How I got sued by Facebook

http://petewarden.typepad.com/searchbrowser/2010/04/how-i-got-sued-by-facebook.html

by petewarden • 16 years ago

336 80 16 years ago

petewarden.typepad.com

kbrower• 16 years ago

"Their contention was robots.txt had no legal force and they could sue anyone for accessing their site even if they scrupulously obeyed the instructions it contained. The only legal way to access any web site with a crawler was to obtain prior written permission."

This is ridiculous. Can someone release the data so this can be tested in court? EFF?

jws2• 16 years ago

robots.txt is good for telling robots they have no business reading a section, or will be severely disappointed if they do. There is no way one can encode the TOS of a site into the syntax of robots.txt, so there is no reason to believe it embodies the TOS.

I've never used facebook, but Section 9.2.6 of their terms says You will delete all data you received from Facebook if we disable your application or ask you to do so.

I don't see how that could be encoded in robots.txt.

axod4• 16 years ago

Surely ToS is only applicable if you use facebook - eg create an account.

Either facebook wants to allow people to crawl it, or they don't. robots.txt should be binary - yes or no.

jdrock• 16 years ago

User-agent: *

Disallow: /directory/people/*

Disallow: /directory/pages/*

Done. Google crawls Facebook. Every social media monitoring company crawls Facebook (and every other social network). Tons of other companies do the same every day. I know this because many of these companies are our customers.

What really irks me is that Pete collected valuable data and whoever he shared it with was probably able to derive added value from that data - in ways that Facebook is not doing. Facebook is prohibiting value creation.

cookiecaper• 16 years ago

As a long-time (but sadly former) EFF donor, I hope they pick it up too. This case is tailor made for them.

DrJokepu4• 16 years ago

There's nothing ridiculous about that. There's a clearly visible link on the bottom of each Facebook page that links to the Terms & Conditions of accessing Facebook pages. Some relevant parts:

"If you collect information from users, you will: obtain their consent, make it clear you (and not Facebook) are the one collecting their information, and post a privacy policy explaining what information you collect and how you will use it."

"You will only use the data you receive for your application, and will only use it in connection with Facebook."

"By "application" we mean any application or website (including Connect sites) that uses or accesses Platform, as well as anything else that receives data." - note that by this definition a Facebook crawler is an applicatiom

"You will only use the data you receive for your application, and will only use it in connection with Facebook."

"You will have a privacy policy or otherwise make it clear to users what user data you are going to use and how you will use, display, or share that data."

"You will not transfer the data you receive from us (or enable that data to be transferred) without our prior consent."

"You will make it easy for users to remove or disconnect from your application."

etc.

These things are easy to look up, it took me about five minutes to find them. In fact, they have the right to limit the way even publicly faced content on their site is used. Things like copyright and data protection laws come in mind. You might not agree with that but it is absolutely in their right to do so.

The FB Terms & Conditions don't mention robots.txt at all.

axod4• 16 years ago

As far as I can see, they weren't creating a facebook application, so I'm not sure why the Terms & conditions are relevant.

If you run a public website, you have to accept that people may crawl your website. If you want to prevent it, don't let them crawl it. That's what robots.txt is for.

dhimes2• 16 years ago

You might not agree with that but it is absolutely in their right to do so.

Well, they claim it is their right. The courts will decide if it actually is.

Plenty of places make claims to rights and make you sign waivers (dojos, for example), but fail in court. This could be interesting.

Vivtek8• 16 years ago

Doesn't apply. "If you collect information from users" is not equivalent to "if you collect information about users". Pete collected information about users that Facebook freely gave him without requiring any binding agreement from him at all.

It's probable they would lose. But it's far, far more probable that Pete would be bankrupt well in advance of that point in time, and that's how the court system works.

nfnaaron2• 16 years ago

Army of Facebook Lawyers:

"Their contention was robots.txt had no legal force and they could sue anyone for accessing their site ..."

Lone data collector dude:

It turns out the lawyers are right. Huh.

nfnaaron2• 16 years ago

Oh. I actually wasn't saying that the guy "blinked." I was trying to evoke the image of a relatively powerless person staring at an army who had just given an order; the guy would of course have no response available except OK. Wasn't deriding the guy at all.

RK• 16 years ago

I had a strangely similar problem to this in college with the network admins and filesystem permissions.

This was back in the day when everybody was using the unix network (pine for email, etc). Many people had webpages on their university accounts and would also store homework online. A very popular thing to do was to go into someone else's home directory and copy their .fvwmrc or .bashrc file (yes this was a few years ago).

The IT people came up with a new policy that said you were not allowed to look into other people's directories without explicit (possibly written) permission from the owner. They said that copying files could be considered "cheating" and possibly copyright infringement and you'd be referred to the university disciplinary court. I assume this all stemmed from fear of cheating.

In any event, I got into a long debate with the IT people about the whole point of unix file permissions. Basically: if you don't want people to look at your stuff, don't let them. As you might guess, when dealing with university IT, I was on the losing end of the argument.

conanite• 16 years ago

It would seem fair to argue that "rwxrwxrwx" is explicit permission to read your files!

3pt14159• 16 years ago

Why don't I just sue Google for crawling my website and get this court case done with. Once precedence is set it would be much harder for FaceBook to make these types of claims. "Your honor in the case of Google Canada vs Zach Aysan the courts clearly decided that..." DONE. Actually, I'm surprised this hasn't happened already.

Vivtek8• 16 years ago

You'd have to show damages. Otherwise (and correct me if I'm wrong on this point) you have no standing to file suit.

ojbyrne• 16 years ago

I'd guess you'd need to burn $100k before you even saw a judge. Are you up for that?

AgentConundrum• 16 years ago

For obvious reasons this would never happen, but it would be pretty cool to see Google unindex Facebook entirely. They could state that Facebook has made it clear that as Google did not have prior written permission to index their content (Google had simply assumed the rules outlined in robots.txt were sufficient, as it is with every other website).

They would state that Google would be happy to reindex Facebook, but it would take several weeks for their lawyers to meet with Facebook's counsel, draft documents, reindex privately, audit their cache to ensure compliance, etc.

We could then sit back and watch how fast Facebook backpedals.

pvg2• 16 years ago

How is it ridiculous? The more ridiculous thing is to expect robots.txt to actually have some sort of legal force.

rlpb• 16 years ago

Implied agreement.

The law acknowledges standard practice and expectations. That's what it is built on.

If you put something up on the web, then although you have copyright, you're also implying permission for people to be able to do what they normally do with it (at a minimum, view it in a web browser).

Similarly, if you've put up a robots.txt, then you're also quite clearly giving permission to crawlers (within certain bounds). There's also reasonableness and taking into account what robots.txt is capable of, of course. You clearly aren't implying permission for me to DoS you.

Explicitly agreed terms trumps this. If it could be shown that the person operating the crawler had agreed to an AUP, then that would change things. I imagine that this would make this case quite different from Google crawling your site.

dotBen• 16 years ago

"my lawyer advised me that it had never been tested in court, and the legal costs alone of being a test case would bankrupt me."

This is a very real problem with law surrounding emerging business practices, esp here in the US.

Ultimately you can only pioneer whatever you can afford to defend in court. Facebook, or any other BigCo for that matter, can assert that you can't do X and it's up to you to fight it in court... Even if there is prior behavior such as with this case. Clearly Google does the very same job and doesn't have an agreement with Facebook to spider their site.

But if you can't afford to defend it and bring up the prior examples in a court, then Facebook - or anyone else for that matter - can stop you.

viraptor2• 16 years ago

They probably have some clause in the terms and conditions about the automated interaction with the page (e.g. point 3.2, but there might be more)... but I hope it would be very hard to enforce. Especially when you can download the public pages without accepting the terms and conditions document or even seeing it.

siculars• 16 years ago

I've been beaten into oblivion before for speaking out about the way I see the future shaping up re Big Corporations owning our information but I'll take my chances and use this opportunity to speak out against Facebook again. In truth, I did invoke Orwell...

I'm no Facebook hater, I actually use Facebook often but when they pull these kind of stunts it really upsets me. I would imagine it would upset most freedom lovers on this site as well. When Facebook decides to take a smattering of our data and make it "Public" how then do they decide to control that data after the fact? Since when did Facebook re-define the word "Public"? It's like your cell phone provider and ISP redefining "unlimited". This stuff has to stop. Getting back to Facebook, since when does merely browsing to a URL(I) enter you into some sort of binding contract with the publisher?

imajes• 16 years ago

Whilst i agree with you, the devil's advocacy in me says,

"what happens when Facebook gets sued for this data exposure?"

And there are two avenues that might happen - investors suing as to loss of potential revenue, and user(s) suing over privacy violations.

Bear in mind, FB have already had class actions against them.. i don't think setting aside another 10m+ (conservative) just to defend yet another nuisance lawsuit is something they're going to be up for.

So, as Pete Warden described, they bullied him into shutting it all down with threats that they could just as easily lose in court - based on the principle that it's cheaper for them to sue Pete and lose cred amongst us than it would be for them to face a class action from users who are led to believe that their privacy has been violated by the data set via an ambulance-chasing lawyer.

Facebook should have instead invited Pete in for a chat and a job, but instead they took the full frontal lawyer bulldog approach. Sometimes that happens. Hopefully next time it wont- and i've already poked my friends at FB to raise the issue internally if possible -- and so should you.

breck• 16 years ago

Wait, from reading the article it appears he didn't get sued by Facebook (they just threatened to sue).

There's a difference.

viraptor2• 16 years ago

Yes... a difference between a lawsuit and a "legal extortion".

Vivtek8• 16 years ago

Barratry.

devinj• 16 years ago

It's not extortion, they didn't settle for anything other than him deleting all copies of the data that he had access to. Hyperbolic statements are unnecessary.

pvg2• 16 years ago

You are right, there is a huge difference. Essentially he's whining their legal terms do not serve his purpose. And they have better paid lawyers to prove it. And then he gets all upset about robots.txt which is actually not a contract of any sort. Let's all move along.

btipling• 16 years ago

I'm surprised that shutting up about this wasn't part of the agreement, either that or he's violating it. I've never heard of a settlement that didn't involve keeping your mouth shut.

I'm glad he posted about it though, that legal issue regarding robots.txt is good to know.

petewarden• 16 years ago

They never asked me to keep quiet about it, and they've been willing to comment about it too, eg

http://www.newscientist.com/article/dn18721-data-sifted-from...

I'd imagine they want to deter people from following in my footsteps, so publicizing their actions serves as a warning.

jrockway2• 16 years ago

I'd imagine they want to deter people from following in my footsteps, so publicizing their actions serves as a warning.

If anything, I'm encouraged to start a publicly-available database based on crawling Facebook. Don't associate your name with it, crawl from your Ipredator account, and make sure your data is spread far and wide. Then they can sue the Entire Internet like the music companies are having so much success with.

Information wants to be free.

(Also, what's the worst that could happen? You get sued, and Facebook gets a few thousand bucks from your savings account and your used mattress? OH NOES.)

ramanujan• 16 years ago

Facebook was founded by an outlaw scraper. Game recognize game, they're just neutralizing a threat, don't worry about the legal window dressing.

Read about Zuck's wget magic here, and how he illegally scraped (guarantee it was a TOS violation) all the Harvard online facebooks in 2003: http://www.scribd.com/mobile/documents/538697

As Balzac said, behind every great fortune lies a great crime :)

pak• 16 years ago

Where did that diary entry come from? Was that entered into public record as a result of a lawsuit against Facebook or something?

If it's real (it's a pretty apalling read into the guy's mind), what a great example of why you shouldn't keep all your private thoughts online...

mos1• 16 years ago

He also wrote software that scraped and archived AIM status messages. Apparently he has a long history of scraping content in various forms.

jacquesm• 16 years ago

Not to mention the fact that he 'scraped' the idea of the concept of facebook in the first place.

analyst74• 16 years ago

How about crawling search engines? For example, instead of crawling directly on facebook, crawl on a search engine with "site:facebook.com".

In that case, your data is gathered from the search engine and has nothing to do with facebook any more. And I doubt the search engine will sue you for using their service.

Vivtek8• 16 years ago

It's still Facebook's data (by which I mean "data that originated at Facebook"), and I guarantee you that their lawyers will still threaten a lawsuit. What do they have to lose?

robryan2• 16 years ago

You could then claim that the lawsuit is against the wrong person or would they argue that the original scraper was in the right and the secondary person was in the wrong?

wooster• 16 years ago

http://en.wikipedia.org/wiki/Feist_Publications_v._Rural_Tel...

asimecs• 16 years ago

Legal precedent: "Copiepresse (Belgian Newspaper Conglomerate) v. Google (Read more.. ). Filed in August, 2006.

Claims: to remove all the content indexed by Google's crawlers on the newspaper's websites."

http://www.infoniac.com/offbeat-news/google-list-of-class-ac...

Google's response: "Of course, if publishers don’t want their websites to appear in search results (most do) the robots.txt standard (something that webmasters understand) enables them to prevent automatically the indexing of their content. It's nearly universally accepted and honoured by all reputable search engines."

http://googleblog.blogspot.com/2006/09/about-google-news-cas...

May be you can get Google to file an amicus brief...

"Outcome: Google had to remove the plaintiff's newspaper content from its database within 10 days or face fines of 1,000,000 Euro per day. Google had to publish "in a visible and clear manner and without any commentary from her part the entire intervening judgment on the home pages of google.be and of news.google.be for a continuous period of 5 days within 10 days... under penalty of a daily fine of 500,000 Euro per day of delay". Google had was awarded the costs of the expenses of 941.63 Euro (summons) and 121.47 Euro (costs of thy proceedings)."

gcb• 16 years ago

He is not publishing the data as is. he is publishing his work done over the data.

or am i wrong?

Now can't i publish my thesis because it contains information i got from copyrighted books?

scott_s2• 16 years ago

He offered to distribute the data as-is to whoever was interested.

How I got sued by Facebook

Related Stories