,
21 tweets,
37 min read
Read on Twitter
Thread: A new report from @PrivacyInt raises serious privacy concerns about the app @TrueCaller, which presents concrete risks for people in vulnerable situations, including journalists and human rights defenders: ow.ly/d44W50urXJD #Privacy #SafetyofJournalists
.@TrueCaller is especially popular in India and Sub-Saharan Africa. It enables its users to filter unwanted calls by identifying the number calling them from its database. Users can tag their contacts, adding them to TrueCaller’s database, under the name entered by the user.
However, as @PrivacyInt reports, the implications for people who end up in @TrueCaller's database raise worrying #privacy and #SafetyOfJournalists concerns. They examine the story of Chloe, an investigative journalist working for an international broadcast service.
Chloe works hard to protect her anonymity, as she travels around the world working with local journalists on uncovering stories that make the headlines. She values this anonymity, which allows her to approach sources without raising suspicions or concerns.
On a recent trip to West Africa, Chloe buys a local SIM card to communicate with her sources. She starts working the story, making phone calls to sources, telling them clearly who she is and what she is trying to achieve.
One day, she uses her local phone to order a cab. Her number is shared with the driver, and, on entering the cab, the driver greets her “So… you work for [media outlet]”. He points to his phone where her name is registered as “Chloe, the [media outlet] journalist”.
Chloe consults her information security team back home, who identify the culprit. This is not a case of mass state surveillance or a targeted attack. Instead she had been betrayed by an app she had never even heard of: @TrueCaller.
Not seeing the potential for harm, one of her sources had tagged her in @TrueCaller’s database. Now, every time Chloe makes a phone call using that phone number, her name appears to TrueCaller users, like the cab driver, as “Chloe the [media outlet] Journalist.”
Thankfully for Chloe, she was not in a country actively hostile to journalists, but knows that in a different country the consequences could have been much more serious had her affiliation been known.
As part of their research for the story, @PrivacyInt engaged with @TrueCaller about the #privacy and #SafetyOfJournalists concerns raised by Chloe’s case.
.@privacyint suggested that @TrueCaller advertise its unlisting option more clearly, and send a SMS to any non-user whose number is entered into its database to warn them someone is attempting to enter their number and ask them for consent.
To date, @TrueCaller has not shown an interest in following @PrivacyInt’s recommendations aimed at protecting privacy and making it a safer app for all. You can read @PrivacyInt’s full exchange with them here: ow.ly/AClQ50urnsX (PDF)
Importantly, if you’re concerned that your number may have been included in @TrueCaller’s database without your consent, check out @PrivacyInt’s tutorial on how to safeguard your privacy and anonymity by de-listing yourself: ow.ly/SwDu50urXNl
As @PrivacyInt concludes, Chloe’s story shows the concrete risks that TrueCaller presents for people in vulnerable situations. Check out their full report here: ow.ly/QLRI50urXWr
