Facebook had ample warning about privacy problems with “contact import” feature

https://www.wired.com/story/facebook-data-leak-contact-import-flaws/

by fortran77 • 5 years ago

174 90 5 years ago

wired.com

gherkinnn• 5 years ago

Another day. Another Facebook fuckup.

When will this end?

29athrowaway• 5 years ago

When consequences get real. Real criminal and civil penalties like jail time, billions of dollars in fines, etc.

Daho0n• 5 years ago

Never but this will help:

https://noyb.eu/en/facebooks-gdpr-bypass-reaches-austrian-su...

StavrosK• 5 years ago

I love the NOYB project. Make sure to support them with a recurring annual donation if you aren't already.

travisgriggs2• 5 years ago

I have an honest question, hope it is not deemed troll bait.

I lurk and read quite a bit here on HN. I think I've come to feel pretty versed in the common anti-social-media gripes and stances, and that Facebook is one of the leading villains there.

But I also read that there are some really smart and empowered/supported people at Facebook and they make some pretty desirable stuff (things like React, etc).

On the one hand I picture a classic clueless business people driven culture driving poor demotivated engineers and so stuff like the latest hack happen.

But then, I see this other picture where teams of quite functional teams are doing good engineering.

I'm not used to these things coexisting well, especially for extended periods. Am I being too naive about that? Or perhaps my simplistic impressions listed above are too naive?

What's the real story? And Facebook insiders here who can add insight?

(Edit and disclaimer: I am neither Facebook user or a React programmer)

nikanj• 5 years ago

” Number of employees 52,535 (June 30, 2020)”

Plenty of space for both groups

travisgriggs2• 5 years ago

So the good and functional engineering teams work on UI toolkits and all the poor programmers shepherded by non technical management work on the ever suspect contact scrapers at another campus or something?

matkoniecz6• 5 years ago

There are some very smart people who either consider privacy as unimportant or dead anyway.

There are some people working in Facebook who consider it as evil but considering salary as sufficient reason to work there.

There are some deluding themself that they can make FB less evil.

I think that some smart people make mistake of assuming that other smart people have the same priorities and ethics as them. It is not true.

Some of smartest people do far more evil things than things ever done by Facebook.

See FSB, KGB, NSA, Mossad, finance companies, chemical companies, lawyers, military sector, military for many examples people doing clearly evil things despite being smart.

To clarify, there are people in mentioned places also doing non evil things or doing evil things and being dumb. Not everyone in chemical company is covering up Bhopal disaster and similar or setting up the next one.

pyjug• 5 years ago

On the one hand I picture a classic clueless business people

They aren't clueless at all. Privacy isn't a priority for their business, in fact it would actively harm revenue.

ericbarrett• 5 years ago

I worked at Facebook from 2009-2012 and again briefly in 2016. "Answers" like this are why you will not read real answers.

matkoniecz6• 5 years ago

classic clueless business people

Why you think that FB is managed by clueless business people? They are clearly not clueless, just with completely different priorities mismatching mine and with completely different opinion about ethics (AKA "they are evil").

brnt• 5 years ago

Money buys you everything, including highly skilled and capable engineering teams.

Lackeys are lackeys, they will do what you ask as long as the crumbs are big enough. The hand that feeds and all that.

It is obvious how Facebook benefits from obtaining this info, thus the onus is on them to prove otherwise. They haven't, so they didn't.

romanhn4• 5 years ago

I'll bite. Worked at FB for a couple of years, until very recently. The HN groupthink on the company is quite strong, reaching conspiracy theory levels in some cases. Thing is, 95% of users (which is like, half the world) either do not know or care about the latest controversy.

Personally, I just do not buy into this "Facebook is evil" narrative, and even less so having worked there. Social media holds a mirror up to society, and we don't like what we see there. It's not our fault, it's Facebook's! So screams the press that is losing subscribers to new forms of media. Is FB sometimes incompetent? Sure (who isn't at that scale). Could they do things better? Of course. Are they trying to? Absolutely (the cynics would never admit this point, but it's true, e.g. the amount of resources and cross-company efforts thrown at improving privacy is incredible).

From my perspective, Facebook (and WhatsApp, and Oculus) have added a lot more to my life than they have taken away. My family and friends are all on Facebook, so clearly they feel similarly. Internally, there are indeed plenty of smart, empowered people that also haven't bought into the doom and gloom of what, ultimately, is a loud minority.

I fully recognize that my priorities might be different from those of others. Or perhaps they are impacted by the negatives differently. All opinions have their place, and I don't mean to speak for all employees either, just sharing my own point of view.

2pEXgD0fZ5cF2• 5 years ago

Social media holds a mirror up to society

This would only really be the case without algorithmic influence on discoverability and what people get shown on Facebook. "Engagement" being one of the keyword here, which very much morphs this "reflection". Facebook might technically be a mirror, but if it is, it is one of those curved distorting ones you used to see at carnivals and fairs.

matkoniecz6• 5 years ago

Could they do things better? Of course. Are they trying to? Absolutely (the cynics would never admit this point, but it's true, e.g. the amount of resources and cross-company efforts thrown at improving privacy is incredible).

What about things like lying that phone numbers for SMS authentication will not be used for other purposes?

What about mental gymnastics to work around legal obligations that are privacy related.

EU regulations require allowing users to get their data in readable form - what FB is doing? Claiming that data is too complex, impossible to provide in readable form and therefore they are legally forbidden from exporting most of it. FB listed targeted advertisements as their obligations, and claims that as result they do not need user consent to spy on them as it is their legal obligation.

Maybe FB is mirror but they are busy mirroring nastiest - and the most profitable - parts.

For me their supposed attempts seem to be rather a smokescreen to me.

hrktb2• 5 years ago

Over time I came to compare facebook with the car culture. It plays a central role to a ton of people’s lives, provides a widely needed service to communities and allows some lifestyle that wouldn’t be possible otherwise. But with a incredible amount of casualties and second/third order negative effects on the whole environment.

The debate will always be “is it worth it ?”. As we dial back on car presence in a lot of situation and try to counterbalance all the lobbying and bullshit that has been thrown at us by the industry for several decades, I see us coming to the same point with ad based/attention based industries. It’s not “evil”, but needs a crazy amount of adjustment to come to a healthy point were the benefits are not drowned into societal pollution and casualties.

panic2• 5 years ago

Is FB sometimes incompetent? Sure (who isn't at that scale). Could they do things better? Of course. Are they trying to? Absolutely (the cynics would never admit this point, but it's true, e.g. the amount of resources and cross-company efforts thrown at improving privacy is incredible).

This type of argument is made over and over on behalf of harmful institutions. The police sometimes screw up, but everyone makes mistakes. Cars (as a sibling comment points out) sometimes kill people, but that's just a fact of life, and car safety improves every year. In each case, the institution's responsibility for harm is deflected by the argument that the institution, in its current form, can't exist without doing some amount of harm. Not considered is the possibility that the institution could fundamentally change forms or stop existing entirely.

halfmatthalfcat2• 5 years ago

I completely agree, re: HN paranoia around FB. I feel like the engineers lose their minds (speaking as one) and need the FB boogieman to exist. Is there no room for the (very plausible) explanation that a group of people had benevolent intent yet the wheels fell off when they didn't understand the scale of what they were working with?

This happens all the time at work for many of us, we underestimate scale and shit breaks. I don't know why the same logic can't be applied to Facebook, albeit taken to the extreme, being one of the biggest data hoarders on the planet.

tobr2• 5 years ago

Is FB sometimes incompetent? Sure (who isn't at that scale).

Do you mean to imply that we should be more forgiving of Facebook because of the scale you operate at? I feel like it’s the exact opposite. You very aggressively sought to grow to that scale, it’s not something that just happened to you. With that should come an immense sense of responsibility, but instead Facebook has stepped up with reckless behavior, lies and manipulation.

the cynics would never admit this point, but it's true, e.g. the amount of resources and cross-company efforts thrown at improving privacy is incredible

Sure, call me a cynic. But I imagine this is where your perspective as an employee might be distorted. From the inside it might look like there’s a lot of effort put into something like this, but from the outside it’s clear it’s nowhere near enough.

mike006324• 5 years ago

Quick reminder that Facebook knowingly facilitated a genocide of the Rohingya people.

BlueTemplar• 5 years ago

These days, one of the main - if not the main - cause of Facebook's (and other GAFAM's) evilness is simply that they have gotten too big.

FabHK2• 5 years ago

Social media holds a mirror up to society, and we don't like what we see there.

Well yes, we humans have flaws. Now, there are some institutions, habits, and organisations that ameliorate these flaws and enable us to become better versions of ourselves ("better angels of our nature").

And then there are things that prey on our baser motives, pander to them, exacerbate them, and profit from it. And Facebook is surely among them.

Is Facebook only possible because our flawed nature? Sure. Does that exculpate it? No.

jacquesm• 5 years ago

Personally, I just do not buy into this "Facebook is evil" narrative, and even less so having worked there.

Of course you don't. To buy in to the 'Facebook is evil' concept you'd have to see yourself as part of the problem and chances are that you would never do that.

Personally, I think Facebook could be good, and probably is good for many people. But I also see the dark side and the downside (shadowprofiles, for instance, a large collection of dark patterns trying to rope people in and to keep them there, the walled garden that it tries to be). It's AOL reimaged, and when AOL went the way of the Dodo I was quite happy.

If I had the choice between working on Facebook or on anything else I would pick the anything else option, because even if Facebook isn't even per-se I strongly believe that it is a net negative and its leadership disgusts me.

tencalls• 5 years ago

Social media holds a mirror up to society

People also say cocaine brings out the true self, but I wouldn’t know.

Facebook is not some giant monolith.

Harboring this thought has no actionable constructive value. Assuming the best intent, people here aren’t disgusted at fb engineers because they think they are making day-to-day evil decisions. They’re disgusted because they think fb engineers would have to believe facebook is overall a force for good, or at least neutral, to be able to continue working at facebook.

But rarely does an fb engineer here have the courage or the care to defend facebook in such a way. Often, they just point out that facebook is not a monolith.

I remember reading about a collection of interviews with drug dealers. The interviewer said the most common refrain they often heard from them was, “if I didn’t do it, someone else would.”

Even so, everyday I thank whoever took these specific FAANG decisions (off the top my head):

…adding the “Add to Home Screen” button on iOS safari for web apps.

…adding Firefox support for Google Meet (Microsoft teams and Zoom are still Chrome only I think)

I say this despite knowing these decisions were most likely not taken with altruistic intent and probably came from the top, relatively speaking.

shubik22• 5 years ago

Personally, I just do not buy into this "Facebook is evil" narrative, and even less so having worked there.

How would you characterize a group of people who built a product used to incite a genocide?[1]. (That’s not hyperbole, that’s literally what happened!)

Even if you attribute this to incompetence (is incompetence which leads to genocide excusable?), what is a reasonable reaction once you’ve discovered your product has been used in this way? Has this been Facebook’s reaction? In my eyes, clearly not, as it continues to be used in similar ways to this day.

[1] https://www.nytimes.com/2018/11/06/technology/myanmar-facebo...

croutonwagon2• 5 years ago

Absolutely (the cynics would never admit this point, but it's true, e.g. the amount of resources and cross-company efforts thrown at improving privacy is incredible).

I would have to disagree there. Their core ethos has been pretty bad on this front. I quit Facebook around the time edu addresses were first no longer required. Things like the wall were the major features.

The main reason I quit though was because they were routinely reverting and NOT respecting my privacy options. It got to the point where I was taking screenshots of my privacy options to make sure it wasn’t just something I was missing.

I reactivated about 2009 but quickly disabled against because of the same reasons. And rather than regularly combing through my options I chose to opt out entirely.

Multiple people I have spoke with since, many of whom aren’t tech savvy have said the same over the years, even recently.

usrusr• 5 years ago

An interesting observation, the low effort (and zero knowledge) answer (answerism?) is that it's easy, low-friction and rewarding to show off technological excellence in things like React etc, but executing "ethical excellence" or whatever you'd call it would be the exact opposite.

In the end, like so often, it's just the old salary-induced difficulty of understanding.

bertil16• 5 years ago

The vast majority of the coverage of Facebook has large factual issues that most employees would know about. Seeing their work, or the work of people they admire, misrepresented just makes employees distrust the media.

It’s easy to have Gell-Mann amnesia when you notice something wrong every year at most. It’s harder when it’s every day.

bertil16• 5 years ago

I’ve been one of the very first critic of the company (suggesting they’d become a monopoly and current laws wouldn‘t be fitting, submitting a PhD about that in late 2004). I’ve worked at Facebook (twice) working on controversial projects and debated about the company a lot in the last 17 years.

1. Most of the reporting is just factually wrong. For instance, Facebook didn‘t sell data to Cambridge Analytica; your bank did sell, with your name, for profit. Facebook didn’t know about the Rohingya genocide: they had a Nobel prize laureate telling them the messages where harmless. It doesn’t matter that Facebook did all was legally possible once they realised what was happening then, there is such a stain on the brand that opponents are actively protecting the people who are still doing harm to this day just because it let them feel good about criticising the company. It’s horrifying. And when employees see that, they are rightfully happy that the company is powerful enough to ignore the critics and do what they can to, say, prevent marketers from using the data that your bank sold them. Or not throw the only hope that Myanmar has of ever being a democracy to the critics because she lied to them.

2. There’s a lot of bad decisions happening. I’ve personally seen several issues that are far worse than what has been reported. Seriously. Which is stunning — but journalists are so latched on their stories (and so hurt to be called out on their lies) that they refuse to hear far more problematic and nuanced issues. I’m not making this up.

3. Most of the real issues are hard, and far outside of Facebook’s control, in spite of them trying really hard and often publicly. Take how bonkers is the American Right right now (sorry to all the readers of HN who think that QAnon is a reasonable group, or that Trump hasn’t raped underaged victims of human trafficking, or never paid for an abortion after raw-dogging pornstars for 40 years). Sure, it looks like banning the racists assholes would be a healthy decision, but it’s not necessarily democratic. And talking about that requires far more nuance that most analysts have granted the company. Internally, the people in charge are far more deliberate than that. “1200 employees have signed a petition!” So… 0.6% of the company? Sure that committee is still horrifyingly American-centric; they have a diversity that would make a Yale-Harvard rowing derby blush; they are full of political appointees with problematic friends, but at least, unlike journalists, they get basics like: Censorship is bad. More importantly, there’s a really good team of researchers that try every thing that is suggested publicly and more. “What about if we told Flat-Earthers and Anti-Vaxxers that they are wrong, and kick them out?” well, there’s published science from Facebook about that. That science informs a lot of the key decisions. What happens when you link to those results in a debate outside the company? “Oh, it’s from Facebook, it must be biased…” Huh… no, it’s peer-reviewed and it has strikingly critical takes; it has detailed experimental protocols. You are welcome to engage with the authors. But most people outside of the company choose not to.

4. The alternative is far worst. Imagine you can help the company gain market share among teenagers. Every minute they spend on Facebook, they are not listening to Chinese propaganda on TikTok, or getting asked for nudes by creepy 45-years-olds on SnapChat. So, are the teams at Facebook working on detecting State-actors or groomers under-funded? Sure, but those teams _exist_; you can help them. Those teams don’t exist at alternative. So you are not necessarily defending the company with insufficient effort in key direction because of “the pay check” or “profit” but because, as insufficient as they may be, those efforts are there.

5. The vast majority of what Facebook is doing is neither controversial nor hard. It’s helping small businesses grow and survive the pandemic; helping families share a video feed for an anniversary; helping VR not trigger headaches after 20 minutes. Those are clear ethical goods (as well as profitable, which isn’t bad) and leaving the company means that those projects get delayed.

6. Employees feel heard on those questions. But the thing is: most of the time, the problem isn’t we need someone whose work and focus is unrelated to barge him and play the reply-guy. That’s occasionally helpful, but rarely. Recent examples: last year, employees from Hong-Kong have reached out to explain how the CCP was trying to detect and hurt them. Facebook has systems to protect dissidents. Knowing about them and spreading awareness locally; translating them to Cantonese was presumably helpful. But the policy team rarely needs petitions to be told that the NYTimes has published a scathing OpEd, or that racism is bad. Employees overall trust the management to do well enough; they share the same view of the world. They read the same opinion that are shared publicly (maybe more often) and agree with it. That’s probably the most striking difference: the same text (say, about how Apple’s changes to iOS will decimate small businesses) is taken at face value internally because the assumptions behind it are well documented and understood. So it’s incredibly confusing when the exact same document is immediately shot down externally, for being wrong (it’s not) or self-interested (sure but still true and important).

So employees disengage. Because it’s too frustrating, too hard and it generally leads to bad things. Not because of the confusion of being a bad guy (it’s far more confusing internally because all the remaining problems are hard) or because of a pay check (you get offers for more money every day in your LinkedIn inbox, let alone from writing a tell-all book).

c22• 5 years ago

The flaw is that young idealistic techies and would-be business people keep making the mistake of believing you can grow a large multinational corporation that doesn't end up becoming at least slightly evil. The evil is inherent in the scale and structure of these entities and it comes from the bureaucracy of many competing and self-defeating business incentives and the ultimate decision/realization that "making more money" is the only sane holistic goal to globally optimize for. Simply deciding that your company will contribute to open source or have some motto like "don't be evil" is not enough to avert this pitfall.

ummonk3• 5 years ago

It’s got a good bottom-up culture focused on empowering engineers to build stuff like React and ship changes to the social media platform on their own initiative (especially when those changes prove effective in improving key metrics in A/B testing).

This same bottom-up culture leads to a lack of oversight on potentially questionable changes, and also means there is sometimes a lack of ownership and investment in fixing issues that haven’t gotten media attention (because no team decides to work in the fix). In recent times there has been quite a bit of investment in improving privacy but it feels a lot like trying to patch over a broken foundation.

bamboozled• 5 years ago

No one really cares about this, in 3 months or less, it will be completely forgotten about and it's business as usual.

dathinab• 5 years ago

Facebooks "contact import" feature had been running on (in the EU):

- it's the user who commits the crime

- it's a crime not pursed by the state without anyone suing

IMHO it's kinda ridiculous that this "gap in laws/regulations" hasn't been closed years ago.

Facebook had ample warning about privacy problems with “contact import” feature

Related Stories