Wickr was bought by Amazon’s cloud-computing division and had contracts with several government agencies. Customs and Border Protection (CBP), which has been criticized by human rights activists and immigration lawyers over what they say is its secretive practices, has expended more than $1.6 million on Wickr, according to public procurement documents.
But little is comprehended about how the agency has deployed the app, which is popular among security-minded people ranging from journalists to criminals.
Moreover, its auto-deletion feature has made the platform a cause of concern among government record keepers and external watchdogs, who worry that Wickr and other similar apps are developing ways for customs officials to sidestep government transparency conditions.
“CBP, like ICE and other instruments DHS oversees, has a plunging track record when it comes to conceding with record-keeping laws,” said Nikhel Sus, senior attorney for Citizens for Responsibility and Ethics in Washington (CREW), a nonprofit watchdog status, in a statement.
“This has had real results for accountability by impeding investigations and oversight of the agency’s actions. In addition, the agency’s use of Wickr, a messaging app with ‘auto-delete’ features, definitely raises red flags.”
CREW filed a lawsuit against CBP the previous month after forgetting to respond to a Freedom of Information Act request the nonprofit filed pursuing records about its implementation of Wickr. CREW asks CBP to ”fully and promptly process CREW’s FOIA request and produce all non-exempt documents immediately.”
Wickr also has another creation called Wickr RAM, which is intended for the military — the company broadcasts it as being accredited by the U.S. Department of Defense. However, it’s not clear how its features and capability vary from the Enterprise version of the app utilized by CBP.
Advertising materials for both of Wickr’s professional derivatives say they can be used in ways that allow for record-keeping compliance. But both also enable users to delete their messages, according to Wickr’s website.
“To reduce the risk of deleted Wickr data being recovered, the Secure Shredder runs whenever your Wickr app runs,” the training read. “The objective is to ‘sanitize’ or overwrite deleted Wickr data on best-effort grounds.”
Amazon did not reply to two requests about Wickr’s various products and government contracts.
The use of apps that destroy messages has been a growing issue at many levels of government.
Other public officials, including Maryland Gov. Larry Hogan, have been criticized for using Wickr’s self-destructing feature (Hogan defended its use as “common practice” and said it was the same as making a phone call).
CREW also unsuccessfully sued the White House in 2017, claiming it was violating the Presidential Records Act after The Washington Post reported. Staff members had been using another app called Confide, which similarly lets users automatically delete messages.
“Numerous CBP officials, across diverse offices, regularly used WhatsApp to communicate with individuals and in various WhatsApp groups, some of which held up to hundreds of U.S. and Mexican officials,” the report said. “Yet, these officials did not consistently retain theirs. WhatsApp messages or copy or dispatch them to their official CBP accounts.”
The Inspector-General recommended that CBP either end its use of WhatsApp or ensure it complied with record-keeping laws. CBP responded by saying that it was “currently piloting a managed messaging platform to replace WhatsApp.”