Ignorance at Apple and Whisper
Quick question: What do Whisper and Apple have in common? That’s right, both are currently being publicly flayed for perceived privacy violations. More specifically the public is in an uproar after discovering that their respective software is sending personal data from their device to corporate servers, much to their surprise.
If you’ve read just about anything I’ve written in the past 3 years you know how I feel about companies that do things that surprise the consumer, but the situation with these two companies is a little unique but becoming more common. Their perceived violations wouldn’t have been easily resolved in the traditional manner – with more precise policies or via policy compliance audits.
If you’re not up on the latest in the Whisper scandal to follow is a brief summary. After garnering some attention from an article in The Guardian, Jonathan Zdziarski, performed a forensic analysis of Whisper’s app revealing that, regardless of what privacy options the user selects, the app will send a unique id of the phone as well as location information back to Whisper. The CTO of Whisper explained that the data is fuzzed (obfuscated to the point of anonymization) once it reaches the servers and therefore abides by their policies — which I guess is true. However, they are still being crucified for not following best practices. If they developed the app with security and privacy in mind, the fuzzing would happen on the device itself, not on the server. That way Whisper couldn’t retrieve that information even if they wanted to.
With an app that promises secrecy and privacy, this consideration should have been baked in at the beginning (cue call for privacy engineering). The person in charge of privacy at Whisper could have prevented this if they had the capability to do code reviews and/or the wherewithal to do a basic forensic analysis of their software before releasing it. My guess is that the CTO likely didn’t consider these things during development and their general counsel (or whoever handles privacy) probably doesn’t have the experience or training to know what to look for.
At Whisper mistakes were made, but if they work to fix them, then I could easily forgive them. I don’t think they had any malicious intent and this was likely just an oversight. Apple however should know better as they’ve been down this road before.
Apparently the latest release of OSX is sending some sensitive information from the user’s computer back to Apple by default and the preferences to change that default aren’t easily discovered. Apple has some of the best minds in the world working on their products and they have been accused of being privacy insensitive in the past. Given Apple’s resources, history and position in the market, this kind of oversight is harder to forgive.
The bottom line, in today’s hyper-sensitive environment, privacy needs to be a top consideration and it doesn’t really matter where in the organization privacy is managed, that function (whether that is one person or a department) needs to have a basic understanding of technical underpinnings of their products and services. That includes an understanding of the application development lifecycle, network traffic analysis, encryption protocols and data management techniques. Without those skills privacy gaffe’s are going to bite these companies over and over again.