Flawed reporting about WhatsApp

https://www.theguardian.com/technology/commentisfree/2017/jun/28/flawed-reporting-about-whatsapp

by Calvin02 • 9 years ago

354 121 9 years ago

Good on them for admitting to all these flaws. I'm especially interested in the fact that government officials seem to be citing articles to push people to certain communication channels.

majewsky• 9 years ago

Hint: If site is empty for you, remove "amp." from domain name.

yorwba• 9 years ago

FWIW, the site worked completely fine for me in Firefox with JavaScript and cookies disabled, and even Lynx worked (but shows some mustache syntax that would be hidden by CSS otherwise).

michaelt• 9 years ago

If you enable JS from theguardian.com but disable JS from ampproject.org the result is a blank page.

Alupis• 9 years ago

You can also try using something like fixamp.com[1] ... not as good as having the real url from the start, but worth it for more complicated url's.

[1] https://fixamp.com/

gtf212• 9 years ago

I think this is a really thorough mea culpa which is quite impressive, given the frequent failure of other newspapers to publish a prominent apology when they have got things far more wrong than this.

moyix• 9 years ago

Yes. It would be nice if they hadn't taken 6 months to get around to it, though...

masklinn• 9 years ago

I think this is a really thorough mea culpa which is quite impressive

It took almost 6 months of badgering for that to finally happen though, despite an extensive and widely signed (by experts) op-ed pointing out how wrong and dangerous it was barely a week after the original article was published, and calls for corrections/retractions started within days if not hours.

given the frequent failure of other newspapers to publish a prominent apology when they have got things far more wrong than this.

Getting things "far more wrong" matters less when it doesn't put lives at stakes, and you don't need to believe me on that, this correction article makes that point:

During the review I independently confirmed that a Turkish government official had used the article when, in effect, attempting to deter users from WhatsApp.

Osmium• 9 years ago

It took almost 6 months of badgering for that to finally happen though, despite an extensive and widely signed (by experts) op-ed pointing out how wrong and dangerous it was barely a week after the original article was published, and calls for corrections/retractions started within days if not hours.

Completely agreed, but they do fully concede this in their retraction:

This made a relatively small, expert, vocal and persistent audience very angry. Guardian editors did not react to an open letter co-signed by 72 experts in a way commensurate with the combined stature of the critics and the huge number of people potentially affected by the story.

It might have taken a while for their internal review to complete but, honestly, what more can we ask for but an honest admission like this? If more media outlets could meet this standard we'd be in a much better place.

segmondy• 9 years ago

No it's not. They were called out immediately and yet refused to correct themselves.

the_watcher2• 9 years ago

It absolutely was a thorough mea culpa. You are also absolutely correct that it was not, at all, a timely mea culpa. The lack of timeliness makes it a much less impactful mea culpa, as public consciousness of the issue is likely drastically reduced, and there will likely be many who now remember the initial uproar but never see the correction.

loeg• 9 years ago

It would be nice if the very second sentence of the "mea culpa" wasn't a defense of the original article.

iaw• 9 years ago

Did you read it? This is a lawyers carefully worded article to avoid being sued...

"I accept the consensus view of the experts and, in consultation with editors, have arranged for the coverage to be amended and for a note to be added drawing attention to the review and linking to this column.
I do not agree with critics that the story should be entirely retracted."

Huh? Accepting a consensus view is a really shifty way to avoid acknowledging being blatantly wrong.

gtf212• 9 years ago

Did you read it?

I try to avoid making a habit of commenting on things without reading them, and also of over-quickly assuming that others do so.

This is a lawyers [sic] carefully worded article to avoid being sued [...] Accepting a consensus view is a really shifty way to avoid acknowledging being blatantly wrong.

This leads me to question whether you read the article, or simply picked out snippets to support your preconceptions. Let's take some other quotations:

In a detailed review I found that misinterpretations, mistakes and misunderstandings happened at several stages of the reporting and editing process. Cumulatively they produced an article that overstated its case.
The most serious inaccuracy was a claim that WhatsApp had a “backdoor”

^ these look like an acknowledgement to me.

Furthermore, to refute your selectively used quotation above:

I am not an expert in this field. For the review I consulted suitably experienced experts other than the 72 who had already declared their view. [...] I found a consensus that [...]

The author is accepting the consensus view amongst the experts with whom he spoke, since, as he acknowledges, he is not an expert in the field. This seems to me to be an emminently sensible approach, which most journalists would do well to follow.

wolf550e• 9 years ago

non-AMP link: https://www.theguardian.com/technology/commentisfree/2017/ju...

nneonneo• 9 years ago

Mods: please make this the canonical link; AMP links force mobile layouts which are suboptimal on desktop.

roywiggins• 9 years ago

AMP links break apps on mobile too, the Guardian app tries to open guardian.com links, but AMP breaks that.

Mind you, stories load faster via AMP than the app, but still.

dom0• 9 years ago

Incidentally, I wondered whether the Guardian has blocked the site or did something stupid, since the page took so long to load. I thought AMP stands for ACCELERATED?

Edit: Actually, repeated loads take exactly as long (seven full seconds); but the scrollbar already has the correct page size. Probably some buggy scripting.

kronos29296• 9 years ago

Why would anybody want AMP link on a PC? I am fuming with hate on AMP. This should be made the link instead of the current one.

Reason077• 9 years ago

AMP-on-the-desktop: It looks kinda weird but it loads super fast!

dang3• 9 years ago

Thanks. We changed to that from https://amp.theguardian.com/technology/commentisfree/2017/ju....

You can get faster results by emailing hn@ycombinator.com. Not to mention more reliable; I only saw this randomly just now.

dphnx• 9 years ago

Non-AMP link: https://theguardian.com/technology/commentisfree/2017/jun/28...

ReverseCold• 9 years ago

Isn't this amp hosted on their own server? What's wrong with that?

danjoc5• 9 years ago

This is not the original Title. Submitter is editorializing via title. Please don't do that on Hacker News.

mikestew• 9 years ago

The title of the article from the linked page is, “Flawed reporting about WhatsApp”. What editorializing are you referring to, and what is your suggested title?

QUFB• 9 years ago

Per HN guidelines (https://news.ycombinator.com/newsguidelines.html):

* If the original title begins with a number or number + gratuitous adjective, we'd appreciate it if you'd crop it. E.g. translate "10 Ways To Do X" to "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the number is meaningful, e.g. "The 5 Platonic Solids."

* Otherwise please use the original title, unless it is misleading or linkbait.

danjoc5• 9 years ago

The submission guidelines are clear about this.

https://news.ycombinator.com/newsguidelines.html

Use the original title. I've seen many informative titles smacked by this and made less informative. Here, an informative title is made less informative and clickbaity, with no action taken so far.

captainmuon3• 9 years ago

Why not? I think this title "Guardian admits WhatsApp story was flawed" reflects the content better. The original title "Flawed reporting about WhatsApp" could have meant many other things. For example, the article might have complained about flawed reporting of other newspapers.

I like this title better, and the likelyhood that I'd have clicked on it would have been less with the original.

Just because somebody wrote that rule down doesn't mean you have to follow it, much less enforce it. Do you believe in it yourself, in absolutely every case, or do you follow it just because it is a rule? I'm not trolling, just curious. I find to many people on the net follow rules blindly. Rules are crystallized attitudes of communities. They shape the community, but the community also shapes the rules. If people would never break a rule, not even a little bit, they would either never change, or only change to be more strict over time.

Why am I loosing so many words over this? Why do I say you shouldn't bother that much, but then myself bother so much to write this? Because I don't want the moderation on HN to become like Wikipedia or Stack Overflow.

aendruk• 9 years ago

Why not?

Personally I couldn't care less about the "Guardian admits…" narrative. The article is a genuinely informative analysis that would be done a disservice to be framed as support for an apology.

danjoc5• 9 years ago

Do you believe in it yourself, in absolutely every case, or do you follow it just because it is a rule? I'm not trolling, just curious.

I don't think you're trolling. I understand your viewpoint. I'm against selective enforcement. If there's a rule, and it isn't applied evenly to everyone all the time, it is a weapon of oppression. It is like the electronic form of white privilege.

jMyles• 9 years ago

You are being downvoted substantially, but I think that, although it's not a huge deal, you're right. A better title is simply: 'Guardian: "Flawed Reporting About WhatsApp"'

dang3• 9 years ago

We changed the title back to the original a while ago.

Submitters: please don't rewrite titles unless they are misleading or linkbait: https://news.ycombinator.com/newsguidelines.html.

The idea on HN is to let readers make up their own minds. If you'd like to say what you think is important about a story you submit, that's fine, but please do so in the comment thread. Then your view is on a level playing field with everyone else's.

lern_too_spel• 9 years ago

Maybe one day they'll issue a correction for their PRISM reporting too. The solution is exactly the same as the solution in this case: the editors should demand that the journalists verify their claims with experts.

tptacek3• 9 years ago

This is getting downvoted, but reporting on PRISM was egregiously flawed in ways that created myths about what PRISM is that persist to this day.

willstrafach6• 9 years ago

I think it is too late - Any refuting of the original narrative will get you labeled a shill, "JTRIG", or discussion turns to "well you can't know what is going on for sure"

te_chris• 9 years ago

For those who don't know, newspapers often have a Reader's editor whose job it is is to criticise and be the voice of the readers inside the newspaper. In this case, this is written by that person for the Guardian after what would appear to be a thorough investigation of the matter.

There's a lot of people here saying this should have happened faster, they're likely right, but also, given how extensive and thorough this is, it is more likely an example of how old-school editorial rigour just takes a lot of time.

stdbrouw• 9 years ago

Actually, and sadly, very few newspapers still have ombudsmen.

chishaku• 9 years ago

Like the NYT, which just eliminated their public editor role.

Freak_NL• 9 years ago

The New York Times retiring their ombudsman was high profile news, but is there actually a trend of (quality) newspapers removing that role from their staff? The NYT move was widely criticised by its peers (not just by the other ombudsmen, but by the newspapers themselves in their respective editorials).

dublinben• 9 years ago

I'm just glad to know that their ombudsman has safely returned from their vacation.[0] Some of us were getting worried.

[0] https://twitter.com/zeynep/status/826872065009422336

eridius• 9 years ago

6 months isn't just "a lot of time". 6 months is "let's wait until everyone completely forgets about this and hope we can slide the apology under the radar".

egeozcan4• 9 years ago

I feel that it took long because the security "issue" is not discussed on technical merits anymore.

The technical side of the study is very well understood by practically anyone. People have different type of opinions on the matter not because they misinterpret the technical details but because they have different expectations on how the privacy situation will end up being for different groups in the light of this knowledge.

So all of this makes it way harder to define if the story was overblown or not. Apparently Guardian editors ended up thinking that it was indeed, after giving it a long consideration. This is not a technical fact (and it cannot be), it is just their interpretation of it (and also the interpretation of many security experts but that's not the point).

idlewords5• 9 years ago

The public editor, in private communication, attributed some of this delay to his difficulty in finding independent experts who hadn't signed the open letter.

Apparently if you're so wrong that an entire field disagrees with you, you can get anything printed in the Guardian.

untog• 9 years ago

It's a kind of interesting problem to have. I can see the logic in trying to find someone not on the letter to verify that what it says is true... but when literally everyone agrees, the logic falls apart.

I suspect this might be the side effect of excessive CYA. I'm not happy with it, but there have been so, so many articles that get the basic premises of tech completely wrong that I think I'd still rather them take an excessive amount of time checking than publish another ill-informed piece.

baby• 9 years ago

Come on. Not everyone in the field signed the letter.

nikcub• 9 years ago

attributed some of this delay to his difficulty in finding independent experts who hadn't signed the open letter.

They emailed me asking why I hadn't signed and if it meant that I didn't agree with the petition.

Funny thing, two reasons why I hadn't signed. First, it was because I only caught the petition when it was already deep with many people I respect a lot and I felt I added nothing

And second, I was conflicted because i'd previously had a disagreement with The Guardian on another story that got kicked up all the way to editorial and I felt was never adequately resolved and was largely swept under the rug.

After that experience I didn't feel that The Guardian were genuinely going to make a best effort to resolve what was their own mess, again.

edit: to add, it drives me fucking nuts every time I hear someone repeat "I heard WhatsApp is insecure". Thanks again, Gruardian.

jolic5• 9 years ago

More likely that The Guardian weren't very good at finding any experts before or after the story. Apparently if you don't expose a distinguishable interface to the rest of the world journalist won't find you.

jsl1212• 9 years ago

It's their institutional lack of "old-school editorial rigour" that got them into this mess. The article gives no indication of what they have done or will do to prevent such poor reporting going forward. In the six months it took them to publish this they could have taken some steps to ensure their team has the resources it needs to better report on these areas in the future. Unfortunately, I think this op ed is too little too late for the Guardian as far as their credibility is concerned.

nailer• 9 years ago

It was already too late for The Guardian's credibility when they reported that Mark Duggan was 'unarmed' before the 2011 riots.

Here's their apology: https://www.google.co.uk/amp/s/amp.theguardian.com/media/201...

idlewords5• 9 years ago

It astonishes me that the Readers' Editor, someone with long experience in journalism, thinks retracting this story would mean taking it offline as if it never happened.

Frankly, I think this is a weak response. There is nothing in this investigation they could not have cleared up in January; instead, they dawdled and now they equivocate.

eehee2• 9 years ago

This entire conflict just seems completely absurd to me - why on earth are the 72 "experts" who signed the open letter so quick to trust WhatsApp without access to the source code?

WillyOnWheels• 9 years ago

I doubt that would satisfy the anti Whatsapp crowd. It's impossible to know what binary Facebook/Whatsapp runs on their servers.

idlewords5• 9 years ago

The point of end-to-end encryption is that it doesn't matter what they run on their servers.

g-clef• 9 years ago

The experts (no scare quotes needed, they really are experts) were commenting on the story's facts as presented. There was no need to read the source of whatsapp, as the facts as stated in the original article were overblown and based on fundamental misunderstandings of cryptography.

The entire story was based on the question of "what do you do when someone you're communicating with using encryption changes keys?" Whatsapp chose to dynamically use the new key, rather than fail & force the user to verify the new key in some out-of-band way. This was described as a "backdoor" in the guardian story. That was simply false. Even calling it a vulnerability is a mis-understanding of how cryptography works and of the risk involved in that design decision.

eehee2• 9 years ago

Thank you for actually replying instead of downvoting...and I'll admit, the scare quotes may have been a bit too much!

That said, the open letter plainly states "WhatsApp effectively protects people against mass surveillance."

How do they know? From this, and the entire tone of the letter, it looks to me like they're still implicitly trusting that WhatsApp does what it claims to do. I see absolutely no reason to do so, and am utterly baffled that top security experts do.

chicob• 9 years ago

Speaking of security, the new possibility of a Google Drive backup for WhatsApp messages and files has been quite overlooked imo.

This backup is not e2ee, which means that if the other part is backing up data in Google Drive, then at least part of you WhatsApp history is not e2ee. Yes, it might be encrypted whithin Google Drive by whatever secure methods Google chooses, but not by you.

acchow• 9 years ago

Pretty much every single person I know outside of the Bay Area and not working in tech believes that the government and the corresponding corporations running the service are reading all of their messages on:

* Whatsapp * FB Messenger * iMessage * Hangouts

They also all believe that the police can look at their Facebook posts because they have special access.

This is precisely why there was minimal reaction to the Snowden revelations - what revelations?

deepnet• 9 years ago

This is precisely why there was minimal reaction to the Snowden revelations - what revelations?

Or perhaps the 1984 Orwellian explanation - fear of surveillance curtails dissent.

E.g. perhaps there was minimal reaction because while people had always joked about the Govt. reading their messages, when Snowden revealed it was utterly true, and way worse than anyone had supposed, they became afraid to voice dissent about surveillance.

They were right to fear this as Snowden's stated reason for whistleblowing was not the existence of mass surveillance but because the mass surveillance was not for national security but its primary goal was to protect the program of mass surveillance.

Snowden revealed this: that the primary mission of the spying was to keep the spying secret and those who opposed the spying faced the greatest extra-legal retaliatory attacks. [1]

As the recent cataclysmic cyber attacks have shown national defense was not a priority for those 3 letter agencies developing weaponised exploits.

The weaponised exploits they screwed us all over by letting fall into the wrong hands, e.g. Wannacry an American state sponsored cyber-weapon funded by US tax-payer monies that wrecked the UK's National Health Service and now threatens international shipping - oopsie.

[1] Snowden outlines his reasons for turning whistleblower in this conversation with Chomsky & Greenwald https://www.youtube.com/watch?v=IOksJKfapVM

jiqiren• 9 years ago

they are correct for two of the above - given a warrant from a court - FB Messenger and Hangouts messages are readable by Facebook and Google.

marcosdumay4• 9 years ago

Google can read any of them. Or anything else on an Android phone with Play (as can Apple on an iPhone).

They very likely don't, but that doesn't mean they can't.

ngrilly• 9 years ago

The linked Guardian's article doesn't really explain why they were wrong. This article by Moxie, designer of the Signal Protocol, is great: https://whispersystems.org/blog/there-is-no-whatsapp-backdoo....

dang3• 9 years ago

https://news.ycombinator.com/item?id=13394900

vzaliva• 9 years ago

It is funny how while reading this article establishing Guardian's screw up I was nevertheless asked twice to give them money.

jancsika• 9 years ago

From the open letter:

"People believe that you perform due diligence on matters critical to their lives and safety."

And at the bottom of the open letter many security experts have signed in support. That is, "signed" in the colloquial sense.

Small digression-- let's say a person tasked with reviewing a story in the Guardian is not an expert in security. They would really love some way to start with one or two security experts they know and trust and "fan out" to other experts based on their relationships.

Is there a quick and easy way for the journalist to do that by looking at the names of cryptographers listed at the bottom of a webpage?

Also: can someone explain what "due diligence" means? Is it the expectation here that a journalist not only report what would look reasonable to a non-journalist reader, but also use their considerable skill to ensure that they present their readers with verifiable facts, to the best of their ability? Even if it takes a considerable amount of time and effort on their part? Even if verifying the evidence relies on clunky, cumbersome tools that no one wants to spend time using?

omnifischer• 9 years ago

Sad that the writer (calling herself investigative journalist - https://twitter.com/manisha_bot ) of the flawed article does not even mention the amended article in her twitter account.

Flawed reporting about WhatsApp

Related Stories