17 ms·

Swedish Radio created fake pharmacy, reveals how Facebook stored sensitive data

400 points by herman82 4y ago

noptd 4y ago
>After four days, 25 000 fake visits from customers had been registered with Facebook. But they had neither shut down nor warned the owners of the made-up pharmacy - Swedish Radio News' reporters. When the reporters log into their account, they see that Facebook has stored the type of sensitive information that they say their filter is built to delete again and again. >The question that the reporters then asked themselves was whether or not Facebook even has a filter that works in the Swedish language. One of the pharmacies that Swedish Radio reported on say that they cannot find any warnings from Facebook on data transfers that have taken place. The other has not wanted to answer the question. According to state investigators in the USA last year, Facebook only filtered in English. Wow, seems like this will have major implications under GDPR as well.
- TazeTSchnitzel 4y ago
  The things Facebook wants to block sound like content that is specially protected under the GDPR: > Article 9 > Processing of special categories of personal data > 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. > 2. Paragraph 1 shall not apply if one of the following applies: […] (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...)
andrelaszlo 4y ago
Also by SR, in the last couple of weeks: - The Swedish healthcare company Kry has built a service for digital patient calls that has leaked doctors 'and patients' contact information to Facebook. https://sverigesradio.se/artikel/health-service-marketed-as-secure-leaked-patient-information-to-facebook https://sverigesradio.se/artikel/health-service-marketed-as-... - The state-owned pharmacy chain Apoteket has sent detailed information about its online customers and their purchases to Facebook, Swedish Radio News can reveal. https://sverigesradio.se/artikel/pharmacy-passed-information-about-online-customers-to-facebook https://sverigesradio.se/artikel/pharmacy-passed-information... Why the f** is everyone sending our data to FB by default? It's not enough to uninstall FB; you can't even go buy prescription medicine without them knowing, apparently.
- WesolyKubeczek 4y ago
  On your smartphone, every other app will have Facebook SDK, whether for login or tracking or anything else at all.
  - Zenst 4y ago
    Indeed, certainly makes application proxy filtering more of a must than a luxury for the wider consumer market in todays times. Though not sure (beyond rolling your own) what offerings are out there for consumers as focus seems to be VPN proxies.
    - Nextgrid 4y ago
      On iOS, "Lockdown Privacy" is a potential option.
  - Nextgrid 4y ago
    Yep, so much for the GDPR. Despite this, I'm sure someone is going to throw the "enforcementtracker.com" link to "prove" that enforcement is sufficient.
  - scns 4y ago
    On Android you can block trackers per app with TrackerControl. https://trackercontrol.org/ https://trackercontrol.org/
    - pmontra 4y ago
      I've been using Blockada for many years. I think it does the same thing with trackers, ads, etc.
  - ChrisMarshallNY 4y ago
    Not on the ones I write, but I know that I'm an outlier. From what I have heard, the FB SDK has a bunch of nice UI candy, so folks may have used it, just so they can get the nice splitscreen, etc. (UISplitViewController is a nightmare. I suspect that SwiftUI may have some improvements to offer).
janandonly 4y ago
If you, as a dweller on the interwebs, do not block all things related to FAANG yet, then you are to blame [1], [2], [3]. Also, as a country or nation state, if you do not curtail and prosecute these thieves of private data, then you show you don't care enough about your populace. [1] I recommend using a combo of https://nextdns.io/ https://nextdns.io/ [2] Ublock Origin: https://ublockorigin.com/ https://ublockorigin.com/ [3] and No-script: https://noscript.net/ https://noscript.net/
- elwell 4y ago
  > all things related to FAANG So I can't use a MacBook or iPhone? I can't watch Netflix?
- Moru 4y ago
  I do this since about forever in different ways. It's getting harder and harder to buy things online thanks to layer on top of layer of javascripts called from so many domains it's not even funny any more. On the other hand I buy less and less things I don't need...
- tirpen 4y ago
  > If you, as a dweller on the interwebs, do not block all things related to FAANG yet, then you are to blame. Quite literally victim blaming. No. The companies are to blame. The internet shouldn't be a bloody minefield that is impossible to navigate without a PhD in network security.
mdrzn 4y ago
"When Facebook replies to the reporters, they do not answer their questions. But in an email they emphasize that advertisers have a responsibility to not pass on sensitive information." Facebook Support is the biggest joke ever, even if you are a paying user of FB Ads. They can't or won't answer any question at all, and always reply with "We'll contact you soon to let you know if there's any updates".
alkonaut 4y ago
I don't understand: where are users entering sensitive information, and how is that related to facebook? If I click an ad on facebook and land on some website where I can fill in sensitive information, surely that's beyond facebooks' control? Were people entering information somehow IN the ad, while still on facebook's page?
- Moru 4y ago
  One way would be to place the facebook pixel on the site so if you buy sensitive meds from the drugstore, facebook knows what you bought and can sell that information to your insurance company. Not sure if they shut down the facebook pixel yet but I'm sure there is something similar around instead if they did.
  - jollybean 4y ago
    I don't think that's it. FB doesn't 'sell' data, rather, they allow advertisers to 'target' people. The targetting dimensions are right there for everyone to see, I'm doubtful that you're going to find the ability to target people on 'recently purchase meds'. I think this is a case of companies asking users to provide information on in-app sign ups.
- jollybean 4y ago
  Neither do I, once again, frustratingly bad reporting. My guess is that the 'ad' is has a 'sign up' where people can input information, which can be sensitive, that is capture for the advertiser. I could be anything i.e. contests, emails, whatever. The advertiser can get the data in a spreadsheet later. If the company doing the ad is 'fake' then you have a CA like scandal possibly, where the fake company can sell that harvested data, some of it sensitive. I think there are legit concerns here, but I mean, the companies could just as easily direct them to their own url and ask users to 'sign up', which would likely be beyond Facebooks purview to control.
- Ma8ee 4y ago
  No, people went to an online pharmacy, unrelated to Facebook. That pharmacy sent the information to Facebook, including information about what kind of medication that was purchased. Of course, the main fault was with the pharmacy, but that is another, related, story. The main point here is that Facebook had promised to filter and not store sensitive information, but that filter apparently didn't work, possibly because that filter didn't handle information in Swedish. So, even if you never ever had been even close to Facebook, Facebook could have the information that you just ordered some Emergency Contraceptives.
williamcotton 4y ago
We need some rather large class action settlements to scare all of the lawyers at our companies into taking these issues seriously!
amelius 4y ago
It is beyond my comprehension why government-installed privacy watchdogs don't do this sort of thing on a regular basis. Their modus operandi seems to be: wait for public outcry, then perhaps slap some wrists.
- Nextgrid 4y ago
  GDPR enforcement is significantly lacking. I'm starting to think that nobody really wants the GDPR to be enforced properly, and politically it makes sense - the social media industry (which relies on widespread privacy violations) now controls much of humanity's social fabric which politicians use to help their election - biting the hand that "feeds" could very well be suicide for one's political career.
- rolobio 4y ago
  Probably because the governments like being able to purchase/subpoena private information about their constituents from FB? It is an amazing surveillance tool from the government’s perspective.
- nonameking2026 4y ago
  No incentive - pat on the back in public, shaming in private. Politicians like big business.
someweirdperson 4y ago
Sweden? That's the country where income taxes of every individual are publically available. The inventors of tracking flights, including private ones. Are they concerned because medical, or because facebook?
- Dan_Sylveste 4y ago
  What's a 'tracking flight?'
- bjoli 4y ago
  What on earth are you trying to say with that comment? That my medicines being public information is comparable to taxable income public information? I don't thing I know anyone who would agree...
- rhodo 4y ago
  The medications you're taking are a vastly different level of private than your income or where a flight goes. I think that's pretty obvious
adamsb6 4y ago
I don't understand how these records were sent, and how it was confirmed they weren't deleted. It can't be tracking info, Facebook doesn't give access to such things outside the company, so the authors wouldn't have been able to confirm the records sent were still available. Also, technically the pharmacy wouldn't be sending those records, the fake user's browser would be sending them. If I had to guess, the fake pharmacy created "Custom Audiences" -- lists of identifying info, like email addresses, that Facebook can use to serve an ad to a specific person-- and labeled them as people that had purchased some specific drug. You can name these whatever you want, and can read their contents. API docs here: https://developers.facebook.com/docs/marketing-api/reference/custom-audience https://developers.facebook.com/docs/marketing-api/reference... There's no complex tagging system, it looks like name and description are the only places where you could say this is a list of people that bought a specific drug.
- deleted 4y ago
  [deleted]
- achsasgrebnarg 4y ago
  I like your idea of using custom audiences - clever! We used Facebook/Meta Pixel to send the data, and then confirmed that sensitive health data had been retained by querying the FB Graph API. /Sascha (one of the reporters)
deleted 4y ago
[deleted]
nonameking2026 4y ago
Well done - we need more of testing how big companies handle your data in practice.

400 points by herman82 4y ago

>After four days, 25 000 fake visits from customers had been registered with Facebook. But they had neither shut down nor warned the owners of the made-up pharmacy - Swedish Radio News' reporters. When the reporters log into their account, they see that Facebook has stored the type of sensitive information that they say their filter is built to delete again and again. >The question that the reporters then asked themselves was whether or not Facebook even has a filter that works in the Swedish language. One of the pharmacies that Swedish Radio reported on say that they cannot find any warnings from Facebook on data transfers that have taken place. The other has not wanted to answer the question. According to state investigators in the USA last year, Facebook only filtered in English. Wow, seems like this will have major implications under GDPR as well.

TazeTSchnitzel 4y ago
The things Facebook wants to block sound like content that is specially protected under the GDPR: > Article 9 > Processing of special categories of personal data > 1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. > 2. Paragraph 1 shall not apply if one of the following applies: […] (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A...)

andrelaszlo 4y ago

Also by SR, in the last couple of weeks: - The Swedish healthcare company Kry has built a service for digital patient calls that has leaked doctors 'and patients' contact information to Facebook. https://sverigesradio.se/artikel/health-service-marketed-as-secure-leaked-patient-information-to-facebook https://sverigesradio.se/artikel/health-service-marketed-as-... - The state-owned pharmacy chain Apoteket has sent detailed information about its online customers and their purchases to Facebook, Swedish Radio News can reveal. https://sverigesradio.se/artikel/pharmacy-passed-information-about-online-customers-to-facebook https://sverigesradio.se/artikel/pharmacy-passed-information... Why the f** is everyone sending our data to FB by default? It's not enough to uninstall FB; you can't even go buy prescription medicine without them knowing, apparently.

WesolyKubeczek 4y ago
On your smartphone, every other app will have Facebook SDK, whether for login or tracking or anything else at all.
- Zenst 4y ago
  Indeed, certainly makes application proxy filtering more of a must than a luxury for the wider consumer market in todays times. Though not sure (beyond rolling your own) what offerings are out there for consumers as focus seems to be VPN proxies.
  - Nextgrid 4y ago
    On iOS, "Lockdown Privacy" is a potential option.
- Nextgrid 4y ago
  Yep, so much for the GDPR. Despite this, I'm sure someone is going to throw the "enforcementtracker.com" link to "prove" that enforcement is sufficient.
- scns 4y ago
  On Android you can block trackers per app with TrackerControl. https://trackercontrol.org/ https://trackercontrol.org/
  - pmontra 4y ago
    I've been using Blockada for many years. I think it does the same thing with trackers, ads, etc.
- ChrisMarshallNY 4y ago
  Not on the ones I write, but I know that I'm an outlier. From what I have heard, the FB SDK has a bunch of nice UI candy, so folks may have used it, just so they can get the nice splitscreen, etc. (UISplitViewController is a nightmare. I suspect that SwiftUI may have some improvements to offer).

janandonly 4y ago

If you, as a dweller on the interwebs, do not block all things related to FAANG yet, then you are to blame [1], [2], [3]. Also, as a country or nation state, if you do not curtail and prosecute these thieves of private data, then you show you don't care enough about your populace. [1] I recommend using a combo of https://nextdns.io/ https://nextdns.io/ [2] Ublock Origin: https://ublockorigin.com/ https://ublockorigin.com/ [3] and No-script: https://noscript.net/ https://noscript.net/

elwell 4y ago
> all things related to FAANG So I can't use a MacBook or iPhone? I can't watch Netflix?
Moru 4y ago
I do this since about forever in different ways. It's getting harder and harder to buy things online thanks to layer on top of layer of javascripts called from so many domains it's not even funny any more. On the other hand I buy less and less things I don't need...
tirpen 4y ago
> If you, as a dweller on the interwebs, do not block all things related to FAANG yet, then you are to blame. Quite literally victim blaming. No. The companies are to blame. The internet shouldn't be a bloody minefield that is impossible to navigate without a PhD in network security.

mdrzn 4y ago

"When Facebook replies to the reporters, they do not answer their questions. But in an email they emphasize that advertisers have a responsibility to not pass on sensitive information." Facebook Support is the biggest joke ever, even if you are a paying user of FB Ads. They can't or won't answer any question at all, and always reply with "We'll contact you soon to let you know if there's any updates".

alkonaut 4y ago

I don't understand: where are users entering sensitive information, and how is that related to facebook? If I click an ad on facebook and land on some website where I can fill in sensitive information, surely that's beyond facebooks' control? Were people entering information somehow IN the ad, while still on facebook's page?

Moru 4y ago
One way would be to place the facebook pixel on the site so if you buy sensitive meds from the drugstore, facebook knows what you bought and can sell that information to your insurance company. Not sure if they shut down the facebook pixel yet but I'm sure there is something similar around instead if they did.
- jollybean 4y ago
  I don't think that's it. FB doesn't 'sell' data, rather, they allow advertisers to 'target' people. The targetting dimensions are right there for everyone to see, I'm doubtful that you're going to find the ability to target people on 'recently purchase meds'. I think this is a case of companies asking users to provide information on in-app sign ups.
jollybean 4y ago
Neither do I, once again, frustratingly bad reporting. My guess is that the 'ad' is has a 'sign up' where people can input information, which can be sensitive, that is capture for the advertiser. I could be anything i.e. contests, emails, whatever. The advertiser can get the data in a spreadsheet later. If the company doing the ad is 'fake' then you have a CA like scandal possibly, where the fake company can sell that harvested data, some of it sensitive. I think there are legit concerns here, but I mean, the companies could just as easily direct them to their own url and ask users to 'sign up', which would likely be beyond Facebooks purview to control.
Ma8ee 4y ago
No, people went to an online pharmacy, unrelated to Facebook. That pharmacy sent the information to Facebook, including information about what kind of medication that was purchased. Of course, the main fault was with the pharmacy, but that is another, related, story. The main point here is that Facebook had promised to filter and not store sensitive information, but that filter apparently didn't work, possibly because that filter didn't handle information in Swedish. So, even if you never ever had been even close to Facebook, Facebook could have the information that you just ordered some Emergency Contraceptives.

williamcotton 4y ago

We need some rather large class action settlements to scare all of the lawyers at our companies into taking these issues seriously!

amelius 4y ago

It is beyond my comprehension why government-installed privacy watchdogs don't do this sort of thing on a regular basis. Their modus operandi seems to be: wait for public outcry, then perhaps slap some wrists.

Nextgrid 4y ago
GDPR enforcement is significantly lacking. I'm starting to think that nobody really wants the GDPR to be enforced properly, and politically it makes sense - the social media industry (which relies on widespread privacy violations) now controls much of humanity's social fabric which politicians use to help their election - biting the hand that "feeds" could very well be suicide for one's political career.
rolobio 4y ago
Probably because the governments like being able to purchase/subpoena private information about their constituents from FB? It is an amazing surveillance tool from the government’s perspective.
nonameking2026 4y ago
No incentive - pat on the back in public, shaming in private. Politicians like big business.

someweirdperson 4y ago

Sweden? That's the country where income taxes of every individual are publically available. The inventors of tracking flights, including private ones. Are they concerned because medical, or because facebook?

Dan_Sylveste 4y ago
What's a 'tracking flight?'
bjoli 4y ago
What on earth are you trying to say with that comment? That my medicines being public information is comparable to taxable income public information? I don't thing I know anyone who would agree...
rhodo 4y ago
The medications you're taking are a vastly different level of private than your income or where a flight goes. I think that's pretty obvious

adamsb6 4y ago

I don't understand how these records were sent, and how it was confirmed they weren't deleted. It can't be tracking info, Facebook doesn't give access to such things outside the company, so the authors wouldn't have been able to confirm the records sent were still available. Also, technically the pharmacy wouldn't be sending those records, the fake user's browser would be sending them. If I had to guess, the fake pharmacy created "Custom Audiences" -- lists of identifying info, like email addresses, that Facebook can use to serve an ad to a specific person-- and labeled them as people that had purchased some specific drug. You can name these whatever you want, and can read their contents. API docs here: https://developers.facebook.com/docs/marketing-api/reference/custom-audience https://developers.facebook.com/docs/marketing-api/reference... There's no complex tagging system, it looks like name and description are the only places where you could say this is a list of people that bought a specific drug.

deleted 4y ago
[deleted]
achsasgrebnarg 4y ago
I like your idea of using custom audiences - clever! We used Facebook/Meta Pixel to send the data, and then confirmed that sensitive health data had been retained by querying the FB Graph API. /Sascha (one of the reporters)

deleted 4y ago

[deleted]

nonameking2026 4y ago

Well done - we need more of testing how big companies handle your data in practice.