Setting The Record Straight

I wrote last Saturday that we welcome the current discussion around Whisper, and are grateful to those who have shared thoughtful feedback with us. We care deeply about our users, and will continue to communicate openly about how we operate.

In that light, it's important that the facts are presented clearly and honestly. An article posted yesterday continues to misrepresent how we operate. Below I have annotated the story, in the interests of getting the facts straight.

As I have said, we strive to do right by all our users, and we continue to look into the unattributed quotes in the Guardian's stories. We have placed members of the editorial team involved with the GuardianÕs visit on leave, pending the results of our internal review.

NeetzanÕs reaction to the Guardian's allegations has taken away from the substance of the issue, which is that much of the Guardian's reporting on this issue has been highly misleading or just plain wrong.

Michael Heyward
Co-Founder and CEO, Whisper

ÒTen privacy questions Whisper should answer for Senate committeeÓ

 

The ÔanonymousÕ social media app Whisper has been summoned to Capitol Hill to answer questions posed by the powerful chair of the Senate commerce committee. Jay Rockefeller said revelations in the Guardian about how Whisper tracks its users raise Òserious questionsÓ over privacy and demanded an explanation.

We share the Senator's interest in protecting consumer privacy and will respond shortly. We welcome the discussion and opportunity to correct the record.

The chairmanÕs letter was delivered a week after the Guardian published three stories about WhisperÕs business practices.

Here are 10 key questions Whisper should answer.

The Guardian only met with members of our editorial team when they came onsite to explore an expanded partnership. Many of their claims arise from the fact that they made technology-related inferences based on discussions with non-technical people.

1. How did Whisper obtain the broad location of some users who opted out of geolocation services?

The GuardianÕs reporting was based on a three-day visit to WhisperÕs Los Angeles headquarters to explore the possibility of working together on journalistic projects. This visit, which took place last month, was hosted by the editor-in-chief, Neetzan Zimmerman.

Targeted location tracking was a key method ZimmermanÕs editorial team used to find and then vet users they believed to be newsworthy. Whisper could (and did) begin private ÒchatsÓ with users and also inspected their activity history on the app. But the the vetting process also involved looking up a userÕs movements to see if they matched the claims they were making in their posts.

But there was a problem. How could they find the location of users who had opted out of geolocation services? Zimmerman told reporters the company had other means of ascertaining approximate locations of those who had asked not to be followed. But his editorial team didnÕt just claim this. They supplied the evidence.

One document ZimmermanÕs team gave to the Guardian listed a number of users who Whisper had identified as potentially newsworthy. It was titled ÒPotential Guardian LeadsÓ. Others were shared via email. Several of the users Whisper identified for the Guardian, and encouraged the reporters to investigate, had opted out of their location services. Despite this, Whisper obtained their approximate location and supplied it to the Guardian.

False. The Whispers referred to here contain location information the users had publicly shared, because the user either opted in to sharing their location, mentioned their location in the Whisper, or tagged their location.

2. Why do Whisper executives disagree about how the company tracks users?

Whisper executives do not disagree. More below.

It turns out Whisper collects two kinds of location data. The first is GPS-based data, provided by users who opt into geolocation services. The second is IP data, which gives only the rough location of all users, including those have opted out of their geolocation services.

Like nearly all websites and apps, Whisper collects IP addresses. WeÕve always been clear about this. Specifically, Whisper collects a user's IP address when a user posts a Whisper. Locations can be inferred from IP addresses. Whisper keeps the IP address itself for only 7 days.

When ZimmermanÕs editorial team do not have access to GPS-based data (because users have declared through the app they donÕt want their location tracked), they sometimes ascertain their rough location through IP addresses.

Whisper initially said this disclosure was Òentirely falseÓ and had been concocted by reporters. ÒWhen I specifically say that they are lying, thatÕs what I mean – that does not happen, and it simply canÕt happen,Ó Zimmerman told tech news website Gigaom.

But WhisperÕs senior vice-president, Eric Yellin, had already acknowledged the practice. He told the Guardian before the stories were published: ÒWe occasionally look at user IP addresses internally to determine very approximate locations.Ó That admission was made in an email exchange about the editorial practices of ZimmermanÕs team.

So who is right? Zimmerman or Yellin? And why do they disagree?

This is confusing the practices of the safety team with the editorial team. If we receive a valid legal request, or we learn through a Whisper post of an imminent and serious threat to peopleÕs safety, the safety team will forward the IP address (if we have it)  to the appropriate legal authority. For example, if a user is soliciting minors, we will share the limited information we have with the National Center for Missing and Exploited Children.

3. How did Whisper ÔvetÕ the users featured in Buzzfeed and Huffington Post articles?

Whisper had established partnerships with Buzzfeed, the Huffington Post and Fusion, all of which have since suspended those partnerships. But these previous collaborations raise important questions about WhisperÕs vetting process.

One Buzzfeed article featured Whisper messages about sexual assaults in the military. Whisper told Buzzfeed it had Òvetted every account using our back-end tools and filtered out any we thought might be bogus claimsÓ. Of the 23 Whisper posts featured in the Buzzfeed article, five were from by users who had opted out of geolocation. So how did Whisper ÒvetÓ these users?

These Whispers were vetted based on keywords in the post, so it's not surprising that the article includes some public Whispers that do not include location. Conversely, for a story based on a location - like a college - we would not include Whispers from users who have not shared their location.

See here for an example of a Whisper that doesnÕt include location, and here for an example of one that does.

The same can be asked of a Huffington Post article featuring Whisper users who claimed to be college students discussing virginity. Four out of seven of the Whisper postings came from users who had opted out of geolocation services.

Again, we vetted these Whispers by the text in the Whisper. Our users also create these types of stories by searching the app for keywords as you can see here.

When the Guardian undertook three small journalistic projects with Whisper earlier this year, ZimmermanÕs editorial team did not indicate they were ascertaining the broad location of some users who had opted out of geolocation services.

4. Why does Whisper collect detailed GPS data from users if it doesnÕt need it?

Jonathan Zdziarski, a security expert who specialises in forensic analysis of operating systems, has published a detailed assessment of WhisperÕs back-end system. He concluded: ÒAnonymous users have good reason to be concerned about their anonymity when using the Whisper application.Ó Among the concerns raised by Zdziarski, an expert in Apple systems, was the type of GPS data he said Whisper is requesting from Apple devices.

According to Zdziarski, Whisper could ask Apple for GPS data that is accurate within a 1km or 3km radius.

Instead, the app requests GPS data that is accurate to within a 100-meter radius and only ÒfuzzesÓ or ÒsaltsÓ that data, rendering it accurate to within 500meters, once it has arrived on the companyÕs servers. The ÒnearbyÓ facility on WhisperÕs app – the ostensible reason the company collects GPS data in the first place – only allows users to see messages posted within a one-mile radius. So why is Whisper collecting GPS data accurate to within a 100-metre radius?

We appreciate ZdziarskiÕs feedback, but using a different ÒCLLocationAccuracyÓ value does not ensure a less accurate location. We use the location that CLLocationManager returns instantly, meaning a different constant would have no bearing on the returned value, as any constant returns a value instantly. We then fuzz the location on the server.

5. Is Whisper now accepting it (passively) tracks users?

Whisper initially responded to the GuardianÕs stories by insisting that it Òdoes not follow or track usersÓ. But as Rockefeller notes in his letter, Heyward has since put it differently. Heyward now states Whisper does not ÒactivelyÓ track its users. Why the change in wording? Is he saying Whisper doesnÕt track users all the time, only when they are interesting or newsworthy? How does the company explain the difference?

We do not track users passively or actively. We have a history of a userÕs Whispers, which are public. If they shared their location, it is randomized to within 500m and publicly displayed on their posts. We promote and feature Whispers, and our editorial team looks at past Whispers from a user to determine their authenticity. Previous locations of posted Whispers may be taken into consideration when evaluating the veracity of a userÕs claims for editorial purposes. For example, if a user claimed to be a doctor treating an Ebola patient in West Africa, and never in fact had any Whispers posted in West Africa, our editorial team would not feature the post.

6. Why does Whisper indefinitely store location data that is linked back to individual users?

This is like asking why Twitter stores old tweets. ItÕs a feature of the product for users to be able to search for old Whispers shared at a location. Again, we do not know who these users are because we donÕt collect any personally identifiable information.

What many users of the app may not realise is that Whisper is indefinitely storing their information in a database that, in the case of most users, can be viewed through an in-house mapping tool.

Whisper stores information linked to individual users. ThatÕs how, when ZimmermanÕs team spot a newsworthy user, they can scour their historical activity on the app and review past messages – including those a user may believe they have deleted. The precise time and general location of messages is recorded (for the 80% who opt into geolocation services), providing a trail of breadcrumbs that can be used to track a personÕs movements over time. Rockefeller has asked Whisper to explain the extent to which it Òretains user dataÓ.

The company states it is only holding user data for Òa brief period of timeÓ. So why does it keep this data in a searchable database and store it indefinitely?

This is wrong. ÒA brief period of timeÓ refers to private messages in the messaging feature of the app, which are stored for only 48 hours, and refers to IP addresses, which are stored for seven days. Whispers are stored indefinitely as this a feature of the service.

7. Why didnÕt Whisper tell users it was sharing information with the Pentagon?

Whisper has been sharing information with the US Department of Defense to help with research into suicides. The study exploits the location data Whisper acquires by searching messages the company knows have been sent from US military bases. Heyward has defended the practice and said his company ÒcanÕt wait to establish more of these relationshipsÓ. But why did Whisper keep this project secret from its users in the first place?

This is alarmist. The implication that we are sharing our users' information for surveillance is misleading. We did not share any user data. We did a search of keyword frequency on public posts for terms like ÒsuicideÓ and ÒdepressionÓ to aid the Department of Defense's Suicide Prevention Office in a study on the unfortunately high rate of suicide in our military. The Whispers were public and in the vicinity of military bases. All users had opted-in to share their location. We regularly talk about how we facilitate such studies.

8. Why didnÕt Whisper tell its users about its overseas base in the Philippines?

We don't have an overseas base in the Philippines. We contract with TaskUs, a content moderation firm in the Philippines used by some of the largest technology companies in the world. We have discussed this many times.

Whisper has hired more than 100 staff in the Philippines to constantly monitor messages posted on its app to stamp out inappropriate behaviour. When the Guardian asked Whisper what security measures were in place at the companyÕs Filipino site, the company provided no specific information but insisted the process was Òextremely secureÓ. At that time, as Rockefeller notes, Whisper was providing its users no indication their data was being held or processed overseas. In fact, the companyÕs terms of service told users Òwe process and store all information in the United StatesÓ.

Four days after learning the Guardian planned to publish its stories, Whisper rewrote its terms of service. The new terms, introduced on 13 October, acknowledge user information is also stored in Òother countriesÓ.

ÒThis may be important to you, as the laws of the United States or such other countries may not be as protective of your personal information as the laws of your jurisdiction,Ó the new policy states. Why were users not told this before?

Because itÕs not true. Our terms give us the ability to store information in other countries, but we do not. All data is stored in the United States, and has always been.

9. Is Whisper claiming that none of the changes to its terms of service are related to the GuardianÕs reporting?

Absolutely. The changes were not related to their reporting, as we have stated multiple times. But the Guardian continues to suggest the contrary, even devoting an entire story to the subject. They have repeatedly used this allegation as their smoking gun to undermine our credibility, even though it's wrong.

Four days after learning the Guardian planned to publish details about WhisperÕs business practices, the company rewrote its terms of service. Rockefeller has demanded WhisperÕs current terms of service, as well as copies of the policies in effect at the launch of the company and at the time it introduced its geolocation feature.

Heyward and his chief technology officer, Chad DePue, have said the changes to the terms of service were unrelated to the GuardianÕs reporting. Heyward said the changes were ÒfinalisedÓ in July and were due to be published in October. He added: ÒHowever, our communications with the Guardian made it clear that our users would benefit from seeing them sooner.Ó Heyward not mention that WhisperÕs terms of service were also updated in September.

False, they were not.

DePue has offered to make public his correspondence with WhisperÕs lawyers to prove the Òentire pointÓ of the changes to the terms of service was to make them more user-friendly.

We have made the correspondence public here and the documents mentioned are here and here. (The names of our attorneys have been redacted to protect their privacy.) We want to elaborate on the earlier statement that they were finalized in July. ChadÕs comments were finalized in July and the lawyerÕs final review took place in August. The files attached in the mail, and the word documents, reflect what is live on the site. Our new policy was completed months before the GuardianÕs story.

Is Whisper claiming that none of the changes were related to the GuardianÕs reporting?

Yes.

10. Why did Whisper deny the existence of a user claiming to be a sex-obsessed lobbyist?

The only comments I've made on this issue were: "We always strive to do right by our users. We have zero tolerance for any employee who violates that trust."

"Of course weÕre investigating the GuardianÕs unattributed quotes and I will take immediate action if we discover theyÕre true."

When two reporters visited WhisperÕs headquarters last month, they had extensive discussions with executives at the company over three days. At no stage during the visit were the journalists told they could not report on the information shared with them by Whisper. Indeed, Whisper has since acknowledged the reporters were entitled to write about what they discovered. Columbia Journalism Review has written about the nature of the GuardianÕs reporting.

While conversations during the visit were on the record,

It was never agreed that the business conversations were "on the record" and the nature of the meeting implied the contrary, but it was our mistake not to be more clear on the terms here.

the Guardian felt it was fair to avoid naming any executives who were not specifically giving quotes for attribution.

This is an odd statement because it suggests some employees were giving quotes for attribution, while others were not. As far as we know, no employees were aware they were on the record. On items of substance, the Guardian only met with members of the editorial team.

One such executive told the reporters about an apparently sex-obsessed Whisper user who claims to be a lobbyist in Washington DC. ÒHeÕs a guy th at weÕll track for the rest of his life and heÕll have no idea weÕll be watching him,Ó the Whisper executive said. The quote was heard by two reporters, as their records of the conversation show.

I'm deeply troubled by this quote, which does not reflect our values.

Zimmerman – who was not present when the executive made the remark – described the quote about the lobbyist as Ò100% fabricatedÓ. He added: ÒIt is a fabrication because it was never said, and no such person exists.Ó

That person does exist. ZimmermanÕs editorial team nicknamed the lobbyist Ô50 shades of greyÕ and believed him to be a potentially newsworthy find. They actively encouraged the Guardian reporters to delve into the lobbyistÕs history of activity on the app. The lobbyist was one of the users included in the ÒPotential Guardian LeadsÓ document that Whisper provided the Guardian.

As I said earlier, we have placed members of the editorial team involved with the GuardianÕs visit on administrative leave, pending the results of our internal review.

---

I hope this provides clarity on how our product works and how we operate as a company - Michael