Setting The Record Straight
I wrote last Saturday that we welcome the current discussion
around Whisper, and are grateful to those who have shared thoughtful feedback
with us. We care deeply about our users, and will continue to communicate
openly about how we operate.
In that light, it's important that the
facts are presented clearly and honestly. An article posted yesterday continues to
misrepresent how we operate.
Below I have annotated the story, in the interests of getting the facts
straight.
As I have said, we strive to do right by
all our users, and we continue to look into the unattributed quotes in the
Guardian's stories. We have placed members of the editorial team involved with
the Guardian’s visit on leave, pending the results of our internal review.
Neetzan’s reaction to the Guardian's allegations
has taken away from the substance of the issue, which is that much of the
Guardian's reporting on this issue has been highly misleading or just plain
wrong.
Michael
Heyward
Co-Founder and CEO, Whisper
The ‘anonymous’ social
media app Whisper has been summoned to Capitol Hill to answer questions posed
by the powerful chair of the Senate commerce committee. Jay Rockefeller said
revelations in the Guardian about how Whisper tracks its users raise “serious
questions” over privacy and demanded an explanation.
We share the Senator's interest in
protecting consumer privacy and will respond shortly. We welcome the discussion
and opportunity to correct the record.
The chairman’s letter was delivered a week after the Guardian published three stories about Whisper’s business
practices.
Here are 10 key questions
Whisper should answer.
The Guardian only met with members of our
editorial team when they came onsite to explore an expanded partnership. Many
of their claims arise from the fact that they made technology-related
inferences based on discussions with non-technical people.
1. How did Whisper obtain the broad location of some users
who opted out of geolocation services?
The Guardian’s reporting
was based on a three-day visit to Whisper’s Los Angeles headquarters to explore
the possibility of working together on journalistic projects. This visit, which took place last month, was hosted by the
editor-in-chief, Neetzan Zimmerman.
Targeted location tracking
was a key method Zimmerman’s editorial team used to find and then vet users
they believed to be newsworthy. Whisper could (and did) begin private “chats”
with users and also inspected their activity history on the app. But the the vetting process also involved looking up a user’s
movements to see if they matched the claims they were making in their posts.
But there was a problem.
How could they find the location of users who had opted out of geolocation services? Zimmerman told reporters the company
had other means of ascertaining approximate locations of those who had asked
not to be followed. But his editorial team didn’t just claim this. They
supplied the evidence.
One document Zimmerman’s
team gave to the Guardian listed a number of users who Whisper had identified
as potentially newsworthy. It was titled “Potential Guardian Leads”. Others
were shared via email. Several of the users Whisper identified for the
Guardian, and encouraged the reporters to investigate, had opted out of their
location services. Despite this, Whisper obtained their approximate location
and supplied it to the Guardian.
False. The Whispers referred to here
contain location information the users had publicly shared, because the user either opted in to sharing their location, mentioned
their location in the Whisper, or tagged their location.
2. Why do Whisper executives disagree about how the
company tracks users?
Whisper executives do not disagree. More
below.
It turns out Whisper
collects two kinds of location data. The first is GPS-based data, provided by
users who opt into geolocation services. The second
is IP data, which gives only the rough location of all users, including those
have opted out of their geolocation services.
Like
nearly all websites and apps, Whisper collects IP addresses. We’ve always been
clear about this. Specifically, Whisper collects a user's IP address when a
user posts a Whisper. Locations can be inferred from IP addresses. Whisper
keeps the IP address itself for only 7 days.
When Zimmerman’s editorial team do not have access to GPS-based data (because users
have declared through the app they don’t want their location tracked), they
sometimes ascertain their rough location through IP addresses.
Whisper initially said this
disclosure was “entirely false” and had been concocted by reporters. “When I
specifically say that they are lying, that’s what I mean – that does not
happen, and it simply can’t happen,” Zimmerman told tech news website Gigaom.
But Whisper’s senior vice-president, Eric Yellin,
had already acknowledged the practice. He told the Guardian before the stories were published:
“We occasionally look at user IP addresses internally to determine very
approximate locations.” That admission was made in an email exchange about the
editorial practices of Zimmerman’s team.
So who is right? Zimmerman
or Yellin? And why do they disagree?
This is confusing the practices of the
safety team with the editorial team. If we receive a valid legal
request, or we learn through a Whisper post of an imminent and serious threat
to people’s safety, the
safety team will forward the IP address (if we have it) to the appropriate legal
authority. For example, if a user is soliciting minors, we will share the
limited information we have with the National Center for Missing and Exploited
Children.
3. How did Whisper ‘vet’ the users featured in Buzzfeed and Huffington Post articles?
Whisper had established
partnerships with Buzzfeed, the Huffington Post and
Fusion, all of which have since suspended those partnerships. But these
previous collaborations raise important questions about Whisper’s vetting
process.
One Buzzfeed article featured Whisper messages about sexual assaults in the
military. Whisper told Buzzfeed it had “vetted every
account using our back-end tools and filtered out any we thought might be bogus
claims”. Of the 23 Whisper posts featured in the Buzzfeed
article, five were from by users who had opted out of geolocation.
So how did Whisper “vet” these users?
These Whispers were vetted based on
keywords in the post, so it's not surprising that the article includes some
public Whispers that do not include location. Conversely, for a story based on
a location - like a college - we would not include Whispers from users who have
not shared their location.
See here for an example of a Whisper that doesn’t
include location, and here
for an example of one that does.
The same can be asked of a Huffington Post article featuring Whisper users
who claimed to be college students discussing virginity. Four out of seven of
the Whisper postings came from users who had opted out of geolocation
services.
Again, we vetted these Whispers by the
text in the Whisper. Our users also create these types of
stories by searching the app for keywords as you can see here.
When the Guardian undertook
three small journalistic projects with Whisper earlier this year, Zimmerman’s
editorial team did not indicate they were ascertaining the broad location of
some users who had opted out of geolocation services.
4. Why does Whisper collect detailed GPS data from users
if it doesn’t need it?
Jonathan Zdziarski, a security expert who specialises
in forensic analysis of operating systems, has published a
detailed assessment of Whisper’s back-end system. He concluded: “Anonymous
users have good reason to be concerned about their anonymity when using the
Whisper application.” Among the concerns raised by Zdziarski,
an expert in Apple systems, was the type of GPS data
he said Whisper is requesting from Apple devices.
According to Zdziarski, Whisper could ask Apple for GPS data that is
accurate within a 1km or 3km radius.
Instead, the app requests
GPS data that is accurate to within a 100-meter radius and only “fuzzes” or
“salts” that data, rendering it accurate to within 500meters, once it has
arrived on the company’s servers. The “nearby” facility on Whisper’s app
– the ostensible reason the company collects GPS data in the first place
– only allows users to see messages posted within a one-mile radius. So
why is Whisper collecting GPS data accurate to within a 100-metre radius?
We appreciate Zdziarski’s
feedback, but using a different “CLLocationAccuracy”
value does not ensure a less accurate location. We use the location that CLLocationManager returns instantly, meaning a different
constant would have no bearing on the returned value, as any constant returns a
value instantly. We then fuzz the location on the server.
5. Is Whisper now accepting it (passively) tracks users?
Whisper initially responded
to the Guardian’s stories by insisting that it “does not follow or track
users”. But as Rockefeller notes in his letter, Heyward has since put it
differently. Heyward now states Whisper does not “actively” track its users.
Why the change in wording? Is he saying Whisper doesn’t track users all the
time, only when they are interesting or newsworthy? How does the company
explain the difference?
We
do not track users passively or actively. We have a history of a user’s
Whispers, which are public. If they shared their location, it is randomized to
within 500m and publicly displayed on their posts. We promote and feature
Whispers, and our editorial team looks at past Whispers from a user to
determine their authenticity. Previous locations of posted Whispers may be
taken into consideration when evaluating the veracity of a user’s claims for
editorial purposes. For example, if a user claimed to be a doctor treating an Ebola
patient in West Africa, and never in fact had any Whispers posted in West
Africa, our editorial team would not feature the post.
6. Why does Whisper indefinitely store location data that
is linked back to individual users?
This is like asking why Twitter stores
old tweets. It’s a feature of the product for users to be able to search for
old Whispers shared at a location. Again, we do not know who these users are
because we don’t collect any personally identifiable information.
What many users of the app
may not realise is that Whisper is indefinitely
storing their information in a database that, in the case of most users, can be
viewed through an in-house mapping tool.
Whisper stores information
linked to individual users. That’s how, when Zimmerman’s team spot a newsworthy
user, they can scour their historical activity on the app and review past
messages – including those a user may believe
they have deleted. The precise time and general location of messages is
recorded (for the 80% who opt into geolocation
services), providing a trail of breadcrumbs that can be used to track a
person’s movements over time. Rockefeller has asked Whisper to explain the
extent to which it “retains user data”.
The company states it is
only holding user data for “a brief period of time”. So why does it keep this data in a searchable database
and store it indefinitely?
This
is wrong. “A brief period of time” refers to private messages in the messaging
feature of the app, which are stored for only 48 hours, and refers to IP
addresses, which are stored for seven days. Whispers are stored indefinitely as
this a feature of the service.
7. Why didn’t Whisper tell users it was sharing
information with the Pentagon?
Whisper has been sharing
information with the US Department of Defense to help with research into
suicides. The study exploits the location data Whisper acquires by searching
messages the company knows have been sent from US military bases. Heyward has
defended the practice and said his company “can’t wait to establish more of
these relationships”. But why did Whisper keep this project secret from its
users in the first place?
This is alarmist. The implication that we
are sharing our users' information for surveillance is misleading. We did not
share any user data. We did a search of keyword frequency on public posts for
terms like “suicide” and “depression” to aid the Department of Defense's
Suicide Prevention Office in a study on the unfortunately high rate of suicide
in our military. The Whispers were public and in the vicinity of military
bases. All users had opted-in to share their location. We regularly talk about
how we facilitate such studies.
8. Why didn’t Whisper tell its users about its overseas
base in the Philippines?
We don't have an overseas base in the
Philippines. We contract with TaskUs, a content
moderation firm in the Philippines used by some of the largest technology
companies in the world. We have discussed this many times.
Whisper has hired more than
100 staff in the Philippines to constantly monitor messages posted on its app
to stamp out inappropriate behaviour. When the
Guardian asked Whisper what security measures were in place at the company’s
Filipino site, the company provided no specific information but insisted the
process was “extremely secure”. At that time, as Rockefeller notes, Whisper was
providing its users no indication their data was being held or processed
overseas. In fact, the company’s terms of service told users “we process and
store all information in the United States”.
Four days after learning
the Guardian planned to publish its stories, Whisper rewrote its terms of
service. The new terms, introduced on 13 October, acknowledge user information
is also stored in “other countries”.
“This may be important to
you, as the laws of the United States or such other countries may not be as
protective of your personal information as the laws of your jurisdiction,” the
new policy states. Why were users not told this before?
Because it’s not true. Our terms give us the ability to store
information in other countries, but we do not. All data is stored in the United
States, and has always been.
9. Is Whisper claiming that none of the changes to its
terms of service are related to the Guardian’s reporting?
Absolutely. The changes were not related
to their reporting, as we have stated multiple times. But the Guardian
continues to suggest the contrary, even devoting an entire story to the
subject. They have repeatedly used this allegation as their smoking gun to
undermine our credibility, even though it's wrong.
Four days after learning
the Guardian planned to publish details about Whisper’s business practices, the company rewrote its terms of service. Rockefeller has demanded
Whisper’s current terms of service, as well as copies of the policies in effect
at the launch of the company and at the time it introduced its geolocation feature.
Heyward and his chief
technology officer, Chad DePue, have said the changes to the terms of service
were unrelated to the Guardian’s reporting. Heyward said the changes were “finalised” in July and were due to be published in October.
He added: “However, our communications with the Guardian made it clear that our
users would benefit from seeing them sooner.” Heyward not mention
that Whisper’s terms of service were also updated in September.
False, they were not.
DePue has offered to make
public his
correspondence with Whisper’s lawyers to prove the “entire point” of the
changes to the terms of service was to make them more
user-friendly.
We have made the correspondence public here and the documents mentioned are here and here. (The names of our attorneys have been redacted to protect their
privacy.) We want to elaborate on the earlier statement that they were
finalized in July. Chad’s comments were finalized in July and the lawyer’s
final review took place in August. The files attached in the mail, and the word
documents, reflect what is live on the site. Our new policy was completed
months before the Guardian’s story.
Is Whisper claiming that
none of the changes were related to the Guardian’s reporting?
Yes.
10. Why did Whisper deny the existence of a user claiming
to be a sex-obsessed lobbyist?
The only comments I've made on
this issue were: "We always strive to do right by our users. We have zero
tolerance for any employee who violates that trust."
"Of course we’re
investigating the Guardian’s unattributed quotes and I will take immediate
action if we discover they’re true."
When two reporters visited
Whisper’s headquarters last month, they had extensive discussions with
executives at the company over three days. At no stage during the visit were
the journalists told they could not report on the information shared with them
by Whisper. Indeed, Whisper has since acknowledged the reporters were
entitled to write about what they discovered. Columbia Journalism Review has written about the nature of the Guardian’s reporting.
While conversations during
the visit were on the record,
It was never agreed that the business
conversations were "on the record" and the nature of the meeting
implied the contrary, but it was our mistake not to be more
clear on the terms here.
the Guardian felt it was fair
to avoid naming any executives who were not specifically giving quotes for
attribution.
This is an odd statement because it
suggests some employees were giving quotes for attribution, while others were
not. As far as we know, no employees were aware they were on the record. On
items of substance, the Guardian only met with members of the editorial team.
One such executive told the
reporters about an apparently sex-obsessed Whisper user who claims to be a
lobbyist in Washington DC. “He’s a guy th
at we’ll track for the rest of his life and he’ll have no idea we’ll be
watching him,” the Whisper executive said. The quote was
heard by two reporters, as their records of the conversation show.
I'm deeply
troubled by this quote, which does not reflect our values.
Zimmerman – who was
not present when the executive made the remark – described the quote
about the lobbyist as “100% fabricated”. He added: “It is a fabrication because it was never said, and no
such person exists.”
That person does exist.
Zimmerman’s editorial team nicknamed the lobbyist ‘50 shades of grey’ and
believed him to be a potentially newsworthy find. They actively encouraged the
Guardian reporters to delve into the lobbyist’s history of activity on the app.
The lobbyist was one of the users included in the “Potential Guardian Leads”
document that Whisper provided the Guardian.
As I said earlier, we have placed members
of the editorial team involved with the Guardian’s visit on administrative
leave, pending the results of our internal review.
---
I hope this provides clarity on how our
product works and how we operate as a company - Michael