8 ms·

ACLU exposes Facebook, Twitter for selling surveillance company user data

296 points by AdmiralAsshat 10y ago

matheweis 10y ago
It's interesting to note that in some cases the data was being fed through an intermediary... who's to say there aren't other integrations doing the same thing?
deleted 10y ago
[deleted]
meriobrudar 10y ago
I love that "user data sales" has become such a normal thing that when someone stops selling it to ONE company out of like several thousand, it's considered newsworthy.
Pxtl 10y ago
If the data is public, why is it a problem? If they're sending private info to cops, that's different, but a reasonable person expects all public info to be visible to the last person you want to see it. Theyre just feeding the customers the same data users can see in a more condensed form aren't they?
- dragonwriter 10y ago
  Probably, because it violates the terms of services of the data access agreement, which I would imagine prohibits the use that was being made because it's the kind of use which discourages people from using the service from which the data is sourced, and it is therefore in the interest of the service provider to officially prohibit the use and to take action to deal with misuse at a minimum when it has become public. The chilling effect of surveillance has commercial as well as liberty implications, and commercial entities have rather strong reasons to care about the former even if they aren't concerned with the latter.
- the_watcher 10y ago
  The firehose isn't public.
  - tantalor 10y ago
    Access is not, but the content is.
    - malchow 10y ago
      COTY.
    - rhizome 10y ago
      Only if you follow everybody, which is impossible as a practical matter.
- eveningcoffee 10y ago
  If something is public then it does not follow directly that you can collect it or share it with a third-party. It all depends on relying legal framework. Especially when it depends on additional spacial and temporal parameters.
- idlewords 10y ago
  Mass databases, in a format that can be read and cross-referenced by computer, are an example where a difference in degree really makes for a difference in kind.
- ben_jones 10y ago
  IMO the average person does not know enough about the freemium services they use to make an informed decision regarding their own privacy, and it's kept that way intentionally by companies like Facebook, LinkedIn, Apple, Google etc. Long terms and conditions that constantly change, user interfaces built to delay gratification until a box or button is checked (and them giving that checkbox a significance that goes well beyond common sense), planned obsolescence and deprecation that force migration to other services..
- throw2016 10y ago
  This conflation is made too often. I think the problem with the assumption that if someone made something public willingly they don't care is if people knew they are under surveillance they may not speak their mind, or speak at all. If people who use the internet expect all their activities to be logged and mined for patterns that can potentially be used against them, they may behave very differently. Since we all act in self interest this means no one will speak freely. This is what surveillance does, this is what the chilling effect is. This reduces the value of the internet for the free exchange of ideas and discussion. People who seek this will have to resort to encryption and other tools and forced to behave in a secretive fashion as if they were doing something wrong. Protests and activism are supposed to be normal part of every democracy and its disconcerting the see the strange discomfort our 'democratic societies' show to activism and the sheer amount of effort devoted to managing it from infiltration to surveillance.
  - cyphar 10y ago
    > If people who use the internet expect all their activities to be logged and mined for patterns that can potentially be used against them, they may behave very differently. Unfortunately you see this already. Though usually people are worried about adversaries taking screenshots of conversations out of context and then painting them in a negative light, not the government doing that. But ultimately it's the same issue, there's a chilling effect on speech which is caused by the overwhelming fear of mass surveillance.
- freshhawk 10y ago
  But almost all location data is "public". I could follow you around, staying in public places, maybe have a friend or two help me out. And hire an army of private investigators to do the same for a bunch more people. But that doesn't scale, so much so that the difference in degree becomes a practical difference in kind. That's just an exaggerated version of the difference here. One of the most effective practical tools to combat bulk surveillance is to increase the cost. I'm also of the opinion that people are kinda asking for this by giving that data away and posting it publicly, but that doesn't mean those already collecting this data have no responsibility if they package it up and make it easy to use for surveillance.
- CoryG89 10y ago
  The data may be public, but they get greater access to the entire data set than the general public. This greater access is what was cut off. Also most people aren't aware that this level of access is even possible, much less that it's being sold to the highest bidder. Which in my opinion, is a problem.
- newman314 10y ago
  The same reason ALPRs (with long retention rate) are a bad idea. "No reasonable expectation of privacy in public" is the US norm today. I'm suggesting that maybe it should be revisited in light of the pervasive surveillance that has come into being.
niftich 10y ago
This is a very messy, multi-layered issue. First of all, a large part of a social network's utility is derived from sharing data about oneself. This data is public, for the benefit of other participants of the social network. Some of those participants may have agendas that are contrary to one's own: stalkers, adversaries, data aggregators -- it's impossible to know all of them ahead of time, and a granularity of permissions that satisfies these competing goals is... tough. Second, it ought to be a person's reasonable expectation that law enforcement is a benevolent actor. Actions such as this, which amount to targeted crowd surveillance, don't instill much faith in this assumption. This is a very serious issue that merits more discussion than my terse comment. Lastly, this data aggregator should not be the target of the outrage. They're an intermediary in a system where we willingly share data with private companies to get some value-add, who then sell that data to fund their operations, and some of the purchasers of our data happen to be law enforcement. Anger directed at any particular intermediary -- like anger at reposessors or ambulance chasers or debt relief counselors -- is woefully misdirected; we should instead be asking why corporations feel the need to sell our data in the first place, and why we have law enforcement that feels the need to employ mass surveillance. If we ponder these questions, we'll have accomplished something more than drive an inconsequential company out business while leaving the systemic faults in place.
- CoryG89 10y ago
  Companies feel the need to sell our data because they are offered tons of money for it by other companies such as Geofeedia. I agree that the blame does not rest on Geofeedia alone, but they aren't innocent either. I don't know a good solution to this issue other than making it illegal to buy or sell information about users of public corporations' products.
  - nostrademons 10y ago
    The bigger issue is "why is it that companies can make more money selling personal data about consumers than selling products to consumers?" If companies had a viable business model that involved ordinary consumers paying money for services rendered, then their responsibility would be to the people paying them money, i.e. the consumer. This is a really complicated question, and probably results from a combination of: 1.) Consumers not having disposable income at all, because real wages for a large slice of the population have been stagnant or falling for a generation and necessities like housing, education, and health care keep going up. 2.) Consumers having certain expectations of what they can get "for free", and not wanting to pay money for things that competitors will offer for free. 3.) Consumers having a poor understanding of the long-term consequences of putting data out there, and what it can be used for. 4.) Network effects where even if a small minority of consumers are aware of the above and would rather pay for products, they can't because a majority of the market would rather pay with information rather than money. If you just ban the sale of information outright, you will either end up with work-arounds (eg. Google doesn't sell information, but it sells better ad-targeting and behavior manipulation based on that information), or consumers will lose access to services that they depend upon for much of their daily life.
mjevans 10y ago
https://www.aclu.org/blog/free-future/facebook-instagram-and-twitter-provided-data-access-surveillance-product-marketed https://www.aclu.org/blog/free-future/facebook-instagram-and... Instead of ArsTechnica, why not link to the ACLU's website?
- bisRepetita 10y ago
  Thank you. >Twitter did not provide access to its “Firehose,” but has an agreement, via a subsidiary, to provide Geofeedia with searchable access to its database of public tweets. I really would like Twitter to share what search words were entered. It would give us a first-hand window on what government agencies are trying to monitor, usually secretly.
- hackuser 10y ago
  > Instead of ArsTechnica, why not link to the ACLU's website? I prefer journalism to the original source's post. The ACLU is an advocate for its cause; a secondary source can provide context, other sources, opposing points of view, etc. For example, compare a post by a political candidate, with its natural extreme bias, to a newspaper article about it, which includes fact-checking, expert analysis, their opponent's reaction, etc. That's the reason Wikipedia requires secondary sources for its citations and forbids primary sources. EDIT: Fleshed it out a bit.
- rhizome 10y ago
  That's nice that Twitter is able to keep this kind of thing at arm's length by allowing resales of the firehose.
gell_mann 10y ago
I'm pretty sure I have seen other apps do similar things. The data they are feeding them does seem to be mostly public data. I'm not exactly sure how I feel about this, or how outraged / surprised I should be.
- CoryG89 10y ago
  Just because the data is public doesn't mean it can be easily accessed or aggregated en-masse for real time survellience. If Geofeedia was only using public data, easily available to anyone else, then Twitter and Facebook wouldn't have been able to cut off their access.
  - nl 10y ago
    "Public data" doesn't mean easily accessible. Twitter sells access to their data. They can cancel that account, but the data is still public. Without the access contract it is inconvenient and against the terms of service to access in bulk.
deleted 10y ago
[deleted]
- deleted 10y ago
  [deleted]
type0 10y ago
> ... The companies need to enact strong public policies and robust auditing procedures to ensure their platforms aren't being used for discriminatory surveillance." Hm, is it okay to use it for non discriminatory surveillance? Can there ever be surveillance that is not discriminatory since the surveying entity is usually has no interest of surveying itself and to provide that data to the public.
Steeeve 10y ago
I find it strange that it would be perfectly OK to sell this data to a commercial entity, but it's not OK to sell it to the government.
- nostrademons 10y ago
  I think that what the buyer does with the data has a lot to do with this. They would be in even more trouble if they had sold the data to a private mercenary firm who takes out contracts on business rivals, for example. Conversely, if they had been selling to, say, the U.S. Census Bureau or FEMA, they would likely be lauded. It does say a lot about how little people trust the police these days, though.
thomasthomas 10y ago
from a story posted yesterday about the CIA crunching data to predict social unrest, it is fairly obvious the feds have access to social media firehoses https://www.engadget.com/2016/10/05/cia-claims-it-can-predict-some-social-unrest-up-to-5-days-ahead/ https://www.engadget.com/2016/10/05/cia-claims-it-can-predic...
Mendenhall 10y ago
I laugh at twitter playing stupid to what their information was being used for. Government loves its surveillance. Try this though, if you live next to a cop, FBI agent or public official place a high res video camera on your property facing their house and leave it live streaming. Post it to a website with photos of all their family and children, their license plate numbers the time they leave for work etc. All things that are publicly available and captured from a simple video camera. Start having multiple people do the same and locate it all on your website. Then watch how fast the hypocrisy rears its head.
webmaven 10y ago
Here's Geofeedia's response: http://blog.geofeedia.com/a-commitment-to-freedom-of-speech-and-civil-liberties http://blog.geofeedia.com/a-commitment-to-freedom-of-speech-...
newscracker 10y ago
Shame on Facebook! Shame on Instagram! Shame on Twitter! I consider this a despicable act on the part of these companies. They stopped this data selling only because they were caught. Using data internally to feed to algorithms to show targeted ads is one thing (though privacy wise it's bad). Selling data outright to other companies is a terrible state of affairs. It's sad that this won't make a big dent in the user base or make people flee these platforms in large numbers.
pluma 10y ago
As a non-native speaker this headline took me way too many attempts to parse correctly. For anyone wondering the same, it's meant to be read as: ACLU exposes Facebook and Twitter for selling user data to a surveillance company The way I read it the first few times I thought they sold user data of a company, for surveillance.
- dredmorbius 10y ago
  As a native speaker, it's a poorly written headline. One term for this form of misleading / confusing sentence (and especially headline) is a "crash blossom". http://www.quickanddirtytips.com/education/grammar/fun-with-crash-blossoms http://www.quickanddirtytips.com/education/grammar/fun-with-... https://en.m.wikipedia.org/wiki/Syntactic_ambiguity https://en.m.wikipedia.org/wiki/Syntactic_ambiguity
  - pluma 10y ago
    I think in this case it's made worse by the wording "selling X Y" as a substitute for "selling Y to X" being relatively rare and in this case both X and Y being compound words (surveillance company and user data). So not only is it a crash blossom in the sense that it's ambiguous whether it's [surveillance] [company user data], [surveillance company] [user data] or [surveillance company user] [data], but it could also be read as [surveillance company user data]. There are at least four possible ways to attempt to parse the sentence and the only one that makes sense relies on unusual phrasing.

296 points by AdmiralAsshat 10y ago

It's interesting to note that in some cases the data was being fed through an intermediary... who's to say there aren't other integrations doing the same thing?

deleted 10y ago

[deleted]

meriobrudar 10y ago

I love that "user data sales" has become such a normal thing that when someone stops selling it to ONE company out of like several thousand, it's considered newsworthy.

Pxtl 10y ago

If the data is public, why is it a problem? If they're sending private info to cops, that's different, but a reasonable person expects all public info to be visible to the last person you want to see it. Theyre just feeding the customers the same data users can see in a more condensed form aren't they?

dragonwriter 10y ago
Probably, because it violates the terms of services of the data access agreement, which I would imagine prohibits the use that was being made because it's the kind of use which discourages people from using the service from which the data is sourced, and it is therefore in the interest of the service provider to officially prohibit the use and to take action to deal with misuse at a minimum when it has become public. The chilling effect of surveillance has commercial as well as liberty implications, and commercial entities have rather strong reasons to care about the former even if they aren't concerned with the latter.
the_watcher 10y ago
The firehose isn't public.
- tantalor 10y ago
  Access is not, but the content is.
  - malchow 10y ago
    COTY.
  - rhizome 10y ago
    Only if you follow everybody, which is impossible as a practical matter.
eveningcoffee 10y ago
If something is public then it does not follow directly that you can collect it or share it with a third-party. It all depends on relying legal framework. Especially when it depends on additional spacial and temporal parameters.
idlewords 10y ago
Mass databases, in a format that can be read and cross-referenced by computer, are an example where a difference in degree really makes for a difference in kind.
ben_jones 10y ago
IMO the average person does not know enough about the freemium services they use to make an informed decision regarding their own privacy, and it's kept that way intentionally by companies like Facebook, LinkedIn, Apple, Google etc. Long terms and conditions that constantly change, user interfaces built to delay gratification until a box or button is checked (and them giving that checkbox a significance that goes well beyond common sense), planned obsolescence and deprecation that force migration to other services..
throw2016 10y ago
This conflation is made too often. I think the problem with the assumption that if someone made something public willingly they don't care is if people knew they are under surveillance they may not speak their mind, or speak at all. If people who use the internet expect all their activities to be logged and mined for patterns that can potentially be used against them, they may behave very differently. Since we all act in self interest this means no one will speak freely. This is what surveillance does, this is what the chilling effect is. This reduces the value of the internet for the free exchange of ideas and discussion. People who seek this will have to resort to encryption and other tools and forced to behave in a secretive fashion as if they were doing something wrong. Protests and activism are supposed to be normal part of every democracy and its disconcerting the see the strange discomfort our 'democratic societies' show to activism and the sheer amount of effort devoted to managing it from infiltration to surveillance.
- cyphar 10y ago
  > If people who use the internet expect all their activities to be logged and mined for patterns that can potentially be used against them, they may behave very differently. Unfortunately you see this already. Though usually people are worried about adversaries taking screenshots of conversations out of context and then painting them in a negative light, not the government doing that. But ultimately it's the same issue, there's a chilling effect on speech which is caused by the overwhelming fear of mass surveillance.
freshhawk 10y ago
But almost all location data is "public". I could follow you around, staying in public places, maybe have a friend or two help me out. And hire an army of private investigators to do the same for a bunch more people. But that doesn't scale, so much so that the difference in degree becomes a practical difference in kind. That's just an exaggerated version of the difference here. One of the most effective practical tools to combat bulk surveillance is to increase the cost. I'm also of the opinion that people are kinda asking for this by giving that data away and posting it publicly, but that doesn't mean those already collecting this data have no responsibility if they package it up and make it easy to use for surveillance.
CoryG89 10y ago
The data may be public, but they get greater access to the entire data set than the general public. This greater access is what was cut off. Also most people aren't aware that this level of access is even possible, much less that it's being sold to the highest bidder. Which in my opinion, is a problem.
newman314 10y ago
The same reason ALPRs (with long retention rate) are a bad idea. "No reasonable expectation of privacy in public" is the US norm today. I'm suggesting that maybe it should be revisited in light of the pervasive surveillance that has come into being.

niftich 10y ago

This is a very messy, multi-layered issue. First of all, a large part of a social network's utility is derived from sharing data about oneself. This data is public, for the benefit of other participants of the social network. Some of those participants may have agendas that are contrary to one's own: stalkers, adversaries, data aggregators -- it's impossible to know all of them ahead of time, and a granularity of permissions that satisfies these competing goals is... tough. Second, it ought to be a person's reasonable expectation that law enforcement is a benevolent actor. Actions such as this, which amount to targeted crowd surveillance, don't instill much faith in this assumption. This is a very serious issue that merits more discussion than my terse comment. Lastly, this data aggregator should not be the target of the outrage. They're an intermediary in a system where we willingly share data with private companies to get some value-add, who then sell that data to fund their operations, and some of the purchasers of our data happen to be law enforcement. Anger directed at any particular intermediary -- like anger at reposessors or ambulance chasers or debt relief counselors -- is woefully misdirected; we should instead be asking why corporations feel the need to sell our data in the first place, and why we have law enforcement that feels the need to employ mass surveillance. If we ponder these questions, we'll have accomplished something more than drive an inconsequential company out business while leaving the systemic faults in place.

CoryG89 10y ago
Companies feel the need to sell our data because they are offered tons of money for it by other companies such as Geofeedia. I agree that the blame does not rest on Geofeedia alone, but they aren't innocent either. I don't know a good solution to this issue other than making it illegal to buy or sell information about users of public corporations' products.
- nostrademons 10y ago
  The bigger issue is "why is it that companies can make more money selling personal data about consumers than selling products to consumers?" If companies had a viable business model that involved ordinary consumers paying money for services rendered, then their responsibility would be to the people paying them money, i.e. the consumer. This is a really complicated question, and probably results from a combination of: 1.) Consumers not having disposable income at all, because real wages for a large slice of the population have been stagnant or falling for a generation and necessities like housing, education, and health care keep going up. 2.) Consumers having certain expectations of what they can get "for free", and not wanting to pay money for things that competitors will offer for free. 3.) Consumers having a poor understanding of the long-term consequences of putting data out there, and what it can be used for. 4.) Network effects where even if a small minority of consumers are aware of the above and would rather pay for products, they can't because a majority of the market would rather pay with information rather than money. If you just ban the sale of information outright, you will either end up with work-arounds (eg. Google doesn't sell information, but it sells better ad-targeting and behavior manipulation based on that information), or consumers will lose access to services that they depend upon for much of their daily life.

mjevans 10y ago

https://www.aclu.org/blog/free-future/facebook-instagram-and-twitter-provided-data-access-surveillance-product-marketed https://www.aclu.org/blog/free-future/facebook-instagram-and... Instead of ArsTechnica, why not link to the ACLU's website?

bisRepetita 10y ago
Thank you. >Twitter did not provide access to its “Firehose,” but has an agreement, via a subsidiary, to provide Geofeedia with searchable access to its database of public tweets. I really would like Twitter to share what search words were entered. It would give us a first-hand window on what government agencies are trying to monitor, usually secretly.
hackuser 10y ago
> Instead of ArsTechnica, why not link to the ACLU's website? I prefer journalism to the original source's post. The ACLU is an advocate for its cause; a secondary source can provide context, other sources, opposing points of view, etc. For example, compare a post by a political candidate, with its natural extreme bias, to a newspaper article about it, which includes fact-checking, expert analysis, their opponent's reaction, etc. That's the reason Wikipedia requires secondary sources for its citations and forbids primary sources. EDIT: Fleshed it out a bit.
rhizome 10y ago
That's nice that Twitter is able to keep this kind of thing at arm's length by allowing resales of the firehose.

gell_mann 10y ago

I'm pretty sure I have seen other apps do similar things. The data they are feeding them does seem to be mostly public data. I'm not exactly sure how I feel about this, or how outraged / surprised I should be.

CoryG89 10y ago
Just because the data is public doesn't mean it can be easily accessed or aggregated en-masse for real time survellience. If Geofeedia was only using public data, easily available to anyone else, then Twitter and Facebook wouldn't have been able to cut off their access.
- nl 10y ago
  "Public data" doesn't mean easily accessible. Twitter sells access to their data. They can cancel that account, but the data is still public. Without the access contract it is inconvenient and against the terms of service to access in bulk.

deleted 10y ago

[deleted]

deleted 10y ago
[deleted]

type0 10y ago

> ... The companies need to enact strong public policies and robust auditing procedures to ensure their platforms aren't being used for discriminatory surveillance." Hm, is it okay to use it for non discriminatory surveillance? Can there ever be surveillance that is not discriminatory since the surveying entity is usually has no interest of surveying itself and to provide that data to the public.

Steeeve 10y ago

I find it strange that it would be perfectly OK to sell this data to a commercial entity, but it's not OK to sell it to the government.

nostrademons 10y ago
I think that what the buyer does with the data has a lot to do with this. They would be in even more trouble if they had sold the data to a private mercenary firm who takes out contracts on business rivals, for example. Conversely, if they had been selling to, say, the U.S. Census Bureau or FEMA, they would likely be lauded. It does say a lot about how little people trust the police these days, though.

thomasthomas 10y ago

from a story posted yesterday about the CIA crunching data to predict social unrest, it is fairly obvious the feds have access to social media firehoses https://www.engadget.com/2016/10/05/cia-claims-it-can-predict-some-social-unrest-up-to-5-days-ahead/ https://www.engadget.com/2016/10/05/cia-claims-it-can-predic...

Mendenhall 10y ago

I laugh at twitter playing stupid to what their information was being used for. Government loves its surveillance. Try this though, if you live next to a cop, FBI agent or public official place a high res video camera on your property facing their house and leave it live streaming. Post it to a website with photos of all their family and children, their license plate numbers the time they leave for work etc. All things that are publicly available and captured from a simple video camera. Start having multiple people do the same and locate it all on your website. Then watch how fast the hypocrisy rears its head.

webmaven 10y ago

Here's Geofeedia's response: http://blog.geofeedia.com/a-commitment-to-freedom-of-speech-and-civil-liberties http://blog.geofeedia.com/a-commitment-to-freedom-of-speech-...

newscracker 10y ago

Shame on Facebook! Shame on Instagram! Shame on Twitter! I consider this a despicable act on the part of these companies. They stopped this data selling only because they were caught. Using data internally to feed to algorithms to show targeted ads is one thing (though privacy wise it's bad). Selling data outright to other companies is a terrible state of affairs. It's sad that this won't make a big dent in the user base or make people flee these platforms in large numbers.

pluma 10y ago

As a non-native speaker this headline took me way too many attempts to parse correctly. For anyone wondering the same, it's meant to be read as: ACLU exposes Facebook and Twitter for selling user data to a surveillance company The way I read it the first few times I thought they sold user data of a company, for surveillance.

dredmorbius 10y ago
As a native speaker, it's a poorly written headline. One term for this form of misleading / confusing sentence (and especially headline) is a "crash blossom". http://www.quickanddirtytips.com/education/grammar/fun-with-crash-blossoms http://www.quickanddirtytips.com/education/grammar/fun-with-... https://en.m.wikipedia.org/wiki/Syntactic_ambiguity https://en.m.wikipedia.org/wiki/Syntactic_ambiguity
- pluma 10y ago
  I think in this case it's made worse by the wording "selling X Y" as a substitute for "selling Y to X" being relatively rare and in this case both X and Y being compound words (surveillance company and user data). So not only is it a crash blossom in the sense that it's ambiguous whether it's [surveillance] [company user data], [surveillance company] [user data] or [surveillance company user] [data], but it could also be read as [surveillance company user data]. There are at least four possible ways to attempt to parse the sentence and the only one that makes sense relies on unusual phrasing.