laws permit authorities to access user data, communication content, and account identities without a court order for public interest, security, or legal proceedings. Urich's decision to link a sensitive communication channel to a foreign-managed service operating under such legal frameworks represents a major information security risk.
