Comment by jasode | Hacker News Reader

Comment by jasode | Hacker News Reader

Parent Full thread

Some thoughts about the possiblities:

1) he's lying ... which would be dangerous since it only takes one disgruntled employee to expose emails and work projects that merged in 3rd-party data (e.g. Acxiom).

2) he's not "lying" ... by doing his version of Clinton's "depends on what the meaning of 'is' is".[0] Let's say Facebook has an internal system that collects data on non-Facebook identities into a holding area. Maybe they internally call it "deferred profiles" or "pre-activated profiles" but not exactly "shadow profiles". Well, MZ can basically interpret "do you have shadow profiles?" as a hyper-literal question and answer with a hyper-literal answer: "no". Again, a Facebook insider would have to come forward and reveal what the shadow-but-we-dont-call-it-that profile actually is.

3) he's telling the truth by every meaning of the question. Facebook truly has zero data on non-Facebook users.

[0] https://www.youtube.com/results?search_query=depends+on+what...

He's not under oath, so the consequences of lying are limited.

Lying to congress is a felony, whether you're under oath or not. It's the same statute that people plead guilty to for lying to the FBI, 18 USC 1001 [1]

[1] https://www.law.cornell.edu/uscode/text/18/1001

That’s not the same as perjury, and relatively few people have been convicted of this. If it were “illegal either way”, then there would be no point to swearing people in. A decision was made to not swear him in, and he knows this.

> relatively few people have been convicted of this

I take it you don’t keep up with current events much. There have been a number of high profile convictions under 18 USC 1001 this past year.

Adding: the penalties for false statements and perjury are roughly the same, although false statements can also carry a heavier sentence in some cases. There are defenses against perjury that are not available under the false statements law. All in all, they are very similar.

You may find the Congressional research Service’s summary of these [1] to be helpful.

[1] https://fas.org/sgp/crs/misc/98-808.pdf

According to your summary document, 1001 has a number of requirements and limitations. It would not surprise me if those were meaningful. You are arguing that there is no additional benefit to being sworn in before Congress, but it is not treated as such when Senators demand that certain testimony be given under oath.

I’d be willing to bet that the donations to >80% of the panel interviewing him purchased the privilege to not having to ‘swear in’

While it's unlikely you'll ever face a problem like this, do know that lying is a punishable offence, which your comment incorrectly demonstrates. You need to take a moment and review "18 U.S. Code § 1001 - Statements or entries generally" [1] sooner than later.

[1] https://www.law.cornell.edu/uscode/text/18/1001

Why wouldn’t they put him under oath? That just seems weird: the cost of doing it is zero.

Possible that if they did every single answer would be "I don't know the exact details, my team will get back to you"

He came without being subpoenaed, so not putting him under oath may have been a courtesy. Many of the congressmen thanked him for coming on his own accord.

Yeah. I'd even go further and say that if you are giving testimony in Congress and answering questions, then you should automatically be under oath unless Congress explicitly waives that requirement before the session.

Perhaps this is more of a show than the real thing

The cost for them is 0, the cost for MZ is incredibly high. I don't think he would have agreed if he was under oath.

3) is provably false by the product. Facebook can accurately suggest friends for you immediately after sign-up.

I believe they do this based on emails and phone numbers.

They do. That is data that is stored and collected about me without my consent.

The way it works is technically very straightforward. I might have have your number in my contacts list, and I give my contacts list to FB to find my friends. They store that number and if you ever sign up they recommend you follow me as we know each other.

What's complicated about it is the ethics of what's happening. Should FB require permission from you to store data about you even though I gave it to them? Do I have permission to share your number with other people? Why isn't the contact information in my phone my data? This is an interesting problem.

We've had to think about this for GDPR. They are contact details that you're giving to a business to contact people. Your email provider needs them, your phone company needs it, your cloud contact manager does it, etc.

I think it's not worth debating to start arguing that we can't use addresses and phone numbers to contact people. That's their whole point.

It's when they're being gathered without informed consent it's a problem or if they get stored without explicit consent past the reasonable use you needed them for.

If I click a button saying "look for my friends", was there a reasonable expectation that FB or LinkedIn or WhatsApp or whoever would then keep that data forever.

FB will argue that obviously you wanted to keep on checking that list. But what about combining different people's list, processing the data in unexpected ways, actually clearly telling the user the list will be stored indefinitely, etc.

And further to that, what if FB doesn't store the information itself but does store a unique hash of it? They can still do all the data processing and yet claim to have no "personal data" at all.

This is a deep, deep rabbit hole.

Under GDPR simple hashing is not enough. You have to throw away the hashing salt (delink the hash from the profile) in order to be compliant. The whole point is exactly the result, you should not be able to map the profile to the data you have.

Exactly - they should have always discarded any data about non-members.

Isn't the social graph they've built of nonusers from address books shared with them part of the "shadow profile"?

Building a system where you input an e-mail address and it spits out likely friends of that e-mail address isn't exactly the same as having pre-built "shadow profiles" for a bunch of e-mail addresses. With such a system it would be trivial to build a social graph for a person quickly after they sign up for facebook (and then suggest friends). But, doing so doesn't necessarily mean facebook had previously built out a social graph for that e-mail address and had a profile waiting for it in the shadows.

4) He's regurgitating verbatim, everything his army of attorneys coached him to say.

At least he's not saying the magic 4 words - I DO NOT RECALL - that every other senator or congressman or CEO says in their hearings, also not smirking or mocking the committee like Pharma Bro did, so I'll give him that.

> At least he's not saying the magic 4 words - I DO NOT RECALL - that every other senator or congressman or CEO says in their hearings

Of five Zuckerberg responses in the linked excerpt, three are “I don't know...” or “I'm not familiar with...”.

> Maybe they internally call it "deferred profiles" or "pre-activated profiles" but not exactly "shadow profiles".

I can't find the article now, but a few weeks ago I saw an article stating that they call them "Future users" or something similar.

That’s somehow much creepier than “shadow profiles”.

Or 4) Facebook has shadow profiles, but Zuckerberg's out of touch, doesn't read his critics closely, and is unfamiliar with the terminology ("shadow profiles") they use.

Pretty sure that falls under #2.

Zuckerberg's out of touch about what his own company is doing?

It's probably not possible that fb has zero data on non users, for example they no doubt have faces in pictures that don't match up to fb profiles. But it is possible that they don't attempt to collate that data in a way that identifies specific individuals who aren't on the platform, e.g. they don't do anything with those unmatched faces.

Reply on news.ycombinator.com