Analyzing the Whisper CEO’s Response To The Guardian’s Allegations

From October 16 to October 19, The Guardian posted a series of articles containing a number of allegations about the Whisper app’s practices.

Some of the more serious allegations made by The Guardian are as follows:

1. Whisper tracks the location of users who have expressly opted out of geolocation services

2. Whisper shares information with the US Department of Defense from smartphones it knows are used from military bases.

3. Four days after learning The Guardian intended to publish their story, Whisper rewrote its terms of service to explicitly permit determining the broad location of people who had opted out of the geolocation feature.

4. Whisper has developed a tool that allows its staff to filter and search GPS data, thus allowing them to track an individual user’s movements over time. Specifically, the tool allows staff to see a user’s history of messages. It also allows staff to determine the approximate location each message was posted from.

5. Whisper indefinitely stores in a searchable database the following data: posts the user believes were deleted, the precise time of those posts, and the approximate location they were made from.

6. Whisper delves into the historical activity and monitors the movements of users they believe are potentially newsworthy. Examples include military personnel and employees of Yahoo, Disney, and Capitol Hill.

What does the CEO Michael Heyward have to say about these allegations? His full response is here, but here are some of the salient points:

Allegation 1: Heyward admits that IP addresses are collected, but says that they are deleted after 7 days. IP addresses make it possible to guess the location of a device.

Heyward at least partially contradicts the comment of Neetzan Zimmerman, Heyward’s editor-in-chief, who claimed on October 16 that “It is a technical impossibility for us to determine their location.” With IP addresses, it clearly is not a technical impossibility to at least estimate the location. If you want to try this for yourself, visit this site and see for yourself how accurate its guess about your location is.

Allegation 2: The only mention of the Department of Defense in Heyward’s post is to say that Whisper works with the Department of Defense’s Suicide Prevention Office to lower suicide rates. I don’t see how this addresses the part about smartphones being used from military bases. It sounds like he’s neither admitting or denying what I’ve labeled allegation 2. If the allegation is false, Heyward’s response leaves us wondering why he failed to deny it. If the allegation is true, Heyward’s silence deprives the public of the opportunity to answer the more important questions of what information is being shared, and for what reasons.

Allegation 3: Heyward says the changes were not related to The Guardian’s reporting. However, he also claims Whisper’s communications with the Guardian made clear that Whisper’s users would benefit from seeing the changes sooner. In other words, he’s denying that the actual substantive revisions were prompted by The Guardian’s reporting, but admits that the timing was related. Let’s delve further into the denial.

You might be thinking the communications may have had nothing to do with the allegations. After all, one of the articles says The Guardian was exploring “the possibility of an expanded journalistic relationship with Whisper.” If true, this would seem to imply the two companies had a relationship of some kind already, so the communications may have been about something other than the allegations.

It may help if we look at some of the actual changes. The Guardian alleges that “permission to our access to and tracking of your location-based information is purely voluntary” changed to “please bear in mind that, even if you have disabled location services, we may still determine your city, state, and country location-based on your IP address (but not your exact location).” I did indeed find the new passage in Whisper’s privacy policy. I also found the old wording in a copy of the policy retrieved by the Wayback Machine on August 19, so while we may dispute why the change was made, it did occur.

The rest of the alleged changes can be found here. You can easily determine for yourself whether the changes actually occurred by comparing the current version of the terms to their previous version as saved by the Wayback Machine. I will say that the fact that the timing of the change (October 13), which was 4 days after The Guardian contacted Whisper to tell them they would publish an article about Whisper’s practices, is very suspicious to say the least.

Given the fact that one of these changes clearly involved the location of users, I find it difficult to believe that the changes were not related to The Guardian’s intent to publish their allegations. After all, one of the allegations was precisely that Whisper tracks the location of users who have opted out of the geolocation services. Are we to believe this was a mere coincidence, especially when the timing was admittedly motivated by The Guardian’s story and Heyward partially contradicted his editor-in-chief on a point related to one of the changes?

Allegation 4: Heyward claims Whisper has allowed users to search for Whispers by location since 2013, and that the company uses the same tool internally. However, this does not seem to be a direct response to the allegation. The Guardian alleged that an internal tool allowed staff to “track an individual user’s movements over time.” The Guardian alleged that the tool allowed staff to see a user’s history of messages and determine the approximate location each message was posted from. Searching for all the whispers by location or category does not appear to be the same thing; such a search would presumably include whispers by many different individuals in the same location. It therefore seems Heyward is neither denying nor admitting this allegation.

Allegation 5: Heyward’s claim that IP address data is stored for seven days appears to be a denial that they store approximate location data indefinitely. However, he does not discuss the storage of the content of posts or the time those posts were made.

Allegation 6: Heyward appears to deny the allegation that users are tracked based on whether they are newsworthy. He says “We do not actively track users.” He says user posts are reviewed to determine if they’re a threat to their community and to determine the authenticity of a post.

According to Whisper’s privacy policy, their company “is committed to being a safe place for our users to anonymously share their innermost thoughts, secrets, and feelings.” Given the woeful inadequacy of Heyward’s response to some of the allegations made by The Guardian, I believe the jury is still out. With so many unanswered questions, would you really trust the app with your innermost thoughts, secrets, and feelings? According to The Guardian, EPIC has called on the FTC to investigate Whisper’s “deceptive practices” and the ACLU says Whisper has “violated the promises they make to users by telling them they can opt out of location and then tracking them.”

2 thoughts on “Analyzing the Whisper CEO’s Response To The Guardian’s Allegations”

  1. “…timing of the change (August 13), which was 4 days after The Guardian contacted Whisper…”

    Shouldn’t that be October 13?

    “Allegation 4: Heyward claims Whisper has allowed users to search for Whispers by location since 2003…”

    2003???

  2. Thanks for pointing out the mistakes. The first date should be October 2013 as you already pointed out, and the second should be 2013 (not 2003). They’re both fixed now.

Leave a Reply

Your email address will not be published. Required fields are marked *