The anonymous social-networking app Whisper was engulfed in a firestorm of criticism this week, after a series of stories in The Guardian (please see disclosure below) accused the company of tracking the location of its users — even if they opted out of that feature — as well as monitoring the behavior of those who might be “newsworthy.” In a phone interview with me, editor-in-chief Neetzan Zimmerman said the articles deliberately blur important distinctions about how location data is used by the service, and were designed to promote fear.
Zimmerman has responded to the Guardian‘s coverage with a point-by-point rebuttal posted to Scribd, as well as on Twitter, and the newspaper has in turn posted a response, saying it stands by its coverage. But I wanted more detail, because I believe there’s an inherent tension between trying to offer anonymity and trying to be a news entity at the same time — so I called and asked him to spell out where exactly the Guardian went wrong.
One of the biggest problems with the Guardian stories, Zimmerman said, is that they conflate the technical aspects of the service — which he says the reporters didn’t really understand — with the way that the editorial operation works, or what it is capable of doing. So for example, they suggest that he and his team track the location of users who work at Yahoo or are serving on military bases (even if they have opted out) because those people might be newsworthy.
Within the context of the editorial operation, we absolutely 100 percent do not, in any way shape or form, track or even care about the location of anyone who did not opt in to the location feature. When I specifically say that they are lying, that’s what I mean — that does not happen, and it simply can’t happen.
No tracking of opted-out users
The Guardian stories describe a map that has the location of users on it, suggesting they are being surreptitiously tracked without their knowledge, but that map only includes users who have specifically said that they want their location to be included — and even then it is “fuzzified” to the point where it is only accurate to within 500 meters, Zimmerman said. That is the only kind of location data the editorial operation has available to it, he reiterated.
“That map doesn’t include opted-out users, and that is the only information we have available for the editorial operation, and I repeat that that is fuzzed to 500 meters,” he said. As for a suggestion in one story that Zimmerman and his team use IP-based location data — even for opted-out users — to identify specific newsworthy individuals, he said: “That just doesn’t happen, and in fact it can’t happen. When they claim that it does, they are lying.”
One of the most damning anecdotes — in which an unnamed executive says Whisper will be tracking a certain sex-obsessed lobbyist in Washington, D.C. “for the rest of his life, and he will never know” — is a complete fabrication, Zimmerman says. “A person like that does not exist. I know for a fact that a person like that does not exist, because I run the editorial operation and if there were a person like that or a project like that, I would know about it.”
When it comes to the technical functioning of the app beyond the scope of the editorial unit, Zimmerman said he couldn’t comment — but the company’s CTO Chad DePue said on Hacker News that if someone opts out of location tracking, all that is recorded is the most basic IP location data, which is almost useless (although there is some debate among commenters in that thread, including Twitter’s former head of security Moxie Marlinspike, about how accurate IP data can be).
When it comes to opted-in users, one expert in mobile security who looked at the app said that it generates a unique identifier for each user that persists over time, and could give the company a wealth of detail about them — including personal information. He couldn’t verify whether Whisper fuzzifies the location data it gets, however, because the company said that this process occurs on its servers.
As a partner, the Guardian knew the truth
Zimmerman says that the reason he describes the Guardian stories as deliberately misleading is that Whisper had been working closely with the newspaper for about eight months as part of a partnership aimed at using the network to find interesting stories — in fact, he says he sat in the Guardian‘s New York office “and had conversations with editors about every aspect of our news-gathering operation, and they never once mentioned any concerns about it.”
[The series] conflates and exaggerates and in no way is an accurate depiction of what we do. What the Guardian wrote is a confabulation, it does not conform to reality or the truth, and they know that having been our partner for eight months… they had full knowledge of our process and went ahead and exaggerated and conflated it for no reason.
The editorial process that Whisper uses when it wants to help a partner like the Guardian or BuzzFeed (which said it has put its partnership on hold until Whisper clarifies its privacy policies, as have other partners like the Fusion network) is no different from that used by a newspaper, Zimmerman said. If the team sees something interesting, they reach out to that user and ask them if they want to have their story told, or do an interview with a journalist.
People really need to understand how this process works, and how air-tight it is, and how much it conforms to traditional journalistic standards… if you read the New York Times and see an anonymous source being quoted, that’s exactly what’s happening here. We only reach out to those who have opted in to sharing their location data — and that user has to give us 100 percent express consent for us to ever consider talking to a third party about that user.
Anonymity is different from privacy
Part of the problem with the Guardian‘s coverage, Zimmerman said — and that done by other media as well — is that it doesn’t distinguish between anonymity and privacy. Although Whisper is an anonymous network, he said, it is also clearly public, so users know that their posts will be seen and can be searched and so on. In fact, that’s a big part of why they use Whisper in the first place: because they want their stories to be heard, or they want to find other users.
That’s completely separate from whether they want those stories to be tied to their specific personal identities, said Zimmerman — and that’s why he doesn’t see any conflict between Whisper wanting to be an editorial or journalistic organization and also being an anonymous network. “They 100 percent want their messages to be public — they just don’t want it to be attached to their identity, to their name, address and phone number, the way it is with other social networks.”
That’s why the company is so focused on not tracking or using a person’s location unless they specifically request it, said Zimmerman, and why he reacted so aggressively to the Guardian‘s suggestion that this isn’t the case. In the end, both parties may wind up having to make their case to the FTC, which has taken a keen interest in tracking of users by apps like Snapchat.
Disclosure: Guardian News & Media is an investor in the parent company of Gigaom. Post and thumbnail photos courtesy of Rani Molla and the Guardian