Betrayed by an app she had never heard of

https://www.privacyinternational.org/case-study/2997/betrayed-app-she-had-never-heard-how-truecaller-endangering-journalists

by Brajeshwar • 7 years ago

442 241 7 years ago

privacyinternational.org

duxup5• 7 years ago

This is one of my concerns ever since the first app asked for my contacts.

You could be a mountain man and value your privacy.... but if you just know someone who uses tech you are exposed in any number of ways.

In the US things like third-party doctrine have not aged well in the information age as just communicating with people can expose you in ways you can't ever control.

SmokeGS• 7 years ago

In the US things like third-party doctrine have not aged well in the information age as just communicating with people can expose you in ways you can't ever control.

agreed. it's by design and i don't think anyone will be allowed to escape it

zucker42• 7 years ago

This is why I don't use WhatsApp despite the fact I know many people who use it. To use the app, you have to give access to your entire contacts list. Even if I'm okay with them having my information, I don't feel comfortable consenting for those in my contacts list who don't use WhatsApp.

vorticalbox2• 7 years ago

That's how it know what contacts are using it and auto add to what's app if you it add a number that's using it.

It's just convenience. People don't want add users names they just want it to work.

I believe signal are/were working on a way to work out this information without actually sending to the server

mwambua• 7 years ago

You don't have to give the app access to your contacts... at least on iOS.

That's what I do. It would be impossible to communicate with friends and family otherwise. I just have to put a little more effort into figuring out who's texting or calling me. The app also still shows me people's (self assigned) nicknames in group-chats.

My only gripe is that I still have to give the app access to my photos. I wish there was a way I could give it sandboxed access to only the photos that it adds to the collection.

DarkWiiPlayer13• 7 years ago

This is why I don't use WhatsApp despite the fact I know many people who use it. To use the app, you have to give access to your entire contacts list. Even if I'm okay with them having my information, I don't feel comfortable consenting for those in my contacts list who don't use WhatsApp.

Fun fact, that has technically been illegal for a while here in Germany. There's quite a few videos / articles on how "Using whatsapp is TECHNICALLY illegal". Of course, nobody really complains, so no legal action was ever taken against any user, but it's still a good excuse for me to say "I'm not installing that. It's illegal."

thekyle• 7 years ago

I use WhatsApp without giving it access to my contacts list to chat with one friend who refuses to use anything else. On Android you just have to deny the contacts permission and everything else works fine.

gcb02• 7 years ago

Blackberry android phones have a feature where it notifies you when any app accessed some resource that requires OS level permissions, such as contacts, gps, etc.

Whatsapp and other facebook apps, access my contact list every 3 minutes.

ddhdhdhdhdhdh• 7 years ago

Looks like a good reason to delete these apps.

londons_explore2• 7 years ago

Whatsapp needs to know when you add a phone contact so it can lookup the corresponding whatsapp contact.

Even the 3 minute delay is annoying - it's common I meet someone, add them to my phone, and then want to send them a Whatsapp message and they don't appear in the list. I have to awkwardly hang around for a minute or so before being able to send them the message I wanted to send.

(for context, in most of Europe, Whatsapp is used pretty much like iMessage or SMS is used in the USA - wouldn't it be annoying not to be able to SMS a new phone number without waiting 3 minutes?)

walrus01• 7 years ago

This is kind of the same problem as people who have no FB account, keep all of their personal life off FB, then they go to a work or social group gathering and some blithely ignorant/clueless person tags their photo.\

One of the biggest sources of spam I have is non-technically-oriented persons who I know either professionally or personally, that have my name and email address in their address book, who click "yes" to everything on their ios and android devices. Some of these particularly less sophisticated individuals have probably had two dozen unique apps from random developers copy the entire contents of their address book.

QualityReboot• 7 years ago

Yeah, it's super annoying that fb knows everything about me even though I don't use their service. There's nothing I can do about it.

powerslacker• 7 years ago

That's not a privacy violation. Her data wasn't collected, a series of numbers was tagged. The person tagging the number could be entering the tag as anything they want.

notafraudster• 7 years ago

According to your logic, If I create a website that maps Hacker News usernames to metadata, and because I know you in real life, I enter your information (name, occupation) on your behalf, and now the connection between your username and that other information is public, your privacy has not been violated, because this is not information about you, it is simply a series of letters connected to another series of letters.

I think what you mean to say is that it is not the app that committed the betrayal, it was the source who was enabled by an app that otherwise had a non-nefarious purpose. Which, fair point, but I don't think the article would disagree.

SmellyGeekBoy4• 7 years ago

Revealing someone's name and occupation to random strangers isn't a privacy violation?

i_feel_great• 7 years ago

Spam it by labeling phone numbers with shit data and make it useless.

bdcravens• 7 years ago

This isn’t a new app - the database is several years old, and is used by many millions. Not sure how you’d get enough numbers and junk entries in there to accomplish what you’re suggesting.

DarkWiiPlayer13• 7 years ago

Enough people with enough bots could probably do it. Is it realistic? no. But possible? certainly yes.

iliketosleep• 7 years ago

This reminds me once again that the weakest link in the privacy chain today is the mobile phone number, especially since governments in many countries have forced people to link their number to a real ID. It's essentially become a ID number by proxy. However, in the case of the article, the reporter should know to inform her sources not to enter _any_ information linking to her real-world identity into their electronic devices.

mherdeg2• 7 years ago

I got a free loaner phone once a few years back ("Samsung Ultimate Test Drive") which came with pre-activated mobile phone service and was very clearly re-using a phone number that someone else had quite recently actively been using.

While it was weird to get SMSes about SoCal drug deals, the strangest thing of all with that phone was opening the Lyft app and being automatically signed in to someone else's Lyft account on the basis of my auto-confirmed phone number. Their active credit card was linked to the account and I could take free rides!

(I didn't... but it was very hard to sign into a different Lyft account when the phone # was actively linked to another, live account.)

jmkni• 7 years ago

You could have signed into Whatsapp as well.

wycy• 7 years ago

Is this because Samsung simply sent you a phone that hadn't been wiped and was still signed into all these accounts, or was it really just auto-signed in due to phone number? I did the Samsung Ultimate Test Drive as well and don't recall being auto-signed into anything (though I also got many SMSes and calls intended for the previous owner).

mjevans• 7 years ago

The biggest threat to privacy, is how little (most, nearly all) other users do NOT value someone else's privacy.

Re Spam: Pre-screening, and people that actually say something useful to the (automated) screening service. Actual spammers should get fed to a blacklist (filtered for multiple confirmations), and organizations that prosecute spammers should be able to read THAT list. Everyone else has to use a more public API that's rate limited.

DarkWiiPlayer13• 7 years ago

However, in the case of the article, the reporter should know to inform her sources not to enter _any_ information linking to her real-world identity into their electronic devices.

Yeah, that had me kinda puzzled as well. Sure, the app seems like a terrible idea, but ultimately it was one of her contacts who put that information into it.

dredmorbius• 7 years ago

Reporters talk to lots of people, who practice very poor tradecraft.

Which suggests: everything this story describes also applies to intelligence and law enforcement services. Imagine you're conducting espionage, or are tracking money laundering or drugs smuggling.

PeterisP2• 7 years ago

In the case of this article, the reporter should keep separate "digital identities" for people whom she want's to know her affiliation and those who don't. The main mistake there was that she used her "burner number" for ordering a taxi, when it should have been used just for these contacts.

mesozoic• 7 years ago

Yeah this is why I keep my old number in Google voice after getting a new one. Not the best option but I can't quite figure out all the ways I could have accounts compromised if some random person with malintent got my old number allocated.

nutjob22• 7 years ago

The problem here is that once you give out a number then it's public in some sense. The person you give it to can pass it on, even inadvertently.

The smart thing to do is to have a public number and a private number. It makes no sense to call cabs with the same number you use to contact sources or whatever.

This is easily done with dual sim phones and can be taken much further with Google Voice or other dial-in phone number vendors. It's not very complicated and if your life depended on it you could easily assign a number per person.

yesforwhat• 7 years ago

The smart thing to do is to have a public number and a private number.

What's the easiest way to do this?

mdani• 7 years ago

Use Twilio Proxy https://www.twilio.com/proxy

skrebbel• 7 years ago

Two phones.

(or a double SIM phone, but then you still risk messing up yourself by mixing data / calling from the wrong number / etc)

SmellyGeekBoy4• 7 years ago

I have our work VOIP account set up on my Android phone. It's integrated into the dialer and works for incoming and outgoing calls. On outgoing calls I have to select whether I want to use the SIM or the VOIP account.

It's a geographic (local) number to our office and costs £7.99 per month. Seems like it would be easy enough to add one for personal use as well.

nutjob22• 7 years ago

Try anveo.com, they have numbers globally which start at less than $1 per month but with a setup fee of a couple of dollars and a per-minute fee of around 1 cent per minute. You can also pay more per month charges for no per minute charges.

You'll also need a SIP client. Some Android phones have these built in but you can also use things like Grandstream Wave. I have no idea about iOS, MAc aor Win but there should be several options for those.

astura2• 7 years ago

Two phones.

DarkWiiPlayer13• 7 years ago

Or just divide your calls into confidentiality classes. Whoever added the journalists number to the app clearly didn't consider it much of an issue; so that probably was neither a very trustworthy nor particularly vulnerable contact.

Also didn't she tell the contact that maybe it'd be better if they didn't tell anyone she's a journalist? Sure, it's a pretty obvious thing, but I feel like in her situation, you'd make sure that they know, just in case, that it's a huge dickmove to make that sort of information public.

tsjq• 7 years ago

once I unlist my number from truecaller website (never installed / used their mobile app),

would it stop new people from adding my number to their database?

ie, I unlist in May2019. i give my number to a new contact of mine in Aug2019. and they use truecaller. would that re-add my name to trucaller database, or would my number stay unlisted forever no matter how many new contacts save my number in their phones with truecaller ?

sriram_malhar• 7 years ago

no. it does not remember you delisted, so you will be added again :(

vorticalbox2• 7 years ago

That's a badly thought out feature, it should be blocked unless you own the number wish to add it yourself.

thirdsun• 7 years ago

What? That is absolutely insane and I don't see how this could be regarded as anything but malicious behavior.

wtmt4• 7 years ago

That’s not how it works. Or maybe you encountered a bug. Unlisting is permanent unless you install the app and activate your number to be listed again.

grive2• 7 years ago

Does unlisting means removing the entry?

Unlisting to me seems like they only stop advertizing that they know your profile.

fencepost• 7 years ago

There's been at least one similar app around in the US for probably seven or eight years. Mr. Number is its name, although I believe it originally had a different one.

Edit: July 2010 release, 10M+ downloads, nearly 200k reviews. From long ago memory seeing names that have been submitted may be a paid subscription option.

visarga2• 7 years ago

The title is wrong. There was no contract or agreement between the app and the journalist so there could be no betrayal.

duxup5• 7 years ago

I don't think you need a contract to fit the usage of "betrayal" here.

visarga2• 7 years ago

Well, before betrayal can take place there must be an implicit or explicit obligation or loyalty.

shakna• 7 years ago

When no contract exists, no permission has been given.

The journalist has not agreed with the company, but the company is still revealing information that they connected to her through a third party.

Yet, the contract only exists between the company and third-party, and not the journalist.

There is a failure here. The company has assumed that the third-party has a right, when they likely do not.

CaptainZapp6• 7 years ago

There is no user agreement, let alone a contract, between Facebook and me.

I use none of their services and properties.

So are you arguing that it's right that they spy on me regardless? Like they do on any other human being who is not in a business relationship, whatsoever, with this company?

diebeforei485• 7 years ago

I have mixed feelings this. Spam calls are very much a real problem in the US as well - I get around ten per day and it's a constant annoyance.

j605• 7 years ago

I get zero spam calls and on most days no calls. Should we give up on privacy because US has bad legislation regarding spam calling.

yardstick3• 7 years ago

You don’t need to know the “contact name” of a spam caller, algorithms when reporting spam should work just on the number and so when it calls you, it should just show a Probably Spam flag, nothing about the identity unless of course the caller has given their consent to provide that info.

SmellyGeekBoy4• 7 years ago

This seems to be how it works in the most recent version of Android and it serves me very well.

If it's suspected spam it will tell me (I can also report spam calls). If it's a business listed with Google Places it will show the business name.

asveikau• 7 years ago

The spam calls are all using fake caller ID. So tagging them as spam only hurts the real owner of that number.

RikNieu4• 7 years ago

I find TrueCaller very usefull. I used to get sooo many sales and robo-calls a day that I seriously considered just getting rid of my phone. Now they get automatically blocked or I can just put them on a profile that they ring silently and hang up immediately.

I get that this can be dangerous for journalists, but shouldn't they maybe investigate alternative ways of contacting sources privately? Mobile numbers are not in any way secure or anonymous in most parts of the world anyways. Hell, here where I live you have to register with your government ID in order to get your sim card activated.

duxup5• 7 years ago

Mobile numbers are also often the most secure (even if not secure) / only way to contact someone in parts of the world....

RikNieu4• 7 years ago

True, but for edgecases with no alternative means of contact, there could be other simple solutions. In the articles instance, Chloe could in the future register that sim, and then immediately tag it as Chloe Sullivan on TrueCaller(or whatever app they use in the country in question). Problem solved. Ta-da.

There are solutions other than proposing regulations or limitations on apps that benefit waay more people than it might inconvenience.

mola2• 7 years ago

If Robocalls are the problem, Truecaller isn't the solution. Regulations against unwanted harassment is. Robocalls are not a force of nature where our only recourse is a technological solution. They are a result of a human choice, where the absolute majority of individual think it's a menace. So our recourse is legal. band-aid solutions like Truecaller cause more problems. The Truecaller product is not a usual commodity where you choose it, and pay a known price. The actual price you pay is totally unknown. Because they require total access to your device without genuine disclosure of their intended use for it.

tty23003• 7 years ago

It also seems to be a problem unique to location. I have never in my life received a robo call in Australia but I did start to get sales calls until I put my number on the do not call list.

neilalexander2• 7 years ago

At the end of the day, someone somewhere is granting robocallers access to the public telephone network. Hold those service providers legally responsible until they start taking action - it's not like there is no way to find out who they are.

Piskvorrr6• 7 years ago

In essence, this is the spam debate all over again, with some extra seasoning. (The permissions are incidental - other apps exist that are polite in this respect.) So, out comes the canned spam response:

Your post advocates a

( ) technical (X) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea.)

(X) No one will be able to find the guy or collect the money (X) Requires too much cooperation from spammers (X) Requires immediate total cooperation from everybody at once

Specifically, your plan fails to account for

(X) Lack of centrally controlling authority for email (X) Open relays in foreign countries (X) Ease of searching tiny alphanumeric address space of all email addresses (X) Asshats (X) Jurisdictional problems (X) Extreme profitability of spam (X) Technically illiterate politicians (X) Extreme stupidity on the part of people who do business with spammers (X) Dishonesty on the part of spammers themselves

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.

inapis• 7 years ago

While I agree with your sentiment, in practice, relying on legislative options is not foolproof and is also a band-aid. You require a lot of human cooperation which, to be honest, is not trivial to achieve in 2019. Second, technology frequently outpaces legislative actions. You can relay a spam call/sms around the world and the receiver, her ISP or her government would still be completely unable to fix the issue.

Honestly, I want disposable phone numbers (which are still compatible with public networks) something akin to email aliases. So if one number gets a lot of spam calls, I can just route it to /dev/null.

We need a complete array of legislative + technological solutions.

makomk• 7 years ago

It's also worth noting that - as with almost any privacy-violating technology - journalists apparently sometimes use TrueCaller for research themselves.

Uplink• 7 years ago

I use "Should I Answer?" for this purpose. I don't have to give them my data in order to know who's calling me most of the time. It could block calls, but I don't use that feature.

blackbrokkoli• 7 years ago

Can somebody enlighten me why robo-calls are such a problem in the US? I'm completely ignorant of any relevant legislation or enforcement, but as a young German I can literally remember exactly two unsolicited survey calls in my whole life, both on a landline.

This suggests some fundamental difference compared to the US which maybe should be changed instead of a third party band-aid app with lots of problems, but again I don't know this difference and thus will refrain from judging...

ktpsns2• 7 years ago

Can confirm, being also a (not-that-young-anymore) German. Scam calls or phone marketing is very seldom here. I always assumed this is due to strict laws in Germany.

Another thing is also that most people I know no more publish their telephone number in a (public) phone book, as it used to be still common 30 years ago. That's something where you easily can grab tons of private information from. How common are phone books in the US?

rapind• 7 years ago

For a somewhat amusing (if roundabout) investigation jumping off point into the robocalls problem: https://gimletmedia.com/shows/reply-all/awhk76

NikkiA2• 7 years ago

We get ~10-15 scam calls per day on our landline here in the UK, so it's definitely not a US-only problem.

llamataboot• 7 years ago

I regularly get calls on my iphone now that say (maybe: Jane Doe) under the name, and they are usually correct. Often they are recruiters, or lawyers, or people that I imagine have their phone number publicized on the web. But I'm not sure I've read where apple is getting this info (or perhaps it is a carrier thing?)

crummy• 7 years ago

My Pixel does this, too. I assumed it was cross referencing businesses' phone numbers, the ones you can find if you search the company name on Google.

amarshall• 7 years ago

It gets the information from other (Apple-only?) apps. From Apple Support[1]:

iPhone automatically suggests new contacts from messages you receive in Mail and invitations in Calendar, and from other apps. To turn this feature off, go to Settings > Contacts > Siri & Search, then turn off Find Contacts in Other Apps.

[1] https://support.apple.com/guide/iphone/add-and-use-contact-i...

jmiserez2• 7 years ago

Settings -> Phone -> Call blocking and Identification -> "Allow these apps to block calls and provide caller id"

You can add phone book apps there. Seems to be an iOS 12 feature, it wasn't there before.

Otherwise it will just use your contacts.

jannes2• 7 years ago

Is this a regional feature? I don't see it on my phone with iOS 12.3. I am located in Europe.

Machado117• 7 years ago

Same thing happens to me. It's from emails you received that have phone numbers in the content.

SlowRobotAhead• 7 years ago

[suggest that] They send a SMS to any non-user whose number is entered to warn them someone is attempting to enter their number and ask them for consent. This would also be an opportunity to inform them about the unlisting option.

Yea, good luck with that.

Alterlife2• 7 years ago

This article focuses on the problems that truecaller poses for 'non-users". As a non-user of truecaller in India myself, I find myself in the minority. It seems I get none of the benefits (improved spam filtering, the chance to see who is calling me), and in the 'prisoners dilemma' sense, it appears I would loose nothing by installing it, because they already have my contact information.

However, this is only half the picture.

If you install truecaller on Android, you're handing over ALL your personal information to them. The list of permissions they ask for is ridiculous. They ask for access to your sms messages, call log, contacts, file system, location, microphone, camera, everything. They also show you advertisements wherever possible.

abtom• 7 years ago

If you're a non-user and do not wish your information to appear on the app, you can unlist your number here - https://www.truecaller.com/unlisting

Though I do not agree with the method where as a non-user I need to manually opt-out of the service, it does seem to work. My number is no longer visible on the app.

grive2• 7 years ago

Unlisting does not mean that the info is removed.

If they have full access on anyone having installed the app, it means they also have mined the conversations with your contacts.

So they might not advertise what they know anymore, but the privacy concern remains anyway.

enitihas2• 7 years ago

I tried using the unlisting UI, but it says I need to install the app and deactivate my account before unlisting. When I install the app, it refuses to run unless I grant it all sorts of permissions. So it seems before unlisting, I need to give truecaller my data. This absolutely ridiculous.

dwighttk• 7 years ago

The "Unlist Phone Number" button never becomes useable for me on that page, even after completing the google captcha

edit: Make sure you put a "+" in front of your country code

dontbenebby• 7 years ago

They seem to have banned my IP (an Algo VPN instance on a pretty reputable web hosting provider which I just use for normal, reasonable web browsing). Not cool.

6ak74rfy• 7 years ago

If you install truecaller on Android, you're handing over ALL your personal information to them.

That's what I remember too but the article said Truecaller only gets non-user's information when a user tags them so. Maybe the app behavior varies with the country the user is in.

ghego1• 7 years ago

This is one of those cases in which the GDPR is very nice to have as a European citizen

siegecraft• 7 years ago

The good news is you can turn off most of those and truecaller still works. I just checked and I only allow it access to Contacts, SMS and Phone which, given the purpose of the app, seems appropriate.

Kuraj• 7 years ago

Honestly I would happily give them some of my personal information in exchange for their service. The problem is that information in my address book, SMS, call log etc. is not just mine.

kevinguh• 7 years ago

pardon me if I'm a bit out of the loop, but my understanding was that Google planned on revoking all app access to SMS messages and call logs on Android as of the beginning of this year -- does this not apply to TrueCaller?

ComodoHacker• 7 years ago

TrueCaller is Facebook's face recognition for phone numbers. They are building shadow profiles using some user-valuable bait feature. For TrueCaller, most of its value is in fighting spam. So, unlike Facebook, it's not only users who compromise privacy of others, it's spammers who steal our privacy. We should examine spam fighting solutions for email, IM and others, they might be involved in the same business model.

If we solve the spam problem, we can regain some privacy back.

pxtail• 7 years ago

TrueCaller is Facebook's face recognition for phone numbers

This is very good analogy - in fact I think that it's even more dangerous because when it comes to Facebook people are slightly more aware about privacy-related issues. I'm pretty sure that TrueCaller extensively profiles users, links all possible connections, gathers data - Facebook might not know that one visited certain doctor or that one has some medical conditions, TrueCaller? Who knows. It is possible to gather a lot of data and build detailed profile just by linking who calls who.

Additionally according to HN comments [0] one doesn't just simply "opt out", truly terrifying

[0] https://news.ycombinator.com/item?id=20058218

mongol2• 7 years ago

Hmmm... I think Chloe, and anyone in her situation, could use a prefix when they call to not show the number at recipients phone. I think it is #31#

Will improve the situation somewhat

loriverkutya• 7 years ago

And how would anybody call Chloe, if she cannot tell her number to anyone?

mongol2• 7 years ago

The point is that this puts her more in control and she can choose who she gives the number to.

mesaframe• 7 years ago

Regarding India, They now have privacy as a right. Shouldn't they enforce it?

wtmt4• 7 years ago

Privacy was declared by the Indian Supreme Court as a fundamental right found within some articles of the constitution. However, till date, there is no data privacy law proposed and passed in the parliament. The draft proposal that was prepared more than a year ago was criticized by many. There will likely be a half baked data privacy law that will be passed in the coming months (since the elections are done and the new government has taken office).

Taking action on such violations today can only be done within the scope of existing laws on fraud, security, etc. That won’t work very well for these cases. The Indian Supreme Court also doesn’t understand technology and doesn’t rely on experts. It seems to go by whoever talks the loudest (based on the hearings in the case against the biometric based unique ID, called Aadhaar).

ddffre• 7 years ago

They are one of the most dangerous companies today, the EU parliament should take a look into them.

tedunangst• 7 years ago

What are the limits to what one is entitled to learn or ask about a caller? I get a call from 555-1234. Is it ok for me to ask a friend, hey, recognize this number? Is it ok for me to ask twitter, hey, I got a call from this number, should I call them back?

jwilk• 7 years ago

It's okay to ask.

If the answer contains personal information, it's not okay to expose it to everybody in the world.

alanh• 7 years ago

Wow, is it just me or is this a mountain-out-of-a-molehill situation? This is not fundamentally any different than “report spam” for email, or a user posting “is 800-xxx-xxxx a legit number?” online, or sending a contact card to a few million of your closest friends.

I appreciate the situation that the journalist found herself in, but if she wants her number to be a secret, she needs to make sure the people she calls know that, too.

I will file the information in this article as “good to know,” not “omg disaster”.

DarkWiiPlayer13• 7 years ago

is it just me or is this a mountain-out-of-a-molehill situation?

It's just you.

The example of the journalist is a very good example of exactly why this is such an extreme issue, but it really starts with the small things. What if you want to call someone, and not tell them your name? well, f#$£ you then, the app already told them. Don't want everyone knowing where you work? well f$%& you again, maybe somebody added that with your name in the app (just as the example of the journalist).

So now you call, say, your beloved grandma and your number shows up as "Henry the drug dealer". Maybe you don't even deal drugs, but someone a) thought it'd be funny or b) wants to hurt your reputation.

Or even worse, imagine you call a company regarding an application for a job. It's already a big enough problem that someone else posting a picture of you doing something stupid while drunk can ruin your chances of getting a job; now we're talking about attaching random, possibly personal, possibly untrue information to your phone number for everyone to see without even informing you.

This isn't a molehill. It's borderline criminal.

xixixao• 7 years ago

Let's go back to the world where there is no internet. Imagine someone spreads a rumor about you. Or a praise. People might have heard this, before they even met you. It can be illegal, harmful, or beneficial, but it's under the control of the people you interact with.

If you meet someone for the first time, and the person heard from someone that you're dealing drugs, and you tell her you don't, and ask them where they heard that, they might trust you over the rumor, and you'll try to eradicate the rumor.

There are differences, mainly in that the call receiver has greater power to reject the call based on the information they have.

I think the real story is in the interaction and how the app behaves, for the receiver. Were they aware that they were putting Chloe into the database? The article doesn't say. Without this, it's hard to judge whether the same thing couldn't have happened in a world without internet (imagine a small village). It doesn't seem to be entirely black and white.

314• 7 years ago

Each of your examples exhibit a broken model of what a phone-number is. You are arguing that people should be able to use a single unique id (their telephone number) anonymously. This is not how the world works and it is terrible opsec.

yardstick3• 7 years ago

It’s quite different. A report spam function wouldn’t include (or shouldn’t include!) the identity of a person. If it does then it’s going over and above a spam filtering service.

Reporting a number as spam should then just result in future recipients seeing a “Probably Spam” or “Spam” etc based on reported levels on Spam vs Non-Spam reports for the number.

But I do agree that the journalist should have practiced better opsec and advised her sources that they probably don’t want her name to show up on their phone if she calls them at an inopportune time such as when around the very people she is investigating.

Also, disabling outbound caller ID would have helped.

Lessons learned all around.

CaptainZapp6• 7 years ago

How do you secure against something that you're not even aware exists?

Maybe outsourcing operational security? But how can a journalist aford that?

Chazprime• 7 years ago

Yes, this does seem like a bit of an edge case and I think it's probably served to highlight that people who need to protect their privacy need to take extra steps to preserve their anonymity... in this case telling sources to obfuscate her identity in their phones.

The reality is that phone databases like this are an invaluable tool in the war on robo & spam callers. I think that there should be an option in these databases to be able to tag numbers as spammers without the need to have their identity preserved. I don't use TrueCaller (I'm a YouMail user) but see numbers flagged all the time as "Real estate scam" or "Probably a Canadian Pharmacy" come up without revealing a name or affiliated company.

DarkWiiPlayer13• 7 years ago

We reply to TrueCaller to suggest that:
- They advertise the unlisting option more clearl
- They send a SMS to any non-user whose number is entered to warn them someone is attempting to enter their number and ask them for consent. This would also be an opportunity to inform them about the unlisting option.

I doubt anything less than that is even really legal in the EU right now. Essentially, if my phone number is entered into that app, my personal data is being digitally processed and maid widely available without my knowledge or consent. Pretty sure that's very much illegal.

Mirioron2• 7 years ago

I'm often critical of GDPR, but stuff like this is why I think it's probably necessary to have.

DarkWiiPlayer13• 7 years ago

GDPR is 100% necessary and fundamentally a good idea. It has a lot of problems that just show how incompetent politicians can get on a bad day, but that doesn't invalidate the core idea.

kkarakk3• 7 years ago

If she's truly after "opsec" then why would she keep using a phone number she's handing out to randos?

Pretty laughable - buy a new sim every week, it's not even hard to do in india/south africa. You can buy a new sim almost instantly from the corner store equivalent. You might get called by the local police if you buy more than 5 a month though - happened to me when i was testing out different carrier's data/sim services and bought 6 sim cards at once in india. They just took down my details and never bothered me again

mikedilger• 7 years ago

It seems absurd to me to consider data about a person to belong to that person. If I learn that Chloe is a reporter for The Inquirer, what law restricts me from telling somebody else? And if there is one, what else can I not say about her? Can I mention she is a brunette? Can I tell the story about going out for coffee, or am I violating her privacy by leaking the fact that she prefers coffee to tea? To get really ridiculous for a moment (brace yourself) does she have a property right on the region of my brain which holds any of this information about her? Clearly there is a fundamental incongruity with other basic social notions.

As a society we have most definitely moved in the direction that data about a person is somehow under their right to control: the right to privacy, the right to be forgotten, etc. We've subsequently run into numerous difficulties with this notion, such as the inability to warn our friends about bad actors, leading to different rules for "public people" versus "private people," arbitrary dividing lines, different rules for minors, different rules for individuals vs companies vs really really big companies, and a number of other abstruse rules about when or where you might be violating somebody's privacy, which seem to change significantly over the years and from jurisdiction to jurisdiction with no hope of ever settling down (because IMHO there is no rational obvious place for this to settle into).

Even if the laws were clear, universal and watertight, privacy is still fundamentally your problem. Laws will not control everybody else, and depending on everybody else to behave doesn't seem like a sane strategy for anybody. So you'd best keep your secrets to yourself and those you trust.

sosborn• 7 years ago

Does there have to be a law for something to be distasteful and ethically dubious?

AlexCoventry• 7 years ago

There probably does if it's sufficiently profitable and you want it to stop.

tty23003• 7 years ago

New technology has opened up new possibilities far beyond what your word of mouth example has. Megacorps are sucking up data on a mass scale and using it for evil such as manipulating elections, tricking you in to buying stuff and reporting your every action to the government.

For this reason we need to think beyond the old ways of dealing with data.

oytis2• 7 years ago

Yes, the reality has changed. We have to either adapt our notions of privacy etc. to the new reality or pretend that nothing really changed. The latter seems to work, but one day you go to Africa (or India, or China, or just have to deal with someone who can ignore/circumvent the regulation), and - surprise! - the reality is still there.

atoav• 7 years ago

Privacy laws IMO have multiple purposes, only one of which is protecting the citizen’ right to their own data.

Another big one is balance of power. If a entity — be it a state, company, individual or a group of indivdiuals — knows everything about you, they thereby create a asymmetry of powers they can leverage for their own interest. In addition to protecting the individual, privacy laws are also meant to reduce or limit that kind of asymmetry to avoid the social consequences that might be linked to it.

Not without a reason it is Germany which has one of the strongest privacy movements in the world, because many of them know first hand, what data in the hand of fascist and communist governments can do to the life of individuals.

When the Nazis marched into the Netherlands, the having the religious orientation in a central database was was made the difference to many lifes. And that is, what makes data different than somebody’s knowledge in their heads: if the Nazis march into your nation you could take the decision whether to tell on your jewish neighbour or not, while in the case of real data you can’t.

johnchristopher3• 7 years ago

What happened to Chloe is that one of her sources was using TrueCaller.

Online communication is hard. The burden of security falls on every parties.

The real hard problem for an investigative journalist here is "Considering the ubiquitous nature of communication tech How do I handle my sources so they don't blunder before I even meet them ?"

qrbLPHiKpiux2• 7 years ago

A smartphone, or any device really, only has information that you feed it. Compartmentize. Different devices for different things combined with pseudo-anonymity. It is very hard to do this and a razor-thin no-mistake margin is always there.

johnchristopher3• 7 years ago

This is great. I logged into the website to check if my number was collected.

It is.

So I click on "suggest a better name" in a naive attempt to erase myself from the grid.

I can't because they "don't collect personal information about private individuals in the EU".

skizo• 7 years ago

you can unlist your number here - https://www.truecaller.com/unlisting

johnchristopher3• 7 years ago

Thanks ! How did you find it on the site ?

bscphil2• 7 years ago

This didn't work for me the first three times I tried. It said I had to log into the app and deactivate my account (which of course I can't do because I don't have an account). It eventually claims to have worked on the fourth try, but I have no way of checking because it doesn't let you look up numbers without being logged in.

daodedickinson• 7 years ago

I just feel spied upon and completely vulnerable everywhere now by this false pervert voyeur god. Can't even get away from it in national forests.

oytis2• 7 years ago

That's the problem with security through regulation. Just leave your happy regulated place and go elsewhere - and you are helpless. Without it you would probably spend more time planning your security life, especially if you are a journalist.

digital_voodoo• 7 years ago

I am in one of the regions where Truecaller is growing rapidly.

And I've found out that the best defence is a good offence: registering my number myself but with totally false information seems to supersede what other register about me. And that's what I did. Not with Truecaller, but with another app (CallApp) that seems less greedy with permissions.

kembrek• 7 years ago

Rather than disabling the Caller ID, what if the journalist spoofed her Caller ID each time she called. In that way, it prevents 'Private Number' showing up on the receiving end which is the thing preventing those on the receiving end picking up her calls.

SmellyGeekBoy4• 7 years ago

I've never had an account with them so I tried to search my number to see what data they had on me. Says I need to sign in.

For that reason I've unlisted: https://www.truecaller.com/unlisting

qrbLPHiKpiux2• 7 years ago

Okay. So the weak link again is the endpoint. The human. There is really nothing to see here. My God. This will never stop.

ktpsns2• 7 years ago

The website encountered an unexpected error. Please try again later.

Has somebody a copy?

gosseyn• 7 years ago

Here is the one I found

https://ifex.org/serious-privacy-concerns-raised-about-the-a...

1f60c• 7 years ago

Seems like the website is having some problems, here’s a mirror: https://web.archive.org/web/20190531023057/https://www.priva...

EastSmith• 7 years ago

Viber, a popular app where I live, does exactly the same thing TrueCaller does. It drives me crazy.

The only solution I can think of is that everyone start using one-time numbers.

You still have a main number and a number "domain service". When you call someone you get a new number, the call receiver can get your name out of the "domain service" only if you have that number in your address book.

guelo• 7 years ago

Journalists could have two sims, one with which they call people when they need to say who they are and one elf r when they don't need to say who they are.

jonshariat• 7 years ago

But that sim would only last until the person they call tags them using the service.

That being said, I'm not sure why this is changes anything for reporters. People can already put a phone number online or share it with the government. The same precautions they would need to take without this service would still be valid.

Abimelex• 7 years ago

Well this is e.g. an secenario where GDPR would protect you from. A company would not be allowed to store you phone number without your consent.

tzs2• 7 years ago

We reply to TrueCaller to suggest that:

...

They send a SMS to any non-user whose number is entered to warn them someone is attempting to enter their number and ask them for consent. This would also be an opportunity to inform them about the unlisting option

For this to be effective in cases like the one in the story, the SMS would have to be sent almost as soon as the attempt is made to add the number.

In many cases, that would allow the person whose number is being added to infer who tried to add it. If the caller is involved in some criminal activity, that could be dangerous for the person who tried to tag them in some parts of the world.

amykhar• 7 years ago

It also defeats the whole point of the app, which allows people to filter out spammers. Of course spammers are going to not want their number listed.

masswerk• 7 years ago

The story is really about a conflict of interests, the misuse of the phone system and legitimate users finding themselves endangered. I.e., if spammers and robo-calls are stressing the system and users to a point, where subscribers can't help but to resign to defensive measures, other interests, like the anonymity of sources, by this the accessibility of crucial information to society, and, eventually, democracy are at risk – and highly so.

Moral of the story: spam callers and countermeasures are a risk to democracy. And we'll have to decide, eventually.

Abishek_Muthian2• 7 years ago

Don't forget the recent 'supposed' data dump from Truecaller![1]

Truecaller, even without breach is a privacy nightmare. Even if one doesn't use Truecaller for privacy reasons, if any of their contacts use it; then their phone number + other details are already in Truecaller's database.

Before android 6.0, contact permissions weren't existent in consumer android devices and India basically being an android country lead to Truecaller's data trove.

If one wish to use Truecaller without uploading their contacts then they can use their web version, which is a progressive web app; it can be saved to phone & used like a native app. Just don't select 'Enhanced Search', it will upload the contacts from email which is used to sign in(better to use a Truecaller only email id for it).

[1] https://economictimes.indiatimes.com/tech/internet/real-thre...

darknoon• 7 years ago

I found my real name and (former) carrier on Truecaller. Shit.

Had to make a fake Microsoft account via Sneakemail to even search it, though.

I tried to unlist my number but it said "Deactivation required", ie bait for me to create a real account?

parliament32• 7 years ago

TrueCaller is a privacy nightmare. Note that to search for a number on their site, you need to sign in with a Google/Microsoft account... and "Enhanced Search" is enabled by default which auto-uploads all your contacts.

As a non-user you can unlist here: https://www.truecaller.com/unlisting

jjwhitaker• 7 years ago

Robocalls need a binding regulatory or legal prevention. But, could technology fix spoofing numbers?

Would some variation of private/public key or authentication work? For example, if each number and the device/SIM or IP it is registered to have a unique key that must authenticate or handshake with the service provider to connect, then a spoof call with that number but lacking the key would fail, potentially be logged and reported to the FCC/authorities.

If no handshake can happen, call fails. If the number and hardware dialing out authenticates via key with the service provider or central store, call goes through.

kevin_b_er• 7 years ago

This the same threat model Facebook poses. Don't want Facebook to know your phone number? You just won't tell them, right? Well Facebook scanned someone else's phone number list and got your number that way for their shadow profile. Too bad, your full name, phone numbers, and addresses were harvested by Facebook due to someone or someones else.

smsm423• 7 years ago

"Betrayed" sounds exaggerated - after all, the only thing that was revealed is the fact about where she works at, and if somebody "betrayed" her it was her source who entered her identity into a public database, not the database.

I personally rely on TrueCaller daily, and do not pick up any call that doesn't have identification I recognize. Otherwise I'd have to listen to bots telling me my Social Security number has been arrested, screaming at me in Chinese and people trying to get me to give them money for a myriad of reasons that I really don't have time to listen to. I get several such calls daily. Before, I was seriously thinking about just never picking up the phone at all. Now that I found TrueCaller, at least I can get calls from normal people or businesses that aren't shady and want to talk to me.

smadurange• 7 years ago

If this is a solution to robocalls and spam, that's just plain f*ing stupid. The worst case scenario of getting a spam call is you get annoyed and hang up. Compare that to handing over your contacts, call logs, text messages to a third party app just so that you can avoid picking up a call. Jesus Christ.

If you hate spam calls that much, it's very easy to not pick up a call from an unknown caller. I can come up with a dozen ideas just off hand that could potentially solve this spam issue far more elegantly. It's baffling that even this is up for debate and that there are people who would defend an app like this. This is not a philosophical or technical problem, this is not like spam emails, this is simply not a difficult problem to solve.

scraft• 7 years ago

For me, the benefits of Truecaller outweigh the negatives. It was a step towards my phone being useable again for the purpose of making and receiving calls (at times I seem to get flurries of spam calls so it is great being able to simple ignore).

For the last 18 months my phone is on silent, no vibration, so I am completely oblivious to whether someone is contacting me. When I check my phone I catch up with any missed activity. It is hard to explain just how much better it is to operate this way.

Betrayed by an app she had never heard of

Related Stories