Whisper chief executive answers privacy revelations: 'We're not infallible'

http://www.theguardian.com/world/2014/oct/19/-sp-whisper-chief-executive-on-privacy-revelations-were-not-infallible

Version 0 of 1.

The chief executive of the “anonymous” social media app Whisper broke his silence late on Saturday, saying he welcomed the debate sparked by Guardian US revelations about his company’s tracking of users and declaring “we realise that we’re not infallible”.

Michael Heyward’s statement was his first public response to a series of articles published in the Guardian which revealed how Whisper monitors the whereabouts of users of an app he has in the past described as “the safest place on the internet”.

Whisper hosts 2.6 million messages a day posted through its app, which promises users a place to “anonymously share your thoughts and secrets” and has billed itself as a platform for whistleblowers.

The Guardian’s disclosures, which were based on a visit to Whisper’s headquarters and detailed conversations with its executives, prompted privacy experts to call for a federal inquiry into the company.

Heyward, who stayed silent for more than 48 hours, came under intense pressure to respond to the controversy. His statement was posted on a blog late on Saturday.

Unlike other Whisper representatives, who have strongly denied the disclosures, Heyward did not dispute the accuracy of the Guardian’s reporting. But he insisted his company was founded on “honesty and transparency” and indicated Whisper would take firm action against employees who breach those values.

“Above all else, we always strive to do right by our users,” he said. “We have zero tolerance for any employee who violates that trust.”

Heyward expressed “dismay” that the Guardian, which had previously collaborated with Whisper on three small projects, “published a series of stories questioning our commitment to your privacy”.

“While we’re disappointed with the Guardian’s approach, we welcome the discussion,” Heyward said. “We realise that we’re not infallible, and that reasonable people can disagree about a new and quickly evolving area like online anonymity.”

In formal responses to the Guardian’s reports, Whisper had insisted it “does not follow or track users”. Heyward, however, said only that Whisper does not “actively” track users.

The 27-year-old CEO’s remarks contrast with those of his editor-in-chief, Neetzan Zimmerman, who mounted an offensive immediately after the reports were published, accusing Guardian journalists of fabricating quotes and denouncing the reports as “a pack of vicious lies”.

The Guardian witnessed how Zimmerman’s editorial team monitors the movements of certain users during a three-day visit to the company’s California headquarters to explore the possibility of future editorial collaboration. Two Guardian reporters were given access to Whisper’s back-end tools and spoke extensively with company executives.

Zimmerman’s team uses an in-house mapping tool to research the movements of users who have opted into geolocation services, using GPS data which is “fuzzed” to be accurate within 500 metres of where messages are posted. The reporters witnessed how Zimmerman’s team tried to determine the “veracity” of potentially newsworthy users by researching their location, sifting through their trail of previous posts and and tracing their movements over time.

When researching users who had disabled geolocation services – preventing the company from accessing their GPS-based data – Whisper executives explained how the editorial team instead relied on IP data to work out a targeted user’s approximate location.

Zimmerman contested the Guardian’s detailed account of those practices, saying it was “100% false” and “a 100% lie” to say the editorial team ever accessed rough location data for people who have opted out. “When I specifically say that they are lying, that’s what I mean – that does not happen, and it simply can’t happen,” he told the tech news site Gigaom.

However, Whisper’s senior vice-president, Eric Yellin, had already acknowledged the practice, telling the Guardian before the stories were published: “We occasionally look at user IP addresses internally to determine very approximate locations.” The admission was made in an email exchange about the location-tracking practices of Whisper’s editorial team.

Heyward acknowledged in his statement on Saturday that Whisper collects IP data which can infer rough location data but did not specify how that information is used – except to say it is sometimes shared with law enforcement. Heyward also acknowledged that Whisper does look at the past activity of some users on the app to “assess the authenticity” of their posts.

Heyward also responded to the Guardian’s disclosure that Whisper was sharing user information with a suicide prevention study run by the Pentagon, based on smartphones the social media app can pinpoint to military bases. Users had not been told about the research. Heyward said Whisper was “proudly working with organisations to lower suicide rates, including the Department of Defense’s Suicide Prevention Office”. He added: “We can’t wait to establish more of these relationships and effect real change.”

The Guardian also revealed on Thursday that Whisper was developing a version of its app to comply with Chinese censorship laws, and indefinitely archiving data, including messages users may think they have deleted, in a database. Heyward’s statement did not address those disclosures.

His company had built media partnerships with the cable TV channel Fusion and the online news website Buzzfeed, and was searching for new partners. Heyward said a key part of Whisper’s mission was to “shine a light” on important social issues, and his blogpost linked to stories that have been published on Buzzfeed. “We look forward to continuing this important work with our partners,” Heyward said.

Both Buzzfeed and Fusion have suspended their partnerships with the social media app in the wake of the Guardian’s revelations.

Heyward said changes to Whisper’s terms of use and privacy policy were “not related” to the Guardian’s reporting. Whisper rewrote its terms of service on Monday – four days after learning the Guardian planned to publish details about its business practices.

Heyward said these changes were finalised in July and were due to be published in October, along with a new website. Heyward did not mention the update to Whisper’s terms of service that occurred in September. Explaining the decision to change the terms of service, again, on Monday, he said: “Our communications with the Guardian made it clear that our users would benefit from seeing them sooner”.