Hacker News Reader

Comment by pmiller2 | Hacker News Reader

This is the part that troubles me about this:

> “The exceptionally broad nature of the Commission’s requests means we would be required to turn over predominantly irrelevant documents that have nothing to do with the Commission’s investigations, including highly sensitive personal information such as employees’ medical information, personal financial documents, and private information about family members of employees,” Facebook associate general counsel Tim Lamb said in a statement.

Why does FB even have employee medical information and personal financial records? I can sort of understand how they might inadvertently end up with small snippets of medical information via their HR process (e.g. Sally Software Engineer submits a request for maternity leave), but, other than possibly account numbers for stock accounts and deposit accounts, I'm scratching my head as to what they even mean by "medical information" and "personal financial documents."

View on HN

"Why does FB even have employee medical information and personal finanacial records?"

You are assuming that they have this information. However their argument is that the search terms "could" retrieve such documents. There is nothing here that confirms they possess these purportedly irrelevant documents that would be produced given the current search terms.

Usually lawyers will redact personal, sensitive information before releasing the documents. In the US, some courts make this an obligation. Also, usually there are some search operators to limit the results of the search to usage of the terms only in certain contexts, e.g., like the ones used in Lexis and Westlaw.

It is a new level of irony, hypocrisy and cognitive dissonance to see an unregulated, privacy-destroying tech company whose core business requires ingesting personal information from hundreds of millions of people at an unprecedented scale try to argue that EU regulators, who are probably limited by statute in what they are authorised to do with the information they receive, should not have access to information for the purposes of investigating Facebook's activities.

It's not a new level.

Cognitive dissonance is an essential requirement to work in Wall St, the MIL complex, Exxon, big tobacco, the gambling industry etc etc. They all have their own stories about how it's okay to exploit weakness in people.

They all reach a stage where to survive they cannot break with their stories. Cognitive dissonance is par for the course.

Facebook by adding the Like button to the Internet is basically giving out free dopamine in exchange for attention that they exchange for $$$. It's a modern legal unregulated drug peddling empire.

And all empires collapse because of their cognitive dissonance.

> Cognitive dissonance is an essential requirement to work in

oh, boo. this is a sophomoric examination that does not do justice to the subject being critiqued.

cognitive dissonance has become a buzzword and its incorrect usage is exemplified here. those people aren't struggling with a value conflict, they just have different values than you do.

the path to togetherness, thoughtfull discussion, and mind-changing lies with honest recognition and good-faith debate, not name-calling.

Can you point me to the discussion where I can confirm that this has become a buzzword?

You miss the point. Many people that work at tobacco companies probably like to smoke!

You miss the point actually. The poster made a statement without any proof. It's a classic logical fallacy.

And your example...? Proves what exactly? It's the exact opposite of a cognitive dissonance. The behavior is consistent with the company values.

But the discussion point is that the company behavior is most of the time inconsistent with the company values. E.g. Exxon value is env friendly energy <-> Exxon true behavior is causing env disaster

There's a bit of a problem here because cognitive dissonance is harder to apply to companies, they are not a single mind even if they almost act like it. I doubt the people under the company's umbrella hold the 2 ideas in their head concurrently, they just put aside any moral aspect and let "the company" bear this moral weight, they just have a job to do regardless of personal preference.

Perhaps hypocrisy would be a better term to describe them. They'll say something is bad but they'll do the very same thing depending on how this suits their agenda.

Not at all. Hypocrisy is the act of criticizing OTHERS for something, while engaging in the same behavior. That's completely beside the point and no-one talks about that here.

I haven’t come across hypocrisy meaning one is criticizing others. I don’t think that needs to be a pretense for hypocrisy.

it would be hypocrisy for some one to be for small government always, but spend 1 trillion a year on a complex tax system beyond what any one else is doing. Regardless of any critiques they make or don’t make.

I simply went by the official definition [0].

> : a feigning to be what one is not or to believe what one does not : behavior that contradicts what one claims to believe or feel

> especially : the false assumption of an appearance of virtue or religion

Seems to me that this is exactly the point of what we're talking about here. It started from the "cognitive dissonance" which applies less effectively to a "hive mind" like a company than the above given definition for hypocrisy.

That feigning is exactly the difference between feigned and real values or behavior. And no matter which feigned/real pair you choose from this story (real values, claimed values, values and behavior towards themselves, or towards users, etc.) you will find evidence of hypocrisy.

[0] https://www.merriam-webster.com/dictionary/hypocrisy

> cognitive dissonance has become a buzzword and its incorrect usage is exemplified here. those people aren't struggling with a value conflict, they just have different values than you do

But maybe, just maybe, their values are incompatible with the values that build up a society. And here is where the cognitive dissonance starts.

> the path to togetherness, thoughtfull discussion, and mind-changing lies with honest recognition and good-faith debate, not name-calling.

That only works when all sides want this. I think it's pretty onbivous that any large corporation, doesn't want this kind of discussion. It mean admitting them doing a lot of cr*p in the name of profit.

Cognitive dissonance is a single person holding two contradictory views at once. A person holding views that contradict yours is not cognitive dissonance. "The values that build up a society" are not a universal truth.

You could argue in both directions actually, since they are part of society and they likely don't want to be held to the same standard as they treat their users. (still not necessarily a contradictory view, but it gets bendy)

However in general I do find cognitive dissonance badly used, since the experience of cognitive dissonance is usually the positive part, since you notice a problem in your view point. The resolution on the other hand ... So it would be better to just say contradiction and then it's obvious that one has to give a better explanation of it.

That's actually incorrect. Cognitive dissonance means that someone's behavior, attitude or thoughts, beliefs are inconsistent. Or in other words someone participates in an action that goes against his beliefs, ideas, values. Which is exactly what the grandparent post refers to:

> They all have their own stories about how it's okay to exploit weakness in people.

This is definitely inconsistent and in contrast with almost all the above mentioned entities' mission statement and their corporate values.

In other words, beside my previous comment you missed the part of the discussion where we concluded (see the grandparent's post again) that both the value and the behavior originates from the same source.

This has nothing to do with an external third person's view.

Would you agree that a US Senator doubling down[1] that 'having slavery was a necessary evil[2] in order to get rid of it[3]' is correct usage of cognitive dissonance? How does it differ from the incorrect usage?

[1] https://www.bbc.com/news/world-us-canada-53550882

[2] I agree with him that it had been a necessary evil to form the original union. I disagree both that formation of that union was necessary, and that slave states joined the union with the intention of abolition.

[3] Luckily, like this senator, the confederate states and contemporary writers said why they seceded. Deepfakes are not an issue when people are willing to go "on the record" with their intent and state of mind.

====

As to "different values", I guess I can come up with some for the examples given above:

Exxon - We need oil profit now to fund later development of our green acquisitions

Wall St - Our arbitrages make the system more efficient for everyone else

the MIL complex - Our products only kill and maim baddies. Besides, we build them so we don't have to use them.

the gambling industry - If we were outlawed only criminals (and uncovered derivatives traders?) would gamble. Besides, people have a sure loss when they pay for other forms of entertainment. And we pay for cultural projects legislators don't want in their budgets!

big tobacco - There is controversy over long term costs, but in the short term smoking clearly demonstrates human mastery over fire. (besides, how are workers supposed to bond, and pace themselves, without the smoke break?)

However, the only clearly non-dissonant one I can come up with is "anything people pay me to do is by definition good."

> the MIL complex - Our products only kill and maim baddies. Besides, we build them so we don't have to use them.

Approximately no one thinks that in the military industrial complex. People are not dumb. They know what they are building. It's actually one of the least hypocritical industry I worked in.

I left because I was feeling uneasy about the foreign countries we were selling to and don't believe in the foreign policy of our last few governments. Still I am not loosing sleep about my contribution to my country military relevance.

Thanks. I'll gladly edit if you can provide me with a better justification? (to me, "contributing to my country's military relevance" would fall under "we build them so we don't have to use them," but I'm obviously the wrong person to be writing these.)

> we build them so we don't have to use them

No, we build them so that we are credible when we threaten, can riposte if we are attacked, are less tempting as a bullying target and win when we wage wars (which we sadly still very much do even if it's mostly in support of allied countries nowadays).

I mean, I am far from fully Clausewitzian but force remains part of the way international relationships work.

I think we agree[1] more than you think we do.

https://www.gutenberg.org/files/1946/1946-h/1946-h.htm#chap0...

> "But a measuring of strength may be effected in cases where the opposing sides are very unequal by a mere comparative estimate. In such cases no fighting will take place, and the weaker will immediately give way.

> If the object of a combat is not always the destruction of the enemy’s forces therein engaged—and if its object can often be attained as well without the combat taking place at all, by merely making a resolve to fight, and by the circumstances to which this resolution gives rise—then that explains how a whole campaign may be carried on with great activity without the actual combat playing any notable part in it."

(the problem here is that this strategy is unstable, as not everyone can follow it at the same time, something demonstrated twice during the prior century. Renaissance italians were fond of manoeuvre over direct combat, for which our more bloodthirsty age faults them.)

[1] compare Alexander in https://news.ycombinator.com/item?id=23963679

The OP gave a simplistic answer about baddies. In general though this does appear to be something of thinking of your side as pretty damn good in a moral sense. A few things I can think of that don’t feel like they align with the motives you gave:

- the US is close to near full support of course what Israel does. We have never had any issues supplying them with aid of all kinds. There doesn’t appear to be nuance there. The practice won’t stop. It exemplifies many of the general practices and uses of the military complex.

I have a hard time believing there isn’t some level of hypocrisy or dissonance to claim moral reasons like not being bullied, but on board with most of Israel’s actions.

Yemen is an easy case of how wrong things are. It is consistent with the frequency of the US not doing things for defensive purposes.

The first 3 points vs the waging war point appear To be conflicting and troublesome themselves.

> even if it's mostly in support of allied countries nowadays

Does "nowadays" include only the 1991 defense of Israel? Because that's the last time the US was in a war that was in defence of its allies, and there's basically a blank history before that.

There's no need to have a good-faith debate with someone who has decided that my privacy is worth less than their salary. Those people should be punished. They can have good-faith debates with each other during their mandatory community service or what have you. That way they only waste each others' time.

How do you not see the lack of coherence in their philosophy?

When it comes to data on Facebook employees — how dare the people request access to such private materials!?

When it comes to data on the worlds people, Facebook is willing to sell it to anybody. Even if the data is used aid in rigging elections.

> they just have different values than you do.

Name them.

Aye, cognitive distancing would be more accurate, though I don't really know what the actual term that applies here is. I generally just refer to it as simply lacking morals, be it in the form of immorality or deep ignorance, neither of which are excusable.

> Cognitive dissonance is an essential requirement

I think the correct word here is "doublethink". Cognitive dissonance implies experiencing an unpleasant sensation from the contradiction, which leads people to try resolve the dissonance. Doublethink implies fully accepting two contradictory notions at once without any unpleasant sensation.

What can we say about the legions of engineers and scientists that work for these companies?

Either they're desperate or they're immoral.

If you're not poor, then it's immoral to work in such company.

If I had to choose between working for a monopolistic corporation or a mafia, I think I'd rather join the mafia because I can't stand hypocrisy. At least they're honest about what they're going to do to you if you don't pay them the protection money and they're not pretending to be the good guys. A mafia has a clear, well defined moral code with clear boundaries which limit the harm they do; also unlike corporate entities, the members of mafias take risks upon themselves.

Are people on HN, reddit, et al, who have criticisms over vast numbers of people, mostly cogs, but all seem to be working jobs at companies that don’t do much harm, if any?

It appears as if at some level all of us need to have some level of cognitive dissonance to not see ourselves as bad people. I know there are levels to how bad things can be. I’m just saying no one is a saint.

The EU Commission is a powerful barely accountable entity. It may be hypocritical for FB to defend privacy but it doesn’t necessarily mean that they are wrong.

Well they are still orders of magnitude more accountable than facebook, that's the irony.

In what way is it "barely accountable"? It's appointed by Member States directly through the European Council (the heads of each Member State who meet quarterly to discuss the EU), who propose nominations, and then confirmed by the MEPs from each Member State directly elected by their voters.

So, from two directly accountable bodies: the heads of state of each country, and then directly elected MEPs. If EU voters don't like their Commission, they can always vote in new MEPs and new governments to represent them on the Council.

There are many arguable democratic deficits within the EU, but isn't one of them in my opinion.

Because "in practice" voters are extremely far removed from the decision process. And it isn't just a problem of scale.

It is like the US inverted. The voters don't vote the president directly, but the Trump vs Biden debate makes clear how things are done "in practice".

>You are assuming that they have this information. However their argument is that the search terms "could" retrieve such documents. There is nothing here that confirms they possess these purportedly irrelevant documents that would be produced given the current search terms.

Having the documents is a necessary condition to them being found (or in other words if they don't have the documents they can not be found), so I would hope making such an argument without actually having any documents containing this information would get them a stern talking to by the judge. Then again law often works very different to what we laypeople assume.

>> You are assuming that they have this information.

Isn't that the entire premise of the article? What you're suggesting here is that Facebook doesn't hold any data until the government asks for it, then that data magically appears on its servers and suddenly it needs to be protected from big bad government. How convenient.

> Why does FB even have employee medical information and personal financial records?

At Facebook's scale, they probably self insure their employee health plans (at least in the US where we don't have universal health care). Meaning when employees make a medical claim, the company pays the cost directly. Consequently, they probably have records of every claim made.

I suspect personal financial records is limited to payroll info and tax withdrawal elections.

The companies I know that self-insure hire an actual insurance company to administer and take an administration fee, and just capitalize it themselves. They don't actually act as a health insurer.

Yes however they still have access to all medical billing claims as they are the ones paying them. I've worked in this space for three years.

You're generally correct, but there are exceptions. The payor still has the right to see claims if they want to, and sometimes they will carve out certain services from the insurance plan that's administered for them, usually for cost optimization reasons.

In a famous example, Wal-Mart carved out back surgery from their healthcare plan and instead negotiated directly with a few specific hospitals across the country, where all Wal-Mart employees who need back surgery then travel to for care.

More common is for big companies to contract with primary care groups to serve their employees directly. (The thinking is that incentives can be better there, since some primary care doctors stay afloat by selling their practices to large hospital chains that they then are encouraged to be aggressive about referring their patients to, raising total costs of care. I think Facebook has this sort of on-site primary care arrangement...this is particularly common in very high cost-of-living cities where it's hard to have what most would think of as a doctor's lifestyle as a primary care physician.

100% this, in addition Facebook has limited onsite medical care at its facilities that they provide as a perk to employees. Even if this is contracted out there is probably some paper trail as to who used what services.

It's probably safe to assume that some Facebook employees have used their work email to correspond with their doctor, accountant, etc. just for the sake of convenience.

And it sounds like the EU is asking Facebook to turn over every email they have the matches any of the 2500 search terms, which would include some of these.

Is there any reasonable term that's not likely to eventually end un in some personal, irrelevant conversation? I can guarantee you that by the time any court rules on anything FB will have so many of these examples where the search words are seemingly organically intermingled through all kinds of irrelevant or personal documents.

> Is there any reasonable term that's not likely to eventually end un in some personal, irrelevant conversation?

"Anti-trust", I'll even give you " competition", but "big picture" seems overly broad

The following seems perfectly plausible:

> > who fancies coming to the pub tonight

> I need to be home soon. My so won his school competition today so want to take him out for ice cream

I’ve got a doctors appointment, sorry

"Competition" would probably show up in half of the HR related emails. So would any generic word. You're left with the "written confessions", the ultra-specifics if you will. Imagine if you would search an assassin's phone only for evidence that contains the word "assassinate" because "eliminate" may refer to medical issues.

I'm not talking hypothetically here, I've actually seen such investigation from both sides of the fence. They're not a new thing. Between common sense, known investigative techniques, and legal teams providing coaching an executive has everything they need to avoid using very explicit wording. They use abbreviations, keywords, vague language, because they know some were caught with their pants down admitting in writing some very specific stuff.

Whatever you search for they will comply and provide a lot of material, but none of the good one. After a while somehow they start producing a lot of irrelevant material that contains this. Eventually they will make this exact move where they use the previously provided stuff as evidence that the investigation is too broad. In the meantime that data retention policy set for a laughably short interval kicks in for both the data and the backups. Some companies delete emails, messenger logs, etc. officially under the guise of "cost savings for storage". Anything an employee wants to keep has to be exported locally to some workstation. So regular employees try to manage like this, while senior management or executives get to keep the important data while maintaining plausible deniability. After all you can't search every workstation and the person can't be expected to remember where every file they ever used was.

you can't search every workstation

I've seen a case where every employee who touched a certain project had to turn over their workstation's hard drive (just the drive) to a forensic company who would document and remove anything related to that project. They ended up failing to delete a bunch of stuff anyway.

This would happen in internal investigations (the worst kind, it means you can;t rely on the company's protection), and ones where there's already a warrant for the entire drive, meaning there's already strong evidence to justify this. You'll never see someone handing over the drive just for discovery.

But if they have to provide something, executives are safe almost by default. Companies explicitly use data retention policies as an official means of destroying evidence on centralized systems (on the servers), and they're not shy when discussing this openly (just not in writing). Executives will not be happy about losing their email history so they store a copy elsewhere, on another workstation whose existence is simply not a matter of common knowledge, many times it's associated with a management assistant. Or they will use aliases [0] and investigators will never know there's anything relevant there. When cooperating with the authorities only the official device used by that person is presented, the one in the asset management. You can't ask for something unless you know and can prove it exists.

These investigations could eventually cost a company billions so trust me, they invest billions worth in effort to make sure evidence stays buried.

[0] https://www.reuters.com/article/us-usa-tillerson-climatechan...

How about a hypothetical example? I went out of my way to use all three terms that were examples. A better way of handling such wide dragnets is similar to how ACLs work. Inclusive terms grant privileges, but specific denials always deny. So the dragnet is cast, and then from the dragnet anything that matches various keywords is flagged for manual review, with a default of excluding if it matches _that_ information. Items which are relevant to the interests of the intended search but which also contain information that is sensitive and not to be made public might end up filed under some sort of seal.

From: Reporting To: Employee Subject: Re Vacation / PTO / Family Medical Leave

... The change in policy is not good for us as it will impact my ability to care for ++my elderly parents++ and the ++young child++ that is on the way.

... It is still a big question about how paternity leave works and if this change in policy might shut down any chance for promotion based on having a family.

Tax withholding elections, retirement contributions, medical elections, emergency contact information, beneficiary information, medical leave requests are all information most employers have about their employees.

Also if an employee is disabled and needs adjustments to their work schedule, desk setup etc.

I didn't think the day would come when government dragnets would be defended like this. This is clearly a fishing expedition using broad queries. Glad I don't work at companies that are routinely targeted for this shit by overzealous spy governments.

This isn't overzealous spy governments. They are investigating the one of the top three data heavy organisations on earth. They are requesting a miniscule subpercentage of that data, and doing so through an untrustworthy and opaque filter. You cannot investigate a company like facebook without large volumes of data.

It's just that relative to people's normal perceptions, it seems like a dragnet.

Facebooks feelings about this are unjustified and nothing but a tactic to waste regulatory body time, taxpayer money, and judicial stamina.

Crack them open like an egg, is what I say. I've no time for companies doing literal exabytes of questionable business and then playing the victim around handing over a few gigs of it for investigation.

Oh yeah, sure, there's always some big evil bad. At least back in the day they were claiming it's terrorists and child pornographers. Now it's Facebook. They told me this slope wasn't slippery but down we go.

Yeah yeah. Pawn all of your reasoning off on a "they" and infer slippery slopes while breaking out the false equivalencies - as if people are equating anti-trust violations with child pornography.

Do you think the anti-trust investigators should instead focus their efforts on Boko Haram? They are a suitable group for the job? Do you think facebook just... shouldn't be investigated?

This has to be one of the weakest arguments I've yet to see on HN.

I don't want the government to hoover up personal data in order to dragnet search for child porn or terrorism so obviously I think it's a massive overreach to do so for something as piddling as antitrust investigations.

Obviously you are falling for facebooks ploy here and imagining the government wants any personal data at all. The regulator is requesting literally zero personal information, especially of the public.

Facebook is smokescreening saying "oh but what if some of our employees' information is given over", to which the response is "well edit that out then, you idiots."

Not only was this lost on you, but you still think it's a dragnet. I've never seen someone fall so hard for corporate propaganda, right before my eyes.

Where is that response? I think if the EU regulators said that and pay for the redaction (the same as we pay for FOIAs) then that's fine but otherwise looking for "big question" OR "not good for us" OR "shut down" is a dragnet.

Happy to revise position if you have a source for that response.

Companies often have an internal escalation path to deal with issues with their company provided health insurance, for instance if the insurance fails to cover something that their company claims they should cover. Those escalation tickets will be logged and retained.

This is a good point but you’re assuming you can believe a word Facebook’s lawyers say when fending off requests for information.

They don't even have to be lying, it's not a stretch to imagine FB interpreting these requests so broadly that they gave up this information to use it as leverage against the requests.

They will explicitly include the search parameter in such documents specifically to prove they are irrelevant and that they should not have to comply with future requests. It's an actual tactic used in all such investigations.

The investigators obtain some circumstantial evidence for what they should search, request it from the company being investigated, then hope that they get enough of the evidence before that company manages to poison the well and make it look like the investigators are on a witch hunt that's so broad it can only be spiteful.

When this happens you can be sure that they're doing their darndest to hide something. From my experience the cases when such investigations are chasing ghosts are rarer then hens' teeth. After seeing the process from both sides I can honestly say that given how chronically deprived of resources (most of all time) almost all investigations are, when they go for something you can bet the farm that it's hidden somewhere in there and they just have time to pull it out before the other side buries it completely. The more damaging the data, the more resources allocated to burying it.

P.S. Let's install on every car this emission cheating device that tricks all the tests and brings us more profits, we'll never get caught. Young child support parents mortgage breast lump. Welp, guess the evidence is compromised now, we'll have to look elsewhere.

It's possible they're exaggerating to get a good sound bite to get people on their side -- "medical information" could refer to health insurance enrollment forms, and "financial records" could refer to paystubs or benefits information.

Is that really exaggerating? Those are both legitimate examples of the words they used. Working at Facebook shouldn't mean that some official in the EU gets to know what kind of insurance I opt for or how much I make, or generally dig around my personal communications without warrant based on the use of arbitrary phrases (speaking hypothetically; I don't work at facebook).

Personal communications from your work email address?

Standard HR insurance documentation shared with a government?

Whatever information HR has can be shared with governments.

The irony is, that this is exactly what Facebook and Google (and whole bunch of other companies) do with their users as part of their business model. Somehow that's ok.

In my case (in the UK) my employer would have diagnoses of diseases from sick notes, occupational health assessments that include medical information, pension details, payslips and personal details of my next of kin. All this would fall under GDPR protection which a) doesn't just apply to websites and b) includes the "only ask for the minimum you need to do the job" proviso so I can see Facebook's point that it's problematic for them to hand over this information. But I'd be surprised if there wasn't a law enforcement carve out that this falls under.

This was exactly my thought when reading this, why do they have this information? Unless it's trivial information like next of kin or the sick days of employees, which really should not contain the search terms, why should Facebook have details of employees medical information or partners?

> we would be required to turn over predominantly irrelevant documents that have nothing to do with the Commission’s investigations

No but it's needed so the Commission can offer better personalized services. Or do what the users have to do when they reject overly broad EULAs: take their business elsewhere.

Simple, company emails. People use work emails for all sort of crap, intentionally or not.

Occupational Health records would be classed as medical information.

I expect the regulator has asked for a lot of email or messenger comms to investigate something and FB has said "we can't turn over that email, it could contain personal stuff that people deal with in their work email".

For example if you send your paycheck home via your email, that's a "personal financial document", if you send home a receipt from when you got a flu vaccination that's "employee medical information" and private information about families is when your mom/spouse/whoever emails you at work about something.

This is typical in a discovery situation and the lawyers will usually sit down and sift through stuff and figure out what really is relevant, what needs to be redacted/excluded altogether etc.

If it is irrelevant to the Commission, then it is irrelevant to Facebook. If the data is highly sensitive, then it is relevant information for the Commission!

Reply on news.ycombinator.com