7 ms·

Facebook's security team tracks posts, location for 'BOLO' threat list

102 points by Jerry2 8y ago

chuckgreenman 8y ago
There's a paragraph here where they talk about reviewing private messenger conversations between interns after they didn't show up for work one day. That feels pretty invasive. Facebook tried to couch it in "genuine concern" for their safety. I'm not sure that holds water with anyone who's familiar with the workplace culture inside Facebook.
- bertil 8y ago
  On that particular aspect: all Facebook employees (and I believe interns) when they write on Messenger to other employees have an on-screen reminder that their conversations are considered work product and can be monitored or reviewed. At least, that was the case when I was there, I can’t think it has changed. I’m assuming this has to do with a lot of well documented legal reasons (insider trading, sexual harassment, etc.) De facto, hardly any conversation goes through email: salary, pension, that kind of things almost exclusively. Project progress, being cancelled, blockers, all that goes through an internal version of Facebook (now Workplace, when I was there, a subset of the main Facebook). It made sense that all that is deemed work product for the company. I would be more surprised if they had access to conversation with outsiders. On the “genuine concern”, I joined several months after Snowden’s revelations. The security team was (and I’m assuming still is) very aware that State agents might try to access employee credentials. Overall, the company is very considerate for employees, typically no matter the cost (e.g. the freezing eggs things) and quite conscious to respect boundaries--but I would expect that a small chance that a hostile Nation state escalated to kidnapping employees is a stretch but not a big one. I’m a little surprised because the company prides itself on not judging, and actually doesn’t care much about time spent in the office. Interns might be given a shorter lead there. With E2E encryption introduced to Messenger since a lot of that could have changed.
  - chuckgreenman 8y ago
    Interesting, I guess I assumed there would be some sort of internal Slack like application for work related communications. The article (or atleast my reading of it) made it seem like these were straight up standard fb messenger chats.
  - clubm8 8y ago
    >On that particular aspect: all Facebook employees (and I believe interns) when they write on Messenger to other employees have an on-screen reminder that their conversations are considered work product and can be monitored or reviewed. Were they limiting themselves to the internal tools? I got the impression they could have used personal FB accounts.
    - hirsin 8y ago
      Hearsay from folks I know at FB - you use your personal account at work. There's no work account/personal account split.
      - patja 8y ago
        That would be consistent with everything I've seen from them as a developer. One of the most common recurring requests on the Facebook Developers Facebook Group is when someone has all of their privileges for app development on the FB API revoked because Facebook found they were using a second "company account" or "developer account" for managing their app. Facebook sees those as "fake accounts" which are prohibited under their policy/TOS. You get only one account for anything personal or business-related, and doing otherwise risks having everything thrown into the black hole of "everything has been revoked, and no human will tell me why or how to fix it"
        metildaa 8y ago
        This seems insane, how is a large company that has any sort of employee churn supposed to maintain something on Facebook? Your inevitably chasing former employees to get access to stuff your company built for the platform...
- sexmachinebot 8y ago
  And here we go again, do you feel surprised that Slack admin can read all private slack messages sent between the members? When will Facebook bashing stop. It's well within FB right to read their employees evil scheming tricks.
  - chuckgreenman 8y ago
    Learn to read mate, I was clearly referring to facebook messenger chats, a product, while used for work at Facebook is used privately by the vast majority of folks.
rconti 8y ago
First thing it made me think of is when the YouTube offices were shot up by a gunwoman who was apparently upset about their changes in monetization policies. Of all the companies to 'hate', I'd expect FB to be a much larger target than YT.
- clubm8 8y ago
  Did that woman make a specific threat though? Lots of people say Fuck Zuck on the internet, but it sounded like they restricted it to people who got specific or had other reasons (fired employee, contractor who's mad their contract wasn't renewed). The idea of a blacklist makes me uneasy, but for example I will state on the record I think Mark Zuckerberg is a big doo doo head, but I don't think if someone tied this nym to my real name I'd be banned from FB's campus.
- general8bitso 8y ago
  Does FB have an AdSense-like offering?
- throwaway-1283 8y ago
  Outside of IG influencers (?), FB doesn't really offer a platform for individuals to make money like they can on YouTube
  - ben_jones 8y ago
    There's a lot of MLM/self-help type scams that use Facebook to grow their base that I could see as similarly upset if they were banned or otherwise demonetized.
    - hopler 8y ago
      I suspect that the psychology of an activist making money via legit video monetization is different from a black-hat SEO scammer. Really though, you can't point to logical reasons for a mass attack against strangers. Someone mentally unstable enough to do that could be triggered by anything.
clubm8 8y ago
>In 2017, a Facebook manager alerted the company's security teams when a group of interns she was managing did not log into the company's systems to work from home. They had been on a camping trip, according to a former Facebook security employee, and the manager was concerned about their safety. >Facebook's information security team became involved in the situation and used the interns' location data to try and find out if they were safe. "They call it 'pinging them', pinging their Facebook accounts," the former security employee recalled. >After the location data did not turn up anything useful, the information security team then kept digging and learned that the interns had exchanged messages suggesting they never intended to come into work that day — essentially, they had lied to the manager. The information security team gave the manager a summary of what they had found. So basically, if a Facebook manager couches their request as concern for your safety, they can track your location on your personal account to uncover where you are? This makes me uneasy.
- cheeze 8y ago
  It's Facebook. Are you surprised in the least?
- Gaelan 8y ago
  Those were employees, to be fair.
  - nitrogen 8y ago
    Employees are not property.
    - yebyen 8y ago
      But the employer was monitoring the employee's activities on company-owned infrastructure... (I think the messaging is a different story than the location data)
      - metildaa 8y ago
        Personal accounts, especially private chat messages on said accounts should not be dug through at a manager's whim. Sure, an employee should know better than to use a chat platform from their own company when off the clock, but its still scummy of Facebook to trawl PMs.
glitcher 8y ago
> "No person would be on BOLO without credible cause," the Facebook spokesman said in regard to this incident. A bit of backwards logic to justify the list contents, eh?
- forgotmyhnacc 8y ago
  I'm having trouble making sense of your comment. If your company knew about credible threats ( disgruntled employees, bomb threats, etc ) wouldn't you have a BOLO list? How is that backwards logic at all?
  - glitcher 8y ago
    The article gives an example of an individual who may not have deserved to be on the list. By stating "No person would be on BOLO without credible cause", they are using a circular logical fallacy (begging the question?) to dismiss any possibility that there may be mistakes made in managing that list.
    - traek 8y ago
      Circular logic is "No person would be on BOLO without credible cause, and the credible cause is that they're on BOLO". What they're saying is that there is a valid reason for each person on the list to be on it. You can take issue with that as a matter of factual accuracy, but there's no tortured use of language happening.
  - ozzyman700 8y ago
    The validity of a list entry is not related to the existence of the list itself, but the reason a person added them to the list.
- demygale 8y ago
  Their justification for spying on these people is that they believe they need to spy on these people. It’s cool that they’re not just picking people at random, but they are engaging in a level of electronic surveillance that would require a warrant if they were a government agency. Do they share this BOLO list with outside groups? Do they share the surveillance results with law enforcement or other people? It’s disturbing behavior from an utterly disingenuous corporation. Zuck is like an incompetent Lex Luthor. We should expect him to announce a run for the presidency soon.
kartan 8y ago
> The company's information security team is capable of tracking these individuals' whereabouts using the location data they provide through Facebook's apps and websites. > But Facebook is unique because it can use its own products to identify these threats and track the location of people on the list. This is so scary. That the company feels entitled to use that user data in any way they please is horrifying. I would not be surprised if they are also using internal data to get to spy on spouses or ex, to stalk people, etc. Once the ethics of a company like this are zero, the possibilities are infinite. This is why more regulation like the GDPR is needed. And also a closer supervision of the big tech companies.
clojurestan 8y ago
First of all, shit like this year after year is why I don't use fb or insta. That said, if somebody went on one of my websites and commented that they were mad at me and planned to show up at my house and do nefarious things, well, yes I certainly would be on the lookout for that person.

102 points by Jerry2 8y ago

There's a paragraph here where they talk about reviewing private messenger conversations between interns after they didn't show up for work one day. That feels pretty invasive. Facebook tried to couch it in "genuine concern" for their safety. I'm not sure that holds water with anyone who's familiar with the workplace culture inside Facebook.

bertil 8y ago
On that particular aspect: all Facebook employees (and I believe interns) when they write on Messenger to other employees have an on-screen reminder that their conversations are considered work product and can be monitored or reviewed. At least, that was the case when I was there, I can’t think it has changed. I’m assuming this has to do with a lot of well documented legal reasons (insider trading, sexual harassment, etc.) De facto, hardly any conversation goes through email: salary, pension, that kind of things almost exclusively. Project progress, being cancelled, blockers, all that goes through an internal version of Facebook (now Workplace, when I was there, a subset of the main Facebook). It made sense that all that is deemed work product for the company. I would be more surprised if they had access to conversation with outsiders. On the “genuine concern”, I joined several months after Snowden’s revelations. The security team was (and I’m assuming still is) very aware that State agents might try to access employee credentials. Overall, the company is very considerate for employees, typically no matter the cost (e.g. the freezing eggs things) and quite conscious to respect boundaries--but I would expect that a small chance that a hostile Nation state escalated to kidnapping employees is a stretch but not a big one. I’m a little surprised because the company prides itself on not judging, and actually doesn’t care much about time spent in the office. Interns might be given a shorter lead there. With E2E encryption introduced to Messenger since a lot of that could have changed.
- chuckgreenman 8y ago
  Interesting, I guess I assumed there would be some sort of internal Slack like application for work related communications. The article (or atleast my reading of it) made it seem like these were straight up standard fb messenger chats.
- clubm8 8y ago
  >On that particular aspect: all Facebook employees (and I believe interns) when they write on Messenger to other employees have an on-screen reminder that their conversations are considered work product and can be monitored or reviewed. Were they limiting themselves to the internal tools? I got the impression they could have used personal FB accounts.
  - hirsin 8y ago
    Hearsay from folks I know at FB - you use your personal account at work. There's no work account/personal account split.
    - patja 8y ago
      That would be consistent with everything I've seen from them as a developer. One of the most common recurring requests on the Facebook Developers Facebook Group is when someone has all of their privileges for app development on the FB API revoked because Facebook found they were using a second "company account" or "developer account" for managing their app. Facebook sees those as "fake accounts" which are prohibited under their policy/TOS. You get only one account for anything personal or business-related, and doing otherwise risks having everything thrown into the black hole of "everything has been revoked, and no human will tell me why or how to fix it"
      - metildaa 8y ago
        This seems insane, how is a large company that has any sort of employee churn supposed to maintain something on Facebook? Your inevitably chasing former employees to get access to stuff your company built for the platform...
sexmachinebot 8y ago
And here we go again, do you feel surprised that Slack admin can read all private slack messages sent between the members? When will Facebook bashing stop. It's well within FB right to read their employees evil scheming tricks.
- chuckgreenman 8y ago
  Learn to read mate, I was clearly referring to facebook messenger chats, a product, while used for work at Facebook is used privately by the vast majority of folks.

rconti 8y ago

First thing it made me think of is when the YouTube offices were shot up by a gunwoman who was apparently upset about their changes in monetization policies. Of all the companies to 'hate', I'd expect FB to be a much larger target than YT.

clubm8 8y ago
Did that woman make a specific threat though? Lots of people say Fuck Zuck on the internet, but it sounded like they restricted it to people who got specific or had other reasons (fired employee, contractor who's mad their contract wasn't renewed). The idea of a blacklist makes me uneasy, but for example I will state on the record I think Mark Zuckerberg is a big doo doo head, but I don't think if someone tied this nym to my real name I'd be banned from FB's campus.
general8bitso 8y ago
Does FB have an AdSense-like offering?
throwaway-1283 8y ago
Outside of IG influencers (?), FB doesn't really offer a platform for individuals to make money like they can on YouTube
- ben_jones 8y ago
  There's a lot of MLM/self-help type scams that use Facebook to grow their base that I could see as similarly upset if they were banned or otherwise demonetized.
  - hopler 8y ago
    I suspect that the psychology of an activist making money via legit video monetization is different from a black-hat SEO scammer. Really though, you can't point to logical reasons for a mass attack against strangers. Someone mentally unstable enough to do that could be triggered by anything.

clubm8 8y ago

>In 2017, a Facebook manager alerted the company's security teams when a group of interns she was managing did not log into the company's systems to work from home. They had been on a camping trip, according to a former Facebook security employee, and the manager was concerned about their safety. >Facebook's information security team became involved in the situation and used the interns' location data to try and find out if they were safe. "They call it 'pinging them', pinging their Facebook accounts," the former security employee recalled. >After the location data did not turn up anything useful, the information security team then kept digging and learned that the interns had exchanged messages suggesting they never intended to come into work that day — essentially, they had lied to the manager. The information security team gave the manager a summary of what they had found. So basically, if a Facebook manager couches their request as concern for your safety, they can track your location on your personal account to uncover where you are? This makes me uneasy.

cheeze 8y ago
It's Facebook. Are you surprised in the least?
Gaelan 8y ago
Those were employees, to be fair.
- nitrogen 8y ago
  Employees are not property.
  - yebyen 8y ago
    But the employer was monitoring the employee's activities on company-owned infrastructure... (I think the messaging is a different story than the location data)
    - metildaa 8y ago
      Personal accounts, especially private chat messages on said accounts should not be dug through at a manager's whim. Sure, an employee should know better than to use a chat platform from their own company when off the clock, but its still scummy of Facebook to trawl PMs.

glitcher 8y ago

> "No person would be on BOLO without credible cause," the Facebook spokesman said in regard to this incident. A bit of backwards logic to justify the list contents, eh?

forgotmyhnacc 8y ago
I'm having trouble making sense of your comment. If your company knew about credible threats ( disgruntled employees, bomb threats, etc ) wouldn't you have a BOLO list? How is that backwards logic at all?
- glitcher 8y ago
  The article gives an example of an individual who may not have deserved to be on the list. By stating "No person would be on BOLO without credible cause", they are using a circular logical fallacy (begging the question?) to dismiss any possibility that there may be mistakes made in managing that list.
  - traek 8y ago
    Circular logic is "No person would be on BOLO without credible cause, and the credible cause is that they're on BOLO". What they're saying is that there is a valid reason for each person on the list to be on it. You can take issue with that as a matter of factual accuracy, but there's no tortured use of language happening.
- ozzyman700 8y ago
  The validity of a list entry is not related to the existence of the list itself, but the reason a person added them to the list.
demygale 8y ago
Their justification for spying on these people is that they believe they need to spy on these people. It’s cool that they’re not just picking people at random, but they are engaging in a level of electronic surveillance that would require a warrant if they were a government agency. Do they share this BOLO list with outside groups? Do they share the surveillance results with law enforcement or other people? It’s disturbing behavior from an utterly disingenuous corporation. Zuck is like an incompetent Lex Luthor. We should expect him to announce a run for the presidency soon.

kartan 8y ago

> The company's information security team is capable of tracking these individuals' whereabouts using the location data they provide through Facebook's apps and websites. > But Facebook is unique because it can use its own products to identify these threats and track the location of people on the list. This is so scary. That the company feels entitled to use that user data in any way they please is horrifying. I would not be surprised if they are also using internal data to get to spy on spouses or ex, to stalk people, etc. Once the ethics of a company like this are zero, the possibilities are infinite. This is why more regulation like the GDPR is needed. And also a closer supervision of the big tech companies.

clojurestan 8y ago

First of all, shit like this year after year is why I don't use fb or insta. That said, if somebody went on one of my websites and commented that they were mad at me and planned to show up at my house and do nefarious things, well, yes I certainly would be on the lookout for that person.