Ex-Facebook insider says covert data harvesting was routine

https://www.theguardian.com/news/2018/mar/20/facebook-data-cambridge-analytica-sandy-parakilas

by valanto • 8 years ago

942 376 8 years ago

The cool thing? This "whistleblower" already spoke publicly with an op-ed on the NYT months ago. Again, this is just the top of the newscycle. Let's see what happens in three months from now. My guess: Facebook revenue will go up. This is a PR shitshow, and a great piece of advertising for Facebook's ad department. A lot of marketers right now are thinking "wait, we could do that with all that Facebook data we have?!"

Gys• 8 years ago

My thoughts exactly. People seem to hold on to Facebook whatever the stories are, so there is no real problem. I was even thinking of buying stocks soon (wait one more week to have the market process these 'new' facts).

spyspy• 8 years ago

It may not be seen as ethical here, but I also plan on buying some more FB. This is a huge overreaction, and we all know it'll blow over inside of a week.

sveme6• 8 years ago

GDPR can't come too soon. That would definitely put an end to these shady practices, as the penalties of several individual infractions would endanger any company.

Oras• 8 years ago

and how many people are aware of it and will write to companies like FB asking for their data?

camillomiller2• 8 years ago

It will offer a possibile solution in Europe, where Facebook has already been under heavy scrutiny. It won't change anything in the US, South America, SE Asia and developing countries where Facebook is already dangerously synonimical to the whole online experience of the average user.

wruwew8uu9• 8 years ago

Even if they complied with your erasure request and deleted everything from all their servers and their backups (spanning the world over a decade), think of all the non-EU third-parties who have your FB data already

tomaskafka• 8 years ago

No it won't.

[] I want to see dancing monkeys and for that, I agree to have all my data shared with unnamed third and fourth parties indefinitely.

See? Everyone clicked that :).

malikNF• 8 years ago

What's utterly horrifying about this whole thing is how the media is acting as if this is some sort of surprise. Like what did you think was happening at a company collecting data about billions of people? Especially at a company that has a CEO who is famous for calling its own users dumb fu * * s? A company that experimented on at risk teens. Like come on.

--edit---

Or lordy, didn't expect this comment to blow up this much. Do forgive me if it sounded a bit smug, that was not my intention. But the fact of the matter is this was something we were all warned about, we were shown countless examples of exactly this, not just us nerds, everyone, people like Edward Snowden risked their lives telling us about how all this data was being used against all of us. and yet everyone kept giving more and more, you were looked at like a tin foil wearing nutter when you told people not to give away so much information about themselves so easily.

At the end of the day, this is not really 100% facebook's fault, this is our fault, the fault of everyone who so readily made their information available without giving much thought to who sees it and what happens to it. And no just because you are not a techie you are not off the hook for not caring enough about your own privacy. I mean what level of technical knowledge is needed to know that once you post something online others can see it?

Funny thing is, this would all blow over after a few months, and everyone will go back to the usual habbits.

fredley• 8 years ago

It's not a surprise to most readers of HN, but most people are not readers of HN, and take things at face value, where face value is what they see in advertisements and hear from their friends.

People still have an expectation of privacy, even when, from an HN perspective they should be extremely skeptical about having such an expectation.

1337biz5• 8 years ago

Fascinating to watch - it shows how much power media has to put a topic on the global agenda if it fits into their preferred narrative.

scottmf6• 8 years ago

Let me guess. It’s a globalist media conspiracy to take down Trump?

jerf• 8 years ago

Facebook's current problem is that they've now created a lot of enemies and they're running short on friends. This isn't quite as bad as it sounds, because creating enemies when you reach this scale is inevitable, so the mere fact that Facebook isn't everybody bestest bud ever is not intrinsically a problem. However, one of the fundamental ways to defend yourself when you reach this scale is to act with a certain amount of ethics and decorum. Ethics are not just about being good to other people, because all sensible formulations of ethics have reciprocity in them, so if you are good to other people, even your enemies will, if begrudgingly, cut you some slack.

Facebook has reached this size but has not prepared itself for it, and what's happening is that they took a bit of a stumble, and absolutely nobody is rushing in to defend them because they've burned all bridges. The media hates them for the economics of taking over the media industry and their ad revenue, and making them dependent on them. Conservatives have a pretty solid case that they are being censored by the platform systematically, even if it isn't true they feel it is true, so no friends there. It's pretty obvious that Facebook can expect no help from the Republicans in general. The Democrats may not hate Facebook, but there's no positive reason to burn very much political capital on helping them. (After all, they didn't deliver this time, did they?) And increasingly, the chickens are coming home to roost with their customer base, as fears about surveillance, power, and abuse of power are now going from vague fears to metastaticized, realized issues with Facebook that appear to affect it down to its very core.

It's not just the media narrative, though that's true enough... everybody is now at best neutral towards Facebook, and they're accruing enemies fast, not least of which is an ever-increasing portion of their own customer base(s).

How will they get out of this one? It's possible this will just die down this time. But these forces aren't going anywhere, and if it isn't already too late for Facebook to change course on this, the clock is definitely reaching midnight fast.

rando444• 8 years ago

Surely you understand the difference between the media reporting on facts vs. general public speculation.

jjoonathan• 8 years ago

A lack of novelty is no reason to be dismissive.

tmalsburg24• 8 years ago

As a matter of fact, this is news and surprising for most users of Facebook even if it's not for you. By saying that no one should be surprised, are you not taking the same condescending attitude that you're pointing out in Zuckerberg?

meuk• 8 years ago

Well, it is extremely naive to think that Facebook does not use all the data they get about you. Then again, most people are very naive about this kind of everyday technology.

realusername• 8 years ago

If people just followed a little bit the news, we had the PRISM scandals going on for years, it's hard to not notice that.

bob_theslob646• 8 years ago

This is not news.

(2010)[http://www.zdnet.com/article/fbi-feds-collect-facebook-socia...]

(2010)[https://www.technologyreview.com/s/418971/facebook-personal-...]

(2012)[http://www.nytimes.com/2012/02/05/opinion/sunday/facebook-is...]

(2011)[https://www.independent.co.uk/life-style/gadgets-and-tech/ne...]

(2011)[https://techcrunch.com/2011/11/01/researchers-flood-facebook...]

(2012)[money.cnn.com/2012/03/22/technology/facebook-privacy-changes/index.htm]

(2011)[https://blogs.wsj.com/digits/2011/09/26/facebook-defends-get...]

The real discussion to be had is how do you know that the person is actually aware of giving consent, similar to how a recaptcha verifies whether or not you are a human. I see in the future, some sort of test for users, that verifies that they read the terms of service, as a form of consent for the user agreement.

Edit: Fixed all urls. All work except, cnn where you have to copy paste.

psyc• 8 years ago

Well, I was with you right up until the gratuitous equivalence to Zuckerberg.

IncRnd• 8 years ago

Yes, this is news. However, it really shouldn't surprise any users of facebook that facebook would find ways to monetize their data, being carelessly abusive in the process.

freyir3• 8 years ago

Just so the quote [2004] isn't out of context:

Zuckerberg: I have over 4,000 emails, pictures, addresses, SNS

[Friend]: What? How'd you manage that one?

Zuckerberg: People just submitted it.

Zuckerberg: I don't know why.

Zuckerberg: They "trust me"

Zuckerberg: Dumb fucks

na854• 8 years ago

Got the original screenshot perhaps?

relyio• 8 years ago

I'm sure you can do a better job at illustrating your point than ressucitating a +10y old quote from Zuck, 19 at the time.

Teenagers and college students say a lot of condescending, dumb, immature stuff in group discussions. It's not news and no evidence at all.

intended2• 8 years ago

I mean this is HN not Reddit, so I expect most people to know the context of that comment by now (on this site) and his apology and explanation of it.

On Reddit the normal person can be forgiven for not knowing the full context of quote, but this quote has come up on HN many times over many years.

dTal2• 8 years ago

You forgot the preamble, "Yeah so if you ever need info about anyone at Harvard - Just ask."

Makes it even creepier. He was willing to dox people for social cred, before he realised the data had financial value.

IAmEveryone2• 8 years ago

“The media” has always been sceptical of Facebook, and I’d love to see examples of them “acting surprised”. In fact I would guess your scepticism was always informed mostly by what you and those you socialize with read in “the media”. The current scandal’s staying power in the news is similarly based on journalists’ pent-up suspicions finally finding a vehicle to be expressed in public.

These stories are newsworthy because they represent the break from generalized scepticism to specific examples of harm. If the New York Times had waged a nebulous campaign against Facebook without clear evidence it would have rightly been accused of getting ahead of the facts.

ybrah• 8 years ago

I would call my users dumb fucks too if I was 19

simias3• 8 years ago

It reminds me of the Snowden leaks about mass surveillance programs like PRISM. I think most technical people expected something like that to exist ever since the internet became mainstream. Still, if it's just an "educated rumor" without hard evidence there's not much for the media to talk about. Up until now you could only say "it seems pretty likely that Facebook is doing something like that, but we don't know for sure". That's not enough to make an article and that's not enough to convince the general populace apparently.

In general it's pretty amazing how trusting the average human being seems to be as soon as computer are involved. I suppose that it's mostly out of ignorance and complacency. People seem a lot more careful when physical mail is involved than emails for instance. They also don't hesitate to share extremely intimate details about their private lives with a faceless corporation. Some of my friends willingly opt into streaming their position in real time continuously through their smartphones. That's terrifying to me but apparently very convenient for them. I think Zuckerberg agrees with my sentiment since that's the source of his "dumb fucks" comment.

I hope these articles will help change that mentality but I'm not overly optimistic. I read a comment on a forum earlier today that basically said "screw Facebook, I'll close my account and do everything from WhatsApp instead". I don't think it was sarcastic.

jclardy• 8 years ago

I think the trust is a new thing though, new to the social media age. I remember growing up with computers in the 90's and people I knew wouldn't even consider entering a credit card number on a website. Now we give them freely. People used anonymous handles on AIM. At some point this changed and people decided they could be themselves on the internet, which is a fine idea, but the trust just went too far.

0942v8653• 8 years ago

Some of my friends willingly opt into streaming their position in real time continuously through their smartphones

How do you avoid this? I have a GPS in my car with stored routing information, but if I need to navigate for someone else or get walking/biking directions, I am forced to do this. Printing out directions beforehand is something I did only a few years ago, but these days I don't always have a chance to do that.

chapill2• 8 years ago

Another educated rumor: As soon as Al Franken suggests regulating Facebook under Net Neutrality, pictures surface that destroy his political career.

hackermailman• 8 years ago

Everybody knew about the data leaking for 'quizzes and games' since 2009 http://www.cbc.ca/beta/news/technology/facebook-breaches-can...

WikiLeaks also covered this earlier in their spyfiles warning. People don't care that a political opinion survey being spammed around by their friends is actually harvesting their details in a campaign dossier to manipulate them directly later.

Angostura4• 8 years ago

What did you think was happening at a company collecting data about billions of people?

I'd expect it to use it for advertising targeting. The privacy settings I've put on there exclude other uses.

flexie• 8 years ago

"Parakilas, 38, who now works as a product manager for Uber, ..."

So from one reckless company that doesn't give a damn about the law to the next. Who teaches developers that it's okay to work for anyone as long as the tech is cool and the salary is great?

exelius• 8 years ago

I actually know Sandy and he’s a conscientious guy who cares about this stuff. He’s a good dude who wants to make positive change by being in the conversation.

zbentley2• 8 years ago

Who teaches developers that it's okay to work for anyone as long as the tech is cool and the salary is great?

Who teaches them otherwise?

Absent parental/primary-school-instilled ethics, rather a lot of engineers operate in a bubble of like-minded (and similarly-employed) people, making large amounts of money, and are often insulated (voluntarily, deliberately, or accidentally) from the impact of their work.

What could be changed to improve on that situation? I've heard simplistic suggestions to "sue the C-class until they learn/abandon the incredibly lucrative profit motive", "fire/imprison engineers whose changes harm people", and "make the bridge-builder stand under bridge they built" (whatever that means in a software context). Those seem utopian. What tangible, plausible changes can be made to improve on developer accountability (for their work) and discernment (about prospective employers)?

jonbarker• 8 years ago

There were many people working on the Manhattan project who then later became nonproliferation advocates. I personally would rather that people feel like they can work for companies that have made mistakes and voice their opinions about where things should go. It would be pretty hard to find out what is happening at companies if there weren't former employees talking about it.

apotheothesomai• 8 years ago

Well, the reason is that people in general aren't often ethical, when they seek to benefit personally. It's not taught; it's the default setting.

I wish a little philosophy and ethics were part of the curriculum. This would not be to inculcate normative values, but to help eng students clarify what they believe, and what the implications are.

That said, most engineers I've met who work on sketchy stuff are either naive, apathetic, or suffer from massive cognitive dissonance.

The latter will too often regurgitate the self-justifying language of the business people in their companies.

Ever listen to ad tech people spew absurdities about people wanting to be engaged with "their" brands? How about the justifications for massive data collection and analysis - targeted ads are so much better for people. Pfft.

Then there are, say, NSA engineers who convince themselves that what they do is necessary, if illegal. That said, I saw a lot of NSA LinkedIn profiles that swapped out NSA for DoD a few years back.

Company leaders tend to hand employees ideas and the slogans to repeat to themselves and others. The internal spin is huge and insidious.

IMHO

freeone30003• 8 years ago

You get to work with cool stuff and get paid money! Who cares about ethics, it's not like you suffer consequences on failure. (I'm not entirely sure the companies do either...)

zeveb2• 8 years ago

So from one reckless company that doesn't give a damn about the law to the next.

Uber doesn't appear to have historically given a damn about the law, but AFAIK it has historically given a damn about its users. Facebook, OTOH, doesn't appear to be giving a damn about its users.

As for the law: there are plenty of unjust laws out there; I respect someone who fights unjust laws such as the taxi monopolies. I don't respect someone who fights just laws.

thatfrenchguy• 8 years ago

I think a lot of software engineers (past me included) are genuinely persuaded that tech really is going to change the world for better and that it’s the way to do good social changes, because “politics is too complicated”.

Then the corporate koolaid of come and tell you you’re doing the most important thing in the world and you just eat it.

switch007• 8 years ago

I know this is HN (where it is probably less of a surprise) but for a wider audience taking this kind of opportunity to write a smug comment might just be harmful to them, their privacy and their rights.

sydd• 8 years ago

Yeat, especially considering that:

- This was part of an open API, you just needed to sign up for free. There is no data breach.

- EVERYONE was using it - this consisted mostly of games like Farmville. This is how they can show your friends progress and their profile pic.

- It was shut down more than a year ago.

Actually there is no newsworthy thing at Facebooks side at all, the new thing is that companies built games just to harvest this data and use it for something else.

mtgx2• 8 years ago

Well, for the past few years, the media has been a "partner" of Facebook. Now it's not any longer. Seems like a wrong move for Facebook to dump the media like old clothes. Whoops.

I even remember such articles from TheGuardian before decrying that people are "going dark" - no, it wasn't about using Tor or VPNs. It was simply about using tracking protection.

merpnderp• 8 years ago

This exact same scandal broke in 2012 only it was with Obama’s campaign. It is humorous to see the media much more outraged when Republicans do it, as if it wasn’t that big of a deal when Obama did it.

https://twitter.com/cld276/status/975564499297226752

Edit for interesting link to the 2012 Facebook election data story.

ptero• 8 years ago

What's utterly horrifying about this whole thing is how the media is acting as if this is some sort of surprise

I agree. A couple of generations ago the media was much more combative and willing to take on the powers that be (and each other). By this time most media outlets would have been saying "told you so (many times)". Unfortunately, now media mostly follows trends and competes on beauty of their talking heads, which is a lot safer than, say, investigating slavery or organized crime.

anonymouz• 8 years ago

As someone who considered himself reasonably well-informed about the privacy implications of Facebook, the "friend permission" was still news to me. That Facebook would share my profile data with a third party because some Facebook contact of mine "allowed" it, is utterly horrific. It is also a clear and massive breach of EU data privacy laws. (Which unfortunately seem difficult to enforce against international companies at the moment; the GPDR can't come soon enough!)

In any case, if this should have been known by everyone already, I guess Facebook has no reason to panic if it's all over the news now. Just a bit of publicity for them, right?

IshKebab2• 8 years ago

There were settings to disable it, but really they should have been private by default:

https://nakedsecurity.sophos.com/2013/04/03/how-to-stop-your...

It was fairly well known at the time I thought.

mancerayder• 8 years ago

I 100% agree, it's the friend permission thing that is criminal. Facebook no doubt covered their asses legally via the TOC, but I hope that the misleading nature of the (complex and ever-changing) privacy settings is mentioned in a lawsuit one day.

mattbrewsbytes2• 8 years ago

The media likes to get people's eyeballs just as much as FB. They will over react to get views.

If those little radio buttons in privacy settings do literally nothing on the backend, then FB could have a massive legal/financial battle if they knowingly ignored user preferences and sold off unaggregated data for profit.

TomK32• 8 years ago

A CEO Mark Zuckerberg who started (or so) the whole thing to get data on his study buddies.

lumberjack3• 8 years ago

I just posted a comment but I will reply here too. The bullshit excuse that used to circulate, even on HN, is that Facebook would never sell the data directly because it was too valuable. Instead they would just sell targeted advertisement.

fancyfacebook• 8 years ago

Yes, I think we are ready to grow out of the "arrogant jerk" phase of tech.

The tech wizards who build things and run these companies:

1. Are not smarter than you

2. Do not have your best interests in mind

3. Will lie to you repeatedly

4. Will do everything to avoid negative attention or consequences

Stop worshipping anyone. Not Jobs, not Zuckerberg, not Gates, not Musk, not anyone. They aren't on your team. I don't care if they look like you or represent something you are really passionate about, you still need to be skeptical.

stochastic_monk• 8 years ago

Bravo! While I hope that some (IE, Musk) have our best interests in mind, it’s of utmost importance to keep in mind that any individual (and particularly, any organization) has their bottom line as their top priority.

9889095r3jh• 8 years ago

Would you rather the media report on unsubstantiated rumors and assumptions, or would you rather they wait to report things until they have evidence, or a source who can verify the information?

JumpCrisscross5• 8 years ago

as if this is some sort of surprise

Most people don’t think “the data used to sell me milk could be used by politicians.” And those that do didn’t think “political ads today could be replaced by surreptitious foreigners tomorrow.”

If your reaction is “they should have known” you are in a Silicon Valley thought bubble. (I was until recently, too.) What you find “horrifying” is that bubble’s edges fraying.

“Of all the news crises Facebook has faced during the past year, the Cambridge Analytica scandal is playing out to be the worst and most damaging.

Why it matters: It's not that the reports reveal anything particularly new about how Facebook's back end works — developers have understood the vulnerabilities of Facebook's interface for years. But stakeholders crucial to the company's success — as well as the public — seem less willing to listen to its side of the story this time around.”

https://www.axios.com/facebook-reaches-tipping-point-cb7e0e9...

CiPHPerCoder3• 8 years ago

If your reaction is “they should have known” you are in a Silicon Valley thought bubble. (I was until recently, too.) What you find “horrifying” is that bubble’s edges fraying.

What if your reaction isn't "they should have known" but rather "they should have listened when I told them this!"?

magic_beans• 8 years ago

Facebook offers their service FOR FREE. What did people expect?

forgottenpass• 8 years ago

Like what did you think was happening at a company collecting data about billions of people?

"A more productive answer to someone saying something you agree with is “I agree”, not mistakenly berating them for not agreeing sooner." (https://news.ycombinator.com/item?id=16627766)

It's not like huge numbers of people didn't know about global warming before society started caring about fixing it.

johnchristopher• 8 years ago

I don't understand how you seem to be surprised some people find this horrifying. /s

barrkel• 8 years ago

It's like the diesel scandal, IMO. Everybody in the industry knows what's going on, but that doesn't mean the industry's Overton window isn't liable to be reset with severe repercussions once the general public gets looped in.

hedonistbot2• 8 years ago

None of this would have come to light if the "right" person had won the elections. The moment Trump won, the campaign against social media began, first with the "Fake news" meme, then "Russian hacking", YouTube's adpocalypse and now "Facebook data breach". Some people are getting very scared that the traditional manufacturers of consent are losing their grip on people's minds.

And I am not in support of the mass surveillance exercised by those companies, just noticing the timing. When Obama won, his data scientists were hailed as geniuses. What do you think they were doing?

kamaal• 8 years ago

I don't think anybody is arguing against using data science in elections. What people are talking about is data theft, stealing private info(like emails, photos, etc) and stuff like that.

Its a bit like comparing withdrawing money from your bank account and robbing a bank.

hinkley4• 8 years ago

“I am shocked to learn that there is gambling going on in this establishment.” “Here are your winnings, sir”

bowlofpetunias• 8 years ago

Funny thing is, this would all blow over after a few months, and everyone will go back to the usual habbits.

It can't blow over in the UK or the EU, because it is seriously f-ing illegal in those places.

Yes, we "knew" it was happening before this (hence all the regulatory steps taken that were dismissed as anti-American protectionism), but we were lacking hard evidence, so all we could do was reinforce regulations and regulatory authorities.

Now that shit has leaked, it's simply not an option for those authorities to not act. Not to mention the fact that they really, really want to act.

So no, this will not blow over. Maybe in the US and/or the media, but not where it matters.

jhayward• 8 years ago

I can't disagree enough with a "blame the user" attitude.

First, it absolves the perpetrators, who are definitely in the wrong. I include both FB and CA in this category.

Second, it is becoming clear that there can be no such thing as "informed consent" in a networked world with respect to data privacy. Zeynep Tufekci, whose writings I heartily commend, had a good article on it a few weeks back.[1] She argues both that the actual uses known of that data are not fully described in consent waivers, and also that it is not possible to know ahead of time how that data will be combined, recombined, projected, analysed, and used in the future to fully consent to all those things. Even if you could do so for yourself as an individual it's not possible to consent to the effects of the combination of an entire society's data as a whole, on others.

Again, it's not possible to obtain informed consent in today's privacy environment, so let's stop blaming the victims.

[1] https://www.nytimes.com/2018/01/30/opinion/strava-privacy.ht...

scottmf6• 8 years ago

Oh man this is bad.

the platform operations manager at Facebook responsible for policing data breaches [...] warned senior executives at the company that its lax approach to data protection risked a major breach
One Facebook executive advised him against looking too deeply at how the data was being used, warning him: “Do you really want to see what you’ll find?”
They felt that it was better not to know. I found that utterly shocking and horrifying.

1337biz5• 8 years ago

Isn't that just part of FB's culture? Didn't the Zuck start out by scraping Harvard's student registry?

coldcode• 8 years ago

Move Fast and Ignore Bad Things. It got FB pretty far.

bandrami• 8 years ago

And the website's original purpose was for upperclassmen to rate the hotness of incoming female freshmen.

txcwpalpha5• 8 years ago

Lol, "this is bad"? This is normal. I can give you an entire list of F500 companies I've worked at that have the same mindset. I've sat in meetings with F100 CIOs where they were given the same warning and shrugged it off. I've been asked before to turn off security monitoring systems because executives prefer to not know about vulnerabilities rather than know about them and not be able to fix them.

The only thing shocking and horrifying about this whole thing is how naive the American public must be to find any of this shocking and horrifying.

peterwwillis3• 8 years ago

People love to pretend to be horrified by things they've assumed to be true. "What? A politician is corrupt? Outrage!!" "What? They're tracking me to build profiles on my use of all their advertising driven free services? Outrage!!" I'm sure there's a word for it in German.

koboll2• 8 years ago

I've been asked before to turn off security monitoring systems because executives prefer to not know about vulnerabilities rather than know about them and not be able to fix them.

It's a simple cost-benefit analysis.

Implementing effective security is difficult, time-consuming, and expensive. Ignoring problems costs nothing. Unless it's clear the cost of a breach is higher than the cost of security, corporations will risk a breach every single time.

The ultimate loser here is users, who bear the burden of having their data appropriated and misused. Unless the government steps in and imposes penalties on corporations on behalf of users, they'll continue merrily offloading the risks of poor data security on the general population.

scottmf6• 8 years ago

Please do share that list.

DFHippie2• 8 years ago

"Better to ask forgiveness after than ask permission before."

bogomipz3• 8 years ago

"This is normal."

So that means its not bad?

snarfy• 8 years ago

For the executives, it is better not to know. As soon as they know they are liable and must disclose it. As long as they don't know they can claim ignorance.

ggm• 8 years ago

Regulator asleep at the wheel.

jakelazaroff7• 8 years ago

Can we not let this become framed as a "breach"? No systems were compromised. Nothing of Facebook's was accessed that wasn't supposed to be accessed. This was data intentionally exposed by Facebook, just exfiltrated and given to an entity whom Facebook hadn't authorized.

This is simply the extent to which we've permitted these Internet giants to collect information about us. It's business as usual.

Edit: To clarify, this is indeed worse than if the data were taken from Facebook without consent. What it means is that not only does Facebook have access to vast troves of personal information, but so does everyone tangentially connected to someone with a Facebook developer account.

mannykannot2• 8 years ago

I hope you are saying that this is worse than a simple breach, not that it is a non-issue.

jakelazaroff7• 8 years ago

Good call. Edited to clarify.

koboll2• 8 years ago

Even "exfiltrated" is not really accurate since it was freely handed over.

The problem is that Facebook just made its partners pinky swear to only use the data for research, which is obviously not an adequate data security measure.

faizshah2• 8 years ago

The real point is that companies like facebook and equifax have such large caches of personal data and have no legal obligation to protect it. This is a point most people outside of tech don't understand. You might not even be a user of facebook but these companies still have data on you that is highly personal and invasive.

An academic who has done some great work on this is Evgeny Morozov. Highly recommend his books, articles and lectures.

jakelazaroff7• 8 years ago

The point of my comment is that we should not compare Facebook to Equifax. The latter may have been lax in protecting that data, but the millions of records exposed last year were taken without their consent. Facebook is literally inviting anyone who can sign up for a developer account to harvest their — sorry, our — data at scale.

mattkevan• 8 years ago

Sounds like a breach to me.

The only difference is that instead of the baddies having to sneak in carefully at night to nick stuff, Facebook said 'welcome, come on in, help yourself – here's a sack'.

The end result – millions of people having their personal data used against them without their knowledge or consent - is the same.

jakelazaroff7• 8 years ago

"Breach" specifically implies that defenses were penetrated. But as you said, Facebook is not trying to protect our data.

This is far worse than if the data were taken from them unwillingly, because it vastly increases the number of entities with unfettered access to it.

d_theorist3• 8 years ago

Two things can result in the same outcome without being the same thing.

toxican3• 8 years ago

To me, calling it a breach is Facebook's attempt at passing the buck. Getting breached alleviates some responsibility for what happened. Maybe not in reality, but in how it's portrayed in the media and how it's understood by laymen it absolutely does.

molszanski3• 8 years ago

No, this is not a breach. Words still mean things.

karmelapple• 8 years ago

Was this a security breach in the sense that the company with the data got “hacked”? No.

Was this a breach in trust to Facebook users? I think undoubtedly yes.

And was there a breach of a the Terms of Service by companies taking all this data and using it for non-academic purposes? Yes there was.

So the type of breach seems to be a worthwhile distinction to make.

_red• 8 years ago

Was this a breach in trust to Facebook users? I think undoubtedly yes.

How naive is the average person? The purpose of facebook is to gather this information, hence why its offered as a "free service".

Frankly, I don't understand why the stock is going down, facebook is fulfilling its core mission: Get private information on millions of people and package that information for sale to its clients. If anything CA situation should show how FB is fulfilling its core mission.

The fact that the public is now waking up to this is not a breach, its simply casting a light on what has always existed.

jstalin• 8 years ago

And was there a breach of a the Terms of Service by companies taking all this data and using it for non-academic purposes? Yes there was.

There's a legal concept of 'waiver' meaning that even if something is prohibited in a contract, but the parties don't enforce that part, then that part is later not enforceable. Facebook was fully aware of this behavior, chose not to enforce the ToS, and therefore it waived that clause. Therefore no breach.

chrononaut• 8 years ago

Was this a breach in trust to Facebook users? I think undoubtedly yes.

What's interesting about this is the fact that the same data is shared with many third-parties, with proper "consent", and users not understanding what's really happening. Calling this a "breach" has the slight unintended side-effect in the public by promoting the idea that this company received a different dataset than other partners, which is not the case.

mattbrewsbytes2• 8 years ago

For Facebook, an actual data breach would be better. They could button things up and make some statements and move on.

This appears to have been systemic and profitable for them because companies would turn around and pay them for highly targeted ads. They ignored it because of greed.

toufka• 8 years ago

Yep. If/when the 50M profiles become public, Facebook will be bending over backwards to rebrand this as a breach. However, on the (Twitter) record, their CISO has already said emphatically this was not a breach. He's been demoted.

generalk• 8 years ago

  >  Can we not let this become framed as a "breach"? No
  > systems were compromised. Nothing of Facebook's was
  > accessed that wasn't supposed to be accessed. This was
  > data intentionally exposed by Facebook, just exfiltrated
  > and given to an entity whom Facebook hadn't authorized.

This is similar to a HIPAA "breach" where the word doesn't imply that a security system was compromised, but that protected data was accessed by folks who shouldn't have had it. In this context, framing it as a breach is perfectly accurate.

As an aside, a HIPAA-style law that protects and enforces portability for this type of personal data might be a good first step to reforming our industry here, which is currently completely unregulated in this regard.

bunderbunder• 8 years ago

Let's please do better than HIPAA. It was the first such law that I know of, and there are a lot of kinks to it. Many subsequent laws were able to learn from its mistakes.

One of the big weaknesses of HIPAA is that the privacy requirements technically apply to the data custodians, not the data. That allows for some loopholes through which private information can fall out of HIPAA protection, and also creates some unnecessary hassles for health care providers.

Ontario's PHIPA is one example of a better model for patient privacy.

phkahler• 8 years ago

> ...but that protected data was accessed by folks who shouldn't have had it.

Facebook handed over the data. They need to understand that they don't have control over it once it leaves Facebook. Is a violation of ToS a data breach? Do we really want to conflate those things?

cyphar• 8 years ago

A much better example would be GDPR, which comes into force EU-wide in about two months.

verylittlemeat6• 8 years ago

protected data

What data was being protected? The data was created when the user chose to engage with the facebook apps. CA pays facebook to put something in front of users faces and then CA gets back information on user engagement. How is that different than any other kind of advertising on the web?

We can argue that there needs to be more transparency on facebook but a breach? That's torturing the word.

mc322• 8 years ago

Listening to politicos, you'd think the systems were actually compromised, and, in the same breath, boogeypeople from Russia are mentioned in order to conflate things in the mind of the audience. This willful conflation is a tactic to drive a narrative.

HIPAA data is accessed by researchers, sometimes anonymized, but not in all cases. These are not considered breaches. In addition, as others indicate, FB posts are not, at least at this time, protected data.

So, while illustrative, the analogy is not apt.

FLUX-YOU• 8 years ago

This is similar to a HIPAA "breach"

It's not, at all. The FB API was designed to give out this information before it was changed. That means the friend data was not need-to-know like healthcare data.

CiPHPerCoder3• 8 years ago

This is similar to a HIPAA "breach" where the word doesn't imply that a security system was compromised, but that protected data was accessed by folks who shouldn't have had it. In this context, framing it as a breach is perfectly accurate.

Data breach is a compound noun with a very specific meaning in information security. It means that the data was protected, and a malicious entity defeated the protections.

Breach of contract, breach of trust, physical breaching of the hull of a ship, etc. are all different usages of the word breach, but it's not a data breach unless someone accessed a protected system without or exceeding authorization as defined by the CFAA.

mrtksn3• 8 years ago

It's definately a breach, just not breach into Facebook's technical infrastructure.

As I wrote previously, don't you think that it can be a breach in the same sense of a breach by phishing? After all, both of the cases are about people giving their "secrets" for one reason but the info being used for something else. I mean, in the case of traditional phishing the user is tricked to provide the password by impersonating a banking site, getting their funds stolen and in the case in question, the users are tricked to provide personal information by being promised some kind of personality analysis but their data is used for political propaganda that they didn't asked for resulting in life-changing consequences du to politics.

whiddershins2• 8 years ago

When you call it a breach it sounds like they made a mistake.

It wasn’t a mistake. It was by design.

bogomipz3• 8 years ago

'Can we not let this become framed as a "breach"?'

Just because it wasn't a hack does not mean it wasn't a breach. To wit - a breach of data governance, breach of trust, breach of moral responsibility.

xmodem• 8 years ago

All this lawyering over the definition of 'breach' is failing to see the forest for the trees. It is a breach of trust, even if not a breach of technical security controls.

Bartweiss• 8 years ago

I think there's a meaningful, non-definition difference - and in some ways it makes Facebook look worse.

Metaphorically, somebody had a gun, and someone else took that gun and used it to rob a bank. Equifax left the gun sitting visible in an unlocked car, and people are angry about the predictable results. Facebook was running a "borrow my gun" program for strangers, but had a clause saying "no using my gun for crimes, no lending my gun to any third parties". One of those strangers lent the gun to the robber, and Facebook is saying this isn't their problem because they said not to do that.

So yes, they're both bad outcomes. But "breach" usually means "this was stolen without our knowledge", and that's a very misleading impression to create here.

lerpa2• 8 years ago

It's the problem with that kind of speech, it's impersonal and dehumanizing.

Let's say it like it is: facebook betrays users expectations giving their data to other businesses.

Same for hacking: some people invaded system such and such and took private information.

It doesn't matter if it was a breach, a floodgate, a window, what matters is what happened, and what happened is that player X did Y. Let's just state that first and foremost.

hinkley4• 8 years ago

It’s important for the public discourse that someone point this sort of stuff out occasionally. Even if this was not even the most egregious example I’ve seen this week.

Once in a while I reread http://www.derailingfordummies.com and review the definition of “horizontal aggression”. Sometimes it saves me from engaging with people who are derailing the conversation. Accidentally or willfully.

elorant• 8 years ago

You don't even need a developer account. You could just scrape Facebook which is probably what CA did in the first place. They used the app to identify US users and from there on just scrape the pages using a headless browser and multiple proxies.

fiddlerwoaroof• 8 years ago

Unless I’m doing something wrong, a developer account makes this sort of thing harder: you can’t just access anyone’s data, you have to convince them to authorize your app first. . . Which is probably why there’s all these “find which star wars character you are!” quizzes that make the rounds on FB.

learnstats2• 8 years ago

It's an alleged legal breach of Data Protection principles. That language is used historically by the ICO in the UK to describe exactly this type of situation.

Facebook's responsibilities and Cambridge Analytica's responsibilities towards data protection have been breached.

There's no other useful word for that. It might not be a hack and it might not be a security vulnerability, but it is surely a breach.

shellac• 8 years ago

Yes, in the words of the ICO:

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Most of the breaches I'm familiar with are accidental - people putting their research on thumb drives and losing them, etc etc.

Whether the fox gets into the chicken shed, or you let the chicken out of the safety of the shed, it's a breach of the chicken's security.

harry8• 8 years ago

No more or less a breach than any social engineering attack. No more or less than Chelsea Manning for that matter. "Our servers weren't compromised" is totally irrelevant.

Did the sensitive data end up someplace it shouldn't? Yes? Then your data security was breached. The end.

But hey let's argue over the technical definition of breach rather than how evil facebook are and how much power they have - both of which are vastly more interesting to consider. I'd like to see some support of the not very, not much school of thought.

InclinedPlane• 8 years ago

Whatever it is, it's the same thing that a breach is. So either call it a breach or invent a new word for it. In any event, calling it a breach results in treating it with the degree of seriousness it deserves so I don't see a reason to not use that word.

CptMauli• 8 years ago

tell me again why you think the EU General Data Protection Regulation (GDPR) is a bad idea?

drchiu• 8 years ago

We’re in the midst of reviewing our GDPR compliance one more time ahead of the May 2018 at my company. As a consumer, this kind of regulation makes sense. On the technical level, with so many service providers involved in running a modern day company, it’s obvious that many things have to be restructured for strict compliance. Eg. ESPs for mail delivery, analytics for business insight analysis

In the end, it’s about using data as it’s intended and nothing more.

IAmEveryone2• 8 years ago

I was actually surprised by the generally positive reaction the GDPR got in recent threads here on HN. I guess the suspicion of data hoarding overcame conspiracy theories about government regulation or EU protectionism.

BUT it’s important to note that GDPR would probably not have had an effect on the specific situation with Cambridge Analytica. CA is obviously toast if not by law then by the attention alone. Facebook, however, is likely allowed to share data under GDPR as they did with CA: they got the users’ permission initially, and there isn’t much you can do to protect yourself against malicious actors.

mziel• 8 years ago

Regarding "they got the users’ permission initially" this is true for the users that signed up for it, not anybody in their social graph. GDPR treats data about a user as data belonging to this user. Those people have definitely not consented to having their data mined for this use case.

Next (as I understand) the consent was for research purposes, not for the CA targeting. So under GDPR Cambridge Analytica could be fined 4% of global revenue or €20M - whichever is HIGHER [1]

[1] https://www.gdpreu.org/compliance/fines-and-penalties/

chopin• 8 years ago

AFAIK Facebook shared data of non-consenting individuals ("friends") of consenting individuals. In light of the GDPR this would be at least borderline to illegal. As well data from consenting parties was used in a manner not consented to (that would cross the line) and handed over to a fourth party. Finally FB did not ensure proper data handling (crossing the line again). At least when regulators would be willing they'd had a leg to stand on.

lumberjack3• 8 years ago

they got the users’ permission initially, and there isn’t much you can do to protect yourself against malicious actors.

The EU is clearly moving against that blatant circumvention. I don't know exactly what they are going to do, but the whole, "just sign all your rights to privacy way with one click" is something they want to change.

I think the mostly likely situation will be one where each specific instance of use of your data would need explicit approval. Moreover the prompt cannot be disingenuous legalese. It needs to be clear and concise. I fear it might just become another Cookie's Law. But it might still be useful. For example, imagine if you get something like:

"Facebook discovered that you have Chronic Illness 1. Facebook requests permission to share this information with Insurance Company in your State. Do you approve?"

I think people would suddenly care about that.

zeveb2• 8 years ago

Because it's over-broad, outlawing for example immutable web server logs.

Laws against murder are good too, but I think we all agree that a law against murder which defined saying mean things as murder would be over-broad.

rm_-rf_slash• 8 years ago

I think a better analogy is automobile laws. Yes it’s a pain to have your car inspected and registered over and over, and there are plenty of places where speed limits are frustratingly below what a driver could safely deal with, but in general these laws do protect people not only from themselves, but others, who are perhaps not so careful with their car.

arkh3• 8 years ago

How the fuck could people be surprised?

Open a software job board. 50% of offers are by companies trying to optimize some data harvesting and analysis to better target some ads.

Ads, the direct child of propaganda. So to everyone working in those kind of companies: you're not better ethically than people working on missile software. I'd say you're worse because you can argue missiles can be used as deterrent.

na854• 8 years ago

I up voted because your point is relevant.

However, Software development is not a Profession, in the proper use of the term. It is not self-regulating the way Medicine, Engineering, Law, and a few others are.

There is no formal standard of ethical conduct in software for practitioners to use as a baseline for their own behaviour.

24gttghh5• 8 years ago

Ahem: http://ethics.acm.org/code-of-ethics/software-engineering-co...

1.03. Approve software only if they have a well-founded belief that it is safe, meets specifications, passes appropriate tests, and does not diminish quality of life, diminish privacy or harm the environment. The ultimate effect of the work should be to the public good.

edit: this version is from 1992. And I should point out my courses at least had a discussion or two regarding programming ethics in college in the mid-2000's.

ascagnel_• 8 years ago

There is no formal standard of ethical conduct in software for practitioners to use as a baseline for their own behaviour.

Such a baseline standard _must_ exist, and _must_ be created. Every applied technology has started out with dreams to "change the world", only to have those dreams shattered by those obsessed with power.

Biology? Biological weapons, nerve agents.

Chemistry? Mustard gas, TNT.

Physics? Nuclear weapons.

aylmao6• 8 years ago

So to everyone working in those kind of companies: you're not better ethically than people working on missile software.

Yikes.

I agree with your points, don't get me wrong! Spot on-- this optimized data harvesting is widespread and terrible, and ads are dangerous.

Yet, I think your analogy is a little bit much and takes away from your argument. Missiles' purpose is to kill people, they tear apart families, bring chaos to countries-- they are built with the explicit purpose of terrorizing at best, and ending anyone not terrorized at worst.

Ads are meant to sell things. Sure, they are terrible when used as propaganda, but they're still just meant to be an efficient way do deliver feelings+ideas, and one that can be escaped with skepticism and critical thinking.

I personally don't think that a Google engineer working on Google Maps, a Youtube intern helping with creator tools, or even a Facebook employee making face filters for Instagram are in nearly the same ethical level.

aylmao6• 8 years ago

Also, you mention missiles at their best are used as a deterrent. That might keep one nation safe, but is is still about spreading terror to others and tends to just fuel arms races.

Ads at their best (aka, furthest removed from propaganda) are about informing people of things they would otherwise not know about. Think, mom and pop sops, some new organization, or a science fair.

It's easy to paint things black and white, and there's a line that can be crossed in terms of tracking, optimization, and attempts to control the population/public opinion. IMHO though, I really do think engineers working on companies in the ad space are not as ethically removed as those working on machines meant to kill.

arkh3• 8 years ago

Isn't the Pen mightier than the Sword? Aren't ideas immortal contrary to people?

If you agree with those tropes missiles are less dangerous than propaganda.

My comment may come as exagerated but I think you need some shock value if you want people to start really thinking. Cognitive dissonance is hard to break and rare are those who don't consider themselves good people.

jjulius3• 8 years ago

How the fuck could people be surprised?

Really? You expect every user to understand the extent of FB's reach into their personal information? You expect every user to understand the extent of how companies obtain that data, whether through purchases or covert harvesting? You expect every user to then understand the myriad of ways their data can be used?

We work in tech, but we're quick to forget that most users at best have a simple understanding of, "I mean, they have some of my data, I guess some of the ads match some things I've searched for on Google before." Joe Schmo never reads a ToS, and we can't expect people not involved in this industry to not be surprised when something like this happens.

arkh3• 8 years ago

I expect people who dismissed the Cassandra of privacy to not act surprised.

10 years ago they dismissed people telling them about things like Google Analytics or other external scripts on website. They used the "nothing to hide, nothing to fear" phrase. "You're paranoid no one want simple people's data".

Even better: doing it one week after complaining about how the GDPR and the Right to be Forgotten are bad EU laws.

tmalsburg24• 8 years ago

It's important to realize that Facebook's lax attitude to data harvesting was most likely one key to their success. If they had closely guarded user data, there would soon have been stiff competition, but this way everyone could benefit from Facebook's data treasure trove and Facebook's success was in many other companies best interest. The current state of affairs should therefore be seen not as the result of negligence but a desired outcome of Facebook's core business strategy.

KasianFranks• 8 years ago

We knew it facebook was going to be the next friendster+AOL+myspace but I never suspected it would disintegrate to these levels. Expect employees to start jumping ship left and right.

drpgq• 8 years ago

I suppose stock option values will plummet, but I guess most get stock grants now.

Invictus0• 8 years ago

Ethics can't be a side hustle.

https://deardesignstudent.com/ethics-cant-be-a-side-hustle-b...

synchronist• 8 years ago

I made a Facebook web scraper which opens 20 headless browsers. You provide a list of unlimited usernames & proxies (you can buy them at https://buyaccs.com/en/). It will scrape every ounce of public information available. I acquired a few million users worth. The data is too easy to get.

hanspeter• 8 years ago

Everyone who ever googled a name should realise that.

aylmao6• 8 years ago

Which kinda throws me off. It's no secret Facebook, Twitter, your phone (if you give permission to a 3rd party app) etc, are all harvestable. All CA is in regards to a story that broke a couple months ago. Why is it catching fire now?

kelvin0• 8 years ago

Of course, nothing is going to change since everyone has known this for years, and still use FB.

In the upcoming weeks users will be more 'careful' but since they have 'nothing to hide' it's 'Okay' to use FB in a 'responsible' way.

'Everyone' is shocked but no one feels threatened individually, so the circus and clown show can continue.

nkkollaw• 8 years ago

Can someone do an ELI5? I have no idea what's going on...

EDIT: I guess not.

zitterbewegung• 8 years ago

So the greatest achievement of big data and ML right now is the manipulation of elections a true shock and awe.

And yes, everyone on HN and RMS will say “why is everyone surprised ?” Well it’s because normal people don’t have that perspective and think Facebook is the internet for them.

Data is the new oil but now everyone knows this except just us on HN.

ams61103• 8 years ago

Asked what kind of control Facebook had over the data given to outside developers, he replied: “Zero. Absolutely none. Once the data left Facebook servers there was not any control, and there was no insight into what was going on.”

Um, well yeah. This is the case any time you give data to a third party. They now have a copy, and you can't control what they do with it.

d_theorist3• 8 years ago

Exactly. What kind of controls could there possibly be?

Even doing an audit wouldn't necessarily reveal anything. If somebody has data that they want to hide I'm not sure how much can really be done to force them to reveal it.

checkyoursudo5• 8 years ago

The controls are agreements that make getting caught doing the unauthorized act painful enough that it might be enough to deter the act in the first place.

If the price is high enough, bad actors will be willing to breach NDAs/CDAs/licensing agreements/etc, but at least then you can be seen as having done more than zero.

Might have been prudent here.

checkyoursudo5• 8 years ago

Well, NDAs/CDAs/licensing agreements/etc can make disclosure to non-authorized 3rd parties very painful for your customers/partners/etc to contravene your requirements for what they do with data, intellectual property, customer lists, etc.

This doesn't stop external attacks, of course, but it can reduce internal risks.

Facebook could have had more than zero control, if it had wanted.

thrownaway9542• 8 years ago

the platform was designed to entice and integrate into every aspect of people's lives and then ENCOURAGED you to get your friends to participate by inviting them to the platform. it was a data harvesting, advertising mongrel from the start and everyone KNEW it, but no one cared.

like all things in life... people cry foul when things come back to bite them in ass.

like i said yesterday in a comment... delete ALL forms of social media cause this goes on with ALL platforms out there, it isn't just limited to FB.

CaptSpify2• 8 years ago

Would you not consider HN Social Media? I personally don't think it's the same as FB, but there are some strong similarities. Maybe "Social News" is a better term?

Where do you draw the line for Social Media?

thrownaway9542• 8 years ago

no... it's a glorified comment chain. no different then posting a comment on an open wordpress blog where everyone can submit a post.

avoutthere• 8 years ago

How long before it comes out that Google does the same thing with search history, Amazon with product browsing, Apple with phone usage, and Microsoft with Windows 10 usage?

amrx101• 8 years ago

They are already doing it mate.

kimdcmason• 8 years ago

Citation needed.

tzakrajs2• 8 years ago

Can you show me how psychographers have been using Google or Amazon in the same way as Facebook?

I believe you are making a false equivalency.

simias3• 8 years ago

Is there any reason to believe that the situation isn't the same in, say, the Android ecosystem? In my experience many 3rd party apps require ridiculous amounts of permissions (contact list etc...) for something that's not core functionality. Surely all these free-to-play crapware games on the Android market have siphoned all the data they could and sold them to the highest bidder? Does Google do a better job of monitoring these apps?

TeMPOraL• 8 years ago

Wait until you see the video of these guys:

https://www.sentiance.com/

(via https://news.ycombinator.com/item?id=16626752)

simias3• 8 years ago

Yeah that's exactly the type of things I'm worried about. Smartphone apps have potential access to an incredible amount of sensitive data and I always found Android's permission system to be woefully inadequate.

beefield• 8 years ago

There is an increasing need for a container app that will feed whatever sensor data you want to the apps within the container. Also there would need to be some preconfigured sensor data profiles, like "Occasionally cheating husband living in city X" or "Really rich housewife living in city Y" or maybe "piss-poor guy living in a rural developing country"

aylmao6• 8 years ago

I don't know which one I'm more worried about. On the one side Facebook can track preferences and something akin to feelings closely, but on the other Google can track day-to-day activities much better.

If you've ever seen your Google activity log; that's very scary. The accuracy with which your phone can track your movement and where you are at every point in time is unprecedented. I'm very careful with what I allow 3rd parties to access but I can see a lot of users blindly accepting (like they did for this personality quiz that leaked all this Facebook info in the first place).

peterwwillis3• 8 years ago

This has literally been de rigeur at any company that does advertising for a decade. Even sports websites have been doing this since forever.

Excuse me if I'm not really horrified by political groups using personal data to craft strategies.

jypepin• 8 years ago

I've been thinking more and more recently of deleting my facebook profile.

1. I barely add stuff on it 2. 99% of my news feed is irrelevant and I really don't care (there maybe 1 post/day from a friend that is interesting to me) 3. Starting to be more and more concerned about all this data

But I'm scared for multiple reasons:

1. connections needed from a lot of friends, family etc. that I would not keep contact with otherwise 2. It does a great job at keeping my contact list updated (no later than yesterday I searched for friends/coworker to make sure I don't forget anyone on my farewell email) 3. Messenger. I use it a lot (almost as much as iMessage) and again, a lot of people I talk to on facebook I don't have their info for telegram/whatsapp/etc.

swyx2• 8 years ago

you dont have to delete it, you can just not be an MAU

orthecreedence• 8 years ago

Yeah exactly. My Facebook is pretty much read-only at this point, except for a few "likes" to show support for friends or if I get invited to a personal event or something.

Chaebixi3• 8 years ago

I've been thinking more and more recently of deleting my facebook profile.
But I'm scared for multiple reasons:

I went through that a similar thought process. I decided to keep my profile active, but unlike everything and delete all my posts. I also changed my profile pic to make it clear I wouldn't be using Facebook anymore. That way I can still get event invites, etc. but not be too burdened by the whole thing.

Eventually I'll delete my profile, but not until Facebook becomes far less ubiquitous (and I do what small things I can to hasten its decline).

mannykannot2• 8 years ago

All the self-serving memes are out on parade here: "This not news", "what did you expect?", "anyone paying attention should have known", "it is the new normal", "it could not be any other way", "everyone benefits"...

Actually, as of posting, the "Apple/Google/Microsoft are just as bad" version has not yet put in an appearance.

freeone30003• 8 years ago

One could argue that Apple and Microsoft are not as bad, because Apple and Microsoft sell products, not advertisements.

Applejinx4• 8 years ago

Apple wants to be a walled garden. Can't be a walled garden without walls: their self-interest and marketing direction lies elsewhere. Also, in the case of the iPhone, hardware is the product, and in the case of the app store, the devs and apps are the product (some of the time, anyway).

jjulius3• 8 years ago

Yeah, it makes me think of how people often say that SV is disconnected from the rest of society.

Sure, those of us on HN know to expect this from data-mining companies, but spend an extended amount of time with people who don't work in tech and you'll quickly learn that, yes, they know that FB uses your data, but most people have almost zero idea around just how much of your data is captured and sold/harvested/whatnot, nor what is done with the data after that point.

belorn• 8 years ago

It would be interesting to see someone analyze if the relationship between government and Facebook got more news coverage this time than it did when Snowden reported the exact same thing in 2013 or when other people reported it back in 2012. In particular it would be interesting to see which new sites write articles about it and if possible how negative they are.

For example we have CNN article in 2013: https://www.cnn.com/2013/09/30/us/nsa-social-networks/

vs now in 2018: http://money.cnn.com/2018/03/19/technology/facebook-data-sca...

Maybe that would explain why we see so many that got surprised by this while others has seen it for a long time and just got used to everyone not caring.

api• 8 years ago

Are we really that ahead of the curve here? Did the general public not realize that a free service that collects tons of information from you might be gasp using that information to make money?

I know some people who work in SEO and marketing and the stuff CA was doing was a more sophisticated version of what every free Facebook game or 'survey' vendor is doing. This is literally the business model of the free/popular Internet. Of course it's going to be used for political campaigns-- why not? It's used for every other kind of marketing.

I'm not saying it's good. I think it's terrible. It's a plague. I'm just shocked that people are shocked by what's been happening in the open now for years.

intended2• 8 years ago

Does anyone else have the wild speculation that Rupert Murdoch is opening a bottle of champagne today?

The interest in FB and privacy, while gratifying, also seems focused through a particularly yellow lens.

People on HN have also pointed out that it’s very likely that CA’a analytical prowess may well be overstated as part of submarine marketing efforts.

I suppose many people are just surprised that this is taking off now, without any truly new or novel fuel driving it - when the same articles and worse, had no effect earlier.

cryptoz• 8 years ago

There is new fuel. Did you miss the video of the CEO of Cambridge Analytica bragging about how his company stole 200 elections around the world by lying and cheating and deceiving the public? With illegal methods abound?

Lots of new fuel.

aylmao6• 8 years ago

But specifically the way Facebook is being dragged to the center of the fire, even though there isn't really any new fuel on Facebook's side.

There's good reason for the media to be tense against Facebook right now, since Facebook has changed the news feed algorithm:

"traffic in the news category, which includes major news publishers The New York Times, Washington Post, CNN and BuzzFeed, was down 14 percent after a sharper drop in the months prior"

I do think Facebook should audit its 3rd party developers more closely and that this leak of data is terrible. Yet, imagine CA instead had built an app for a personality quiz and asked for a ton of permissions from your phone to track your location, harvest your contacts, etc. What else could Google/Apple have done?

[1] https://digiday.com/media/promised-facebook-traffic-news-pub...

mollusc• 8 years ago

What kind of data are we talking about here?

I'm sure there are all kinds of metrics and analytics available but I'm interested:

  What are the "rawest" forms of user interaction that Facebook makes available to these companies?

I'm not in the business of using this data and neither I suspect are most of the Guardian readership so it would be nice to see this elucidated.

mstade• 8 years ago

From the article:

He said one Facebook executive advised him against looking too deeply at how the data was being used, warning him: “Do you really want to see what you’ll find?” Parakilas said he interpreted the comment to mean that “Facebook was in a stronger legal position if it didn’t know about the abuse that was happening”.

If this is true – would this constitute willful blindness, and is that not illegal?

d_theorist3• 8 years ago

One thing I can't quite find a straight answer to: is there any suggestion that either FB or CA broke the law here?

Note that I'm not saying that any of this is ok just because there was no illegality.

IshKebab2• 8 years ago

Unlikely, I've managed to work out what was happening (the news never really explains it - just a "data breach"). In the past if you gave it permission, a Facebook app could access information about your friends, e.g. their photos, name, gender, etc. I'm not sure exactly how much data.

Some sketchy apps harvested this data (which was against Facebook's terms and conditions for those apps). So the apps may have broken the law. I guess there is the question "should Facebook have protected the data better" but I doubt they broke the law exactly.

Anyway the stupid thing about this is that it was obvious that's what all these sketchy apps were doing at the time. Facebook app developers knew they could get this data, and the only thing stopping its exploitation was Facebook's app T&C's - i.e. "please don't do bad things".

There was even a setting to prevent third party apps accessing your data when given permission by friends. That's how obvious this issue was. (I doubt anyone used this option).

https://nakedsecurity.sophos.com/2013/04/03/how-to-stop-your...

Facebook removed the friends API in 2014 so this is all about historical data "breaches".

lumberjack3• 8 years ago

Stallman is right once again. The response that we used to get is, "but Facebook/Google would never give away their data, they will just use it for targeted advertisement, the data is too valuable to just sell it wholesale to other entities".

bbarn• 8 years ago

Attention everyone's smart friend or family member:

Now is not the time to scream "DUH!" or "I told you so!" to people who in the past have not grasped just what they were agreeing to. Now is the time to help your less tech-savvy friends understand the impact their data has in aggregate (like swaying elections!), and how they have been used by this system. Take advantage of all this bad press and help people you care about stop contributing to this machine. If ever you were going to get someone to stop using these services, these are the moments you capitalize on.

jjulius3• 8 years ago

Thank you!

I'm going to be using this thread as a perfect example when people think I'm crazy for saying that SV often exists in its own bubble. The disconnect here, and the failure of so many people to realize something so obvious, is appalling.

YCode• 8 years ago

I take this to mean anything private or sensitive said on Facebook Messenger should be considered breached?

CaptSpify2• 8 years ago

Those were never actually private in the first place.

smpetrey• 8 years ago

Well of course this was routine. Facebook prides itself on it's data collection and ad targeting. I'm not discounting The Guardian's reporting, but I thought this was known.

I mean you can download your data here and see what endpoints/interests you can be targeted on: https://www.facebook.com/help/302796099745838

Sadly, the world will continue to use Facebook and users will continue to be exploited.

robterrell2• 8 years ago

That URL doesn't tell me what I really want to know -- what parties used the graph API to download data from me.

4684499• 8 years ago

I'm OK with data harvesting, but, it has to be transparent and ask for permissions every time they want to use my data, allow me to delete the data I generated. It should always be opt-in.

I use google maps a lot. I search a place, it provides me lots of useful information. Yes, I find it helpful, but also terrifying, especially with the "Popular times" section, which is "based on visits to this place."

Where are the eyes? :/

mroll• 8 years ago

...terms and conditions people did not read or understand.

The article acts like this is unprecedented. No one reads terms and conditions. It's not as if people fork over intimate details of their personal lives to Facebook with the defense that "oh the terms and conditions say they can't use this in a way I don't like"

People fork over intimate details of their personal life to companies like fb because they haven't thought about it very hard

dwighttk• 8 years ago

A Tangent:

What is the deal with those videos in news stories these days that are just moving* pull quotes with music and maybe some pictures? It's like a really short article in video form.

*I mean literally, not emotionally

whiddershins2• 8 years ago

I still don’t understand the breach part. It just seems like Facebook app developers used Facebook exactly as it was set up, and then resold the data.

xtracto• 8 years ago

It is more of misuse than a breach. The data was provided to a guy for academic research, but the guy sold it to a third party. That is where the 'breach happened.

tzakrajs2• 8 years ago

Imagine a clinic has a policy that allows patient data to be released to non-patients but a court decides that the use violates HIPPA. There would be no technical breach of security, but rather a breach of responsibility.

squozzer• 8 years ago

I have a feeling this is less about what was done and more about who was doing it.

https://www.investors.com/politics/editorials/facebook-data-...

matte_black• 8 years ago

What’s the worst that could really happen from any of this?

You’re shown a highly targeted ad that you don’t even look at anyway? Give me a break.

Manipulating elections? Elections already have tons of opportunities for manipulation across all mediums.

skc• 8 years ago

I still think FB is a useful tool, but it puts things into perspective when people try and argue that Microsoft of the 90's is/was evil.

bogomipz3• 8 years ago

"Academic research from 2010, based on an analysis of 1,800 Facebooks apps, concluded that around 11% of third-party developers requested data belonging to friends of users.

If those figures were extrapolated, tens of thousands of apps, if not more, were likely to have systematically culled “private and personally identifiable” data belonging to hundreds of millions of users, Parakilas said."

So it's quite possible that there are more than a few third parties holders of FB user data who have now been alerted to the potential profitability of their old "research data."

deevolution• 8 years ago

Im honestly not surprised by this news at all.

Mc_Big_G• 8 years ago

Delete your Facebook/Instagram/Whatsapp accounts.

SaturateDK• 8 years ago

I say wipe them. I have been deleting data for the last couple of days, I don't need old comments and likes - even pictures as I have them myself.

This was I can slowly phase it out, this has been my plan all along, but I need some time to make all logins work without facebook ect.

My intent is to delete it eventually. Until then no new content, and wiping the old content.

discordance• 8 years ago

So the Cambridge Analytica stuff had been public for a while, as has Facebook's responsibilty in the matter.

The cynicist in me wonders if this is all lighting up intentionally before GDPR is enacted to reduce potential financial liability. Too conspiratorial?

ahmetkun• 8 years ago

Parakilas, 38, who now works as a product manager for Uber

a company known for their respect of privacy and exemplary business ethics. good that he left facebook.

CodeSheikh2• 8 years ago

I see a lot of Facebook sympathizers here. Is this what devs do at Facebook? Browse HN and defend the reputation of Facebook at any cost? Yes we all knew what we were in for when we signed up for Facebook and Instagram. Yes, they can sell our data to show us ads about what coals to buy for July 4th bbq party and we are OK with that. But not to turn blind eye to foreign entities which in return use it against us and jeopardize the American democracy and social fabric.

verylittlemeat6• 8 years ago

I don't work for facebook. I don't have a facebook. I don't like facebook.

What I do like is honesty.

https://en.wikipedia.org/wiki/Data_breach

Look at this very robust list of data breaches and tell me how the CA/Facebook incident this week looks anything like any of them.

lightbyte• 8 years ago

2006 - AOL search data scandal [1]

The release was intentional and intended for research purposes;

Sounds pretty damn close to this event with Facebook

[1] https://en.wikipedia.org/wiki/AOL_search_data_leak

FilterSweep• 8 years ago

You're right, it looks worse.

CodeSheikh2• 8 years ago

This data breach is different in nature. It is not same as Ashley Madison or Experian where someone got hold of root pwd or some other data storage (some form of hacking involved). This is about third party using Facebook's API to access user data and exploiting those API to retrieve hoards of information about a particular user. IN this case, Facebook most likely knew which third party developer was heavily hitting a certain API in a certain pattern but they decided to turn a blind eye.

deft• 8 years ago

lol, noticed the same thing. Sadly its not just Facebook doing it. Every time a company goes under fire there's a ton of comments defending them or saying how it's a necessary step etc. etc. Sometimes its the "famous" users here doing this, consistently for the same companies. Gonna guess they have invested in them but this kind of shilling is just stupid.

xixi772• 8 years ago

TBH I see a plenty of the arguments on the other side too, whenever a company does something people disagree with, there are calls for regulation. Even further, there are lots of people here who get annoyed when they see someone just skirting the rules without literally breaking them and always argue for the most expansive interpretation.

I think some people just naturally like rules and would prefer to live in a more orderly, rule based society, and some people don't like the idea of being constrained. Both groups act quite sanctimoniously though, as if their personal preference is somehow the holy truth.

antr• 8 years ago

"Move fast and break things." Sigh...

yread• 8 years ago

I'm starting to feel like all this is just a PR campaign for GDPR cause I'm sure looking forward to it

paulie_a• 8 years ago

Isn't that their business model?

KevanM• 8 years ago

Remember folks, if you've got nothing to hide, you don't have anything to worry about.

pcarolan• 8 years ago

Are there any liability laws that hold those in the chain of custody accountable for third party misuse? Seems like it is an obvious burden of responsibility.

ismail• 8 years ago

Wow. “react only when the press or regulators make something an issue, and avoid any changes that would hurt the business of collecting and selling data.”

From:

https://mobile.nytimes.com/2017/11/19/opinion/facebook-regul...

The scary part is the cat is already out of the bag if you authorised any app. They could have a wealth of your data that is being sold.

Applejinx4• 8 years ago

You are assuming these same people, with everything to gain through just this behavior, have been utterly and scrupulously well-behaved this entire time all while nobody really questioned them.

'If you authorized any app'? I'm sure there are workarounds for that. If you touch them or pages where their invisible Facebook gif is present, they've probably got all your data that's gettable.

sol_remmy• 8 years ago

Ongoing discussion at: https://news.ycombinator.com/item?id=16626318

panchicore3• 8 years ago

Sorry for this stupid question: how does Facebook to prevent kamikazes developers/sysadmins data dump and run away? It's there some framework to manage data loss prevention in this way?

arkona3• 8 years ago

utterly horrifying

This has been common knowledge for years. Is the general population not aware of Facebook’s business model?

petilon• 8 years ago

From the story: > They seemed to be entirely focused on limiting their liability and exposure rather than helping the country address a national security issue.

This is a national security issue. That seems like the most pertinent issue, and yet there is no mention of it in the discussions here. Facebook has amassed huge amounts of data about all citizens, and adversary nations are leveraging this data to manipulate the nation, including by helping elect a president who will be friendlier towards them.

Facebook is Russia's biggest cyberweapon. Just as private companies would not be allowed to stockpile WMDs, private companies should not be allowed to stockpile so much digital information either. This is a national security issue.

mithoon• 8 years ago

This was 6 years ago, and we wonder they would be no where 6 years down the line ?

username223• 8 years ago

This article sums it up for me. FB makes the short-sighted decision to allow apps to scrape friend-of-friend info, because it would encourage more app developers, from which they get a 30% cut. When this guy asks a question about scraping, his boss replies "better not to know." The company continues not to give a shit about distributing PII until they realize that someone might use that data to create a rival social network. Then they shut it down and treat the fallout as a PR exercise.

Utter scum.

Khaine• 8 years ago

I'm glad that a light is finally being shined on the sliminess of facebook's business model and that the public are starting to understand what an ugly company facebook is.

I am dismayed at the state of journalism that it took until there was a trump connection until they seriously reported on this

xixi772• 8 years ago

Do we actually know what data has been leaked/illegitimately retained/whatever you call it?

A lot of the discussion revolves around friends data -- was all friends data accessible regardless of the friends' own privacy setting (this would be deeply troubling), or was it the data that friends shared with the app users (a bit less troubling, but still very questionable), or was it friends' data that was openly available on their public profiles open to any internet user?

Ex-Facebook insider says covert data harvesting was routine

Related Stories