5 ms·

I normally like to play devil's advocate, but in this case I simply can't come up with a decent argument to justify Facebook's position that they "own" your dat

I normally like to play devil's advocate, but in this case I simply can't come up with a decent argument to justify Facebook's position that they "own" your data. They can own the expression of your data on a Facebook page, but they can't own the data itself. That's my understanding at least - am I in the wrong here?

epochwolf 16y ago
> That's my understanding at least - am I in the wrong here? You're wrong because Facebook has the money and will to sue you into poverty. :)
- stcredzero 16y ago
  The Golden Rule: He who has the gold makes the rules! :)
mattmanser 16y ago
One would hope not, but law and common sense can diverge. The devil's advocate argument is that you don't own the data, you uploaded it to Facebook to use in a limited capacity (e.g. they're not allowed to just broadcast it to the world without your permission or unless they trick you into exposing it with weird 'privacy' options). To use their service, which happens to use data you gave them willingly, you need to access their server in a manner they are happy with. And they are claiming that using a third party option to access it is forbidden. This is perfectly normal. In essence this is the EFF trying to establish some ground in a new field. It's nowhere near as cut and dry as they present it, you had the choice to never upload that data in the first place. It's not a safety deposit box where you own the contents, it's a online social site that you chose to use and provide some data in order to be able to use it. I've got no legal expertise, but that would be my first attempt as a devil's advocate.
- chrischen 16y ago
  But if you don't access it in a manner they are happy with, and thus violate the agreement to use Facebook, then shouldn't Facebook then terminate the agreement and its obligation to service you (aka, delete your account)? Of course facebook does not want to do that, so it seems like using criminal law to enforce their will is a bit unfair.
- stcredzero 16y ago
  It's not a safety deposit box where you own the contents, it's a online social site that you chose to use and provide some data in order to be able to use it. But the natural way people think about their personal information is that they own it. This needs to be codified into law. Perhaps activism along these lines is one of the most important things we should be doing as citizens of a digital age?
repiret 16y ago
Playing devil's advocate: This isn't about data ownership but about computer ownership. If you're going to access Facebook's servers, then you need to do so in a way that complies with Facebook's rules. Power Ventures ignored robots.txt, and circumvented an IP address block. In concept, this is no different than bypassing the password of a password protected web site. That said, I'm with the EFF on this one.
- jasonlotito 16y ago
  While I understand you are playing devil's advocate, I think one problem they would have is that they'd have to prove that Power Ventures is doing this themselves, which they aren't. One argument could be that power ventures built the application, and users of Facebook are in fact utilizing the software to perform these actions. If Facebook were to approach anyone, it would be the users of the software. I think that argument holds as much water as Facebook's, if not more so.
- ryoshu 16y ago
  I'm not sure why ignoring robots.txt or an IP block would violate criminal statutes. I'm not even sure why circumvention would violate civil statutes. Obeying robots.txt is common courtesy. For IP blocks /and/ people that ignore robots.txt, I have years of logs I'd like to turn over to the proper authorities.
- modeless 16y ago
  Circumventing access controls should not be illegal. The DMCA has shown us why this is a bad idea. If circumventing access controls leads to a real crime, then prosecute that crime instead. For an analogy to the real world, think about lockpicking. Lockpicking should be legal. Picking locks isn't the real crime; it's theft, trespassing, destruction of property, etc. that we should prosecute. In this case users authorized Power Ventures to access their Facebook accounts (in exactly the same way users authorize Facebook to access their GMail/Hotmail/etc. accounts), so no actual crime was committed after circumventing the access controls.
gojomo 16y ago
That's not Facebook's argument. Their argument is that a contract exists with their user. In that contract, the user agreed not to use 'automated' means of access. Then, when the user has Power perform automated access, Facebook claims that a criminal law violation has occurred, because that's unauthorized access under their terms. They want that to be treated just like other California Penal Code unauthorized access -- access like exploiting a bug or stealing someone's password to view or change info never intended for you. EFF says only a contractual violation has occurred; violating some arbitrary company-chosen 'terms of use' shouldn't be enough to trigger criminal enforcement. It's an interesting and difficult distinction. So many of these systems and terms are defined by the arbitrary choices of coders and lawyers. At one level of abstraction, it's against the will of the system provider -- Facebook -- so it could be seen like a break-in. But at another level, it's just a contract, and Facebook has other contract-enforcement options short of criminal prosecution: cancel the account, sue for actual damages, and so forth. If Facebook can define what's a 'crime' via arbitrary clickthrough terms, suddenly users and Power staff could wind up in jail for a terms-of-use violation that had no other economic damages. So the issues are tricky, but important.
- what 16y ago
  I don't understand this bit about automated access. Isn't anything using their "Open Graph" accessing it automatically then?
  - cookiecaper 16y ago
    The idea is that there is "unauthorized access" to Facebook's computers, that is, the user accessed Facebook's systems in some way that Facebook didn't like. Facebook wants absolute jurisdiction over who and what can see information stored on their servers and they want the civil justice system to enforce this will on their behalf after-the-fact. Under Facebook's claims, people could get arrested for something as small as using a browser or operating system that Facebook didn't like. If this idea is accepted, then Facebook can pretty much say anything and if you violate that thing and then access Facebook, Facebook would seek criminal penalties for your violation. For instance, if Facebook says "no person that doesn't own a pair of Nikes can access Facebook, under our new Nike sponsorship deal", and someone who doesn't own Nikes still accesses Facebook, Facebook would consider this "unauthorized access" and get mad. Or, if Facebook decides it doesn't like born in Florida, and they write "No one born in Florida may access Facebook", and you still access Facebook after being born in Florida, Facebook will try to get the police to come and arrest you. Open Graph API is not unauthorized access because Facebook allows people to use it.
hooande 16y ago
I would say that it ceased to be "your" data once you typed it into facebook. Common sense should say that anything you send to a remote server is no longer under your control. I don't understand what the other side of this issue is. If you keep data on your local machine and facebook comes and takes it from you, that's a problem. But if you voluntarily send it to them, then they're going to do whatever they want with it. How else would you expect it to work?
- silentOpen 16y ago
  They control the data access but if they dump it to HTML and send it back to me then I can do whatever I want with that HTML. All we're asking is for symmetry. If I send them data, they can do whatever they want with it inside the law, their ToS and privacy policy. If they send me data (even the data I previously sent them), I can do whatever I want with it inside the law.
- pyre 16y ago
  > I would say that it ceased to be "your" data once you > typed it into facebook. Common sense should say that > anything you send to a remote server is no longer under > your control. I don't understand what the other side > of this issue is. It is your data under the law. Sure you may have handed it to someone else, but to say it is no longer your data just because it was handed to Facebook is like saying that you no longer have a Social Security Number when you provide it on a form to a bank (for example) or that when you are the victim of identity theft that you literally no longer have an identity. Now, one should probably act as if handing their data to one person was like handing it to the world, but there are obviously limits. If I purchase hosting from a company and host my data 'myself,' does my data now belong to the hosting company? > If you keep data on your local machine and facebook comes > and takes it from you, that's a problem. But if you > voluntarily send it to them, then they're going to do > whatever they want with it. How else would you expect it > to work? The basis for your entire argument seems to be: "If you trust people, you shouldn't be surprised if they in turn stab you in the back." While possibly true, society would be non-functional if everyone were like that.

epochwolf 16y ago

> That's my understanding at least - am I in the wrong here? You're wrong because Facebook has the money and will to sue you into poverty. :)

stcredzero 16y ago
The Golden Rule: He who has the gold makes the rules! :)

mattmanser 16y ago

One would hope not, but law and common sense can diverge. The devil's advocate argument is that you don't own the data, you uploaded it to Facebook to use in a limited capacity (e.g. they're not allowed to just broadcast it to the world without your permission or unless they trick you into exposing it with weird 'privacy' options). To use their service, which happens to use data you gave them willingly, you need to access their server in a manner they are happy with. And they are claiming that using a third party option to access it is forbidden. This is perfectly normal. In essence this is the EFF trying to establish some ground in a new field. It's nowhere near as cut and dry as they present it, you had the choice to never upload that data in the first place. It's not a safety deposit box where you own the contents, it's a online social site that you chose to use and provide some data in order to be able to use it. I've got no legal expertise, but that would be my first attempt as a devil's advocate.

chrischen 16y ago
But if you don't access it in a manner they are happy with, and thus violate the agreement to use Facebook, then shouldn't Facebook then terminate the agreement and its obligation to service you (aka, delete your account)? Of course facebook does not want to do that, so it seems like using criminal law to enforce their will is a bit unfair.
stcredzero 16y ago
It's not a safety deposit box where you own the contents, it's a online social site that you chose to use and provide some data in order to be able to use it. But the natural way people think about their personal information is that they own it. This needs to be codified into law. Perhaps activism along these lines is one of the most important things we should be doing as citizens of a digital age?

repiret 16y ago

Playing devil's advocate: This isn't about data ownership but about computer ownership. If you're going to access Facebook's servers, then you need to do so in a way that complies with Facebook's rules. Power Ventures ignored robots.txt, and circumvented an IP address block. In concept, this is no different than bypassing the password of a password protected web site. That said, I'm with the EFF on this one.

jasonlotito 16y ago
While I understand you are playing devil's advocate, I think one problem they would have is that they'd have to prove that Power Ventures is doing this themselves, which they aren't. One argument could be that power ventures built the application, and users of Facebook are in fact utilizing the software to perform these actions. If Facebook were to approach anyone, it would be the users of the software. I think that argument holds as much water as Facebook's, if not more so.
ryoshu 16y ago
I'm not sure why ignoring robots.txt or an IP block would violate criminal statutes. I'm not even sure why circumvention would violate civil statutes. Obeying robots.txt is common courtesy. For IP blocks /and/ people that ignore robots.txt, I have years of logs I'd like to turn over to the proper authorities.
modeless 16y ago
Circumventing access controls should not be illegal. The DMCA has shown us why this is a bad idea. If circumventing access controls leads to a real crime, then prosecute that crime instead. For an analogy to the real world, think about lockpicking. Lockpicking should be legal. Picking locks isn't the real crime; it's theft, trespassing, destruction of property, etc. that we should prosecute. In this case users authorized Power Ventures to access their Facebook accounts (in exactly the same way users authorize Facebook to access their GMail/Hotmail/etc. accounts), so no actual crime was committed after circumventing the access controls.

gojomo 16y ago

That's not Facebook's argument. Their argument is that a contract exists with their user. In that contract, the user agreed not to use 'automated' means of access. Then, when the user has Power perform automated access, Facebook claims that a criminal law violation has occurred, because that's unauthorized access under their terms. They want that to be treated just like other California Penal Code unauthorized access -- access like exploiting a bug or stealing someone's password to view or change info never intended for you. EFF says only a contractual violation has occurred; violating some arbitrary company-chosen 'terms of use' shouldn't be enough to trigger criminal enforcement. It's an interesting and difficult distinction. So many of these systems and terms are defined by the arbitrary choices of coders and lawyers. At one level of abstraction, it's against the will of the system provider -- Facebook -- so it could be seen like a break-in. But at another level, it's just a contract, and Facebook has other contract-enforcement options short of criminal prosecution: cancel the account, sue for actual damages, and so forth. If Facebook can define what's a 'crime' via arbitrary clickthrough terms, suddenly users and Power staff could wind up in jail for a terms-of-use violation that had no other economic damages. So the issues are tricky, but important.

what 16y ago
I don't understand this bit about automated access. Isn't anything using their "Open Graph" accessing it automatically then?
- cookiecaper 16y ago
  The idea is that there is "unauthorized access" to Facebook's computers, that is, the user accessed Facebook's systems in some way that Facebook didn't like. Facebook wants absolute jurisdiction over who and what can see information stored on their servers and they want the civil justice system to enforce this will on their behalf after-the-fact. Under Facebook's claims, people could get arrested for something as small as using a browser or operating system that Facebook didn't like. If this idea is accepted, then Facebook can pretty much say anything and if you violate that thing and then access Facebook, Facebook would seek criminal penalties for your violation. For instance, if Facebook says "no person that doesn't own a pair of Nikes can access Facebook, under our new Nike sponsorship deal", and someone who doesn't own Nikes still accesses Facebook, Facebook would consider this "unauthorized access" and get mad. Or, if Facebook decides it doesn't like born in Florida, and they write "No one born in Florida may access Facebook", and you still access Facebook after being born in Florida, Facebook will try to get the police to come and arrest you. Open Graph API is not unauthorized access because Facebook allows people to use it.

hooande 16y ago

I would say that it ceased to be "your" data once you typed it into facebook. Common sense should say that anything you send to a remote server is no longer under your control. I don't understand what the other side of this issue is. If you keep data on your local machine and facebook comes and takes it from you, that's a problem. But if you voluntarily send it to them, then they're going to do whatever they want with it. How else would you expect it to work?

silentOpen 16y ago
They control the data access but if they dump it to HTML and send it back to me then I can do whatever I want with that HTML. All we're asking is for symmetry. If I send them data, they can do whatever they want with it inside the law, their ToS and privacy policy. If they send me data (even the data I previously sent them), I can do whatever I want with it inside the law.
pyre 16y ago
> I would say that it ceased to be "your" data once you > typed it into facebook. Common sense should say that > anything you send to a remote server is no longer under > your control. I don't understand what the other side > of this issue is. It is your data under the law. Sure you may have handed it to someone else, but to say it is no longer your data just because it was handed to Facebook is like saying that you no longer have a Social Security Number when you provide it on a form to a bank (for example) or that when you are the victim of identity theft that you literally no longer have an identity. Now, one should probably act as if handing their data to one person was like handing it to the world, but there are obviously limits. If I purchase hosting from a company and host my data 'myself,' does my data now belong to the hosting company? > If you keep data on your local machine and facebook comes > and takes it from you, that's a problem. But if you > voluntarily send it to them, then they're going to do > whatever they want with it. How else would you expect it > to work? The basis for your entire argument seems to be: "If you trust people, you shouldn't be surprised if they in turn stab you in the back." While possibly true, society would be non-functional if everyone were like that.