Facebook Planned to Spy on Android Phone Users, Internal Emails Reveal

https://twitter.com/ashk4n/status/1099117028026118144

by DyslexicAtheist • 7 years ago

200 68 7 years ago

twitter.com

Nicksil• 7 years ago

Save a trip to Twitter. Here's the link to the story:

https://www.computerweekly.com/news/252458208/Facebook-plann...

creato• 7 years ago

The twitter thread has a few of the source documents, and a few things not mentioned in the story, this particular e-mail seems... interesting: https://twitter.com/ashk4n/status/1099146500725063680

Also, that twitter user is a former senior leader at the FTC, and claims something here to be "textbook @ftc deception": https://twitter.com/ashk4n/status/1099164648379580416

throwaway00d36• 7 years ago

Serious question -- how does Facebook keep getting hit with these 5+ year-old emails getting published? Did they not have any email retention policy?

Is the root cause that they migrated off of email and did all their sensitive discussions in "internal tools" with no actual data retention enforcement? If so, that seems quite ironic.

accountwhatever• 7 years ago

Also, here's a link to the full set of documents:

https://github.com/BuxtonTheRed/btrmisc/blob/master/fb-643-e...

joeseeder3• 7 years ago

Where do fb recruit engineering talent ?

are we (engineers) really that indifferent to what organizations we support do ?

brador• 7 years ago

I wonder if they psychologically test for and target these traits during recruitment.

renholder• 7 years ago

This would seem to make the most sense, as it's the same line of thinking around why only 1 out of thousands at the NSA would be a whisteblower (see: Snowden); despite the shady shit that they were (and probably still are) undertaking.

Also, non-disclosure agreements really fuck people in the overall scheme of things. If you worked for Facebook and came out tomorrow showing some really shady shit that they were doing, it's conceivable that no other company would ever want to hire you. (I think the term is "black-balled" but not sure if it's still in use, today?)

(Whistleblower laws only protect government workers and do not affect the commercial industry. Even then, the whistleblower laws only go so far...)

So, you're damned if you do and damned if you don't.

pdkl95• 7 years ago

After their internal memos about valuing "connecting people" over anything else (like safety) leaked[1], some of the comments by Facebook employees were almost cult-like[2]:

Leakers, please resign instead of sabotaging the company
How fucking terrible that some irresponsible jerk decided he or she had some god complex that jeopardizes our inner culture and something that makes Facebook great?

In particular, this included comments about wanting a loyalty test "screen" in their hiring process:

Although we all subconsciously look for signal on integrity in interviews, should we consider whether this needs to be formalized in the interview process?
This is so disappointing, wonder if there is a way to hire for integrity. We are probably focusing on the intelligence part and getting smart people here who lack a moral compass and loyalty.

[1] https://www.cbsnews.com/news/facebook-memo-the-ugly-andrew-b...

[2] https://www.theverge.com/2018/3/30/17179100/facebook-memo-le...

joeblau• 7 years ago

Their recruiters reach out to me about 4 times a year. I will say that some of the challenges and scale of the problems Facebook is solving really can't be found at other companies. You're doing data analytics, product design, infrastructure engineering, dev ops, security and software engineering at a scale that's pretty much never been done before. Also, companies like Facebook, Twitter, and Google generally define frameworks that other companies use. Think about products like Angular (Google), Bootstrap (Twitter), ReactNative/ReactJS (Facebook) — If you want to work on a project of that scale, there aren't that many options for companies to work for. I always tell my buddy who works at Turner — Your company is never going to be better than Facebook when all of the tools you use are built by Facebook. I also hear that compensation and benefits are really good, plus their stock value is going up faster than other companies in the market. If you live in the Bay Area, you need that equity boost to move up the socioeconomic ladder.

I probably won't ever work at Facebook (I have all of their services blocked in my host file and I've deleted my account and they aren't working on anything interesting to me) but I'm just trying play devils advocate and paint a picture of why someone would choose to work there.

joeseeder3• 7 years ago

Interesting bit is that, I wanted to counter the Stock price argument but after checking current trend it’s back to former values from last year. Well thought out arguments. cheers!

akhilcacharya2• 7 years ago

All of those things apply to Amazon too, yet for some reason that’s not considered in these conversations...I wonder why

blaisio• 7 years ago

I agree with everything except the projects. It is true that Google Amazon and Facebook have projects that are exclusive. But there are lots of other interesting and widely used projects out there. Redis, PostgreSQL, MariaDB, Rust, Firefox, Python, VueJS, Linux, Apache Hive, Hadoop, etc. If you care about projects that involve the largest number of servers, you need to work for one of those companies. But if you care about your code being used by a huge number of people, there are lots of other interesting things out there.

high_derivative2• 7 years ago

This is just an anecdote but being a PhD student at a well-known university in CS I often hear from undergrads (via teaching) what they think about companies/where they go for internships.

Observationally, ethics does not even enter the equation. Especially career-driven students from backgrounds where name-brand prestige is important just want such a name-brand on their CV.

Not that faculty are any better given how many academics effectively sign away their lab to FB through 'collaborations'. All they see is resources to use, name-brand recognition, a big personal pay-check, and publicity for their work.

What I find most mystifying is that this is a literal non-topic. At best someone may forward a blogpost about a security leak and make a snarky comment, but I have never witnessed any political discussion.

mehrdadn2• 7 years ago

I feel like it's difficult to bring it up. What are you going to do... tell your friends/students their next job is at an unethical company?

Also, people generally believe it's quite possible to work on good things in a company that also does bad things. (And many of them indeed will.) So it's not the most compelling argument that you shouldn't work with X/Y/Z because they did bad thing W.

joeseeder3• 7 years ago

I have had a quick run of an analysis - Academically vs Self trained Computer Engineers among my peers.

From the small sample, it shows very strong correlation between working in ethically questionable organisations and finishing Academia.

Is the opposite for most of my Self trained peers.

detaro• 7 years ago

At my German university that was a topic that regularly came up around internships, job fairs, and among those currently graduating and looking for jobs, with a wide range of opinions.

stilist• 7 years ago

Do you ever have (and use) opportunities to bring up the ethical aspects? It’s becoming a more prominent thing for people in the industry, and it makes sense to discuss before people leave academia. I know it’s not your problem to solve, but I think if the university isn’t talking about the ethical considerations it’s tacitly endorsing the ‘technology is value-neutral’ philosophy that’s begun to get some pushback.

throw2016• 7 years ago

Given the widespread apologism and hand waving around Google, Facebook and others here this is hardly surprising. Decision makers shoulder the blame but what we are seeing from these revelations is rank and file tech folks are 'eager' and willing enablers.

Ethics is reduced to meaningless posturing if whenever it comes to action people have a litany of excuses on hand. In the case of surveillance whether its government or private its individuals empowering themselves at the cost of others not particularly burdened by the wider social ramifications.

It's a bit tragic that its only when without power that people talk of ethics and even with little power it seems self interest always rules. And discussions become pointless as it becomes impossible to tell how many will do differently.

sametmax• 7 years ago

I refused a job interview with them for ethical reasons, but I'm not blamming people accepting. Morality is an abitrary line. My phone is probably made by slaves, my clothes by children and my bank account probably invest in arms companies.

It's good if one can take the opportunity to take a stand. But let's not pretend we are parangon because we do.

aboutruby• 7 years ago

They offer the top salaries, and they have 2B+ users.

chooseaname2• 7 years ago

Hire young. Their ethics haven't evolved yet. [0]

[0] Not a condemnation of the young, but they still don't realize what they don't realize at that point.

basementcat• 7 years ago

It depends. If you have a variety of employment options, it is easy to follow you “conscience”. When you have fewer options and more personal responsibilities (private school tuition, piano lessons, etc), you start to lose the luxury of working for less pay.

FakeComments• 7 years ago

How is Facebook not producing malware?

I struggle to see how they’re legally different from malvertising: perhaps there’s some vague terms about data or advertising (which also exists for malvertising! you agreed to the ads!) but at no point was there a “meeting of the minds” in which Facebook was authorized to bypass security mechanisms to exfiltrate data from the system.

I don’t see how Facebook’s behavior is anything but classic “hacking”, and a willful abuse of the CFAA.

I think it’s time we started addressing gigacriminals[0] like Zuckerberg: we need to stop pandering to people who commit millions of crimes a day, at “web scale”, and just use force.

If Facebook doesn’t want to get the memo that wanton criminality isn’t okay, then it’s time to use force to correct the behavior.

[0] I use gigacriminal in the technical sense: I believe Mark Zuckerberg, as the leader of an organization, has ordered over 1 billion criminal acts to be commmitted for his profit.

deytempo• 7 years ago

Send him to prison

riyakhanna1983• 7 years ago

Lock 'em up!

chooseaname2• 7 years ago

FB is making a lot of people a lot of money. Good luck getting traction on getting Zuck to stop.

Also, while I think Zuck is devious (based on the history of FB), I think Sandburg is the brains of the worst of FB.

Andre6072• 7 years ago

I know we have lots of FB employees at HN.

I would be genuinely curious to hear, via throwaway accounts if need be, about how FB staff rationalise things like this happening.

Do you shrug it off as not a big deal in the long run? As FB still doing a net amount of good versus what you perceive as isolated incidents like this? I'm just in good faith trying to figure out how people willingly work and continue to work for outfits that repeatedly engage in behaviour such as this. I know there are lots of speculative reasons we can put forward, but I think we have a great opportunity here in our community to have first-hand input.

beatgammit• 7 years ago

I'm in a similar boat.

I worked with a group at Facebook, and I almost refused to take the project on. I'm the type that has deleted me Facebook and uses a blocker to stop their tracking, and when I showed up to work with the team, there were surprised that I didn't have an account.

From what I could tell, the teams are fairly isolated and thus don't see the forest for the trees. When someone points to an article like this, it seems that they just shrug it off and think the author probably got it wrong because it doesn't seem that way from the inside (again, they only work in isolated teams, but still think they have enough of an insider's perspective to discount it). Even huge companies we know now as bad had a ton of employees, like Enron.

I would really like the perspective of someone "on the inside". Facebook is one of the companies I trust the least with my data, yet they have so much talent that I can't help but wonder how they convinced them to work there (is it just the money?).

analogmemory• 7 years ago

From personal conversations with tech folk who don’t work at Facebook, I’d say it’s about the money. Most people say they don’t want to work there, but if the money was fuck-you good, they wouldn’t say no

po7w0toqweug2• 7 years ago

Not a employee, and I like my data to be safe and not exploited as much as anyone. But, let me try to take a swing at this.

First, obviously there is the money factor, you may choose to ignore it but it is a big factor for many.

Second, the tech is truly state of the art and it is good experience/skill to have/pickup.

Third, I'd say almost everyone passing judgement about people taking up such jobs also judge having such jobs on your resume as a positive. That drives one's value as a candidate up even post such a job. If people care so much why don't they provide an incentive, would you hire someone who turned down such a job compared to someone who gained experience in such a job? No one ever asked me - so which jobs offers did you discard and why, during any interview.

Fourth, almost every big company has its scandals, now how does one decide which ideal is worth giving up job offer for, is big financial ok? is big pharma ok? is big tech ok? is big anything ok? is working on open source in such a big something ok, say open source software others use at their jobs? is a start up using questionable practices to get to the next level ok? define what's ok according to you, and why do you expect that would be the same for everyone else.

vjeux• 7 years ago

It’s really hard as a Facebook employee to engage in those topics. The probability of your comment to hit the front page of the New York times is very high. There are a lot of pending litigation so you’re also likely to be involved in those, which is the last thing you want as an engineer.

untog• 7 years ago

When have HN comments been featured in an NYT article? I'd say they'd be very hesitant to do that because there's no way to verify anyone is who they say they are, which is usually a requirement.

effbee• 7 years ago

(throwaway) I started at FB out of college relatively recently and wasn't there for very long, so I can't speak for longer-term/more senior employees but hopefully this is a bit helpful. I myself joined because I needed a job, the money was amazing, and I wanted to be in the Bay Area. When I went in, there were already questions about data privacy/elections, but this was still before Cambridge Analytica and the subsequent weekly bad news that's gone on for a year now. Personally I've never been a big FB user and wasn't that enthusiastic going in, but a) the money and b) the scale of their data/infrastructure/data infrastructure was attractive.

My impression was that many employees hold a self-contradictory view about the extent of their influence at the company. When asked about their jobs, they tell you that they're working hard on fixing the problem and making impact ("where better to fix it than from inside?"). But when confronted w/stories like Onavo, they get defensive because "it's a big company, I had no way of knowing." Which is fair, honestly; the problem is that they think they can fix anything in the first place. Part of the problem is that FB advertises itself internally as being super transparent but it isn't at all. (This applies mostly to product/data+ML people. The infra folks I worked with for the most part just want to make their money and go home.)

A lot of longtime employees joined when FB was good and amazing in the media, and it's hard for them to accept that it's really gone in a bad direction. A lot of younger ones join for the money, and/or because they're coming from FB's massive, culty college intern pipelines (especially if you come out of FBU) and confuse being dazzled by the perks with actually believing in the mission. The money is big for everyone (I was there for part of the long 2018 stretch where the stock price just fell and fell, and you could feel people getting antsy), and the defensiveness that comes from constantly seeing negative news is another part. Lots of blame thrown around internally (leakers, leadership, bad eng practices) but little responsibility; lots of sunk cost fallacy-ish thinking ("we all took jobs here for a reason, we can't just give up and leave").

Andre6072• 7 years ago

Thank you for taking the time to respond; this is insightful and informative.

hsbaut76• 7 years ago

Thank you

ggggtez• 7 years ago

Facebook, which charged 30% service fees on the transactions, revealed in the internal email, “that an overwhelming majority of Apps using Facebook Payments to solicit funds are likely fraudulent.”

No surprise here, again. Facebook launches a feature that allows criminal behavior, reaps the profits, and only tries to roll it back after they are under intense scrutiny.

There is an easy way to fix these repeated problems: Hire people who care about ethics. Of course, the fact that they don't shows that they are only looking for a rubber stamp.

What kind of "privacy" team do they have that approved all the garbage listed here?

salawat• 7 years ago

I think Computer Science needs to come coupled with exposure to a philosophical ethics sub-curriculum. I run into too many intelligent people who haven't ever spared a thought toward how to recognize "what is right? What is wrong?"

Philosophy may not equip you with a concrete answer, but it definitely equips you with the machinery to look at something and recognize there's more to the question than some manager saying it's legit.

AlexandrB• 7 years ago

I've often argued that the basic "dumb fucks" sentiment from Mark Zuckerberg's university days has not changed within Facebook's leadership and frequently got push-back that Mark Zuckerberg has matured and is now a responsible steward of our data.

I feel vindicated by news like this. It's pretty clear that privacy overreach and violation at Facebook are not "accidents". It's standard operating procedure.

species9606• 7 years ago

I work at one of Zuckerberg’s charitable organizations, but I’m considering resigning because of this kind of thing. At some point it’s not possible to separate the charity from the source of the money.

justapassenger• 7 years ago

Yeah, everyone hates Facebook, but is there anything new here? Targeted advertising based on location and relationship status? That's not a secret, that's one of the biggest selling point of their product. Can someone explain to me why should I be outraged?

Facebook Planned to Spy on Android Phone Users, Internal Emails Reveal

Related Stories