Investigation finds 'anonymous' Whisper app secretly tracks user location

Following all of the NSA revelations, mass surveillance has increased the general level of paranoia to be found online -- although it could be argued that not all surveillance is bad. With everyone on such high alert it's little wonder that an app that described itself as "an anonymous social network that allows people to express themselves" should be so popular. Whisper encourages users to embrace the supposed anonymity it offers and reveal secrets they would not otherwise feel comfortable sharing.

An investigation by the Guardian found that the app is tracking the location of its users -- even those who have opted out of such tracking. As a result of the Guardian's report, Whisper amended its terms of service and introduced a new privacy policy. But the revelations will cause concern to users of the service, who sent more than 2.5 million messages per day.

Despite the claims of anonymity, Whisper is in fact able to determine the location of users to within 500 metres. Does this matter? Some of the messages posted via Whisper have been found to originate from within the White House -- one that reads "I'm so glad this app is anonymous. The press would have a field day if they knew some of the stuff I post on here", for example. Whisper assures its users that "We collect very little information that could be used to identify you personally" -- which you'll notice is very different to saying no data is collected.

The Guardian learned about the existence of in-house tools that Whisper can use to plot the location of messages on a map. Perhaps most worrying, this includes those users who has explicitly opted out of sharing their location. The privacy statement does state that "we use the information that we collect from you for internal purposes", but few users would expect that their expressed wishes would be directly opposed. The Usage Data section of the privacy documents states that "even if you have disabled location services, we may still determine your city, state, and country location based on your IP address".

The privacy page also now says that using Whisper means that it is possible "to make a determination as to your identity based on the content of your whispers as well as your general location". Whisper reveals that user data if often stored outside of the US: "This may be important to you, as the laws of the United States or such other countries may not be as protective of your personal information as the laws of your jurisdiction."

User location is valuable data, Like many other services, Whisper is keen to provide content that will be of interest to individual users -- this is very hard when dealing with "anonymous" users. But location can reveal a great deal about a user, hence Whisper's keenness to gather such information. The data could also be shared with third parties: "We may also partner with universities or other research institutions or scientists to use the limited information we have in anonymous, controlled research studies".

The Guardian's investigation also found that Whisper was sharing information with the FBI and MI5 for legal reasons, and working with the US Department of Defense to provide data about suicide and self-harm.

Michael Heyward, co-founder and CEO of Whisper, has described the service as "the safest place on the internet". In the light of the revelations, many users might disagree.

Photo credit: Lightspring / Shutterstock