Whisper app that was intended to be a safe haven for anonymity is exploiting a vast library of texts, photographs and, in many cases, the location of their authors – from Guantánamo to the White House

In an elegant warehouse-style building on Venice Beach known locally as “the fortress”, Michael Heyward, a tech entrepreneur, was struggling to control the remote-controlled drone hovering above the heads of his employees.

The 27-year-old son of Andy Heyward, one of cartoon character Inspector Gadget’s co-creators, giggled as the drone came crashing down to the floor, narrowly missing the head of a female developer.

Outside the building, once owned by Hollywood royalty Anjelica Huston, skateboarders, surfers, tourists and the homeless mingled in the Californian sun. It was just another day on Silicon Beach – a name the local tech crowd loathe, but one that has come to define a new generation of savvy, young firms sprouting up in Los Angeles, challenging the tech giants of San Francisco.

One of the hottest new kids on the block is Whisper, the company Heyward co-founded, which is part of a new wave of Venice Beach-based social media companies that have grown up in Facebook’s shadow. Snapchat is next door; Tinder, the dating app, is round the corner.



Whisper’s selling point is anonymity. It describes itself in the app store as “the first completely anonymous social network”.

For Heyward the established social media networks – Facebook and Twitter – have created a dilemma. People can no longer speak honestly; they self-censor for fear of being judged by their peers, colleagues and family, or portray only idealised version of their lives.

Whisper is a platform for the truth, however ugly.



A quick look at the app proves the point. “I push great guys away because I’m terrified they will leave like my dad did. I hate him for causing this,” reads one message you would be unlikely to see on Facebook. “That moment when ur mum tells u she hates u because ur gay 17/M/gay,” reads another.

Hate speech, real names, pornography, drug dealing and other offences are all sifted out of the app. Some 40,000 people mentioning suicidal tendencies have been automatically referred to a suicide hotline. Whisper has set up a nonprofit, Your Voice, to help raise awareness of mental health issues.

Whisper now hosts more than 2.5m messages every day, an outpouring of intimate confessions made on a platform Heyward has described as the “safest place on the internet”.

But Whisper has a secret.

The Guardian was given access to the company’s back-end system – the tool they use to sift through the millions of messages posted via the app each week – and spoke at length with the company’s staff to explore the possibility of an expanded partnership.

Whisper’s internal practices appeared at odds with Heyward’s public declarations, some of the company’s terms of service and, in all probability, the expectations of users who are downloading the app in growing numbers on the assumption it will give them a cloak of invisibility.

The company denies this, pointing to its policy of not collecting information – such as user names, phone numbers or addresses – that would easily identify them. “Whisper does not collect nor store any personal identifiable information from users therefore their privacy and anonymity are always protected,” the company said in a statement.

But four days after Whisper learned the Guardian planned to make public its internal practices, the company quietly rewrote its terms of service and introduced a new privacy policy.

Furnished with an extremely simple password, we were given access to the company’s vast library of texts and photographs and, in most cases, the location of their authors. The company’s developers have created a back-end analytics tool to conduct more refined searches of the database, the most powerful of which pinpoints location.

Whisper’s in-house mapping tool identifies users who have posted from Guantánamo Bay, Cuba, using their GPS data. Occasionally, the company uses IP address location data to establish the rough location of some users who have opted out the app’s geolocation services. Photograph: Guardian

The location information is “salted” – accurate to within a 500-metre radius of a phone, Whisper says – and staff work on the basis that they can identify a user’s street, or neighbourhood, but not usually their home unless they live in a rural area.

But that still allows Whisper to use its mapping tool to trawl for all the users in one place.

There were postings from Guantánamo Bay, Cuba, the US naval facility on Diego Garcia, in the Indian Ocean, the National Security Agency in Maryland and the CIA at Langley, Virginia.

Many of the messages were banal expressions of boredom, or solicitations for sex; some hinted, however vaguely, at potential abuses of power.

On top of a picture of a whip, a user who appeared to be inside the Pentagon posted: “I love being a sadist and breaking women.” A user inside Nevada’s Creech air force base, the remote military compound where US military drones are controlled, posted the phrase “Allah Ahkbar” over a picture of a grenade.

There were 12 Whispers seemingly posted from within of grounds of the White House. One message, superimposed over a picture of President Barack Obama, said: “I’m so glad this app is anonymous. The press would have a field day if they knew some of the stuff I post on here.”

A Whisper user posted this message from the vicinity of the White House. The red dots indicate Whisper messages sent from that location. Potentially identifying information has been redacted by the Guardian. Photograph: Guardian

Of course, just because the user posted from inside the White House, does not mean they work in the West Wing. They could be secret service agent, a cleaner, a journalist or one of the hundreds of visitors given temporary access to the presidential residence each week.

But while Whisper stresses it does not collect information that immediately identifies a user, geographical information, stored over time, leaves a digital footprint of clues to a person’s true identity.

To the public, Whisper postings are disconnected from each other. Users do not have a history of messages that can be looked up and inspected by other users.

But Whisper’s in-house tools do offer that power of investigation. The company’s staff are trawling through past messages – even those the user believes they have deleted – inspecting the precise date, time and approximate location of each message.

Whisper insisted in its statement to the Guardian that it “does not follow or track users”.

The location of users who have turned off Whisper’s geolocation service is not automatically uploaded onto the company’s mapping tool. However the rough location of those users is retrieved, on demand, for a news unit headed by the company’s editor-in-chief, Neetzan Zimmerman.

The company stressed in the statement that this data, based on a phone’s IP address, is a “very coarse and unreliable source of location information”.

Whisper’s interest in delving into the prior movements of users is rooted in the company’s emerging business model. Striving to build awareness for an app that’s in fierce competition with rivals Secret, Yik Yak and now another proposed anonymous message service from Facebook, it is curating and promoting interesting content.

Whisper hired Zimmerman, a former editor at Gawker who specialised in viral content, to lead a concerted push to promote the messages appearing on its app. The company does not see itself as a news organisation as such, but Zimmerman is tasked with turning some of the juiciest confessions appearing on the app into page views and publicity.

But there is a problem. If users are anonymous, how can Whisper know if they are telling the truth?

Hence, the company’s desire to dig into the background of certain users. Location, Whisper has discovered, gives a strong hint of who a user might actually be.

If a user claims to be in the US marines, for example, Whisper will track their movements to see if they’ve spent time on a military base. If a user claims to be a college student, Whisper will track their whereabouts to see if they are based on a college campus.

Those who have opted into geolocation services are easiest to track. For the estimated 20% of users who have opted out of geolocation services, Whisper turns instead to their IP data. These constitute a sizeable portion of users being targeted for special attention by Whisper.

In a widely read Buzzfeed article drawing on 23 Whisper postings about assault in the military, for example, five came from people who had disabled their geolocation services. The article said Whisper had “vetted every account using our back-end tools and filtered out any we thought might be bogus claims” but did not specify how that was done.

The five users who had explicitly opted out of geolocation services, but were featured in the article anyway, included one who said she was gang raped after having an abortion in the army, and another who said they had been were drugged and raped by two marines.

Whisper said in its statement: “Whisper does not request or store any personally identifiable information from users, therefore there is never a breach of anonymity. From time to time, when a user makes a claim of a newsworthy nature, we review the user’s past activity to help determine veracity.”

On Thursday, a Buzzfeed spokesperson said the news outlet is now halting its partnership with Whisper. “We’re taking a break from our partnership until Whisper clarifies to us and its users the policy on user location and privacy,” the spokesperson said.

Zimmerman acknowledges there are complex ethical issues that the tech start-up is still grappling with internally. Like Heyward, he can sound almost evangelical about Whisper’s potential to fulfill a public good.

Both see the company as a potentially trusted haven for whistleblowers, a safe place for people to air their most private thoughts.

But a look behind the curtain at Whisper raises difficult questions about the burden of responsibility the company acknowledges it is shouldering.

“Anonymity is a very powerful tool,” Heyward told a Bloomberg reporter in March. “There’s a Spider-Man quote that says with great power comes great responsibility. It is a famous one. We view anonymity very much in the same way.”