Biz & IT —

WhatsApp’s idealism and Facebook realism: A study in contrast

In a sea of piratical apps, WhatsApp swears you can trust it with your data.

The red disk, or the green disk? The choice is yours, Neo.
The red disk, or the green disk? The choice is yours, Neo.
United Artists

WhatsApp founder Jan Koum asserted again in a blog post Monday that Facebook's acquisition of his company does not mean that WhatsApp's internal values will change. Koum called speculation that WhatsApp will turn traitor to its users' data not just "baseless and unfounded" but "irresponsible," countering the concerns of privacy advocates.

Since Facebook laid out its $19-billion plan to acquire WhatsApp, both users and expert onlookers have derided the partnership as an opportunity for Facebook to make a massive data-grab to correlate with its own user information troves. Last week, the Electronic Privacy Information Center and the Center for Digital Democracy filed a complaint with the Federal Trade Commission out of concern for how WhatsApp might treat its customers going forward, particularly when many of its users sought the app out for its commitment to privacy.

Per WhatsApp's privacy policy, the company stores virtually no customer information, not even phone numbers—messages are associated with a phone number "dynamically" on each device, according to Koum. The only thing the company stores are messages that go undelivered, which are deleted after 30 days. The FTC complaint focuses on the importance of giving notice to WhatsApp's customers if its backend practices were to change and concerns that those practices are likely to change given its new owner.

In his post, Koum shared information about his birth in Ukraine, growing up in the USSR in the '80s, and a mother who frequently refused to pass certain types of information over the phone. "I want to make sure you understand how deeply I value the principle of private communication. For me, this is very personal," wrote Koum.

"Respect for your privacy is coded into our DNA, and we built WhatsApp around the goal of knowing as little about you as possible," Koum continued. WhatsApp does not collect most types of data, he wrote. It has never been stored on WhatsApp's servers, "and we really have no plans to change that. If partnering with Facebook meant that we had to change our values, we wouldn’t have done it."

Koum emphasized that the partnership will allow WhatsApp to "continue operating independently and autonomously… Facebook will not compromise the vision that brought us to this point."

The effort that Koum is making to reassure his customers is greater than those we typically see from the targets of an acquisition. When Facebook acquired Instagram, for instance, founder Kevin Systrom made no assurances about data sharing between the two entities. Instead, he focused on keeping the services and customer experience the same: "The Instagram app will still be the same one you know and love. You’ll still have all the same people you follow and that follow you." In the intervening period, Instagram has added advertisements and the ability to post videos, paving the way for very lucrative video advertisements (which have not come to pass, but all the pieces are in place).

However, because Instagram was not an app born with the same privacy priorities as WhatsApp, it had far fewer reassurances to make about how it might change. As far as its privacy policy went, Instagram always availed itself of the available consumer data, whereas WhatsApp specifically did not, and does not.

Facebook's desire for consumer information is as legendary as the slippage of its concern for users' privacy. Having earned many users' information with one site setup that valued privacy with invisible profiles and locked-down search, Facebook slowly pushed its users and their information into the limelight, both for other Facebook users to see as well as for third parties, as when its Beacon program showed users what others were buying on third-party websites.

Granted, Facebook never promised not to put its users' data to new and different uses as its needs changed; to do so would have easily fenced the company in or landed it in hot water. Companies rarely put limits on future uses of the data they collect, so even if a certain type of usage might surprise or upset users—like when Snapchat began displaying users' most frequent messaging partners—there is often little the user can do.

Hence, WhatsApp's statements are not only strong, but highly unusual. While ownership has transferred, Koum now has a seat on Facebook's board of directors, so he is still positioned to protect the app. It's refreshing to see an app founder not only stick to his guns, regardless of what those guns are, but also stand up for pro-consumer privacy policies.

But there are some side concerns about WhatsApp's commitments, too, in light of the number of security flaws the app has displayed over the last year, including vulnerabilities that expose message histories locally and allow sent communications to be easily decrypted. While the app ideologically protects its users, it seems to have some trouble putting its ideas into practice.

Koum's idealism is clearly deep-rooted and admirable, but it's still not wholly reassuring. Facebook itself has promised only to operate WhatsApp as a standalone application and that its "brand will be maintained," and it has not echoed any of WhatsApps' commitments to privacy. Koum is clearly committed to protecting his customers, but the issue remains that, under new ownership, the customers are no longer solely his to protect.

Channel Ars Technica