Facebook shoots first, ignores questions later; account lock-out attack works
arstechnica.com
arstechnica.com
On it I talk about what books and tools we're reviewing and cool book and tool stuff for startups and hackers. Hn-books.com is a hobby site, and the fan page is a part of that hobby of collecting cool resources.
But really, at the heart, it's all links -- links to the site, links to hn, recent blog entries with links. I don't do events, and resource links are the most useful thing I can provide. So when FB banned me from my own fan page, I was kind of freaked out. Why do that?
The only answer I got was because I was spamming, but heck I was just doing what the page was supposed to be about. I guess the problem was that somebody joined the fan page, then complained about the links the page was providing. The links they asked to get.
Just like with Ars, I found very little help. I finally sent an email off into the blind with something like "I am not spamming. I am simply maintaining a page full of resources. People who want to be fans of the page expect to see these resources. That's the whole point!"
A few days later the ban was lifted. The whole episode happened with very almost zero useful information from Facebook.
So somebody out there is reading these emails. But my customer service experience was far from pleasant. I hope Ars gets it straightened out. When you're in a situation where you can be punished for little reason and without much recourse something is whacked somewhere. This situation desperately needs some transparency and structure.
The saddest part is that now he can't use FB's advertising tools anymore, there is just some text there saying that he is locked out. No explanation. No form he could fill to resolve the issue. No nothing. And he has spent several thousands euros on FB adverts for our products (and was planning on spending even more). I really can't say anything else but what the fuck Facebook?!
As you may have heard, today we investigated a number of recent trademark (intellectual property) takedowns, and as a result of this investigation we restored four Facebook Pages. We apologize for any disruption to those who posted content.
Taking a step back, abuse of DMCA and other intellectual property notice procedures is a challenge for every major Internet service, and we take it seriously. In many cases, when we're put on notice we're obligated to take appropriate action. We have invested significant resources into creating a dedicated team (including me) that uses specialized tools, systems, and technology to review and properly handle these intellectual property notices. This system evaluates a number of factors when deciding how to respond -- and in many cases, we require the reporter to provide additional information before we can take action.
As a result of these efforts, the vast majority of intellectual property notices that we receive are handled without incident. Of course, no system is perfect and we're always striving to improve our practices. Rest assured that the dedicated team who handle incoming complaints from rights holders are equally devoted to protecting the interests of people expressing themselves on Facebook. As part of our ongoing efforts to improve, we will be considering the results of our investigation into this matter as we continue to refine our systems and procedures.
Can you add anything that wasn't in the originally-posted article? For example, answers to any of these questions:
Why was the accused infringer of trademarks not given specific, actionable information about the trademarks in question? You state that the reporter is required to provide additional information in many cases. Assuming this was one of those cases, why was this additional information not shared with the accused infringer? (And if this was not one of those cases, why mention this at all?)
You invoke the DMCA, citing it as obligating you to take appropriate action. Was the action taken in this case the most appropriate one? Who decides what's appropriate here, Facebook or the relevant laws?
Care to discuss any of your specialized tools, systems, and technology to review and properly handle IP notices? I can't speak for others, but their mere presence says little to me.
No sane person expects a perfect system. We're just curious about the particular circumstances of this particular case, and you have a reasonable audience here who would love for you to share some of them.
Edit: I'm surprised an account would be locked by a DMCA request though. Block or remove the content (if it's a legit DMCA notice) but keep the account alive. That's just one more way to carry out this sort of denial of service attack.
I think I was quite lucky to have both my gmail and FB go down at the same time as it showed me such a clear contrast of approaches. Google, though impersonal, still assume that you're telling the truth. Facebook just don't give a shit.
As you can see, it's not a normal DMCA take down, and it can easily be spoofed.Yes, you have to certify under penalty of perjury, but what difference does that make if the contact information is bogus?
I (and I think some others, like @finiteloop) always try to drop a comment when discussion on here is relevant to stuff we work on.
Brands building their online presence via Facebook are mad as far as I'm concerned, Facebook owns that content, they can do with it what they want and as this demonstrates, zero recourse.
Because, as ars points out, the system is ripe for abuse. I could make an auto complaining bot that aims to take down every page with a copyright complaint. Eventually facebook would be a waste land with large groups of alienated folks bad mouthing facebook and seeking an alternative.
Ultimately, facebook needs to resolve this issue, even if they need to charge a fee.
Just because the currency in question is not (directly) the USD doesn't mean I'm not paying for it.
Sure you are giving them personal information that is valuable, but I don't think the datacenter power company is going to take that as a monthly payment from Facebook each month the bill is due.
You do have the right to complain, as everyone does, but since you aren't giving them actual $, they have the right to really not give a damn.
Sure, it's not quite the same as a financial exchange, but at the very least they should treat their users well -- their virtual monopoly isn't gonna last forever.
And it's not clear they realistically could be staffed to handle it well. Though Amazon seems to do a better job than the others. So arguably you can provide better service if you're willing to invest in it. But for Facebook and Google, beyond some VERY base level, better customer service is a cost that probably wouldn't drive much in the way of revenue.
You get to complain about AT&T and your roofer because you have a contract with them entitling you to a certain level of service in exchange for your money. Your only agreement with Facebook is Facebook's AUP / ToS / privacy policy, which gives you no such rights. If you don't think it's an equitable agreement, don't accept it!
Unfortunately, as long as facebook keeps growing without going public, their staff is kept busy with other things, like calculating their stock's valuations.
Comcast Internet Video Package (YouTube and Hulu): $79.99/mo.
Comcast Social Media add-on (Facebook, Xfinity Friends, NYTimes): $14.99/mo.
Point being, a large number of paid providers becomes inconvenient if not impossible for an individual to maintain. This creates a market for a gateway provider to aggregate payments and subscriptions, which role the big media companies have traditionally fulfilled. While it's true that dependence on Facebook leaves you with little recourse if things go wrong, individual payments for social media services seems untenable. There must be some better way of addressing the issue, as you cannot necessarily afford to ignore Facebook, Twitter, etc.
The trouble is, Facebook don't have any viable competition any more. If someone leaves Facebook in disgust then the consequence is that they no longer use a social network. If a respected site like Ars Technica don't like Facebook's policies then, as you say, they have zero recourse.
Given the above, what would you advise Ars Technica to do, other than complain loudly and hope that Facebook smile favourably on them?
Remember, Facebook is about one thing: eyeballs. If some eyeballs cost them money, it's easier to lock them out than to work with them.
If you don't want some large company to shut down your website, host your own.
The outraged tone and arguments of the article imply that the author thinks he has “rights”, hence his fairness demands. This is a privately owned website, they can do what ever the ____ they want with the data that you give them. This quote from the article exemplifies this view:
How dare we post our own content to our own Facebook page
They really think it's their own. I can't decide if that's sad or hilarious.
I'm not an open web fanatic, but such naivety from a tech savvy site is scary. Regular people must think Facebook is a given, like air or tap water. This widespread lack of education is going to get ugly soon.
Maybe I'm just a grumpy young guy, but I can't understand why people not only use, but depend on Facebook.
Look at Hacker News, there is something interesting here everyday. I'm sure there are equally relevant sites in almost every field of knowledge. Yet, I've never seen anything in Facebook deeper than regular gossip or elevator chitchat about the weather: your friend spent last holiday at his beach house. Wow.
And regarding business contacts, C'mon. We've been doing business networks for ages. I've yet to see someone getting loads of money because of whom they met at Facebook.
All the businesses out there actively marketing their Facebook page should take heed. Set up and market a proper website; utilize a mailing list for client communication.
https://www.chillingeffects.org/dmca/counter512.pdf (not actually a pdf)
They have to put it back online with a counter-notice.
The catch is there is virtually never a prosecution for a bogus takedown, I cannot remember ever reading about one, it would be huge news.
Bogus takedowns happen all the time on youtube so I guess now it's moved onto facebook.
Can't believe I am suggesting this but anonymous just needs to have "Takedown Fridays" where they target the service of their choice and perjure away to their hearts' content. When thousands of FB pages suddenly vanish, eventually Congress may get wind of it and improve the law but I kind of doubt it.
Nope.
You'd target Actors/Actresses, Politicians, CXOs, and other influential people, and their families. When those people hurt, they WILL do something. Sometimes, that something could be changing the law, or using the law as a nice pointy stick.
(The quotes because, you're not so much the customer as the product...your eyeballs at least.)
No they don't. Doing so merely gives them safe harbor from any liability for having taken it down. Facebook has no legal obligation to its members to maintain the content in the first place, and therefore no obligation to pay attention to a counter-notice.
Even taking into account some level of exaggeration, this is laughable. Facebook advertisers might be Facebook partners. The Facebook-user relationship cannot be further from partnership, it is the relation between a farmer and their livestock.
When you are dealing with virtual monopolies that have zero customer support and negative processes (Facebook, Google, etc) getting locked out does not mean that you get go somewhere else, it literally mean getting locked out of an entire aspect of your life and/or business...
Think about it: all your friends are on facebook, you get banned, where are you going to go, which other social site are you going to use?
Facebook did not make facebook popular, the users did. Virtual monopolies need to recognize this, that they have a responsibility to the users.
Ars is talking about helping everyone else by trying to get a better process in place. I really hope they follow through on this -- Facebook could certainly use a dose of due process.
Conversely, when you pay for a physical Apple product like a Macbook, consumer laws make it much clearer what services and guarantees the company must provide its customers.
More in the same vein: http://news.ycombinator.com/item?id=2087120.
"It's not fair! Facebook has a responsibility to its users! I demand them to do such and such!"
So what if facebook was never around? You are in debt to them for such a great service, they never forced you to become so dependent. People lived for tens of thousands of years without social networking, and they'll continue to do so.
The issue at hand isn't whether or not Facebook has the power to do this, but rather that the system is intrinsically moronic in that it involves no checks and balances. It is trivial to abuse.
You don't like a company's Facebook fan page, and you can have it removed with a little effort into building an email. You don't actually have to prove anything, just wave your hands.
In essence, you seem to be defending the right of Facebook's public users to disable accounts and pages on Facebook on a whim. Is that correct?
If you want to guarantee the stability of your content, you need to get a contract or host it yourself. Facebook doesn't owe you anything.
To assume that since there is no legal contract between a user and Facebook, Facebook has no need to treat its users well is simply untrue. The users make Facebook, not the other way around.
When I last read through that (and which was admittedly a few years back), the ToS indicated that whatever you uploaded became available to FB in perpetuity, and for whatever purpose FB wanted to make of it.
Put another way, if you didn't pay for something, then there's a good change it's you that's what's being sold.
The Terms of Service are irrelevant to the idea of whether "it's the users that make Facebook". Put it this way: how useful would Facebook be if you were the only user?
Of course, it's not a good PR or long term business strategy to screw with lots of its users, but talking as though it must do things when it really doesn't have to is the issue that the parent is responding to.
If someone says Facebook "must" do something, it doesn't necessarily mean that they're implying a legal requirement. It is more likely that they're talking about something that, in the opinion of the commenter, is required to stay successful long term - regardless of the legalities.
> You are in debt to them for such a great service, they never forced you to become so dependent.
No. I'm not in debt to them.
My ad views and clicks cancel the debt for the provided service. And my patronage further adds to push that balance in my favor.
In a way, you can say that Facebook and Google are in my debt.
> "It's not fair! Facebook has a responsibility to its users! I demand them to do such and such!"
There is a difference between a startup, a small-to-medium size business, and a monopoly.
Once you become a monopoly the rules change, since by definition you are the only option there is. Understand that we are not dealing with a business that cornered some niche. That's not a monopoly. What we are dealing with are businesses that are involved with billions of lives. They do have a responsibility, yet they accept none. It's a clear case of indifference, lack of understanding, and perhaps ego at the top of these orgs.
Facebook and Zuckerberg's responsibilities are to their shareholders. As far as I can tell they've been taking that responsibility pretty seriously.
Furthermore, Facebook is not a monopoly in any meaningful sense of the word, they definitely don't have more than 50% of the ad revenue on the internet. As a person who consumes Facebook's services for free you really have no leg to stand on as to what Facebook is legally obligated to provide you for free.
How can you argue that kicking people off Facebook is a monopolistic practice that unfairly prejudices it's competitors? It would seem to me that the more widespread this practice becomes at Facebook the better it's competitors would do.
There are also many alternatives to Google.
Except to the webmasters, since Google brings in 95-98% of a website's traffic.
> they definitely don't have more than 50% of the ad revenue on the internet
I don't see why you're injecting ad revenue into this.
> As a person who consumes Facebook's services for free you really have no leg to stand on as to what Facebook is legally obligated to provide you for free.
I have stated nothing of the sort.
> How can you argue that kicking people off Facebook is a monopolistic practice
I have not stated nor argued anything of the sort.
What I have stated is that after you get to a certain size and market share (monopoly) where you begin to effect the lives and welfare of people, society, and businesses, "public good" rules begin to apply to you (or should be applied to you).
No one is asking for free services. What we are asking for is fare treatment and fare processes.
There's an implicit agreement here - the user puts time and effort into providing content to Facebook that Facebook users want to see, and Facebook puts that content in front of lots of people. If the risk of Facebook reneging on the deal becomes seen as too high, fewer content creators are going to take up the offer.
If losing your Facebook page (or Twitter account or regular call-in segment on your local morning talk show or any other marketing vehicle) would be a serious blow to your online strategy, then Facebook has much too prominent a spot in your online strategy.
Whatever happened to making your business's website the destination for consumers? I fucking despise Facebook as much as anyone else, but I am finding it a little difficult mustering up sympathy for any business or blogger whose business is impacted disproportionately by losing their Facebook page.
It's like programmers who build their entire business around a company's API. When the company decides to drastically alter the terms of use of that API, it's catastrophic for the programmer's company. It's terrible for the hacker, yes, but "don't put all your eggs in one basket" is a cliche for a reason.
If your customers are predominantly Facebook users then that is where you go. Our customers are mostly teens and the best way to reach them and keep them engaged is through Facebook where our response rates are off the charts. Email on the other hand sometimes feels like it is more likely to bounce than to get read. And practically none of them use Twitter.
I didn't say not to have a presence on Facebook, did I? The social media/new media/online strategy for a great many companies and publications -- I wouldn't be surprised at all if it was >50% of the top 1000 companies in America -- consists solely of having a Facebook fan page.
They might have a website where you can buy their actual product. However, if, "Come visit us on Facebook!" is the extent of your online presence strategy, you're exposing your brand and your strategy to huge risks.
Have a Facebook presence. Make it part of your strategy. But don't be an idiot and make it "Our Facebook/Twitter Strategy." You might think that's silly, and no one would do it, but by god there are a LOT of idiots in the world.
(I'm using the generic "you" here, not specifically you hartror)
You could assume a $50 bil. company would have something like a customer service ...