Why weasel words might not work for Whisper

Sex-obsessed and worth his weight in gold

Whisper denies that it is abusing its users' trust by keeping data on them that enables them to track people it deems newsworthy. But a quote that featured in the Guardian's original piece on the firm highlights just how easily that information can be abused.

The article noted that Whisper's staff were following a specific individual who they said was a "sex-obsessed lobbyist in Washington DC". The staff even had a nickname for him: '50 shades of grey'.

The Guardian quoted one executive as saying: "He’s a guy that we’ll track for the rest of his life and he’ll have no idea we’ll be watching him."

In case you're wondering, the Whisper pasted above is from that lobbyist. You won't be able to find other examples of his Whisper posts because his username is not displayed and because he has turned off geolocation.

But The Guardian was able to find him while at Whisper's offices, as well as his previous posts, and his location within a few blocks in Washington. How? Because when you download the Whisper app it creates a unique identifier. That identifier is applied to every user of Whisper, even if they wish to remain anonymous, even if they turn off geolocation, and even if they uninstall the app.

"It should therefore be considered a permanent unique id," explained security researcher and iOS expert Jonathan Zdziarski.

Whisper has hit back hard on this damning piece of evidence. Then editor Zimmerman claimed the quote was "100 percent fabricated".

.@kevinroose NO. That is probably the most egregious lie of the bunch. 100% fabricated.

— Neetzan Zimmerman (@neetzan) October 16, 2014

And claimed no such person exists:

@nandayadav it is a fabrication because it was never said, and no such person exists.

— Neetzan Zimmerman (@neetzan) October 17, 2014

What does Whisper CEO Michael Heyward have to say about it? "I'm deeply troubled by this quote, which does not reflect our values."

Aside from the fact that Whisper employees are actively searching for people and content on their "anonymous" service that they think might prove newsworthy i.e. valuable, note that Heyward does not dispute the fact that it demonstrates his company is capable of tracking every user of its service whenever it feels the incentive is sufficient.

Other details

There are a range of other damning details in the response, such as a nonsensical response to the fact that Whisper tracks users to within 500 metres when it doesn't need to.

Or that it claims: "We do not track users passively or actively" and then in the same paragraph explains that its staff go through a user's previous posts to "determine their authenticity".

Or that it plays semantic games with the fact that it hires a team of people in the Philippines to review content, raising questions over its claim to keep all user data within the United States.

Or that it denies the Guardian's claims that it changed its terms and conditions after the newspaper said it was publishing a story on them and publishes emails "proving" that they were reviewing the terms and conditions beforehand but redacts every single word of the exchanges so we have no idea what changes were being looked at and why.

All of those unpleasant holes in Whisper's defense are immaterial because of the following three questions and answers.

1. Can Whisper track its users? Yes.
2. Does Whisper track its users? Yes.
3. Does Whisper's current business model only make sense if it is able to track its users? Yes.

Read Heyward's full response below:

Whisper CEO "Setting Record Straight" by kierenmccarthy