8 ms·

CA also scraped the data of friends of those users, meaning that many millions of people had their info exposed instead of a few hundred thousand.

darawk 9y ago
Right, but that was a privilege that the users authorized them to grant, no? As in, the people who signed up for CA's app had access to those profiles, and they explicitly granted CA's app access to those profiles. And then CA scraped them and saved them. Am I understanding correctly?
- JumpCrisscross 9y ago
  > that was a privilege that the users authorized them to grant Kogan was granted permission to ephemerally use, for academic purposes, the data of a quarter of a million people who authorized the access. Kogan got fifty million peoples' data (i.e. Facebook let him scrape the data of people who had not given authorization, some of whom had explicitly gone into their privacy settings to turn off the sharing of their data with third parties), kept it, and then forwarded a copy to CA.
  - chatmasta 9y ago
    This is hyperbole. He created an app, wrote in the description that it was for academic purposes, and then later amended the description / TOS to allow selling of data. Facebook is faulting him because he did not update them on the purpose of the app. There were no systemic barriers in place that Kogan had to circumvent to get access to the data; the Facebook API worked as expected and gave it to him. Regardless of the original “purpose” of the app (a small textarea input you supply to FB), the API would provide the data. The “purpose” of an app does not affect what data is available to it in any meaningful way. The idea that he should have notified Facebook of the changes is laughable; all he had to do is change a few text inputs to update the TOS. The FB platform does not treat an app differently based on its purpose. This is CYA language from FB trying to obfuscate the fact that any and every app has access to this same data, and FB has no control over what happens to the data once an app extracts it. Indeed, much of their business model depends on this premise. Further, the practice of changing terms / functionality of an app is a laughably commonplace way of circumventing the nearly non-existent FB platform review process. I have personally seen much worse incidents of FB app abuse in the wild. For example I once reverse engineered a top 10 iOS social app and discovered they were injecting custom JS into the WebView provided by FB to get the ID of all your friends, rather than the top 50 you can see. The app’s FB “app” was classified as a game which gave it the requisite permissions for abuse and even allowed the app to secretly invite all your FB friends to it without you ever knowing.
    - JumpCrisscross 9y ago
      > the Facebook API worked as expected and gave it to him "Breach" doesn't have to involve a technical malfunction. An employee handing confidential information to an outsider is a breach. Facebook collected users' information. The information was accessed, stored, and distributed without Facebook's (nor their users') authorization. That's a breach.
      - chatmasta 9y ago
        By that logic does every FB app that stores collected data on non-FB servers represent a breach? The crucial point here is that the users authorized the app to collect the data. Facebook has an extremely extensive authorization system for you to grant apps access to your data. Did Kogan use this system differently than every other FB app? What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” To me, it looks like the system worked exactly as designed and intended. The only system he really circumvented is the honor system, which is about the only limitation on what an app can do with the data FB gives to it.
        JumpCrisscross 9y ago
        > The crucial point here is that the users authorized the app to collect the data A quarter of a million people authorized the app to collect their data. It then gained access to fifty million peoples' data. Those extra data were accessed without proper authorization. All of the data were then used in an unauthorized manner. > What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” "Breach" isn't constrained to technical vulnerabilities. If an FSB agent walks out of Langley with a bunch of sensitive CIA documents, that constitutes a breach.
        chatmasta 9y ago
        I get the point you’re trying to make, but I’m skeptical that a breach can be non-technical if there exists a technical framework whitelisting what apps can and cannot do. By implementing an explicit system for granting app access to user accounts, Facebook is effectively setting the boundaries of apps within that system. How can Facebook then arbitrarily pick an app utilizing the system that Facebook setup to protect user data, and say the app is breaching user data? If it’s a breach, the problem is the system by Facebook. If that’s true, then there must be a “bug” (technical or not) that Kogan exploited in the system. In that case I would expect Facebook to fix the “bug.” Yet the bug is the system itself. There is nothing to fix.
makomk 9y ago
I don't think that's really the problem. I mean, Obama's 2012 campaign scraped the data of Facebook friends of people who'd signed into the campaign website in order to figure out the most effective way to convince those friends to vote for him via microtargeting and other techniques, in particular working out which friends their volunteers could most easily convince to vote for him. We're not just talking about general profile information, but photos and feed activity. Apparently they were so aggressive about this it tripped Facebook's internal alerts. The New York Times spun all this as some clever, sophisticated breakthrough that marketers could take advantage of: http://www.nytimes.com/2013/06/23/magazine/the-obama-campaigns-digital-masterminds-cash-in.html http://www.nytimes.com/2013/06/23/magazine/the-obama-campaig... (While they were more honest about getting those users' permission than Cambridge Analytica, they didn't have any kind of permission from the friends they were hoping to profile and target, much like CA didn't. The viral tweet doing the rounds attacking CA for comparing the two is misleading.) The main problem Facebook seem to have is that the wrong candidate won the 2016 presidential election and the press need someone else to blame. Incidentally, based on the reporting come out of the Trump campaign, it's not clear they were even doing much or anything in this area. Their campaign leaned heavily on exactly the kind of "political gut instinct" that article decries - used as an input to models rather than directly, and augmented with stuff like A/B testing, but still nothing like the data-guzzling microtargeting machine of Obama 2012. There doesn't seem to have been much sign of CA involvement aside from the initial check the campaign wrote them and their attempts to use Trump's victory in their marketing.
- oh-kumudo 9y ago
  What you talk about Trump campaign is clearly far from the reality: https://youtu.be/zb6-xz-geH4 https://youtu.be/zb6-xz-geH4 Starting around 11:00 The CA person clearly shows, from the screenshots, they have personal level targeting to predict whether a person is neurotic or not, what ads should be used to exploit that.
  - scoggs 9y ago
    Here's a timestamp for anybody who needs it: https://youtu.be/zb6-xz-geH4?t=10m33s https://youtu.be/zb6-xz-geH4?t=10m33s (10:33)

darawk 9y ago

Right, but that was a privilege that the users authorized them to grant, no? As in, the people who signed up for CA's app had access to those profiles, and they explicitly granted CA's app access to those profiles. And then CA scraped them and saved them. Am I understanding correctly?

JumpCrisscross 9y ago
> that was a privilege that the users authorized them to grant Kogan was granted permission to ephemerally use, for academic purposes, the data of a quarter of a million people who authorized the access. Kogan got fifty million peoples' data (i.e. Facebook let him scrape the data of people who had not given authorization, some of whom had explicitly gone into their privacy settings to turn off the sharing of their data with third parties), kept it, and then forwarded a copy to CA.
- chatmasta 9y ago
  This is hyperbole. He created an app, wrote in the description that it was for academic purposes, and then later amended the description / TOS to allow selling of data. Facebook is faulting him because he did not update them on the purpose of the app. There were no systemic barriers in place that Kogan had to circumvent to get access to the data; the Facebook API worked as expected and gave it to him. Regardless of the original “purpose” of the app (a small textarea input you supply to FB), the API would provide the data. The “purpose” of an app does not affect what data is available to it in any meaningful way. The idea that he should have notified Facebook of the changes is laughable; all he had to do is change a few text inputs to update the TOS. The FB platform does not treat an app differently based on its purpose. This is CYA language from FB trying to obfuscate the fact that any and every app has access to this same data, and FB has no control over what happens to the data once an app extracts it. Indeed, much of their business model depends on this premise. Further, the practice of changing terms / functionality of an app is a laughably commonplace way of circumventing the nearly non-existent FB platform review process. I have personally seen much worse incidents of FB app abuse in the wild. For example I once reverse engineered a top 10 iOS social app and discovered they were injecting custom JS into the WebView provided by FB to get the ID of all your friends, rather than the top 50 you can see. The app’s FB “app” was classified as a game which gave it the requisite permissions for abuse and even allowed the app to secretly invite all your FB friends to it without you ever knowing.
  - JumpCrisscross 9y ago
    > the Facebook API worked as expected and gave it to him "Breach" doesn't have to involve a technical malfunction. An employee handing confidential information to an outsider is a breach. Facebook collected users' information. The information was accessed, stored, and distributed without Facebook's (nor their users') authorization. That's a breach.
    - chatmasta 9y ago
      By that logic does every FB app that stores collected data on non-FB servers represent a breach? The crucial point here is that the users authorized the app to collect the data. Facebook has an extremely extensive authorization system for you to grant apps access to your data. Did Kogan use this system differently than every other FB app? What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” To me, it looks like the system worked exactly as designed and intended. The only system he really circumvented is the honor system, which is about the only limitation on what an app can do with the data FB gives to it.
      - JumpCrisscross 9y ago
        > The crucial point here is that the users authorized the app to collect the data A quarter of a million people authorized the app to collect their data. It then gained access to fifty million peoples' data. Those extra data were accessed without proper authorization. All of the data were then used in an unauthorized manner. > What technical measures did he need to circumvent in order to get access to the data that you say constitutes a “breach?” "Breach" isn't constrained to technical vulnerabilities. If an FSB agent walks out of Langley with a bunch of sensitive CIA documents, that constitutes a breach.
        chatmasta 9y ago
        I get the point you’re trying to make, but I’m skeptical that a breach can be non-technical if there exists a technical framework whitelisting what apps can and cannot do. By implementing an explicit system for granting app access to user accounts, Facebook is effectively setting the boundaries of apps within that system. How can Facebook then arbitrarily pick an app utilizing the system that Facebook setup to protect user data, and say the app is breaching user data? If it’s a breach, the problem is the system by Facebook. If that’s true, then there must be a “bug” (technical or not) that Kogan exploited in the system. In that case I would expect Facebook to fix the “bug.” Yet the bug is the system itself. There is nothing to fix.

makomk 9y ago

I don't think that's really the problem. I mean, Obama's 2012 campaign scraped the data of Facebook friends of people who'd signed into the campaign website in order to figure out the most effective way to convince those friends to vote for him via microtargeting and other techniques, in particular working out which friends their volunteers could most easily convince to vote for him. We're not just talking about general profile information, but photos and feed activity. Apparently they were so aggressive about this it tripped Facebook's internal alerts. The New York Times spun all this as some clever, sophisticated breakthrough that marketers could take advantage of: http://www.nytimes.com/2013/06/23/magazine/the-obama-campaigns-digital-masterminds-cash-in.html http://www.nytimes.com/2013/06/23/magazine/the-obama-campaig... (While they were more honest about getting those users' permission than Cambridge Analytica, they didn't have any kind of permission from the friends they were hoping to profile and target, much like CA didn't. The viral tweet doing the rounds attacking CA for comparing the two is misleading.) The main problem Facebook seem to have is that the wrong candidate won the 2016 presidential election and the press need someone else to blame. Incidentally, based on the reporting come out of the Trump campaign, it's not clear they were even doing much or anything in this area. Their campaign leaned heavily on exactly the kind of "political gut instinct" that article decries - used as an input to models rather than directly, and augmented with stuff like A/B testing, but still nothing like the data-guzzling microtargeting machine of Obama 2012. There doesn't seem to have been much sign of CA involvement aside from the initial check the campaign wrote them and their attempts to use Trump's victory in their marketing.

oh-kumudo 9y ago
What you talk about Trump campaign is clearly far from the reality: https://youtu.be/zb6-xz-geH4 https://youtu.be/zb6-xz-geH4 Starting around 11:00 The CA person clearly shows, from the screenshots, they have personal level targeting to predict whether a person is neurotic or not, what ads should be used to exploit that.
- scoggs 9y ago
  Here's a timestamp for anybody who needs it: https://youtu.be/zb6-xz-geH4?t=10m33s https://youtu.be/zb6-xz-geH4?t=10m33s (10:33)