Facebook shoots first, ignores questions later; account lock-out attack works

http://arstechnica.com/business/news/2011/04/facebook-shoots-first-ignores-questions-later-account-lock-out-attack-works.ars

by shawndumas • 15 years ago

260 84 15 years ago

arstechnica.com

16s2• 15 years ago

Many IT security standards actually require account lock-outs. For example, PCI-DSS requires it. No one seems to understand that the goal of the attack may be to deny access. The attackers may not want to compromise the account, only to keep someone (or a group of people) locked out for a bit while they do something bad elsewhere.

Edit: I'm surprised an account would be locked by a DMCA request though. Block or remove the content (if it's a legit DMCA notice) but keep the account alive. That's just one more way to carry out this sort of denial of service attack.

rexreed3• 15 years ago

It's not even a DMCA request. You just fill in a form and claim infringement, without even having to authenticate who you are. So, I don't see this as following any sort of "fair" process that gives the other side an opportunity to challenge or object.

invisible• 15 years ago

It looks more like facebook PAGE lock-out. Furthermore, aren't they legally obligated to do this under DMCA?

kmfrk2• 15 years ago

Yes. It's similar to when YouTube pulls a video temporarily over copyright claims. I don't see how a page can go down several times, though - there are only so many copyright holders.

16s2• 15 years ago

If it's a valid notice, they have to take some action to stop infringement. It seems they should verify beforehand, but I'm sure they don't want to dedicate resources to that, so the easy thing for them to do is to lock or block access to the content and put the burden on the end-user.

biot• 15 years ago

The email Ars received doesn't mention DMCA, so it's likely not the case. If it were, there are specific requirements that Facebook would need to follow including allowing Ars to file a counterclaim which then reinstates the content and absolves Facebook of liability -- the third party would then need to follow-up directly with Ars over their infringement claims.

recampbell• 15 years ago

It seems like someone clever could easily turn this policy against itself by reporting popular facebook pages for DMCA violations. Not that I would encourage or condone such activities.

CWIZO• 15 years ago

My boss recently went trough something similar. His profile was locked and he just received a generic email offering no explanation as to why that has happened. He sent them an email asking why he was locked out and received no response. After about 14 days he finally got an email from FB that his account was locked because of an error or something like that.

The saddest part is that now he can't use FB's advertising tools anymore, there is just some text there saying that he is locked out. No explanation. No form he could fill to resolve the issue. No nothing. And he has spent several thousands euros on FB adverts for our products (and was planning on spending even more). I really can't say anything else but what the fuck Facebook?!

sawyer• 15 years ago

This is what happens when people and businesses choose to lock themselves in a walled garden they do not control.

All the businesses out there actively marketing their Facebook page should take heed. Set up and market a proper website; utilize a mailing list for client communication.

ck22• 15 years ago

Counter-notice, but only if you are positive it's a bogus takedown.

https://www.chillingeffects.org/dmca/counter512.pdf (not actually a pdf)

They have to put it back online with a counter-notice.

jerf• 15 years ago

It doesn't sound to me like this is necessarily a DMCA complaint. While the DMCA defines certain procedures in return for certain protections, I don't think it actually forbids just dropping Facebook a note saying "Hey, this is infringing content", without even having to necessarly own the content in question, and if Facebook chooses to aggressively take it down, what recourse do you have? Filing a counternotice won't necessarily do anything, as far as I can tell.

ck22• 15 years ago

Safe-harbor means the provider dooes not have to authenticate a DMCA notice - the takedown notice is done under perjury, they just have to obey it to escape any liability.

The catch is there is virtually never a prosecution for a bogus takedown, I cannot remember ever reading about one, it would be huge news.

Bogus takedowns happen all the time on youtube so I guess now it's moved onto facebook.

Can't believe I am suggesting this but anonymous just needs to have "Takedown Fridays" where they target the service of their choice and perjure away to their hearts' content. When thousands of FB pages suddenly vanish, eventually Congress may get wind of it and improve the law but I kind of doubt it.

kljensen• 15 years ago

Totally right -- it's well within FB's TOS and you have no recourse other than to email them. But, humans responding to email doesn't scale well, hence the poor "customer service".

(The quotes because, you're not so much the customer as the product...your eyeballs at least.)

dfranke2• 15 years ago

They have to put it back online with a counter-notice.

No they don't. Doing so merely gives them safe harbor from any liability for having taken it down. Facebook has no legal obligation to its members to maintain the content in the first place, and therefore no obligation to pay attention to a counter-notice.

fuckoff• 15 years ago

Yes they do. Read the law.

ignifero2• 15 years ago

That's not even news, everyone who has worked with facebook has the same issues. For such an understaffed company, that's not surprising. We have our domain banned from their spam filter before we even launched our game (really, it was just a redirect back to facebook); been like that for months and still no response to our complaints.

jrockway• 15 years ago

They have 500 million users. It's probably easier to shoot first and ask questions later, because even if you kill 1000 users a day, you still have a lot of users.

Remember, Facebook is about one thing: eyeballs. If some eyeballs cost them money, it's easier to lock them out than to work with them.

If you don't want some large company to shut down your website, host your own.

narrator• 15 years ago

You are one of 500 million "customers" who aren't even paying them any money. They can drop you at any time.

rexreed3• 15 years ago

Unless you are paying them for advertising, in which case you ARE a customer. They owe their users some sort of due process.

ra• 15 years ago

users != customers

jarin• 15 years ago

Advertisers are the customers, users are the product.

rexreed3• 15 years ago

FYI - the copyright complaint form is here: https://www.facebook.com/legal/copyright.php?noncopyright_no...

As you can see, it's not a normal DMCA take down, and it can easily be spoofed.Yes, you have to certify under penalty of perjury, but what difference does that make if the contact information is bogus?

msy• 15 years ago

I feel like I'm repeating myself daily at the moment. If you're not paying for it, you shouldn't expect anything. If people paid for the services they used, they'd have recourse and the interests of the provider and the consumer would be aligned. As it stands, why would or should Facebook give a shit?

Brands building their online presence via Facebook are mad as far as I'm concerned, Facebook owns that content, they can do with it what they want and as this demonstrates, zero recourse.

IanDrake• 15 years ago

>why would or should Facebook give a shit?

Because, as ars points out, the system is ripe for abuse. I could make an auto complaining bot that aims to take down every page with a copyright complaint. Eventually facebook would be a waste land with large groups of alienated folks bad mouthing facebook and seeking an alternative.

Ultimately, facebook needs to resolve this issue, even if they need to charge a fee.

roc• 15 years ago

... which makes me wonder why Anonymous hasn't already done this. If only for the lulz.

yellowbkpk• 15 years ago

I am paying for it with a very valuable commodity: my personal information. I have every right to complain about getting the crappy end of the stick when stuff like this happens in the same way you have the right to complain about a crummy contract with AT&T or your roofer.

Just because the currency in question is not (directly) the USD doesn't mean I'm not paying for it.

res0nat0r2• 15 years ago

If your boss paid you via an excel spreadsheet of personal data every month I think you'd give a bit of pause on the real value of the dollar vs. personal information.

Sure you are giving them personal information that is valuable, but I don't think the datacenter power company is going to take that as a monthly payment from Facebook each month the bill is due.

You do have the right to complain, as everyone does, but since you aren't giving them actual $, they have the right to really not give a damn.

dfranke2• 15 years ago

I have every right to complain about getting the crappy end of the stick when stuff like this happens in the same way you have the right to complain about a crummy contract with AT&T or your roofer.

You get to complain about AT&T and your roofer because you have a contract with them entitling you to a certain level of service in exchange for your money. Your only agreement with Facebook is Facebook's AUP / ToS / privacy policy, which gives you no such rights. If you don't think it's an equitable agreement, don't accept it!

ignifero2• 15 years ago

But brands must be built on something, right? That's why google, facebook, twitter exist. It's a mutual relationship, facebook cannot go on screwing users, developers, advertisers, etc. for ever. At the moment, facebook's support gets an F- from me in all departments: user support, advertiser support, FB credits support, platform developers support.

Unfortunately, as long as facebook keeps growing without going public, their staff is kept busy with other things, like calculating their stock's valuations.

flatline• 15 years ago

Comcast Internet Basic Package: $49.99/mo

Comcast Internet Video Package (YouTube and Hulu): $79.99/mo.

Comcast Social Media add-on (Facebook, Xfinity Friends, NYTimes): $14.99/mo.

Point being, a large number of paid providers becomes inconvenient if not impossible for an individual to maintain. This creates a market for a gateway provider to aggregate payments and subscriptions, which role the big media companies have traditionally fulfilled. While it's true that dependence on Facebook leaves you with little recourse if things go wrong, individual payments for social media services seems untenable. There must be some better way of addressing the issue, as you cannot necessarily afford to ignore Facebook, Twitter, etc.

chris_j• 15 years ago

You may well be repeating yourself daily. This "if you're not paying for it then you're not the customer" meme is getting really annoying, partly because it is repeated so often (whenever anyone complains about a free service on the internet) but mostly because it is true.

The trouble is, Facebook don't have any viable competition any more. If someone leaves Facebook in disgust then the consequence is that they no longer use a social network. If a respected site like Ars Technica don't like Facebook's policies then, as you say, they have zero recourse.

Given the above, what would you advise Ars Technica to do, other than complain loudly and hope that Facebook smile favourably on them?

DanielBMarkham• 15 years ago

I have a fan page for the hn-books site (shameless plug: http://www.facebook.com/pages/Hn-books/176636875710129?ref=s... )

On it I talk about what books and tools we're reviewing and cool book and tool stuff for startups and hackers. Hn-books.com is a hobby site, and the fan page is a part of that hobby of collecting cool resources.

But really, at the heart, it's all links -- links to the site, links to hn, recent blog entries with links. I don't do events, and resource links are the most useful thing I can provide. So when FB banned me from my own fan page, I was kind of freaked out. Why do that?

The only answer I got was because I was spamming, but heck I was just doing what the page was supposed to be about. I guess the problem was that somebody joined the fan page, then complained about the links the page was providing. The links they asked to get.

Just like with Ars, I found very little help. I finally sent an email off into the blind with something like "I am not spamming. I am simply maintaining a page full of resources. People who want to be fans of the page expect to see these resources. That's the whole point!"

A few days later the ban was lifted. The whole episode happened with very almost zero useful information from Facebook.

So somebody out there is reading these emails. But my customer service experience was far from pleasant. I hope Ars gets it straightened out. When you're in a situation where you can be punished for little reason and without much recourse something is whacked somewhere. This situation desperately needs some transparency and structure.

powertower3• 15 years ago

The worst is that as soon as Facebook detects the stink on the internet of this, they will rectify the situation for ArsTechnica, but everyone else will still be screwed.

When you are dealing with virtual monopolies that have zero customer support and negative processes (Facebook, Google, etc) getting locked out does not mean that you get go somewhere else, it literally mean getting locked out of an entire aspect of your life and/or business...

Think about it: all your friends are on facebook, you get banned, where are you going to go, which other social site are you going to use?

Facebook did not make facebook popular, the users did. Virtual monopolies need to recognize this, that they have a responsibility to the users.

jpadvo• 15 years ago

In an update to the post: "As evidenced by our updates and comments, many people seem to be affected by this, and some of them don't have as loud megaphones as we do. We'll continue trying to find out why this process is the way it is, and if it will ever be changed."

Ars is talking about helping everyone else by trying to get a better process in place. I really hope they follow through on this -- Facebook could certainly use a dose of due process.

Apocryphon• 15 years ago

I definitely agree. I believe that Facebook, Google, and Apple have some of the worst customer service out there due to their huge natures. Trying to get a straight answer from them is like trying to scale a completely smooth monolith.

kmfrk2• 15 years ago

I think that as soon as there's some vagueness about what you are paying the companies for, and how you are paying for them (Google Checkout, Free Facebook, Apple App Store), all consumer concerns are forfeit.

Conversely, when you pay for a physical Apple product like a Macbook, consumer laws make it much clearer what services and guarantees the company must provide its customers.

More in the same vein: http://news.ycombinator.com/item?id=2087120.

hammock2• 15 years ago

Why should facebook care? They are a "monopoly" that you willingly submitted yourself to. They created a great service and you bought into it. If all your friends are on facebook then that's you and your friends' own damn fault.

"It's not fair! Facebook has a responsibility to its users! I demand them to do such and such!"

So what if facebook was never around? You are in debt to them for such a great service, they never forced you to become so dependent. People lived for tens of thousands of years without social networking, and they'll continue to do so.

esmevane• 15 years ago

I can't help but think this blame mentality is the root of a lot of problems with the intended discourse, here.

The issue at hand isn't whether or not Facebook has the power to do this, but rather that the system is intrinsically moronic in that it involves no checks and balances. It is trivial to abuse.

You don't like a company's Facebook fan page, and you can have it removed with a little effort into building an email. You don't actually have to prove anything, just wave your hands.

In essence, you seem to be defending the right of Facebook's public users to disable accounts and pages on Facebook on a whim. Is that correct?

powertower3• 15 years ago

That's the problem, Facebook and other virtual monopolies don't care because they don't have to.

> You are in debt to them for such a great service, they never forced you to become so dependent.

No. I'm not in debt to them.

My ad views and clicks cancel the debt for the provided service. And my patronage further adds to push that balance in my favor.

In a way, you can say that Facebook and Google are in my debt.

> "It's not fair! Facebook has a responsibility to its users! I demand them to do such and such!"

There is a difference between a startup, a small-to-medium size business, and a monopoly.

Once you become a monopoly the rules change, since by definition you are the only option there is. Understand that we are not dealing with a business that cornered some niche. That's not a monopoly. What we are dealing with are businesses that are involved with billions of lives. They do have a responsibility, yet they accept none. It's a clear case of indifference, lack of understanding, and perhaps ego at the top of these orgs.

caf3• 15 years ago

Why should Facebook care? They should care because they need that content (obviously not individually, but in aggregate).

There's an implicit agreement here - the user puts time and effort into providing content to Facebook that Facebook users want to see, and Facebook puts that content in front of lots of people. If the risk of Facebook reneging on the deal becomes seen as too high, fewer content creators are going to take up the offer.

tokenadult• 15 years ago

In what sense are you or I customers of Google or Facebook if we don't pay money to either company to use any of their services?

adsr• 15 years ago

That is interesting, we are not their customers but their resource. Their real customers are the companies that they sell our data to.

mattdeboard4• 15 years ago

I really dislike this high-minded morality drama that seems to crop up on the Internet when Facebook or Google or Apple does something stupid.

If losing your Facebook page (or Twitter account or regular call-in segment on your local morning talk show or any other marketing vehicle) would be a serious blow to your online strategy, then Facebook has much too prominent a spot in your online strategy.

Whatever happened to making your business's website the destination for consumers? I fucking despise Facebook as much as anyone else, but I am finding it a little difficult mustering up sympathy for any business or blogger whose business is impacted disproportionately by losing their Facebook page.

It's like programmers who build their entire business around a company's API. When the company decides to drastically alter the terms of use of that API, it's catastrophic for the programmer's company. It's terrible for the hacker, yes, but "don't put all your eggs in one basket" is a cliche for a reason.

hartror2• 15 years ago

You go to your customer's preferred method of communication.

If your customers are predominantly Facebook users then that is where you go. Our customers are mostly teens and the best way to reach them and keep them engaged is through Facebook where our response rates are off the charts. Email on the other hand sometimes feels like it is more likely to bounce than to get read. And practically none of them use Twitter.

JoeCortopassi2• 15 years ago

Easy way to fix this: Flag everything you see on Facebook. Once it starts crippling everyday users, they will take more care in taking stuff down just because a random person complains

ekanes• 15 years ago

Random abuse against innocent people isn't really the moral solution. Public complaints and negative press for Facebook is a better way.

JoeCortopassi2• 15 years ago

Didn't say it was moral, but it's the only way Facebook listens to complaints

CWuestefeld• 15 years ago

Don't Sony and friends have Facebook pages? Since they're the ones that insisted that this weapon be built, it would be ironic if it were deployed against them. (not that I'd advocate such an action, mind you)

mrerrormessage• 15 years ago

Can someone come up with a way that any of the Zynga stuff (or even better, Facebook-generated content) genuinely infringes on their rights? If they start getting takedowns for things that make them money, that might make them think about reforming their procedures.

praptak• 15 years ago

Oh well: "Everyone who uses Facebook is on some level a Facebook partner."

Even taking into account some level of exaggeration, this is laughable. Facebook advertisers might be Facebook partners. The Facebook-user relationship cannot be further from partnership, it is the relation between a farmer and their livestock.

bxr• 15 years ago

Facebook has issued a statement to ReadWriteWeb and (as of this post) has yet to contact Ars. That action speaks volumes about what Facebook's real concerns are.

michaelpinto• 15 years ago

If Facebook wants to scale they need to learn about customer service — maybe not so much for their individual users, but for businesses. I recently helped a consumer brand client clean up her Facebook presence which was a mess — their interface was impossible for typical bricks-and-mortor biz owner to decipher.

PonyGumbo• 15 years ago

If Facebook wants to scale?

user9756• 15 years ago

Yeah, you know, beyond earth.

leon_• 15 years ago

> At least the help page has a contact e-mail address, but we have received no response as of yet.

You could assume a $50 bil. company would have something like a customer service ...

ovi256• 15 years ago

Do you think they got to be worth $50 bil. by spending cash on such niceties such as customer service ? That's so old industry BTW. /joke

smackfu• 15 years ago

Same problem as Google: how do you provide customer service to the 0.1% of customers that have a unique problem that needs human intervention, without it being hidden by the other 99.9% that are asking FAQs?

te_chris• 15 years ago

As an aside, I had my personal account hacked last year. It was such a torturous process getting it back. They got into my gmail account, then took my fb account off that (I actually didn't realise the two were connected as I'd signed up to FB with my University of Otago email addy back when you had to have an academic address - turns out you could login with your "backup address"). Google's process for locking my account and getting it back to me was clinical, quick and mostly efficient: I had my account back in a day. Facebook took nearly two months of me trying everything to get them to respond. I got my friends to email them, I emailed them daily, I started a blog about my ordeal, I did everything then, finally, they got back to me, after nearly two months.

I think I was quite lucky to have both my gmail and FB go down at the same time as it showed me such a clear contrast of approaches. Google, though impersonal, still assume that you're telling the truth. Facebook just don't give a shit.

tambourine_man• 15 years ago

I find it amusing that this may come as a surprise. Facebook's got so big that people think it's a government institution or something.

The outraged tone and arguments of the article imply that the author thinks he has “rights”, hence his fairness demands. This is a privately owned website, they can do what ever the ____ they want with the data that you give them. This quote from the article exemplifies this view:

How dare we post our own content to our own Facebook page

They really think it's their own. I can't decide if that's sad or hilarious.

I'm not an open web fanatic, but such naivety from a tech savvy site is scary. Regular people must think Facebook is a given, like air or tap water. This widespread lack of education is going to get ugly soon.

Maybe I'm just a grumpy young guy, but I can't understand why people not only use, but depend on Facebook.

Look at Hacker News, there is something interesting here everyday. I'm sure there are equally relevant sites in almost every field of knowledge. Yet, I've never seen anything in Facebook deeper than regular gossip or elevator chitchat about the weather: your friend spent last holiday at his beach house. Wow.

And regarding business contacts, C'mon. We've been doing business networks for ages. I've yet to see someone getting loads of money because of whom they met at Facebook.

mkramlich• 15 years ago

I'm making a note here: sharecropping reminder incident #435.

paulcjeffries• 15 years ago

I'm Paul C. Jeffries, Head of Legal Operations at Facebook, where I work with the team that handles incoming notices of intellectual property infringement. I wanted to provide a little color about what happened in this situation.

As you may have heard, today we investigated a number of recent trademark (intellectual property) takedowns, and as a result of this investigation we restored four Facebook Pages. We apologize for any disruption to those who posted content.

Taking a step back, abuse of DMCA and other intellectual property notice procedures is a challenge for every major Internet service, and we take it seriously. In many cases, when we're put on notice we're obligated to take appropriate action. We have invested significant resources into creating a dedicated team (including me) that uses specialized tools, systems, and technology to review and properly handle these intellectual property notices. This system evaluates a number of factors when deciding how to respond -- and in many cases, we require the reporter to provide additional information before we can take action.

As a result of these efforts, the vast majority of intellectual property notices that we receive are handled without incident. Of course, no system is perfect and we're always striving to improve our practices. Rest assured that the dedicated team who handle incoming complaints from rights holders are equally devoted to protecting the interests of people expressing themselves on Facebook. As part of our ongoing efforts to improve, we will be considering the results of our investigation into this matter as we continue to refine our systems and procedures.

hobbes• 15 years ago

Boilerplate.

nolanw• 15 years ago

A very little color.

Can you add anything that wasn't in the originally-posted article? For example, answers to any of these questions:

Why was the accused infringer of trademarks not given specific, actionable information about the trademarks in question? You state that the reporter is required to provide additional information in many cases. Assuming this was one of those cases, why was this additional information not shared with the accused infringer? (And if this was not one of those cases, why mention this at all?)

You invoke the DMCA, citing it as obligating you to take appropriate action. Was the action taken in this case the most appropriate one? Who decides what's appropriate here, Facebook or the relevant laws?

Care to discuss any of your specialized tools, systems, and technology to review and properly handle IP notices? I can't speak for others, but their mere presence says little to me.

No sane person expects a perfect system. We're just curious about the particular circumstances of this particular case, and you have a reasonable audience here who would love for you to share some of them.

GeorgFechner• 15 years ago

Dear Paul, I am German lawyer, facebook-Fan and I found a trademark "facebook" that is registerd by an Individual in the German Trademark-Register (DE 302010048481). The opposition deadline ends may, 18.th. If I can file the opossition let me know. I would love to do it. Best regards Georg Fechner (fechner@uvh.de)

orijing• 15 years ago

It sounds like a hard problem to find a balance that satisfies everyone. What do the security experts here recommend?

Facebook shoots first, ignores questions later; account lock-out attack works

Related Stories