Both Facebook and Cambridge Analytica Threatened to Sue Journalists
techdirt.com
techdirt.com
It's not just "IP 12.342.32.1 is chaotic neutral" but "'Bob Smith, with a degree in X from Y, that likes A, B, and C and is newlywed' is chaotic neutral." The issue isn't really the quiz (and it's not even CA tbh), it's Facebook giving out real names, real pictures, etc. every time you "Log in with Facebook" on any random website or app.
Granular permissions are also a pain point for me on Android phones. They were possible with apps on BlackBerry phones in the late 200x's, but on Androids before version 5 or 6? No, it's either give the app permission for all of requested functionality, or don't install it...
It is this way that Cambridge Analytica was able to get 50 million profiles by just paying ~270k Amazon mechanical turkers [1].
It's true that everyone agreed to everything along the way: people allowed Facebook to have the information in question, and people allowed Cambridge Analytica to access that information. But it wasn't the same people agreeing to both. The set of people agreeing to the latter was much smaller than the former.
It may be true that technically neither Facebook nor Cambridge Analytica did anything wrong (at least in collecting this information, this seems to be by far the least shady part of CA's business), but, Facebook's business is built on trust, and this is a huge hit to that trust. Arguing technicalities doesn't help.
1. https://www.nytimes.com/2018/03/19/opinion/facebook-cambridg...
Except that those users had granted that permission to the people who then granted it to CA. So, transitively (which is the only way to think about permissions), they had granted it to CA.
Now Facebook may make a different statement etc and the rules of service, privacy can allow for this. But it is not a property that is transitive in general. And it is bad publicity. (I hope.)
I can be told a secret, I do not necessarily have the permission to share, for instance, what happened in the bachelor party last Saturday right?
But I disagree that if we went back in time and quizzed people clicking "yes" that the majority would really understand that recent events were the probable expected outcome of them clicking "yes".
There's a difference between consent and informed consent. And it was strongly in the interests of Facebook (and anybody who made an app using their APIs) to be very vague about the potential consequences.
Of course, you can allow the authorization server to publish these details, but this is not an inherent part of OAuth. Also, there's OpenID Connect [2] which builds on OAuth and adds just this information in another token: "The ID token resembles the concept of an identity card, in a standard JWT format." (from [2]). However, you can happily use OAuth without ever publishing the user's details.
[1] https://tools.ietf.org/html/rfc6749 [2] https://openid.net/connect/
I took your comment to say "You have to allow access to your data if you're using OAuth, because that's how OAuth works", and wanted to argue against that. The OAuth protocol is so complicated because it tries to be safe and secure and so it doesn't force any data disclosure. However, I now see that you probably meant "OAuth forces you to accept these permissions explicitely". In that case, we're hopefully both right :)
I believe the reason this story is blowing up so big in the media is because most people never imagined their data being used in this way. When I login to patreon and subscribe to someone, I know exactly what I am paying. When I login to facebook and make a post, I (the average user) have no idea what it is that I am paying and/or how it can be used. I give away some factoid about myself without realizing that my angry post about Trump actually tweaks some political vector that is being calculated on me.
Consent is not enough, informed consent is the bar we have to set and it's basically impossible to say that the average facebook user is properly informed of what data they're giving, how it's being used and how much it is worth in dollar terms. Can you imagine if I could log into Facebook and see the models they've generated based on my content, and the dollar amount they've collected for that information so far. That's informed consent and somehow I doubt Facebook would be quite as profitable if people knew the actual cost they're paying.
Actually, there are lots of people who have no clue that such things are possible. Maybe in 20 or 30 years, everyone would become savvy enough to understand the implications of giving away their personal info freely, but we are not yet there. The people who know (younger, tech savvy etc) are in the minority. Today a big chunk of the population simply believes everything they read on FB, that is why trolling works so wonderfully
I have my Facebook profile set to 'friends', and perhaps its obvious now, but I guess I didn't realize an app installed by my great aunt now has all my information. I happily gave her access to see my profile, kids pictures, etc. But do I want every single thing she connects to to see any data I allow her to see?
It's located in the user's "Apps" settings [1] under the section, "Apps Others Use: People who can see your info can bring it with them when they use apps. Use this setting to control the categories of information people can bring with them."
[1] https://www.facebook.com/settings?tab=applications&ref=setti...
That said, I believe FB would LOVE if we change the topic from PRIVACY to "anything-except-privacy".
And yes. Any/all dictators (of any shape or form) are trying to silence the media/journalists. Why would FB practice a different method?
This way they want to make sure that the next whistleblower won't have an outlet.
I'd offer an alternative: the fact that we're stuck "sharing" via centrally managed platforms is the real issue.
I don't care about Facebook auth mechanism. Regardless of how it shares data, FB still HAS all the data, and can find a different way to share that with whatever party they want.
There's no leverage in the information economy outside "Use the one or maybe 2 ISPs you have, and these handful of "top" providers online."
It's like having a meat space economy be controlled by a top-down authority, and you can only trade along it's finan... distribution network.
Oh wow, what a shock. We remade cyberspace society to be just as centrally controlled as meatspace society. While meatspace became more constrained in an authoritarian way yet again in human history.
Human society exists in a strange loop of "build walls that are used to oppress me."
Wild guess (probably incorrect):
http://web.archive.org/web/20170205180142/https://www.foley....
-- does this conclusion hinge on the fact that Facebook should have realized earlier that the app is harvesting data? If the creator of the app said that he is doing it for academic purposes only then how should have Facebook known? Not trying to defend Facebook, but calling this a breach is at least a little bit gray area, no?
EDIT: concise wording
The "breach"/"something-else-that's-not-a-breach" debate from what I've seen doesn't hinge on Facebook knowing or not, it's about if all loss of data can be called a breach or if the term should be reserved for cases where the perpetrator did aquire the data without Facebook knowing.
- Steve Smith (Vice President, Intel)
(a) Users were duped into giving up their data under a false pretense. This alone cannot be called a breach.
Also, one of the following occurred:
(b.1) Facebook was duped into letting a fraudster install an app on their platform. If this happened, it was a breach.
or
(b.2) Facebook knew all along that the academic research was only a cover for duping users into giving up their data. If this happened then it was not a breach, because Facebook themselves effectively sold the data.
So what Facebook appears to be saying is: There was no breach. We sold the data!
[Edit] Judging by what this man says, it was probably b.2: https://www.theguardian.com/news/2018/mar/20/facebook-data-c...
My conclusion is that there was no breach.
It is WORSE than a breach, because FB is complicit.
A breach in which the custodian is complicit is still a breach, not something worse. Obviously, the its worse from the perspective of the custodians degree of responsibility if they are actively malicious rather than negligent or innocent, but this is still within the usual definition of a breach of private data. A breach is about the subject’s privacy being violated, which can happen with or without the complicity of the custodian of the data.
Consider an alternative scenario: a Facebook employee has access to data to perform his job. He makes a copy, takes it with him, and uses it in his new startup. Breach? It’s exactly the same as above, only the employee was an external partner in reality.
But I see the point of this being a breach, and suing based on this does then look as the article says. :)
Any editors or journalists that don't cooperate should have their Facebook, Whatsapp, or any other service suspended. (If any other service starts gaining network effects, Facebook can just buy it when it has < 100k users - this is how a monopoly works under network effect)
Anyway Mark Zuckerberg, my message to you is if you want to be remembered as one of the worst autocrats who ever lived, you are really going to have to step up the retaliation. Maybe introduce targeted executions of journalists?
Just some thoughts.
I have a similar anecdote, but mine does not match the mitigating circumstance you ventured.
Regardless, even a less-than-credible personal account clears the bar of required evidence to dismiss the above claim, since that requirement is currently zero.
You realize theres 2 billion people on FB but only 330 million people in the US right? That's many more people than just Americans giving "zero fucks."
https://investor.fb.com/investor-news/press-release-details/...
I find it more likely that Facebook is completely unwilling to admit that many of its accounts are not genuine representations of a real, living person.
• Nestle
• Every cigarette maker
• Gun companies
• Mosanto
• Pharma companies who charge astronomical prices
• Private prison companies
I just don't like 'em.
> I just don't like 'em.
That's what is called "poor critical thinking" in most circles. Please push your agenda elsewhere.
1. Cars kill a lot more people than guns. Every year. And while cars can be useful a lot of the driving is more ir less meaningless.
2. While guns might be used for evil they are also used for good: there is no doubt in my mind that our big neighbour to the east (I'm Norwegian) would have invaded a number of European countries during the 50-ies, 60-ies and 70-ies if those countries hadn't been prepared to defend themselves.
Globally, that may well still be the case. In the US, it recently ceased to be thanks to improvements in car safety.
(And yes, I'm aware of the theory that consumer guns are for taking lives in self defense. But in 2012, there were 33,563 gun deaths in the US, only 259 of which were justifiable homicides, so it's at least reasonable to think think that whatever the intent of gun companies, it's not working out like one might hope.)
Regarding self-defense, there is also a benefit in deterrence - look at relative crime rates in the most heavily armed per-capita states.
No. It's delusion. In doubt, feds will fuck you over and shoot your corpse when they're done. There is no such thing as stopping the police, short of welding yourself shut in a tank, but you're bound to run out of gas, air or food/water. Or being blown up with an RPG, if you do enough damage.
The only thing that works as a deterrence to authoritarianism is masses - but you really need MASSES, as in hundreds of thousands of people, not a couple hundred neckbeards with guns. Hell, G20 Hamburg was in the upper 5-digit range of protesters with a decent amount of experienced and willing rioters and it got royally screwed. I don't nearly see any protest coming near that range of numbers soon... except, maybe and hopefully, if Trump decides to be a totally ignorant idiot and fires Mueller.
(a) groups like Deacons for Defence (https://en.wikipedia.org/wiki/Deacons_for_Defense_and_Justic...) where the presence of weapons serves as a deterrence, or if you want to turn to more grim times, (b) events like Warsaw Ghetto Uprising (https://en.wikipedia.org/wiki/Warsaw_Ghetto_Uprising) where the concentration of weapons counts for forcing an oppressor to suffer casualties instead of just rolling over the unarmed opposition. That is what the quote you are responding to alludes to.
Finally, weapons also serve as deterrent for the out-of-control forces, e.g. (c) 1992 Los Angeles Riots (https://en.wikipedia.org/wiki/1992_Los_Angeles_riots) when the government is not acting directly or indirectly against a group but is simply not acting at all during critical time
All of these has happened before, and all of these will happen again, during our lifetime.
Comparing guns per capita on a small sampling, the top 5 most violent states per one survey are Louisiana (gun ownership: #11), Alaska (gun ownership: #1), Tennessee (gun ownership: #15), Delaware (gun ownership: #51), and Nevada (gun ownership: #16). All over the place, at least so far. Maybe a small bias towards "more guns=more violence per capita", but with such a huge outlier with Delaware, that makes me imagine that the overall data is pretty noisy.
My impression is that there is a much stronger indicator of guns-per-capita: population density. The top 5 guns per capita states are: Alaska (population density: #50), Arkansas (population density: #40), Idaho (population density: #44), West Virginia (population density: #29), Wyoming (population density: #49). Again, somewhat messy, but there seems like a strong bias towards more rural areas.
This makes sense to me. In America, a driving force for many people with guns is less pure self defense and more sport and recreation. Of which the opportunities are quite a bit more readily available in rural areas.
[1] https://www.usatoday.com/story/money/business/2016/07/29/ame... [2] https://www.cbsnews.com/pictures/gun-ownership-rates-by-stat... [3] https://en.wikipedia.org/wiki/List_of_U.S._states_and_territ...
Guns saved us from Hitler and guns saved us from the Russians in the 50-70ies.
Cars on the other hand kills way more people and should be banned except for people who can document that they need it ;-)
[1] in recent years, terrorists have been using cars to kill people too, but not the same extent.
This part of the discussion started with the claim that gun producers were evil by definition.
That seems to include everyone including if they only sell to armed forces.
Threaten lawsuits, fire/demote people that don't agree with you, etc.
The threat of forcing the other person to spend themselves into bankruptcy, for example.
Standards need to be defined and enforced, where such activity is grounds for punishment up to and including disbarment.
To the extent such already exists, it is clearly proving insufficient.
Law should be about justice, first. Not just another field of unfettered warfare.
Also, to that end, sealed records and confidentiality should be more severely constrained. The judicial system is a public system; everyone should be able to see what you're up to in it, for better and for worse.
Protecting clearly threatened victims, sure. Defined legitimate, critical secrets, for defined limited periods of time, ok (real national security, trade secrets). Beyond that, not so much. Not at all, maybe.
needless to say the idea that they want to suppress journalists is egregiously illiberal and warrants our unanimous excoriation of these businesses.
zuck's silence (terror? or destroying more evidence, as they have already done?) is very telling. if we organize, the bell will toll for facebook. it is long overdue.
as a bonus, zuck's presidential run is ruined, hopefully.
Defamation, per TFA.
There have been several high profile cases when politicians sued for libel, won, the facts were established as true, and the politician jailed for perjuring themselves during the trial.
http://news.bbc.co.uk/1/hi/uk/1424501.stm
https://www.theguardian.com/politics/1999/jun/08/uk
http://www.bbc.co.uk/news/uk-scotland-glasgow-west-12059037 (but see http://www.bbc.co.uk/news/uk-scotland-glasgow-west-17909946 )
To take a justified example where a ""journalist"" really did defame someone: https://www.independent.co.uk/news/uk/home-news/katie-hopkin...
"This includes £24,000 in damages to Monroe and £107,000 to her lawyers to cover court costs." Hopkins is now selling her house to cover costs.
Most people fold immediately when threatened with a convincing libel suit, because apologising (even for the truth) is a lot cheaper than a settlement which is in turn a lot cheaper than losing your house.
Another high profile example of effectively suppressing true facts: Trafigura https://www.theguardian.com/environment/georgemonbiot/2009/s...
Note that a litigant doesn't necessarily have to suppress facts forever, a few years while the case proceeds is often enough to turn the original issue into a historical curiosity.
When you look to silence someone, you venue shop for the best place to silence them. The UK is a decent place to stop them.
Life is better without them. They really haven't got you, you can break free just by deciding to do it.
(Apologies for mentioning up/down voting)
Or, perhaps the castle is reaching the next phase of construction, where users are supposed to have an appropriate level of fear.
The idea that "their elders" were "intuitively resistant" because they understood the decade-later implication of algorithmic user profiling being weaponized to undermine public thought and democracy is.... generous.
They didn't understand computers or why anyone would give a shit about seeing your lunch. Both fair. But let's not repaint them as wise prophets of some future data apocalypse.
The real kumbaya moment you're talking about is both self-deprecating and metacognitive: "I am not so much an individual as one of fewer-than-you'd-think archetypes, and my beliefs about the world are malleable based on cute pictures placed in front of me for pennies. I should take time out of every day of my life and spend it working to double check that the things i think are true, and the people I hate are the thing I think they are. Whole organizations of much smarter people than I will abuse me at every chance they get to take as much money from me as they possibly can. Most things that feel good on the internet are designed to turn me, somehow, into money."
This is a painful, stark realization that lots of people never get to. Whole industries rely on people never coming to the realization that all of us are "basic bitches" and not anomalously unique or intelligent.
I'd love to believe you that there is a multi-generational awakening to the idea that people are herdable animals, but don't bet the farm.
Intuition doesn't require explicit understanding. Many of my elders certainly had the instinctive sense that we're oversharing and that it will, somehow or another, bite us in the behind. And many of my peers assumed they were paranoid.
So basically if you're feeling trapped by Facebook's social network, remember that it is in fact possible (and often superior) to interact socially outside of Facebook. The tide may be turning.
Even then, Whatsapp is still king in terms of messaging in most of the world. Sadly that is also owned by facebook.