5 ms·

Comparing Cambridge Analytica, who harvested data though means that were not transparent to users (and for malicious purpose), to NYU has explained what data an

Comparing Cambridge Analytica, who harvested data though means that were not transparent to users (and for malicious purpose), to NYU has explained what data and why, AND has the consent of its users, seems disingenuous at best.

mobileexpert 6y ago
The whole point is that a major problem with CA was the scaled friend’s data collection. The NYU app scraping modality could easily do the same thing which violates the present FB consent/sharing model of you control your data going to or not going to third party apps. FB has to fight as hard as possible against such apps. Remember Clearview AI? If we want FB to fight CA and Clearview they must fight here as well.
- andybak 6y ago
  > If we want FB to fight CA and Clearview they must fight here as well. Or they could partner with NYU, offer technical insight to maintain integrity and privacy (me stifles laughter) and do everything to support researchers who potentially could help build trust in their platform. Going after this group just isn't a good look if you're Facebook. If there are valid concerns then don't start with a Cease and Desist.
  - nickff 6y ago
    They might be willing to partner if NYU is willing to indemnify Facebook against any and all liabilities which may result. How likely is NYU to take on that risk? Why should we expect Facebook to take on the risk for NYU?
    - MAGZine 6y ago
      So is your opinion just that facebook just shouldn't be researched?
      - nickff 6y ago
        I don't really have a view on that, but I think researchers and universities should be held fully liable for the harms they cause, that way, they'll be more careful. Some research just isn't worth the risk, but as an outsider, I'm not in a place to make that judgement. NYU could also insure against data breaches; in that case, we might get some good security audits.
    - xg15 6y ago
      Hang on. The whole chain of reasoning started with FB protecting users' interests through the permission system, which NYU ostensibly circumvented. How is it in the users' interests to indemnify Facebook?
      - nickff 6y ago
        If NYU internalizes the cost of all breaches (by indemnifying FB against harm), they will be very careful with the data, and prevent another Cambridge Analytica problem.
- XMPPwocky 6y ago
  > The NYU app scraping modality could easily do the same thing So could any browser extension with the ol' "read and modify your data on \*" permission. Or any browser. Or any third-party Facebook client. There is a difference between being technically capable of doing a thing and actually doing the thing- especially in cases where the software authors are well-known and relatively easy to hold accountable. To say otherwise is a little bit goofy!
  - ipsum2 6y ago
    > especially in cases where the software authors are well-known and relatively easy to hold accountable Like a certain lecturer and senior researcher at University of Cambridge? https://en.wikipedia.org/wiki/Aleksandr_Kogan https://en.wikipedia.org/wiki/Aleksandr_Kogan
- beagle3 6y ago
  Suppose NYU sent a person to sit behind every NYU participant, and take a photo of their screen each time it changes - that would be exactly the same as NYU is doing (except more expensive); the participant knows that and gave their consent. It is within their rights to show their screen to anyone. They are just doing it more economically then sending a person. This is entirely unlike CA, which effectively, sent a person to go through all participants available information as quickly as possible while they weren’t looking and store a copy of everything.
edouard-harris 6y ago
The point is that CA's data harvesting looked like it was transparent to users at the time they were doing it — which is precisely the appearance you'd expect a malicious app to try to convey. The NYU project is probably on the level, but "they're probably on the level" isn't a very good security model at Facebook's scale. More to the point, the FTC's 2019 Consent Decree [1] makes it fairly clear that FB is responsible for third parties' access to its users' data — and it would be prudent (from FB's point of view) to interpret this responsibility as also covering browser extensions. [1] https://www.ftc.gov/system/files/documents/cases/c4365facebookmodifyingorder.pdf https://www.ftc.gov/system/files/documents/cases/c4365facebo...
- libeclipse 6y ago
  Users have to install a browser extension in order to participate in the study. That's a way higher barrier than the personality quizzes that Cambridge Analytica used. It also happens at a different layer of abstraction. Cambridge Analytica extracted data through the permissions framework that Facebook itself implemented. Facebook's interest in its users' data doesn't need further explanation after you see that most of their profits derive from their control over it. The same control that allowed the profitable mass political targeting that these researchers are trying to study.
  - mFixman 6y ago
    The researchers ask people to opt in tracking a restricted amount of data, and then install an extension that has access to their entire Facebook accounts. There is no way for Facebook or anyone else to prove that the current or a future version of the NYU's extension won't scrape more data than people agreed to.
    - MAGZine 6y ago
      the plugins are just javascript, so verifying that is actually a trivial task. You just open the plugin and read the source. NYU could also provide the code, to make it even easier.
tupputuppu 6y ago
Sure. So what exactly is the binding rule which Facebook should apply here? Rsearchers can get access to anyone's Facebook data if people enable it? What about the ones in chinese universities? Or just respected universities? Which universities is that? How do we decide? You're missing the point. There needs to be a black and white line, and whatever Facebook allows they're always being demonised, nobody gives them the benefit of the doubt.
- xg15 6y ago
  > Rsearchers can get access to anyone's Facebook data if people enable it? Yes. Where is the problem?
  - tupputuppu 6y ago
    This is ironic. Cambridge Analytica was a university with an IRB collecting personal data, then later sold to foe-profits.
PrinceKropotkin 6y ago
There's no way to see what these third parties actually access of your data. I don't think anything substantial has changed since CA to ameliorate this. The problem is Facebook Ads itself: it's impossible to trust period, let alone with what scraps of information they toss us about how we're actually transacting for services paid with ads.

mobileexpert 6y ago

The whole point is that a major problem with CA was the scaled friend’s data collection. The NYU app scraping modality could easily do the same thing which violates the present FB consent/sharing model of you control your data going to or not going to third party apps. FB has to fight as hard as possible against such apps. Remember Clearview AI? If we want FB to fight CA and Clearview they must fight here as well.

andybak 6y ago
> If we want FB to fight CA and Clearview they must fight here as well. Or they could partner with NYU, offer technical insight to maintain integrity and privacy (me stifles laughter) and do everything to support researchers who potentially could help build trust in their platform. Going after this group just isn't a good look if you're Facebook. If there are valid concerns then don't start with a Cease and Desist.
- nickff 6y ago
  They might be willing to partner if NYU is willing to indemnify Facebook against any and all liabilities which may result. How likely is NYU to take on that risk? Why should we expect Facebook to take on the risk for NYU?
  - MAGZine 6y ago
    So is your opinion just that facebook just shouldn't be researched?
    - nickff 6y ago
      I don't really have a view on that, but I think researchers and universities should be held fully liable for the harms they cause, that way, they'll be more careful. Some research just isn't worth the risk, but as an outsider, I'm not in a place to make that judgement. NYU could also insure against data breaches; in that case, we might get some good security audits.
  - xg15 6y ago
    Hang on. The whole chain of reasoning started with FB protecting users' interests through the permission system, which NYU ostensibly circumvented. How is it in the users' interests to indemnify Facebook?
    - nickff 6y ago
      If NYU internalizes the cost of all breaches (by indemnifying FB against harm), they will be very careful with the data, and prevent another Cambridge Analytica problem.
XMPPwocky 6y ago
> The NYU app scraping modality could easily do the same thing So could any browser extension with the ol' "read and modify your data on \*" permission. Or any browser. Or any third-party Facebook client. There is a difference between being technically capable of doing a thing and actually doing the thing- especially in cases where the software authors are well-known and relatively easy to hold accountable. To say otherwise is a little bit goofy!
- ipsum2 6y ago
  > especially in cases where the software authors are well-known and relatively easy to hold accountable Like a certain lecturer and senior researcher at University of Cambridge? https://en.wikipedia.org/wiki/Aleksandr_Kogan https://en.wikipedia.org/wiki/Aleksandr_Kogan
beagle3 6y ago
Suppose NYU sent a person to sit behind every NYU participant, and take a photo of their screen each time it changes - that would be exactly the same as NYU is doing (except more expensive); the participant knows that and gave their consent. It is within their rights to show their screen to anyone. They are just doing it more economically then sending a person. This is entirely unlike CA, which effectively, sent a person to go through all participants available information as quickly as possible while they weren’t looking and store a copy of everything.

edouard-harris 6y ago

The point is that CA's data harvesting looked like it was transparent to users at the time they were doing it — which is precisely the appearance you'd expect a malicious app to try to convey. The NYU project is probably on the level, but "they're probably on the level" isn't a very good security model at Facebook's scale. More to the point, the FTC's 2019 Consent Decree [1] makes it fairly clear that FB is responsible for third parties' access to its users' data — and it would be prudent (from FB's point of view) to interpret this responsibility as also covering browser extensions. [1] https://www.ftc.gov/system/files/documents/cases/c4365facebookmodifyingorder.pdf https://www.ftc.gov/system/files/documents/cases/c4365facebo...

libeclipse 6y ago
Users have to install a browser extension in order to participate in the study. That's a way higher barrier than the personality quizzes that Cambridge Analytica used. It also happens at a different layer of abstraction. Cambridge Analytica extracted data through the permissions framework that Facebook itself implemented. Facebook's interest in its users' data doesn't need further explanation after you see that most of their profits derive from their control over it. The same control that allowed the profitable mass political targeting that these researchers are trying to study.
- mFixman 6y ago
  The researchers ask people to opt in tracking a restricted amount of data, and then install an extension that has access to their entire Facebook accounts. There is no way for Facebook or anyone else to prove that the current or a future version of the NYU's extension won't scrape more data than people agreed to.
  - MAGZine 6y ago
    the plugins are just javascript, so verifying that is actually a trivial task. You just open the plugin and read the source. NYU could also provide the code, to make it even easier.

tupputuppu 6y ago

Sure. So what exactly is the binding rule which Facebook should apply here? Rsearchers can get access to anyone's Facebook data if people enable it? What about the ones in chinese universities? Or just respected universities? Which universities is that? How do we decide? You're missing the point. There needs to be a black and white line, and whatever Facebook allows they're always being demonised, nobody gives them the benefit of the doubt.

xg15 6y ago
> Rsearchers can get access to anyone's Facebook data if people enable it? Yes. Where is the problem?
- tupputuppu 6y ago
  This is ironic. Cambridge Analytica was a university with an IRB collecting personal data, then later sold to foe-profits.

PrinceKropotkin 6y ago

There's no way to see what these third parties actually access of your data. I don't think anything substantial has changed since CA to ameliorate this. The problem is Facebook Ads itself: it's impossible to trust period, let alone with what scraps of information they toss us about how we're actually transacting for services paid with ads.