5 ms·

The Facebook API has been useless since 2014 when most access to friend data was cutoff. Since then, if your objective was data collection, that could be easil

The Facebook API has been useless since 2014 when most access to friend data was cutoff. Since then, if your objective was data collection, that could be easily achieved by scraping publicly available information (many friends lists are public, there are many public posts, etc. - certainly enough to use in aggregate to formulate campaign strategies etc.). I suspect that will be the next “scandal,” since in 2018, people can’t possibly take personal responsibility for the things they post and allow to be public. Ironically, the “scandal” that caused this whole thing is a non-issue. Pre-2014 Facebook apps could collect a lot of information about you and your friends, along with their Facebook user IDs, and that was scary because there was a time when you could simply submit a list of user ID’s that you wanted to show a specific ad to. But since Facebook advertising cannot be targeted by user ID anymore, and this policy was in place well before the 2016 election, all of that data was essentially useless to any participant in the 2016 election other than for aggregate things like general campaign strategies. I am intimately familiar with the advertise by ID issue - I was awarded a $2k Facebook bug bounty for spotting an exploit in the Custom Audiences feature that allowed an equivalent version of targeting by ID after they disallowed it. So while it’s possible that Obama used his special access to the entire US social graph to successfully influence his elections, it is impossible for Trump or Hillary to have done it even if they had the data because of the changes in the FB ad platform in between 2012 and 2016. This entire “scandal” was created and promoted by people that don’t understand, or actively ignored, this concept. If you ask everyone that has read the recent headlines, including reporters that wrote the stories, I’ll bet 99%+ will tell you that they believe they could be specifically targeted with ads. It would be interesting to see if the executives at any of the media companies that have managed to sell this scandal to the public took unusually large short positions in Facebook stock before releasing the story. Since the story is effectively fraudulent (it was not possible for the election to have been influenced in the way that the stories imply), I assume that would be securities fraud.

orf 9y ago
It's not possible to target by specific user id, sure, but that's not the story and in no way makes the whole thing fraudulent. It's also not what CA was doing or how they operated.
- downandout 9y ago
  The story isn’t that they used data obtained through the Facebook API to microtarget ads on Facebook? That’s the story I’ve read at every major media outlet.
  - orf 9y ago
    > The story isn’t that they used data obtained through the Facebook API to microtarget ads on Facebook? Yes, that is exactly it. You seem to assume that the only way you can achieve this is by advertising to individual people by Facebook ID's and use this as the basis of your argument that the whole story is fraudulent and instead there is some media conspiracy to commit securities fraud. Can you see where your logic might be faulty? There is a lot of information at your fingertips about how they actually used the data, you can go to your favorite search engine right now, type in "how did cambridge analytica use the facebook data" and read the answer. I'd do this first before calling the whole thing bogus and accusing Channel 4 of committing securities fraud.
    - downandout 9y ago
      I’ve looked, and I manage a relatively large Facebook ad budget so I know exactly what is and is not possible to do through it. I’ve also been both advertising and writing software that interacts with both the ad API and the graph API since the beginning of both. What is being claimed in the media simply isn’t possible to do today. I’ve seen the term “audience of one” thrown around so much it makes me sick. So yes, the story is fraudulent. The (years old) data that Kogan scraped and sold to CA years after the fact could possibly be used in aggregate to formulate campaign strategy (although because of its age even that use wouldn’t have been very effective). It couldn’t be used to target specific individuals or anything resembling that. If you’re saying they were able to target zip codes heavily populated by people in a given political party sure, they could. But that’s not remotely close to what is being described in the articles. Also, since you and your friends at the Guardian are implying that they used this data in other ways, see here: https://www.theverge.com/2018/3/20/17138854/cambridge-analytica-facebook-data-trump-campaign-psychographic-microtargeting https://www.theverge.com/2018/3/20/17138854/cambridge-analyt... Even that part of your/their narrative is inaccurate.
alasdair_ 9y ago
>Facebook advertising cannot be targeted by user ID anymore This doesn't matter much if you can do essentially the same thing by targeting with extremely specific location and demographic data.
- downandout 9y ago
  You can’t “essentially do the same thing” in the way you mention though. You are bringing up a second issue, that is also not allowed. You cannot, for example, use specific GPS coordinates to target a house or even a group of houses. Anything less specific than that and the effect gets watered down significantly, and the platform simply doesn’t allow anything close to that kind of “extremely specific” location targeting. Same with demographic data (which can easily be obtained through other places, where the data is much more accurate than you would get from Facebook - see Acxiom).
  - IAmEveryone 9y ago
    The idea is this: given the complete graph and add some external data, you can identify those users you should advertise to, i. e. jane@test.com. BUT: what is still possible, and what Cambridge Analytica was actually building, is slightly different: with a statistical sample of maybe a few ten thousand complete profiles, you can build a statistical model that targets your advertisement not to a user, but a set of criteria: "Males between the ages of 35 and 40 living in a mid-sized town in Texas who liked curling and Star Wars Episode I, but has never traveled to Australia". This is still perfectly possible. It's likely the latter model performs at least 90% as well as the former, with an upward trajectory as methods are improved. Note that CA probably didn't get this working terribly well. But someone else definitely will. Intuitively, I am far more uncomfortable with the first. But practically, I can't really think of a reason why.
    - downandout 9y ago
      Agreed that it’s scary if someone actually manages to get it working. CA did not, nor did Obama who was given access to far more data. But the issue is the false narrative being sold by these news stories. If you ask an average person right now what happened based upon these news stories, they’ll tell you that Trump hired someone to hack their Facebook data and then used it to target Facebook ads to them, and that this was so effective that he was able to steal the election from Hillary. That’s what I take issue with - it’s a provably false narrative.
misiti3780 9y ago
That is what I thought also but how did CA get this friend data?
- downandout 9y ago
  They got it by using the same technique that Obama did in 2008 and 2012. They got one of your friends to authorize their app, and then they were allowed to access most of the data about your friends that you could access. The only difference between CA and Obama is that Obama’s app was given special permission to blow through data collection limits enforced on all other apps, such that even though less than 1 million people authorized Obama to have their data, they had information on ~200 million people - the entire US social graph. The researcher that created the app at issue in the CA scandal, who eventually sold that data to CA years after the fact, only had access to about ~50 million profiles. Both of these things were wrong, but it should have been a huge deal back in 2008 and again in 2012, when 4x the number of profiles were accessed and used, about 99.5% of which never authorized Obama to have or use their information.
  - IAmEveryone 9y ago
    There are, obviously similarities. Yet there are, I believe, also two major differences: (a) This was 8 and 4 years earlier. A lot changed in that timeframe. While, yes, there were always concerns about privacy, the string of data leaks, and the increasingly obvious power of statistical methods for targeting, have had a strong effect on the general public's attitude towards the practice. (b) The Obama campaign did not break their contract with Facebook. Facebook did apparently turn of their API limits, either because of sympathy or because that's just what they did for big clients back then (FarmVille got the same privilege). But in the end, it appears that nobody broke any rules back then. Now this probably won't convince everybody. So let me say this: even if the reaction now is hypocritical, it seems everyone agrees that the current outrage is justified. If so, it would be foolish not take action now just because "your team" got caught while the other got away. After all, the chances of each party being advantaged by such practices going forward seem to be exactly equal. (Not to mention the vastly larger universe of threats not involving the two US parties)
dannyw 9y ago
Is it really the layman that is wrong? You can put something backyard of your house, and reasonably expect that it’s not going to end up used in a database to profile you. Why DO we have to accept that “public” means big data? Why can’t we legislate access so that aggregate collection of public personal data requires _consent_?
- downandout 9y ago
  Why can’t we legislate access so that aggregate collection of public personal data requires _consent_? If you can get enough people to agree with you, then great - go for it. But that’s not the point of my comment. It’s that even if they did collect the data, it couldn’t have been used to microtarget you through Facebook ads, even though that is exactly what all of these articles have said happened here.
anonrrudnd 9y ago
You can create custom audiences by Facebook id (or email, phone number, etc) https://www.facebook.com/business/help/606443329504150?helpref=faq_content https://www.facebook.com/business/help/606443329504150?helpr...
- downandout 9y ago
  This only applies to people that have installed your Facebook app (not to their friends). In the CA case, that means they would have been able to specifically target a few hundred thousand people, but they didn’t do that because the app had long been deleted before the 2016 election. Facebook actually cares about this issue. The bug bounty I was awarded arose from the fact that you could build a custom audience email list using user_nickname@facebook.com without knowing their actual email address. So you could simply write a bot that visited Facebook.com/profile.php?id=4 and see that it redirected to Facebook.com/zuck, and now knowing that “zuck” is the user nickname corresponding to user ID 4, you could then put him in your custom audience list using zuck@facebook.com. That worked for all 2 billion people on the platform, because at one point Facebook gave everyone an @facebook.com email address that mapped to their account. However, that issue has been fixed and was fixed before the election.
blub 9y ago
It would also be interesting to see why you're so motivated to find excuses for Facebook and to whitewash the damning facts. Facebook employee? Family financial interests in the ad industry? Concerned citizen? Bored? Let me explain some simple things: * this scandal (without scare quotes) is an issue because many people have finally realised that Facebook has a ton of information about them and they can't be trusted to handle that information properly. * it's not just about ad targeting, it's about all the possible ways information can be misused too: stalking, blackmail, fraud, trolling, circumventing various constitutional protections, identity theft etc, etc. * your assertion that it's impossible to to influence specific outcomes because of the impossibility to accurately target is... wrong. There were many account included in the CA data set, there were and are other data sets and even if they can't target those people with ads, they can probably send them an e-mail, give them a call or send someone to their house. * people do have responsibility for what they post, but when their information is stored forever and combined with massive quantities of other collected and bought information the entity doing the above has a lot of power and a lot of responsibility too.
- downandout 9y ago
  >It would also be interesting to see why you're so motivated to find excuses for Facebook and to whitewash the damning facts. Facebook employee? Family financial interests in the ad industry? Concerned citizen? Bored? None of the above. It’s because the hypocrisy of this whole thing is wrong and represents everything that’s wrong with the press today. There was a Facebook data abuse scandal where elections were involved, it just didn’t occur in 2016. It was committed by the Obama campaign in both 2008 and 2012. But the articles portraying that were downright celebratory. Now the “wrong” guy wins and all of a sudden it’s a big problem? There’s a word for that. It’s hypocrisy. >this scandal (without scare quotes) is an issue because many people have finally realised that Facebook has a ton of information about them and they can't be trusted to handle that information properly. I agree with you that Facebook gave away too much data pre-2014, but this isn’t the incident that proved they couldn’t be trusted with people’s data. It was the Obama campaign incidents, which involved 4x as many records, that proved it. Most of the holes have been closed today. >it's not just about ad targeting, it's about all the possible ways information can be misused too: stalking, blackmail, fraud, trolling, circumventing various constitutional protections, identity theft etc, etc. Are you saying that you believe that Donald Trump is using this data to stalk you? Because this “scandal” cannot be executed again. These capabilities were removed in 2014. >your assertion that it's impossible to to influence specific outcomes because of the impossibility to accurately target is... wrong. There were many account included in the CA data set, there were and are other data sets and even if they can't target those people with ads, they can probably send them an e-mail, give them a call or send someone to their house. While it’s true that there are other bands of communication available, the articles surrounding this subject have mostly focused on Facebook advertising, where this is no longer possible and hasn’t been for several years. Read my comment. >people do have responsibility for what they post, but when their information is stored forever and combined with massive quantities of other collected and bought information the entity doing the above has a lot of power and a lot of responsibility too. This is a ridiculous statement. If you voluntarily post things publicly, you should expect that they will be stored and crawled. That’s like saying ”I walked down the street naked, and now I can’t believe that my neighbors won’t delete their pictures of it!” If you don’t want it out, don’t put it out in public.

orf 9y ago

It's not possible to target by specific user id, sure, but that's not the story and in no way makes the whole thing fraudulent. It's also not what CA was doing or how they operated.

downandout 9y ago
The story isn’t that they used data obtained through the Facebook API to microtarget ads on Facebook? That’s the story I’ve read at every major media outlet.
- orf 9y ago
  > The story isn’t that they used data obtained through the Facebook API to microtarget ads on Facebook? Yes, that is exactly it. You seem to assume that the only way you can achieve this is by advertising to individual people by Facebook ID's and use this as the basis of your argument that the whole story is fraudulent and instead there is some media conspiracy to commit securities fraud. Can you see where your logic might be faulty? There is a lot of information at your fingertips about how they actually used the data, you can go to your favorite search engine right now, type in "how did cambridge analytica use the facebook data" and read the answer. I'd do this first before calling the whole thing bogus and accusing Channel 4 of committing securities fraud.
  - downandout 9y ago
    I’ve looked, and I manage a relatively large Facebook ad budget so I know exactly what is and is not possible to do through it. I’ve also been both advertising and writing software that interacts with both the ad API and the graph API since the beginning of both. What is being claimed in the media simply isn’t possible to do today. I’ve seen the term “audience of one” thrown around so much it makes me sick. So yes, the story is fraudulent. The (years old) data that Kogan scraped and sold to CA years after the fact could possibly be used in aggregate to formulate campaign strategy (although because of its age even that use wouldn’t have been very effective). It couldn’t be used to target specific individuals or anything resembling that. If you’re saying they were able to target zip codes heavily populated by people in a given political party sure, they could. But that’s not remotely close to what is being described in the articles. Also, since you and your friends at the Guardian are implying that they used this data in other ways, see here: https://www.theverge.com/2018/3/20/17138854/cambridge-analytica-facebook-data-trump-campaign-psychographic-microtargeting https://www.theverge.com/2018/3/20/17138854/cambridge-analyt... Even that part of your/their narrative is inaccurate.

alasdair_ 9y ago

>Facebook advertising cannot be targeted by user ID anymore This doesn't matter much if you can do essentially the same thing by targeting with extremely specific location and demographic data.

downandout 9y ago
You can’t “essentially do the same thing” in the way you mention though. You are bringing up a second issue, that is also not allowed. You cannot, for example, use specific GPS coordinates to target a house or even a group of houses. Anything less specific than that and the effect gets watered down significantly, and the platform simply doesn’t allow anything close to that kind of “extremely specific” location targeting. Same with demographic data (which can easily be obtained through other places, where the data is much more accurate than you would get from Facebook - see Acxiom).
- IAmEveryone 9y ago
  The idea is this: given the complete graph and add some external data, you can identify those users you should advertise to, i. e. jane@test.com. BUT: what is still possible, and what Cambridge Analytica was actually building, is slightly different: with a statistical sample of maybe a few ten thousand complete profiles, you can build a statistical model that targets your advertisement not to a user, but a set of criteria: "Males between the ages of 35 and 40 living in a mid-sized town in Texas who liked curling and Star Wars Episode I, but has never traveled to Australia". This is still perfectly possible. It's likely the latter model performs at least 90% as well as the former, with an upward trajectory as methods are improved. Note that CA probably didn't get this working terribly well. But someone else definitely will. Intuitively, I am far more uncomfortable with the first. But practically, I can't really think of a reason why.
  - downandout 9y ago
    Agreed that it’s scary if someone actually manages to get it working. CA did not, nor did Obama who was given access to far more data. But the issue is the false narrative being sold by these news stories. If you ask an average person right now what happened based upon these news stories, they’ll tell you that Trump hired someone to hack their Facebook data and then used it to target Facebook ads to them, and that this was so effective that he was able to steal the election from Hillary. That’s what I take issue with - it’s a provably false narrative.

misiti3780 9y ago

That is what I thought also but how did CA get this friend data?

downandout 9y ago
They got it by using the same technique that Obama did in 2008 and 2012. They got one of your friends to authorize their app, and then they were allowed to access most of the data about your friends that you could access. The only difference between CA and Obama is that Obama’s app was given special permission to blow through data collection limits enforced on all other apps, such that even though less than 1 million people authorized Obama to have their data, they had information on ~200 million people - the entire US social graph. The researcher that created the app at issue in the CA scandal, who eventually sold that data to CA years after the fact, only had access to about ~50 million profiles. Both of these things were wrong, but it should have been a huge deal back in 2008 and again in 2012, when 4x the number of profiles were accessed and used, about 99.5% of which never authorized Obama to have or use their information.
- IAmEveryone 9y ago
  There are, obviously similarities. Yet there are, I believe, also two major differences: (a) This was 8 and 4 years earlier. A lot changed in that timeframe. While, yes, there were always concerns about privacy, the string of data leaks, and the increasingly obvious power of statistical methods for targeting, have had a strong effect on the general public's attitude towards the practice. (b) The Obama campaign did not break their contract with Facebook. Facebook did apparently turn of their API limits, either because of sympathy or because that's just what they did for big clients back then (FarmVille got the same privilege). But in the end, it appears that nobody broke any rules back then. Now this probably won't convince everybody. So let me say this: even if the reaction now is hypocritical, it seems everyone agrees that the current outrage is justified. If so, it would be foolish not take action now just because "your team" got caught while the other got away. After all, the chances of each party being advantaged by such practices going forward seem to be exactly equal. (Not to mention the vastly larger universe of threats not involving the two US parties)

dannyw 9y ago

Is it really the layman that is wrong? You can put something backyard of your house, and reasonably expect that it’s not going to end up used in a database to profile you. Why DO we have to accept that “public” means big data? Why can’t we legislate access so that aggregate collection of public personal data requires _consent_?

downandout 9y ago
Why can’t we legislate access so that aggregate collection of public personal data requires _consent_? If you can get enough people to agree with you, then great - go for it. But that’s not the point of my comment. It’s that even if they did collect the data, it couldn’t have been used to microtarget you through Facebook ads, even though that is exactly what all of these articles have said happened here.

anonrrudnd 9y ago

You can create custom audiences by Facebook id (or email, phone number, etc) https://www.facebook.com/business/help/606443329504150?helpref=faq_content https://www.facebook.com/business/help/606443329504150?helpr...

downandout 9y ago
This only applies to people that have installed your Facebook app (not to their friends). In the CA case, that means they would have been able to specifically target a few hundred thousand people, but they didn’t do that because the app had long been deleted before the 2016 election. Facebook actually cares about this issue. The bug bounty I was awarded arose from the fact that you could build a custom audience email list using user_nickname@facebook.com without knowing their actual email address. So you could simply write a bot that visited Facebook.com/profile.php?id=4 and see that it redirected to Facebook.com/zuck, and now knowing that “zuck” is the user nickname corresponding to user ID 4, you could then put him in your custom audience list using zuck@facebook.com. That worked for all 2 billion people on the platform, because at one point Facebook gave everyone an @facebook.com email address that mapped to their account. However, that issue has been fixed and was fixed before the election.

blub 9y ago

It would also be interesting to see why you're so motivated to find excuses for Facebook and to whitewash the damning facts. Facebook employee? Family financial interests in the ad industry? Concerned citizen? Bored? Let me explain some simple things: * this scandal (without scare quotes) is an issue because many people have finally realised that Facebook has a ton of information about them and they can't be trusted to handle that information properly. * it's not just about ad targeting, it's about all the possible ways information can be misused too: stalking, blackmail, fraud, trolling, circumventing various constitutional protections, identity theft etc, etc. * your assertion that it's impossible to to influence specific outcomes because of the impossibility to accurately target is... wrong. There were many account included in the CA data set, there were and are other data sets and even if they can't target those people with ads, they can probably send them an e-mail, give them a call or send someone to their house. * people do have responsibility for what they post, but when their information is stored forever and combined with massive quantities of other collected and bought information the entity doing the above has a lot of power and a lot of responsibility too.

downandout 9y ago
>It would also be interesting to see why you're so motivated to find excuses for Facebook and to whitewash the damning facts. Facebook employee? Family financial interests in the ad industry? Concerned citizen? Bored? None of the above. It’s because the hypocrisy of this whole thing is wrong and represents everything that’s wrong with the press today. There was a Facebook data abuse scandal where elections were involved, it just didn’t occur in 2016. It was committed by the Obama campaign in both 2008 and 2012. But the articles portraying that were downright celebratory. Now the “wrong” guy wins and all of a sudden it’s a big problem? There’s a word for that. It’s hypocrisy. >this scandal (without scare quotes) is an issue because many people have finally realised that Facebook has a ton of information about them and they can't be trusted to handle that information properly. I agree with you that Facebook gave away too much data pre-2014, but this isn’t the incident that proved they couldn’t be trusted with people’s data. It was the Obama campaign incidents, which involved 4x as many records, that proved it. Most of the holes have been closed today. >it's not just about ad targeting, it's about all the possible ways information can be misused too: stalking, blackmail, fraud, trolling, circumventing various constitutional protections, identity theft etc, etc. Are you saying that you believe that Donald Trump is using this data to stalk you? Because this “scandal” cannot be executed again. These capabilities were removed in 2014. >your assertion that it's impossible to to influence specific outcomes because of the impossibility to accurately target is... wrong. There were many account included in the CA data set, there were and are other data sets and even if they can't target those people with ads, they can probably send them an e-mail, give them a call or send someone to their house. While it’s true that there are other bands of communication available, the articles surrounding this subject have mostly focused on Facebook advertising, where this is no longer possible and hasn’t been for several years. Read my comment. >people do have responsibility for what they post, but when their information is stored forever and combined with massive quantities of other collected and bought information the entity doing the above has a lot of power and a lot of responsibility too. This is a ridiculous statement. If you voluntarily post things publicly, you should expect that they will be stored and crawled. That’s like saying ”I walked down the street naked, and now I can’t believe that my neighbors won’t delete their pictures of it!” If you don’t want it out, don’t put it out in public.