6 ms·

Surprisingly the tailored audience targeting had very little tests and certainly no end to end tests when I was there. Once the whole targeting / matching pipel

by verst 7y ago

Surprisingly the tailored audience targeting had very little tests and certainly no end to end tests when I was there. Once the whole targeting / matching pipeline was down for 3 days and nobody noticed (I uncovered this) Honestly, I wouldn't be surprised if the pipeline was set up wrong to match against the wrong field. These matching pipelines are just Hadoop jobs (written in Scalding (Scala library for Cascading) and orchestrated / scheduled by Apache Aurora. Internally Twitter generally operated the way you would expect them to as an external user. User data and privacy was taken seriously and no data was given to third parties etc. Source: I worked at Twitter in 2015 as in engineer on ads (on the programmatic ad buying side and partner integrations).

sofaofthedamned 7y ago
If Twitter didn't distinguish between phone_2fa and phone_identifier then they really shouldn't be in business.
- verst 7y ago
  I don't recall how user data was stored or accessed, but I'm certain there will have been separate fields, or at least a flag indicating whether the person opted out from being targeted by their phone number. That being said, it will have been incredibly easy for a single engineer to make this mistake (code review probably should have caught it? But maybe it looked just close enough to the right data source), and it would have been extraordinarily difficult to discover.
  - sofaofthedamned 7y ago
    Not a chance. It's never a single engineer, code gets the PR checked by another engineer and the Jira will be specific with any PII, probably written by committee, all of whom know the importance of the data. Don't conflate this crap with blaming a single nebulous engineer. I've not worked in years at a place that wouldn't understand the importance of PII. Not that it doesn't happen, but let's not mince words here - this was wilfully done.
    - tidepod12 7y ago
      Your comment made me audibly laugh at the notion that most companies would have a committee checking PR and Jira tickets for PII. I've worked at plenty of companies, even ones at the scale of Twitter and larger, that don't approach anything even remotely close to that level of sophistication. I've seen audits uncover precisely what the GP comment is talking about. IME, it's not at all uncommon for someone to send an email saying "hey can I get a dump of usernames and phone numbers" and some naive engineer dumps it into a CSV file and sends it to whoever. Hell, most of the places I consulted at don't even consider phone numbers to be protected PII. I don't mean to defend Twitter in any way, but I could easily see this being an oversight or a mistake.
      - danShumway 7y ago
        I bet if we could get a hard percentage of companies that have strict access rules for engineers around even just sensitive data in general, let alone PII, that would easily be <50%. It's entirely feasible to me that this is was a mistake, I think people who assume this was deliberate are ironically putting more trust in tech companies than they should. Most of the world is being held together by duck-tape, fastened by people who don't understand the systems they're fixing or maintaining. I don't think that tech companies are an exception to that rule.
      - eitally 7y ago
        fwiw, Google at least has policies around how to handle PII in support tickets, as well as how to handle PII in bugs reported against public-facing-ish software (like Chrome). That's not to say there can't be bad actors or lapses due to poor training or inappropriate behavior, but the tools & policies exist.
    - verst 7y ago
      I get your perspective and skepticism, I really do. I have no incentive to defend Twitter. I cannot say whether this was done deliberately or not, but it absolutely could have been a mistake by a single engineer at Twitter. The JIRA will just have been something vague like "add support for phone number matching to tailored audience matching pipeline" likely created by a manager on the ads infra team. Context will have already been assumed. Given that these are simple data pipelines there likely will not have been a design document specifically calling out the fields to match against for this task. At Twitter it was also possible to deploy these Hadoop jobs without checking in code. They would require to be run as the main ads system service accounts, but most ads engineers should have had the ability to deploy such a job. As I mentioned earlier, the fragility of this part of the ads infrastructure I observed in 2015 makes me believe that a mistake is entirely possible here. Example: Hadoop job writes some output file to HDFS, a different job reads files from a particular location on HDFS and processes them. If no files exist there must not have been anything to process right? But it could have also been the case the first Hadoop job failed which nobody noticed subsequently. Anyways, it could have been an engineer by mistake, an engineer trying to get promoted and increasing revenue numbers, or an action at the direction of management. Don't rule out the first option though...
- atian 7y ago
  Yes they should employ stronger vetting processes new engineering hires.
ABeeSea 7y ago
Hopefully the FTC sees this comment and fines Twitter a couple billion for privacy violations.
- verst 7y ago
  That doesn't make any sense. I have not seen any evidence of wrong doing or improper use of data [edit for clarification: I'm talking about my literal observation in 2015]. Happy to speak on the record.
  - TheSpiceIsLife 7y ago
    > have not seen any evidence of wrong doing They admit to using 2FA phone numbers for advertising purposes. How is this not wrong doing? That they believe it was a mistake doesn’t make it right doing.
    - wpietri 7y ago
      Exactly. "Whoops, we did a thing that accidentally made us money," is not the most confidence-inspiring excuse. One, that's a very convenient accident. And two, if procedures around private data are so sloppy that one small accident can do this, that strikes me as the kind of negligence that a regulator should punish vigorously.
    - verst 7y ago
      Yes that is wrong-doing but I have not seen any evidence during my time there that such a move would have been intentional. I'm very inclined to believe it was an unfortunate mistake. A mistake that probably should not have been possible. I'm not sure why or how it was.
      - TheSpiceIsLife 7y ago
        Intention or not it is still wrong. Intention should have an impact on punishment / reparation outcomes, but it shouldn’t necessarily impact guilt.
      - 7y ago
Mindwipe 7y ago
> Internally Twitter generally operated the way you would expect them to as an external user. As a total shitshow?
t0astbread 7y ago
Is Tailored Audiences not a third party?
- verst 7y ago
  The feature is part of the Twitter ads platform, just like Facebook's custom audiences. A third party partner on behalf of an advertiser or the advertiser themselves can upload the list of identifiers (here phone numbers) to match against (the audience). Note that an audience can only be used if it matched at least 500 users.

by verst 7y ago

sofaofthedamned 7y ago

If Twitter didn't distinguish between phone_2fa and phone_identifier then they really shouldn't be in business.

verst 7y ago
I don't recall how user data was stored or accessed, but I'm certain there will have been separate fields, or at least a flag indicating whether the person opted out from being targeted by their phone number. That being said, it will have been incredibly easy for a single engineer to make this mistake (code review probably should have caught it? But maybe it looked just close enough to the right data source), and it would have been extraordinarily difficult to discover.
- sofaofthedamned 7y ago
  Not a chance. It's never a single engineer, code gets the PR checked by another engineer and the Jira will be specific with any PII, probably written by committee, all of whom know the importance of the data. Don't conflate this crap with blaming a single nebulous engineer. I've not worked in years at a place that wouldn't understand the importance of PII. Not that it doesn't happen, but let's not mince words here - this was wilfully done.
  - tidepod12 7y ago
    Your comment made me audibly laugh at the notion that most companies would have a committee checking PR and Jira tickets for PII. I've worked at plenty of companies, even ones at the scale of Twitter and larger, that don't approach anything even remotely close to that level of sophistication. I've seen audits uncover precisely what the GP comment is talking about. IME, it's not at all uncommon for someone to send an email saying "hey can I get a dump of usernames and phone numbers" and some naive engineer dumps it into a CSV file and sends it to whoever. Hell, most of the places I consulted at don't even consider phone numbers to be protected PII. I don't mean to defend Twitter in any way, but I could easily see this being an oversight or a mistake.
    - danShumway 7y ago
      I bet if we could get a hard percentage of companies that have strict access rules for engineers around even just sensitive data in general, let alone PII, that would easily be <50%. It's entirely feasible to me that this is was a mistake, I think people who assume this was deliberate are ironically putting more trust in tech companies than they should. Most of the world is being held together by duck-tape, fastened by people who don't understand the systems they're fixing or maintaining. I don't think that tech companies are an exception to that rule.
    - eitally 7y ago
      fwiw, Google at least has policies around how to handle PII in support tickets, as well as how to handle PII in bugs reported against public-facing-ish software (like Chrome). That's not to say there can't be bad actors or lapses due to poor training or inappropriate behavior, but the tools & policies exist.
  - verst 7y ago
    I get your perspective and skepticism, I really do. I have no incentive to defend Twitter. I cannot say whether this was done deliberately or not, but it absolutely could have been a mistake by a single engineer at Twitter. The JIRA will just have been something vague like "add support for phone number matching to tailored audience matching pipeline" likely created by a manager on the ads infra team. Context will have already been assumed. Given that these are simple data pipelines there likely will not have been a design document specifically calling out the fields to match against for this task. At Twitter it was also possible to deploy these Hadoop jobs without checking in code. They would require to be run as the main ads system service accounts, but most ads engineers should have had the ability to deploy such a job. As I mentioned earlier, the fragility of this part of the ads infrastructure I observed in 2015 makes me believe that a mistake is entirely possible here. Example: Hadoop job writes some output file to HDFS, a different job reads files from a particular location on HDFS and processes them. If no files exist there must not have been anything to process right? But it could have also been the case the first Hadoop job failed which nobody noticed subsequently. Anyways, it could have been an engineer by mistake, an engineer trying to get promoted and increasing revenue numbers, or an action at the direction of management. Don't rule out the first option though...
atian 7y ago
Yes they should employ stronger vetting processes new engineering hires.

ABeeSea 7y ago

Hopefully the FTC sees this comment and fines Twitter a couple billion for privacy violations.

verst 7y ago
That doesn't make any sense. I have not seen any evidence of wrong doing or improper use of data [edit for clarification: I'm talking about my literal observation in 2015]. Happy to speak on the record.
- TheSpiceIsLife 7y ago
  > have not seen any evidence of wrong doing They admit to using 2FA phone numbers for advertising purposes. How is this not wrong doing? That they believe it was a mistake doesn’t make it right doing.
  - wpietri 7y ago
    Exactly. "Whoops, we did a thing that accidentally made us money," is not the most confidence-inspiring excuse. One, that's a very convenient accident. And two, if procedures around private data are so sloppy that one small accident can do this, that strikes me as the kind of negligence that a regulator should punish vigorously.
  - verst 7y ago
    Yes that is wrong-doing but I have not seen any evidence during my time there that such a move would have been intentional. I'm very inclined to believe it was an unfortunate mistake. A mistake that probably should not have been possible. I'm not sure why or how it was.
    - TheSpiceIsLife 7y ago
      Intention or not it is still wrong. Intention should have an impact on punishment / reparation outcomes, but it shouldn’t necessarily impact guilt.
    - 7y ago

Mindwipe 7y ago

> Internally Twitter generally operated the way you would expect them to as an external user. As a total shitshow?

t0astbread 7y ago

Is Tailored Audiences not a third party?

verst 7y ago
The feature is part of the Twitter ads platform, just like Facebook's custom audiences. A third party partner on behalf of an advertiser or the advertiser themselves can upload the list of identifiers (here phone numbers) to match against (the audience). Note that an audience can only be used if it matched at least 500 users.