'Anonymous' Whisper app tracks its users and shares data with authorities
Anonymity claim rings hollow as company follows people who ask not to be, stores deleted messages and passes information to authorities
PUBLISHED : Saturday, 18 October, 2014, 4:53am
UPDATED : Saturday, 18 October, 2014, 4:53am
The Guardian
The US version of Whisper enables people to publish short messages superimposed over photographs or other images.
The company behind Whisper, a social media app that promises users anonymity and claims to be the "the safest place on the internet", is tracking the location of its users, including some who have specifically asked not to be followed.
Whisper is also sharing information with the US Department of Defence gleaned from smartphones it knows are used from military bases, and is developing a version of its app to conform with Chinese censorship laws.
The US version of the app, which enables people to publish short messages superimposed over photographs or other images, has attracted millions of users, and is popular among military personnel using the service to make confessions they would be unlikely to publish on Facebook or Twitter. Some post from secret bases such as Guantanamo Bay or Diego Garcia.
Asked to comment last week, Whisper said it "does not follow or track users". The company added that the suggestion it was monitoring people without their consent, in an apparent breach of its own terms of service, was false.
But on Monday - four days after learning that The Guardian intended to publish this story - Whisper rewrote its terms of service. It now explicitly permits the company to establish the broad location of people who have disabled the app's geolocation feature.
Whisper has developed an in-house mapping tool that allows its staff to filter and search GPS data, pinpointing messages to within 500 metres of where they were sent. The technology, for example, enables the company to monitor all the geolocated messages sent from the Pentagon and National Security Agency. It also allows Whisper to track an individual user's movements over time.
When users have turned off their geolocation services, the company also, on a targeted, case-by-case basis, extracts their rough location from IP data emitted by their smartphone.
The Guardian has also established that user data, including Whisper postings that users believe they have deleted, is collated in a searchable database. The company has no access to users' names or phone numbers, but is storing information about the precise time and approximate location of all previous messages posted through the app. The data is being stored indefinitely, a practice seemingly at odds with Whisper's stated policy of holding the data only for "a brief period of time".
Whisper's policy towards sharing user data with law enforcement has prompted it on occasions to provide information to America's FBI and Britain's MI5. Both cases involved potentially imminent threats to life, Whisper said, a practice standard in the technology industry.
But privacy experts who reviewed Whisper's terms of service for The Guardian said the company appeared to require a lower legal threshold for providing user information to authorities than other tech companies.
Whisper is developing a Chinese version of its app, which received a soft launch this month. Google, Facebook and Twitter are banned in China. Whisper said it had agreed to the demands the Chinese government places on tech companies operating in its jurisdiction, including a ban on the use of certain words.
