Blog Post

Here’s everything you need to know about the Whisper-Guardian story

It’s a messy one, but Whisper is suddenly at the center of what could become one of the most significant tech news stories all year.

The Guardian published an damning, extensive report Thursday on anonymous confessional app Whisper and how it tracks its users. The story claims that even those who opt out of geolocation services have their whereabouts tracked, and Whisper keeps an eye on the activity of users it believes are newsworthy. If even half of the allegations are true, it’s a huge blow for the company. Whisper, for its part, is vehemently denying almost everything.

The company’s editor in chief, Neetzan Zimmerman, tweeted a few bold denials, ranging from “a pack of vicious lies,” to “100% false” to “The Guardian made a mistake posting that story and they will regret it.” Then, in the name of transparency, Whisper released a Scribd document with The Guardian’s original email request for comment and Whisper’s unaltered responses.

The two sides disagree over what constitutes “personally identifiable information,” whether rough location data tied to a user’s previous activity could expose someone. In other words, it’s a debate about the nature of anonymity, a conversation we were bound to have sooner or later with the growth of Whisper, Secret, and Yik Yak.

An anonymous secret on Whisper discusses the Guardian's article. Photo by Biz Carson/Gigaom
An anonymous secret on Whisper discusses the Guardian’s article. Photo by Biz Carson/Gigaom

Here’s the laundry list of allegations in the story and Whisper’s response to them:

  1. The company keeps tabs on particular users it believes are newsworthy, based on the locations they post from. For example, it has been following someone in D.C. who writes Whispers about his sexual urges and life as a lobbyist. A Whisper executive reportedly told a Guardian staffer, “He’s a guy that we’ll track for the rest of his life and he’ll have no idea we’ll be watching him.”
    1. Response: “Whisper does not follow or track users. Whisper does not request or store any personally identifiable information from users, therefore there is never a breach of From time to time, when a user makes a claim of a newsworthy nature, we review the user’s past activity to help determine veracity.”
  2. The Guardian included a map of posts from the White House. Source: Guardian (http://www.theguardian.com/world/2014/oct/16/-sp-revealed-whisper-app-tracking-users)
    The Guardian included a map of posts from the White House. Source: Guardian (http://www.theguardian.com/world/2014/oct/16/-sp-revealed-whisper-app-tracking-users)
  3. Whisper tracks the locations of many users, even some who have opted out of geolocation services. For the latter case, it uses IP address technology to figure out the general area, like city or country, a person is posting from. For example, it used such technology to verify that someone who claimed to be a soldier heading to Iraq had previously posted from Afghanistan.
    1. Response: “We neither receive nor store geographical coordinates from users who opt out of geolocation services. User IP addresses may allow very coarse location to be determined to the city, state, or country level.”
  4. The company has a map internally that populates the locations where Whispers are posted.
    1. Response: Zimmerman told Valleywag the map is no secret – it was available in early versions of Whisper. But users weren’t interested in it, so they removed it.
  5. It has worked with the FBI and British intelligence agency MI5 to find a user in cases where someone’s life was at risk.
  6. Whisper gives aggregated user data, like number of suicide threats posted from within The Pentagon, to the government.
    1. Response: “We’re proudly working with many organizations to lower suicide rates and the US military is among them. We noticed how frequently suicide is mentioned among those living on US military bases or compounds and reached out to organizations to see how we could work together to address this important issue. We have publicly shared similar aggregated PTSD statistics that are absent of any personally identifiable information, as, again, we do not collect or store PII.”
  7. Rather damningly, the company changed its terms of service and introduced a new privacy policy after learning The Guardian was working on a story about the user data gathering. It added in hedges, like “Bear in mind that, even if you have disabled location services, we may still determine your city, state, and country location.” It removed its description of location tracking as “voluntary.” It added a warning for people that if they do use the geolocation feature their identities could be figured out over time.
  8. Whisper is building an app version specifically for China, one that will fit the censorship laws by blocking the posting of certain words, among other changes.
    1. Response: “We haven’t launched in China but we operate in many countries and comply with the same local laws and regulations as other US-based technology companies that operate internationally do.”

The Guardian got the scoop in a rather unusual way – it was developing a partnership with Whisper so the publication could further its use of Whispers in reporting. Whisper executives walked Guardian reporters through their technology to show its potential for finding sources in breaking news situations. The Guardian claims it was never told the information was off the record.

It’s too soon to say what the impact of the news could be on Whisper’s business, but power users are likely to be shaken.