6 ms·

Why are people calling this a data breach? As I understand it, CA just scraped the data from users who authorized their app to do so. Am I missing something her

by darawk 9y ago

Why are people calling this a data breach? As I understand it, CA just scraped the data from users who authorized their app to do so. Am I missing something here?

sithadmin 9y ago
Your're missing a key detail (the data was collected by a third party, which then handed the data off to CA against Facebook TOS), but I agree, this doesn't seem to be a 'breach' so much as abuse of personal data by a developer.
- maxerickson 9y ago
  The third party handing the data over to Cambridge Analytica is a privacy breach. Which is what is happening. The initial headline called it a breach and it isn't all that inaccurate to call it a breach, so it stuck.
cycrutchfield 9y ago
CA also scraped the data of friends of those users, meaning that many millions of people had their info exposed instead of a few hundred thousand.
- darawk 9y ago
  Right, but that was a privilege that the users authorized them to grant, no? As in, the people who signed up for CA's app had access to those profiles, and they explicitly granted CA's app access to those profiles. And then CA scraped them and saved them. Am I understanding correctly?
  - JumpCrisscross 9y ago
    > that was a privilege that the users authorized them to grant Kogan was granted permission to ephemerally use, for academic purposes, the data of a quarter of a million people who authorized the access. Kogan got fifty million peoples' data (i.e. Facebook let him scrape the data of people who had not given authorization, some of whom had explicitly gone into their privacy settings to turn off the sharing of their data with third parties), kept it, and then forwarded a copy to CA.
    - chatmasta 9y ago
      This is hyperbole. He created an app, wrote in the description that it was for academic purposes, and then later amended the description / TOS to allow selling of data. Facebook is faulting him because he did not update them on the purpose of the app. There were no systemic barriers in place that Kogan had to circumvent to get access to the data; the Facebook API worked as expected and gave it to him. Regardless of the original “purpose” of the app (a small textarea input you supply to FB), the API would provide the data. The “purpose” of an app does not affect what data is available to it in any meaningful way. The idea that he should have notified Facebook of the changes is laughable; all he had to do is change a few text inputs to update the TOS. The FB platform does not treat an app differently based on its purpose. This is CYA language from FB trying to obfuscate the fact that any and every app has access to this same data, and FB has no control over what happens to the data once an app extracts it. Indeed, much of their business model depends on this premise. Further, the practice of changing terms / functionality of an app is a laughably commonplace way of circumventing the nearly non-existent FB platform review process. I have personally seen much worse incidents of FB app abuse in the wild. For example I once reverse engineered a top 10 iOS social app and discovered they were injecting custom JS into the WebView provided by FB to get the ID of all your friends, rather than the top 50 you can see. The app’s FB “app” was classified as a game which gave it the requisite permissions for abuse and even allowed the app to secretly invite all your FB friends to it without you ever knowing.
      - JumpCrisscross 9y ago
        > the Facebook API worked as expected and gave it to him "Breach" doesn't have to involve a technical malfunction. An employee handing confidential information to an outsider is a breach. Facebook collected users' information. The information was accessed, stored, and distributed without Facebook's (nor their users') authorization. That's a breach.
        chatmasta 9y ago
        By that logic does every FB app that stores collected data on non-FB servers represent a breach? The crucial point here is that the users authorized the app to collect the data. Facebook has an extremely extensive authorization system for you to grant apps access to your data. Did Kogan use this system differently than every other FB app? What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” To me, it looks like the system worked exactly as designed and intended. The only system he really circumvented is the honor system, which is about the only limitation on what an app can do with the data FB gives to it.
- makomk 9y ago
  I don't think that's really the problem. I mean, Obama's 2012 campaign scraped the data of Facebook friends of people who'd signed into the campaign website in order to figure out the most effective way to convince those friends to vote for him via microtargeting and other techniques, in particular working out which friends their volunteers could most easily convince to vote for him. We're not just talking about general profile information, but photos and feed activity. Apparently they were so aggressive about this it tripped Facebook's internal alerts. The New York Times spun all this as some clever, sophisticated breakthrough that marketers could take advantage of: http://www.nytimes.com/2013/06/23/magazine/the-obama-campaigns-digital-masterminds-cash-in.html http://www.nytimes.com/2013/06/23/magazine/the-obama-campaig... (While they were more honest about getting those users' permission than Cambridge Analytica, they didn't have any kind of permission from the friends they were hoping to profile and target, much like CA didn't. The viral tweet doing the rounds attacking CA for comparing the two is misleading.) The main problem Facebook seem to have is that the wrong candidate won the 2016 presidential election and the press need someone else to blame. Incidentally, based on the reporting come out of the Trump campaign, it's not clear they were even doing much or anything in this area. Their campaign leaned heavily on exactly the kind of "political gut instinct" that article decries - used as an input to models rather than directly, and augmented with stuff like A/B testing, but still nothing like the data-guzzling microtargeting machine of Obama 2012. There doesn't seem to have been much sign of CA involvement aside from the initial check the campaign wrote them and their attempts to use Trump's victory in their marketing.
  - oh-kumudo 9y ago
    What you talk about Trump campaign is clearly far from the reality: https://youtu.be/zb6-xz-geH4 https://youtu.be/zb6-xz-geH4 Starting around 11:00 The CA person clearly shows, from the screenshots, they have personal level targeting to predict whether a person is neurotic or not, what ads should be used to exploit that.
    - scoggs 9y ago
      Here's a timestamp for anybody who needs it: https://youtu.be/zb6-xz-geH4?t=10m33s https://youtu.be/zb6-xz-geH4?t=10m33s (10:33)
IAmEveryone 9y ago
Facebook did not authorize data retention. CA’s actions were therefore unauthorized use of data, which is the textbook definition of a data breach.
- darawk 9y ago
  ...you mean facebook said "don't keep this" and then they kept it? And people are calling that a breach?
  - cryptoz 9y ago
    Yes, that's what Facebook said. And yes, people are calling it a breach because of that. Because it is. If you pay a company for a service, and then use the service against the terms of use, putting millions of people into danger, you have created a massive data breach of unauthorized data access that has massive real-world physical consequences. This was a data breach of the highest order.
  - dragonwriter 9y ago
    Well, no, the breach happened when the data was acquired under false (bogus “academic use”) pretenses and then transferred to CA, thus taking personal data contrary to both the will of the subjects and the policy of the entity through which it was taken; the “dont keep this” was a (pitiful) post-breach mitigation effort by Facebook.
- bdcravens 9y ago
  So you're saying that every company that is screen scraped in violation of their TOS has experienced a data breach?
  - IAmEveryone 9y ago
    No. Facebook’s app Developer TOS are different than that of some random website, in that they require explicit consent. It’s a contract, not a one-sided passive statement and is therefore binding in a way a linked TOS is not.
- 9y ago
cryptoz 9y ago
> users who authorized their app to do so. Users did not authorize the app to do any of this. You are incorrect in that assumption. This was a data breach. Facebook also knew about it and did not care. It is a data breach made worse by likely criminal negligence. Edit: I have been (temporarily?) banned from replying or writing comments on HN. Maybe it is because of all the downvotes. Here is my response to the comment reply below (and with this, goodbye, I'm no longer allowed to post on HN I guess). > In what sense did they 'not authorize' this? Users did not authorize the data that was collected by these apps to be retained for more than a day or two, as described by Facebook's terms of service for CA using the data.
- darawk 9y ago
  > Users did not authorize the app to do any of this. You are incorrect in that assumption. Are you saying their accounts were hacked? In what sense did they 'not authorize' this?
oh-kumudo 9y ago
And the friends of the users, including their shares/likes, who are largely unaware of it. That is THE meat of the incident. There is no consent to begin with.
toufka 9y ago
So apparently right now a company that is not contractually bound to Facebook has 50M full profiles from Facebook's API. From Facebook's perspective, what happens when if csv file gets released publicly. Or a government official or law-enforcement officer sees it. It apparently has >50M real-names connected with political affiliation, gender, sexuality, home town, etc. It is an email attachment away from getting released by a whistle-blower... So even if the data was taken with scraped without unauthorized privileges, what happens when that data becomes public. Has there (yet) been a public leak of millions of private facebook-like or gmail-like profiles? Sure emails, sure PII, but ever 50M people's admitted sexuality linked to their real name leaked to The Pirate Bay?
- cinquemb 9y ago
  I remember when I could make unauthenticated api calls to public posts useds made for their phone numbers… I'm wondering if I should start a seed of the ~300-500 million useds info in JSON files (I was only interested in name, sex, profile photo) I was able to get from facebook via the thousands of credentials people check in on public repos that everyone else can still do today (beyond the name, sex and profile photos)… but I've been hording it to start up in Indonesia the project I shut down in the US (seeding profiles used to crowd source fur thing information about people like geoip location graphs of people interested in them, pseudo anonymous messaging if you have their email [acting as an email forwarder], and other personality information, and having it publicly accessible by default and/with an api). I'd be willing to give it away to any who ask though as long as they build something with it. In the past me and my friend monetized with adsense, but now were going to mine monero while people engage with the site and give up information about their friends/enemies/lovers. We half joked about being an "open source" NSA/BND/[insert ones favorite SIGINT acronym] or what it would be like if everyone had access to the data to leverage for their own ends instead of the privileged few do today. Thank you "open graph", oauth and the weakest link, other developers and the apathy of most people. Either way, this genie is not going back into the bottle unless you can convince billions of useds of platforms like facebook to exercise some discretion over things they, for the most part, don't care about nor choose to understand on a technical level.

by darawk 9y ago

Why are people calling this a data breach? As I understand it, CA just scraped the data from users who authorized their app to do so. Am I missing something here?

sithadmin 9y ago

Your're missing a key detail (the data was collected by a third party, which then handed the data off to CA against Facebook TOS), but I agree, this doesn't seem to be a 'breach' so much as abuse of personal data by a developer.

maxerickson 9y ago
The third party handing the data over to Cambridge Analytica is a privacy breach. Which is what is happening. The initial headline called it a breach and it isn't all that inaccurate to call it a breach, so it stuck.

cycrutchfield 9y ago

CA also scraped the data of friends of those users, meaning that many millions of people had their info exposed instead of a few hundred thousand.

darawk 9y ago
Right, but that was a privilege that the users authorized them to grant, no? As in, the people who signed up for CA's app had access to those profiles, and they explicitly granted CA's app access to those profiles. And then CA scraped them and saved them. Am I understanding correctly?
- JumpCrisscross 9y ago
  > that was a privilege that the users authorized them to grant Kogan was granted permission to ephemerally use, for academic purposes, the data of a quarter of a million people who authorized the access. Kogan got fifty million peoples' data (i.e. Facebook let him scrape the data of people who had not given authorization, some of whom had explicitly gone into their privacy settings to turn off the sharing of their data with third parties), kept it, and then forwarded a copy to CA.
  - chatmasta 9y ago
    This is hyperbole. He created an app, wrote in the description that it was for academic purposes, and then later amended the description / TOS to allow selling of data. Facebook is faulting him because he did not update them on the purpose of the app. There were no systemic barriers in place that Kogan had to circumvent to get access to the data; the Facebook API worked as expected and gave it to him. Regardless of the original “purpose” of the app (a small textarea input you supply to FB), the API would provide the data. The “purpose” of an app does not affect what data is available to it in any meaningful way. The idea that he should have notified Facebook of the changes is laughable; all he had to do is change a few text inputs to update the TOS. The FB platform does not treat an app differently based on its purpose. This is CYA language from FB trying to obfuscate the fact that any and every app has access to this same data, and FB has no control over what happens to the data once an app extracts it. Indeed, much of their business model depends on this premise. Further, the practice of changing terms / functionality of an app is a laughably commonplace way of circumventing the nearly non-existent FB platform review process. I have personally seen much worse incidents of FB app abuse in the wild. For example I once reverse engineered a top 10 iOS social app and discovered they were injecting custom JS into the WebView provided by FB to get the ID of all your friends, rather than the top 50 you can see. The app’s FB “app” was classified as a game which gave it the requisite permissions for abuse and even allowed the app to secretly invite all your FB friends to it without you ever knowing.
    - JumpCrisscross 9y ago
      > the Facebook API worked as expected and gave it to him "Breach" doesn't have to involve a technical malfunction. An employee handing confidential information to an outsider is a breach. Facebook collected users' information. The information was accessed, stored, and distributed without Facebook's (nor their users') authorization. That's a breach.
      - chatmasta 9y ago
        By that logic does every FB app that stores collected data on non-FB servers represent a breach? The crucial point here is that the users authorized the app to collect the data. Facebook has an extremely extensive authorization system for you to grant apps access to your data. Did Kogan use this system differently than every other FB app? What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” To me, it looks like the system worked exactly as designed and intended. The only system he really circumvented is the honor system, which is about the only limitation on what an app can do with the data FB gives to it.
makomk 9y ago
I don't think that's really the problem. I mean, Obama's 2012 campaign scraped the data of Facebook friends of people who'd signed into the campaign website in order to figure out the most effective way to convince those friends to vote for him via microtargeting and other techniques, in particular working out which friends their volunteers could most easily convince to vote for him. We're not just talking about general profile information, but photos and feed activity. Apparently they were so aggressive about this it tripped Facebook's internal alerts. The New York Times spun all this as some clever, sophisticated breakthrough that marketers could take advantage of: http://www.nytimes.com/2013/06/23/magazine/the-obama-campaigns-digital-masterminds-cash-in.html http://www.nytimes.com/2013/06/23/magazine/the-obama-campaig... (While they were more honest about getting those users' permission than Cambridge Analytica, they didn't have any kind of permission from the friends they were hoping to profile and target, much like CA didn't. The viral tweet doing the rounds attacking CA for comparing the two is misleading.) The main problem Facebook seem to have is that the wrong candidate won the 2016 presidential election and the press need someone else to blame. Incidentally, based on the reporting come out of the Trump campaign, it's not clear they were even doing much or anything in this area. Their campaign leaned heavily on exactly the kind of "political gut instinct" that article decries - used as an input to models rather than directly, and augmented with stuff like A/B testing, but still nothing like the data-guzzling microtargeting machine of Obama 2012. There doesn't seem to have been much sign of CA involvement aside from the initial check the campaign wrote them and their attempts to use Trump's victory in their marketing.
- oh-kumudo 9y ago
  What you talk about Trump campaign is clearly far from the reality: https://youtu.be/zb6-xz-geH4 https://youtu.be/zb6-xz-geH4 Starting around 11:00 The CA person clearly shows, from the screenshots, they have personal level targeting to predict whether a person is neurotic or not, what ads should be used to exploit that.
  - scoggs 9y ago
    Here's a timestamp for anybody who needs it: https://youtu.be/zb6-xz-geH4?t=10m33s https://youtu.be/zb6-xz-geH4?t=10m33s (10:33)

IAmEveryone 9y ago

Facebook did not authorize data retention. CA’s actions were therefore unauthorized use of data, which is the textbook definition of a data breach.

darawk 9y ago
...you mean facebook said "don't keep this" and then they kept it? And people are calling that a breach?
- cryptoz 9y ago
  Yes, that's what Facebook said. And yes, people are calling it a breach because of that. Because it is. If you pay a company for a service, and then use the service against the terms of use, putting millions of people into danger, you have created a massive data breach of unauthorized data access that has massive real-world physical consequences. This was a data breach of the highest order.
- dragonwriter 9y ago
  Well, no, the breach happened when the data was acquired under false (bogus “academic use”) pretenses and then transferred to CA, thus taking personal data contrary to both the will of the subjects and the policy of the entity through which it was taken; the “dont keep this” was a (pitiful) post-breach mitigation effort by Facebook.
bdcravens 9y ago
So you're saying that every company that is screen scraped in violation of their TOS has experienced a data breach?
- IAmEveryone 9y ago
  No. Facebook’s app Developer TOS are different than that of some random website, in that they require explicit consent. It’s a contract, not a one-sided passive statement and is therefore binding in a way a linked TOS is not.
9y ago

cryptoz 9y ago

> users who authorized their app to do so. Users did not authorize the app to do any of this. You are incorrect in that assumption. This was a data breach. Facebook also knew about it and did not care. It is a data breach made worse by likely criminal negligence. Edit: I have been (temporarily?) banned from replying or writing comments on HN. Maybe it is because of all the downvotes. Here is my response to the comment reply below (and with this, goodbye, I'm no longer allowed to post on HN I guess). > In what sense did they 'not authorize' this? Users did not authorize the data that was collected by these apps to be retained for more than a day or two, as described by Facebook's terms of service for CA using the data.

darawk 9y ago
> Users did not authorize the app to do any of this. You are incorrect in that assumption. Are you saying their accounts were hacked? In what sense did they 'not authorize' this?

oh-kumudo 9y ago

And the friends of the users, including their shares/likes, who are largely unaware of it. That is THE meat of the incident. There is no consent to begin with.

toufka 9y ago

So apparently right now a company that is not contractually bound to Facebook has 50M full profiles from Facebook's API. From Facebook's perspective, what happens when if csv file gets released publicly. Or a government official or law-enforcement officer sees it. It apparently has >50M real-names connected with political affiliation, gender, sexuality, home town, etc. It is an email attachment away from getting released by a whistle-blower... So even if the data was taken with scraped without unauthorized privileges, what happens when that data becomes public. Has there (yet) been a public leak of millions of private facebook-like or gmail-like profiles? Sure emails, sure PII, but ever 50M people's admitted sexuality linked to their real name leaked to The Pirate Bay?

cinquemb 9y ago
I remember when I could make unauthenticated api calls to public posts useds made for their phone numbers… I'm wondering if I should start a seed of the ~300-500 million useds info in JSON files (I was only interested in name, sex, profile photo) I was able to get from facebook via the thousands of credentials people check in on public repos that everyone else can still do today (beyond the name, sex and profile photos)… but I've been hording it to start up in Indonesia the project I shut down in the US (seeding profiles used to crowd source fur thing information about people like geoip location graphs of people interested in them, pseudo anonymous messaging if you have their email [acting as an email forwarder], and other personality information, and having it publicly accessible by default and/with an api). I'd be willing to give it away to any who ask though as long as they build something with it. In the past me and my friend monetized with adsense, but now were going to mine monero while people engage with the site and give up information about their friends/enemies/lovers. We half joked about being an "open source" NSA/BND/[insert ones favorite SIGINT acronym] or what it would be like if everyone had access to the data to leverage for their own ends instead of the privileged few do today. Thank you "open graph", oauth and the weakest link, other developers and the apathy of most people. Either way, this genie is not going back into the bottle unless you can convince billions of useds of platforms like facebook to exercise some discretion over things they, for the most part, don't care about nor choose to understand on a technical level.