On Thursday the Guardian published three stories detailing how Whisper, the social media app that claims to be “the safest place on the internet”, is tracking the location of its users, including some who have specifically asked not to be followed.
Whisper executives over the last 24 hours have denounced those reports as “lousy”, “a pack of vicious lies” and “beyond silly”. They’ve said the stories contain aspects that are “100% FALSE”, “made-up quotes” and “so inaccurate as to be laughable”.
“The Guardian made a mistake posting that story and they will regret it,” tweeted Neetzan Zimmerman, Whisper’s editor-in-chief. “The Guardian is lying. Full stop.”
Here are the facts:
How does Whisper track the location of its users?
The Guardian reported that Whisper has built an in-house mapping tool to pinpoint the location of the 80% of users who opt into its geolocation services, using GPS data accurate to within a 500-metre radius. We also reported that Whisper establishes the broad whereabouts of some users who have disabled their geolocation services, by extracting approximate location information from IP data.
Both of those statements are undeniably true. So what does Whisper claim is false?
To start with, Whisper is denying some things which haven’t been alleged. Zimmerman tweets that no “exact location data” is ever stored by Whisper and “the Guardian’s suggestion to the contrary is FALSE”. The Guardian never suggested that Whisper collated the exact location data of its users.
But Zimmerman goes further. He states that data identifying the location of users who have disabled their services “is NEVER collected nor stored, period”, even adding that it is a “a technical impossibility” for Whisper to ascertain the location of these users.
The privacy section of Whisper’s terms of service puts it differently. The wording in the terms is rather important. They are the contract Whisper agrees with its users – the rules of the game.
Whisper rewrote these rules a few days ago, after learning the Guardian planned to publish its stories (more on that below).
These terms don’t say (or even insinuate) that IP location data is “never stored”. Nor do they suggest that it is “technically impossible” for Whisper to work out someone’s broad location after they’ve disabled their geolocation service.
They actually state the opposite. They caution users to “please bear in mind that, even if you have disabled location services, we may still determine your city, state, and country location based on your IP address”.
So when (and why) did Whisper change its terms of service?
Whisper hasn’t answered that question directly. The Guardian contacted Whisper detailing the allegations it intended to publish on 9 October. Four days later, Whisper quietly posted a significantly changed terms of service – rewriting entire sections and introducing a whole new page about privacy.
Whisper suggests the timing was a coincidence. The company’s chief technology officer, Chad DePue, posted this statement on Hacker News in which he said: “The Guardian’s reporting that we changed our terms of service in response to the article is beyond silly.”
DePue offered to show a screenshot of a discussion he had with lawyers in July about making changes to Whisper’s terms and suggests the intention was to make the company’s legalese more user-friendly, “not to protect ourselves or give ourselves more rights to user data”. He has not released the screenshot, which anyway may relate to a different update to the company’s terms of service that was made on 15 September.
In any case, the changes Whisper made to its terms of service this week were not merely cosmetic. Whisper made several significant changes, each of which can be clearly be traced back to the specific allegations it had received in writing from the Guardian.
What exactly did Whisper tell the Guardian about the tracking of users?
The Guardian’s reporting is based on a three-day visit to the company’s Los Angeles headquarters last month, part of a trip to explore the possibility of an expanded journalistic relationship with Whisper. Two Guardian reporters were given access to Whisper’s back-end tools and spoke extensively with the company’s executives.
At no stage during the visit were the journalists (the authors of this article) told they could not report on the information shared with them.
As the reporters’ records confirm, Whisper executives spoke openly and extensively about their methods for researching the location of individual users they deemed potentially newsworthy. They said they used their in-house mapping tool to try to work out if users were who they claimed to be, and to fish for whispers being posted from potentially interesting places (like military bases or government buildings).
One executive described how Whisper was following an apparently sex-obsessed lobbyist in DC. “He’s a guy that we’ll track for the rest of his life and he’ll have no idea we’ll be watching him,” the Whisper executive said.
Zimmerman, who was not present when the executive made the remark, describes the quote as “probably the most egregious lie” and “100% fabricated”. The quote was heard by two reporters, as their records of the conversation show.
OK, but what about IP data? Isn’t Whisper denying that it uses IP location data to dig into the background of interesting users?
That depends who at Whisper you ask – and when.
Over three days, Zimmerman and another Whisper executive spoke extensively about the practice of obtaining the rough location of users who had disabled their geolocation services. They were clear this was done by the editorial team headed by Zimmerman.
They explained that this was done on a case-by-base basis, to research the approximate whereabouts of users Whisper deemed potentially newsworthy. It was portrayed as a special tool - available on demand. The Guardian reporters questioned the ethics of this practice. It was discussed at length.
Zimmerman denies this outright. “That is false, that is 100% false. That was never said by anyone. I have no idea where that quote came from,” he told the Washington Post. “I have no idea what they’re talking about. I have never, ever, ever asked anybody in my life, and would never ask anybody, for information on a user who opted out of user location. That cannot be overemphasized. That is a 100% lie.”
Separately, in several tweets Zimmerman has suggested IP location data is only ever extracted in extreme circumstances, such as when there is a threat to someone’s life.
But Zimmerman’s denials are even at odds with a statement from Whisper’s senior vice-president, Eric Yellin.
The Guardian told Yellin that Whisper’s editorial staff were using IP location data to obtain the rough location of users who had opted out of geolocation services. In an email reply on 10 October, he confirmed as much. “We occasionally look at user IP addresses internally to determine very approximate locations,” Yellin wrote.
What about the report of Whisper sharing information with the US Department of Defense? And developing a Chinese version of its app to comply with censorship laws?
Both of those statements are true. Whisper has not attempted to deny them.
But Whisper does deny it collects personally identifiable information?
Not really.
Zimmerman has made some bold claims on this front. He tweets that Whisper “has never nor will ever collect nor store ANY personally identifiable information” from its users, adding: “nothing that could identify a user in ANY way is stored by Whisper, period”.
Certainly, Whisper does not collect obvious personal details like names, phone numbers and email addresses. The Guardian never said it did.
Whisper does collect users’ unique smartphone ID code, their IP data and, for the majority who choose to turn on their geolocation services, their location, to within 500 meters of where they post messages. In the hands of law enforcement, that data can (and does) identify users.
The easiest way to see how even an approximate location could make you identifiable is to think about people working in rural areas: yours might be the only house in that radius. Even if it weren’t, how many people would post a Whisper from within 500m of your office a few times a week, and again within 500m of your house? When you start adding in social visits, or out-of-town trips to see relatives, even very approximate locations can become sharply identifying – especially to law enforcement and others who could match it to more precise geolocations from your phone records or similar.
Privacy experts argue that geographical tracking alone can easily be used to identify a person. But don’t take their word for it: Whisper actually says the same.
Users are not told that Whisper collects no personally identifiable information, or nothing that could identify them in any way.
Whisper instead states in its terms of service that it collects “very little information” that could be used to personally identify them. Those terms of service warn users that geographical information can lead to a person’s identification: “[E]ven if you do not include personal information in your whispers, your use of the services may still allow others, over time, to make a determination as to your identity based on the content of your whispers as well as your general location.”
Where is Whisper storing my data and for how long?
Before Whisper discovered the Guardian planned to publish details about its employment of more than 100 staff at an offshore site in the Philippines, its terms of service told users the company processes and stores all information in the US.
Whisper’s new terms of service now acknowledge users’ information is, in fact, stored and processed overseas. Whisper’s stated policy is that user data and content is only held for a “brief period of time”. The Guardian reported that the data, including messages users may think they have deleted, is being archived in a searchable database and held indefinitely.
Zimmerman maintains that no user data whatsoever is stored. “There is no ‘user data’ to store,” he tweeted when asked if Whisper data was being stored “indefinitely”. “We don’t know who our users are. They are anonymous.”
This seems to come down to a definition of data. The Whisper archive the Guardian had access to included all of a user’s historical messages posted on the app (including those they may have thought they deleted) as well as the precise time and, for geolocated users, the location the messages were sent from.
So what happens now?
The New York Times reports that Buzzfeed is suspending its editorial partnership with Whisper until the social media app clarifies its privacy policies. The Washington Post asks whether Whisper’s recent revisions to its terms of service will be enough to protect the company from a Federal Trade Commission inquiry into “unfair or deceptive practices”. The Wall Street Journal notes that another app, Snapchat, settled with the FTC earlier this year after accusations it deceived users over whether their messages were disappearing.
The FTC generally does not announce when it has begun an investigation. In the meantime, journalists and users can keep pressing Whisper on the specifics.
Tough questions are already being put to DePue, Whisper’s chief technology officer, who has committed to an open conversation with users of Hacker News. You can join that exchange here.
