LONDON – Westminster Bridge attacker Khalid Masood sent a WhatsApp message that cannot be accessed because it was encrypted by the popular messaging service, a top British security official said Sunday.
British press reports suggest Masood used the messaging service owned by Facebook just minutes before the Wednesday rampage that left three pedestrians and one police officer dead and dozens more wounded.
As controversy swirled over the encrypted messages, police made another arrest in Birmingham, England, where Masood had lived. The 30-year-old is one of two men now in custody over possible links to the attack. Neither has been charged or publicly named.
Masood was shot dead on the grounds of Parliament.
Home Secretary Amber Rudd used appearances on BBC and Sky News to urge WhatsApp and other encrypted services to make their platforms accessible to intelligence services and police trying to carrying out lawful eavesdropping.
“We need to make sure that organizations like WhatsApp — and there are plenty of others like that — don’t provide a secret place for terrorists to communicate with each other,” she said.
Rudd did not provide any details about Masood’s use of WhatsApp, saying only “this terrorist sent a WhatsApp message and it can’t be accessed.”
But her call for a “back door” system to allow authorities to retrieve information is likely to meet resistance from the tech industry, which has faced previous law enforcement demands for access to data after major attacks.
In the United States, Apple fought the FBI’s request for the passcodes needed to unlock an iPhone that had been used by one of the perpetrators in the 2015 extremist attack in San Bernardino, California.
The FBI initially claimed it could obtain the data only with Apple’s help, but ultimately found another way to hack into the locked phone.
Masood drove a rented SUV into pedestrians on Westminster Bridge before smashing it into Parliament’s gates and rushing onto the grounds, where he fatally stabbed a policeman and was shot by other officers. A detailed police reconstruction has found the entire attack lasted 82 seconds.
Police are trying to pinpoint his motive and identify any possible accomplices, making the WhatsApp message a potential clue to his state of mind and his social media contacts.
Rudd said attacks like Masood’s would be easier to prevent if authorities could penetrate encrypted services after obtaining warrants similar to the ones used to listen in on telephone calls or — in snail mail days — to steam open letters and read their contents.
Without a change in the system, she said terrorists would be able to communicate with each other without fear of being overheard even in cases where a legal warrant has been obtained.
Rudd also urged technology companies to do a better job at preventing the publication of material that promotes extremism. She plans to meet with firms Thursday about setting up an industry board that would take steps to make the web less useful to extremists.
British police investigating the attack say they still believe Masood, a 52-year-old Briton, acted alone and say they have no indications that further attacks are planned.
Metropolitan Police Deputy Assistant Commissioner Neil Basu said it may never be possible to fully determine Masood’s motives.
“That understanding may have died with him,” Basu said Saturday night as police appealed for people who knew Masood or saw him to contact investigators. “Even if he acted alone in the preparation, we need to establish with absolute clarity why he did these unspeakable acts, to bring reassurance to Londoners.”
The Islamic State group, which is losing territory in Iraq and Syria but still has radical followers in other parts of the world, has claimed Masood was a “soldier” carrying out its wishes to attack Western countries.
Masood had convictions for violent crimes in the U.K. and spent time in prison. He also worked in Saudi Arabia teaching English for two years and traveled there again in 2015 on a visa designed for religious pilgrimages.
Along with the man arrested Sunday, a 58-year-old man detained in Birmingham several days ago remains in custody in the case. Nine others arrested after the attack have been freed without charges, while one person was released on bail.
The family of slain police officer Keith Palmer, meanwhile, released a statement thanking those who tried to save his life.
“There was nothing more you could have done. You did your best and we are just grateful he was not alone,” the statement said.
The Sunday arrest came four days after the lightening assault that unfolded in the shadow of the Houses of Parliament.
The latest arrest, a 30-year-old man who was detained in Birmingham, is being held on suspicion of preparing terrorist acts, London’s Metropolitan Police said.
A dozen people have been arrested since Wednesday’s attack by 52-year-old Masood who deliberately ran down pedestrians on Westminster Bridge then stabbed a policeman just inside the gates of Parliament.
Nine people have been released without charge, while the 58-year-old man remains in custody and a 32-year-old woman has been released on bail.
Media reports said Masood used the Facebook-owned WhatsApp service just minutes before staging his assault, although it was unclear whether he sent any messages or just looked at the app.
Speaking to Sky News, Home Secretary Amber Rudd said it was “completely unacceptable” that police and security services had not been able to crack the heavily-encrypted service.
“You can’t have a situation where you have terrorists talking to each other — where this terrorist sent a WhatsApp message — and it can’t be accessed,” she said.
Police had on Saturday acknowledged they may never know why Masood, a Muslim convert with a violent criminal past, carried out the attack and that he probably acted alone, despite a claim of responsibility by the Islamic State group.
“We must all accept that there is a possibility we will never understand why he did this. That understanding may have died with him,” said senior counter-terrorism officer Neil Basu.
Although police believe he acted alone on the day, investigators are still trying to find out whether he was encouraged or directed by others.
WhatsApp said it was “horrified” by the attack and was working with the investigating authorities without saying whether it would change its encryption policy.
“We are horrified at the attack carried out in London earlier this week and are cooperating with law enforcement as they continue their investigations,” a spokeswoman told AFP.
Rudd acknowledged that end-to-end encryption was vital to cyber security, to ensure that business, banking and other transactions were safe — but said it must also be accessible.
“It’s not incompatible. You can have a system whereby they can build it so that we can have access to it when it is absolutely necessary,” she told Sky News.
Rudd said she did not yet intend to force the industry’s hand with new legislation, but would meet key players on Thursday to discuss this issue, as well as the “constant battle” against extremist videos posted online.
Tech firms and social media players are coming under increasing pressure over extremists using their websites, applications and technology to communicate extremist content.
Last year, U.S. authorities fought a legal battle with tech giant Apple to get it to unlock a smartphone used by one of the shooters in a 2015 attack in San Bernardino, California.
The FBI’s own experts ended up breaking into the device.
And Google has faced a boycott by companies whose adverts appear alongside extremist content on its internet platforms, particularly its video-sharing site YouTube.