Netanyahu adviser Urich linked his WhatsApp to a UAE-based service with access to his messages
Jonatan Urich connected his personal account to a third-party management platform that could access correspondence and media, including potentially sensitive government communications.
Jonatan Urich, an advisor to Prime Minister Benjamin Netanyahu, connected his WhatsApp account to a management service provided by a UAE-based company, granting the service full, unencrypted access to the correspondence and media passing through the account. The communications could potentially also be accessible to UAE authorities under local laws that provide government agencies with broad powers to obtain data in certain circumstances without a court order.
Last week, Haaretz revealed a media monitoring tool that Urich had built for the Prime Minister and his wife. The tool monitored media mentions of the couple in real time and sent alerts to designated WhatsApp groups when necessary. Urich developed the tool using Anthropic’s Claude AI model, and the project came to light after he published its code on GitHub.
The code exposed confidential information and technical details, as well as unique identifiers and access tokens for the WhatsApp groups receiving the alerts. Such information could potentially be used to identify group members and their phone numbers, extract group content, or send messages from within the groups.
Following an inquiry from Haaretz to Urich, access to his GitHub account was restricted. However, the code had already been exposed and circulated by users who had discovered it before the report was published.
An examination of the code points to a significant security and data confidentiality risk. Professional WhatsApp accounts used to manage numerous groups or distribute messages automatically often rely on third-party management tools. These services connect to a WhatsApp account much like a browser-based session, giving them access to messages and media within the account and the ability to send messages to the account’s groups and contacts.
Such access makes the choice of service provider particularly important, especially when the account belongs to someone who is in regular contact with the Prime Minister.
Urich’s code indicates that he used a service called Ultramsg. In terms of functionality, Ultramsg is a standard type of service in this field. After an account is created, it connects to a user’s WhatsApp account by scanning a QR code provided by the app to link an additional device. This allows Ultramsg to read and send messages and provides additional capabilities such as reminders, automated messaging, bot creation and deployment, and integration with customer service or sales management systems.
An independent cybersecurity researcher who examined the matter told Calcalist that Urich connected his personal WhatsApp account to Ultramsg rather than a dedicated account created for this purpose. This meant that correspondence on his personal account could have been accessible to Ultramsg in unencrypted form, potentially including conversations with officials in the Prime Minister’s Office and other government figures involving sensitive or classified information.
The situation becomes more complicated when examining Ultramsg’s terms of use and service information. The company’s website includes a broad authorization allowing it to transfer collected data to third parties with whom it works. It also states that data collected by the service is stored on Amazon servers for 120 days, even if the WhatsApp account itself is configured to automatically delete messages.
Another concern is the company’s stated location. The Ultramsg website identifies the service as operating from the United Arab Emirates, while the company’s LinkedIn profile lists its location as Dubai. Other databases identify the company’s founder as Ahmed Kumar. Kumar appears to have little publicly available information associated with him, and no press interviews or professional conference appearances were identified in the material reviewed for this report. Ultramsg’s website does not provide details about its founders or employees. The limited public information does not, by itself, establish that the identity is fictitious.
The UAE’s data-protection and security framework also differs from the privacy regimes in many Western countries. UAE laws provide for disclosure of personal data in certain circumstances, including matters involving public interest, legal proceedings and security. The scope of government access depends on the applicable law and circumstances.
In practical terms, Urich linked a WhatsApp account used for sensitive communications to a third-party service operating from the UAE. The service had access to the account’s messages and media, its terms state that collected data can be shared with third parties and that data may be retained for 120 days, and the company operates in a jurisdiction where government authorities have powers to obtain data under certain circumstances.
No response was received from Urich by the time of publication.
