The administrator of a website that let anyone enter the phone numbers of two or more WhatsApp users, and see in an easy to understand visualization when each person was using the app, potentially indicating who was talking to who, has blamed WhatsApp for allowing such a capability to exist.
The comments come after Motherboard reported how WhatsApp stands by its decision to not let users turn-off a feature that displays when they are using the app, despite the privacy risks that this can pose as well as specific security issues for people who may face stalkers or abusive partners.
Videos by VICE
“We feel Whatsapp should remove online statuses access from numbers that are not mutual contacts. This is the only reason we can operate, if they do that us and all the other apps who do the same will not be able to operate,” the administrator told Motherboard in an email.
Do you know about any other ways that abusive partners are leveraging technology? We’d love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.
In WhatsApp, all users display an “online” notification under their profile picture when the app is open. As cybersecurity company Traced found, there are multiple online services that leverage this feature to allow people to easily check whether a WhatsApp user is online without having to start a chat with them, and some of them specifically market themselves for tracking suspected cheating spouses.
Motherboard then spoke to someone who is the administrator of at least one of those sites, via the contact email address on the website. The service offers users the ability to see anyone’s online history, receive push notifications when the target does go online, and even predict whether two people are speaking to each other by mapping out their WhatsApp activity.
The administrator told Motherboard they “track sleep patterns, use regression analysis to give you probability of a chat between two people, for us it’s just a fun (albeit challenging) way to shed light on the privacy issue.”
At the time of writing, the tracking functionality of the website is not working. On Thursday, WhatsApp told Motherboard it took action against another specific WhatsApp tracking site by suspending the site’s related WhatsApp accounts and sending a cease and desist letter. WhatsApp told Motherboard it believes the same person is behind both sites. The administrator of this second site declined to tell Motherboard whether they also operated the first site. Although the tracking functionality is currently not working, Motherboard is not naming the site in case it becomes operational again in the near future.
“At this point we make no profits, and yes Facebook does shut down accounts and it’s a bit of a whack a mole game that we really don’t want to play. And yes they usually win,” the administrator said. The website charges users around $3 a week or $10 a month after a free trial period, according to Motherboard’s tests.
“We are considering stopping to playing this game to focus on other projects, we feel the point has been made repeatedly and we salute FB for their ability to fight back effectively but it would be so much easier if they removed Online status access from non-mutual contacts, for the privacy of their users, not for us,” they added. The tracking website explicitly markets itself for spying on spouses.
“We listen closely to feedback from users and we’ve heard that knowing when someone in their contacts is ‘online’ provides a sense of closeness when friends and family are chatting with one another,” a WhatsApp spokesperson previously told Motherboard. A WhatsApp spokesperson reiterated that their previous statement stands.
Eva Galperin, the director of cybersecurity at the Electronic Frontier Foundation, previously told Motherboard that the inability to hide whether you’re online on WhatsApp “seems like a problem rather than a fucking feature.”
Subscribe to our cybersecurity podcast CYBER, here.
