Advertisement

SKIP ADVERTISEMENT

Off the Record in a Chat App? Don’t Be Sure

Evan Spiegel, one of the founders of Snapchat, which has drawn considerable attention as investors and entrepreneurs size up the potential for new ways to exchange messages on a mobile phone.Credit...Jae C. Hong/Associated Press

What happens on the Internet stays on the Internet.

That truth was laid bare on Thursday, when Snapchat, the popular mobile messaging service, agreed to settle charges by the Federal Trade Commission that messages sent through the company’s app did not disappear as easily as promised.

Snapchat has built its service on a pitch that has always seemed almost too good to be true: that people can send any photo or video to friends and have it vanish without a trace. That promise has appealed to millions of people, particularly younger Internet users seeking refuge from nosy parents, school administrators and potential employers.

But the commission charged that there were several easy ways to save messages from the service, and in settling the accusations, the company agreed not to misrepresent the disappearing nature of its messages.

The company’s early popularity and hype led to a multibillion-dollar buyout offer last year from Facebook, which Snapchat’s leaders spurned in the hope of something better. But the settlement announced on Thursday set a different tone, one that could extend to the many other start-ups that promise security, privacy and anonymity as an antidote to the public nature of Facebook and Twitter.

“The Internet is forever, and people don’t realize that,” said Nico Sell, a security expert and one of the founders of a rival mobile app called Wickr that also lets people send self-destructing messages. “You think you can delete a tweet or a Facebook post, but it doesn’t go away. Most people don’t know how hard it is to make a message disappear.”

The settlement is the latest revelation that much of what is shared over the web and through mobile devices is at risk for interception or eventual retrieval, even if the hardware and software companies that transmit them promise otherwise. Security vulnerabilities have been exposed at major banks, corporations and retailers around the globe and at many start-ups.

Image
A recent update to Snapchat included the ability to conduct a real-time video conversation.Credit...Snapchat

The settlement between the F.T.C. and Snapchat also raised another notion: that some technology companies may be misleading users about how their information is stored and shared, even if unintentionally.

Under the terms of the settlement, Snapchat will be prohibited from misrepresenting how it maintains the privacy and confidentiality of user information. The company will also be required to start a wide-ranging privacy program, a sort of probation, and will be independently monitored for 20 years. Fines could ensue if the company violates the agreement.

In its complaint against Snapchat, the commission said the app’s messages, often called snaps, could be saved in several ways, contrary to what the company has said. Users can save a message by using a third-party app, the agency said, or employ simple workarounds that allow users to take a screen shot of messages without alerting another user.

The complaint also said Snapchat transmitted users’ location information and collected sensitive data like address book contacts, despite its saying that it did not collect such information. The commission said the lax policies did not secure a feature called “Find Friends” that allowed security researchers to compile a database of 4.6 million user names and phone numbers during a recent security breach.

“One thing we want to make clear,” said Chris Olsen, the assistant director of the F.T.C’s division of privacy and identity protection. “If you make promises about privacy, you must honor those promises or otherwise risk F.T.C. enforcement.”

Snapchat declined an interview request, but posted a statement on its blog. “While we were focused on building, some things didn’t get the attention they could have,” the company wrote.

Snapchat added: “Even before today’s consent decree was announced, we had resolved most of those concerns over the past year by improving the wording of our privacy policy, app description and in-app just-in-time notifications. And we continue to invest heavily in security and countermeasures to prevent abuse.”

Brian Blau, an analyst with Gartner Research, said that it was a bit premature to predict how the F.T.C. settlement might affect the standing of the company and its ability to transform itself into a sustainable business. The company does not yet generate revenue. Snapchat has only recently begun to experiment with partnerships that may lay the framework to eventually make money.

But the settlement is “really bad for a technology company,” he said. “You don’t have the government coming after you when you’re doing regular business.”

Still, some of Snapchat’s vulnerabilities have been public for some time, suggesting that users and venture capitalists may not be terribly concerned about Snapchat’s false promises.

An article on BuzzFeed, the online news start-up, published in late 2012 explained how Snapchat videos could easily be copied and saved using a simple service. That revelation and others did not deter venture capitalists from writing checks worth $123 million to back the company, nor did it seem to prevent people from using the service.

Mr. Olsen of the F.T.C. declined to say what led the commission to open an investigation into Snapchat, but he did say that several organizations, including the Electronic Privacy Information Center, an independent, nonprofit research center, had raised concerns about the messaging service. He said the case and resulting settlement were part of a larger, continuing investigative effort by the commission to hold start-ups and companies accountable to their marketing claims and privacy assurances to consumers.

Snapchat’s rise is part of a sea change in social media, one that is defined by companies promising more private and anonymous interactions than existing popular services. Mobile applications like Whisper, Secret, Confide and a number of others also assure their users that the content they share and sometimes even their identities are secure.

Danah Boyd, who researches technology adoption and use among teenagers, said that younger Internet users tended to be “far more concerned about people in their immediate world getting access to their content than the company itself” as long as it did not disrupt their personal lives.

“There’s a huge disconnect between what we mean when we say anonymity in the colloquial sense and what it means in a technical sense,” said Ms. Boyd, who wrote “It’s Complicated,” a book about technology habits and use.

And even Evan Spiegel, one of Snapchat’s founders, seemed to acknowledge as much in an interview.

“Nothing ever goes away on the Internet,” he said.

A version of this article appears in print on  , Section A, Page 1 of the New York edition with the headline: Off the Record in a Chat App? Don’t Be Sure. Order Reprints | Today’s Paper | Subscribe

Advertisement

SKIP ADVERTISEMENT