As The World Frets Over Social Media Tracking For Advertising, Young People Are Turning Fooling Sites Into Sport
from the the-games-we-play dept
As the techlash continues to rage against tech and social media companies, one of the more common criticisms has been how sites track users in order to feed them advertising. Now, I won't pretend to believe that these concerns are entirely unfounded. There is something creepy about all of this. That perception is also not helped by the opaque manner in which sites operate, nor the manner in which these sites often barely inform users of the tracking that is in place. Through it all, those that have the worst opinions of the internet and tech companies often couch their concerns in hand-wringing over how these sites handle younger users.
Except that, as per usual, younger users are way ahead of the adults. Rather than waiting to rely on some half-brained "for the children!" legislation, at least some youth are instead making a sport out of beating social media sites at their own game. The CNET post focuses on one teenager, Samantha Mosley, and her use of Instagram.
But unlike many of Instagram's users, Mosley and her high school friends in Maryland had figured out a way to fool tracking by the Facebook-owned social network. On the first visit, her Explore tab showed images of Kobe Bryant. Then on a refresh, cooking guides, and after another refresh, animals. Each time she refreshed the Explore tab, it was a completely different topic, none of which she was interested in. That's because Mosley wasn't the only person using this account -- it belonged to a group of her friends, at least five of whom could be on at any given time. Maybe they couldn't hide their data footprints, but they could at least leave hundreds behind to confuse trackers.
These teenagers are relying on a sophisticated network of trusted Instagram users to post content from multiple different devices, from multiple different locations.
Here's how this works. One person creates an Instagram account, or maybe more than one. Then that person requests a password reset and sends that link to a trusted friend without closing their own session. Now that both people have active sessions, person two begins uploading photos, which triggers Instagram's tracking on this new device. Rinse and repeat and suddenly you've given Instagram, which assumes it is tracking one person, a ton of data from many people. The end result is the site has no real insight into the behavior of any one person. This can be further gamed by posting photos of people that are not those operating on the account. If these users are geographically disperse, that too adds confusing data for Instagram's tracking.
"They might be like, 'Hey, you posted from this hamburger place in Germany, maybe you like Germany, or hamburgers, or traveling, we'll just throw everything at you,'" Mosley said. "We fluctuate who's sending to what account. One week I might be sending to 17 accounts, and then the next week I only have four."
Facebook said that this method was not against its policies, but didn't recommend it to people because of security concerns.
So, why are these young people doing this? Part of it is something of a sport. The other part is a desire by young people for privacy. Despite all the concerns of the older generations, young people are better than average when it comes to being aware of how tech companies and social media sites are using their data, tracking them for advertising purposes, and all the rest. I imagine that part of this is these young people thumbing their noses at these companies thinking they will blindly allow this intrusion on their desired privacy.
Either way, even the adults who would instead like to go the regulation or legislative routes admit this is all fairly brilliant.
Teens shouldn't have to go to those lengths to socialize privately on Instagram, said Liz O'Sullivan, technology director at the Surveillance Technology Oversight Project.
"I love that the younger generation is thinking along these lines, but it bothers me when we have to come up with these strategies to avoid being tracked," O'Sullivan said. "She shouldn't have to have these psyop [psychological operations] networks with multiple people working to hide her identity from Instagram. The platform should just have an account that works and lets people feel safe about being on social media."
All well and good, but you can wish for that in one hand and spit in the other, and see which one fills up faster. Meanwhile, the kids are handling this just fine.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: adaptation, groups, kids, privacy, social media
Companies: instagram
Reader Comments
Subscribe: RSS
View by: Time | Thread
The kids are cyberpunks.
This reminds me of my youth when we figured out how to subvert the advertising of free internet providers.
Netzero used to be a free, ad-based provider. You dialed in and they served up banner ads on the program that took up some portion of your screen.
But the ads were just downloaded and stored in an accessible folder as image files. So we found that folder and replaced the images, sometimes with blank images all black or all white, or sometimes with our our photoshopped graphics. Fun times.
[ link to this | view in thread ]
Fine if the sites won't anonymize user data we will just do it ourselves.
[ link to this | view in thread ]
These kids have a very shallow understanding of the kind of tracking they are "subverting". The ads & recommendations are still relevant to the group, so tracking is working quite well. The AI and algorithms see a cluster of devices and IP addresses all in the same geographic area, all posting content of interest to teens. They most likely constantly de-anonymize themselves via other means, like cookies and device fingerprinting, e.g. device A only logs into FB account X and visits this constellation of websites, and device B only logs into FB account Y and visits this overlapping constellation, and both devices are using Instagram account Z, so serve up ads relevant to both users. Wow, those kids really stuck it to The Man, huh.
[ link to this | view in thread ]
Re:
Looks like someone needs to read the summary.... the teen said explicitly that she might be logged into as many as 17 accounts, or as few as 4, it all depends on what the group has scheduled (presumably outside of the usual social media accounts, but who knows). I took that to mean that she can do several accounts concurrently, not consecutively over a week's time. And about the only thing that the advertisers are able to do is, more or less, serve ads that would likely appeal to teens, not to say, pre-teens or adults. Not much individual targeting to glean from that, I imagine.
[ link to this | view in thread ]
Brilliant
This is a brilliant hack (in the original sense of the word -- playfully gaming the rules of a system). The trackers rely on single use of an account, potentially from multiple devices. They're shot down 'single use' into 'group use'. And using password reset to do it is crazy good.
More power to 'em.
The only downside is that this doesn't scale well. But, it can be replicated. It will be interesting to see if this catches on, and then, what new stoopid "Terms of Service" changes get made to outlaw the fun.
[ link to this | view in thread ]
Re: Brilliant
Not a hack.
[ link to this | view in thread ]
Pollute the database, I like it.
[ link to this | view in thread ]
Re:
Um, not exactly. From the article:
So, actually, the devices and IP addresses are not necessarily all in the same geographic area.
I don’t think so. Again from the article:
From what I understand, this means that as many as seventeen accounts are being used by a single person simultaneously, likely over multiple platforms. It doesn’t sound like any of them have any social media accounts that are used solely by one person. They also switch pretty frequently. Cookies and device fingerprinting are not terribly good at deanonymizing people if the users are frequently switched out.
Really, what you’re suggesting sounds too much like speculation without any basis from what’s in the article.
Now, could there be some improvements? Perhaps. Swapping physical devices, using devices available to the public, using public networks, etc. could add further confusion. Still, I think you’re downplaying what these teens are doing a bit too much. At the very least, it’s a start.
[ link to this | view in thread ]
Re: Re: Brilliant
I think they meant “hack” in the same vein as “life hacks” and generally abusing the rules for their own gain, not necessarily hacking into a computer.
[ link to this | view in thread ]
A few kids.
[ link to this | view in thread ]
The real price of this technique...
Is when they need to go back and look up something they posted a couple of years ago, like "where was that burger joint in Germany again?" and they have to check 10 or more accounts to find it.
Maybe this group doesn't care about that, but it doesn't seem to be generally applicable for others. And eventually, they will start caring about their personal history. Which is why facebook is full of middle-aged people catching up with old high school friends.
[ link to this | view in thread ]
Needs a dog
[ link to this | view in thread ]
This makes sense. Learning to avoid threats and danger is one of the things kids do best.
Don't stick things in power sockets, even though Mommy and Daddy do it all the time. Drink these brightly-colored drinks in the fridge, but not these ones under the sink or in the medicine cabinet. Run around outside all you want, but don't go near the street without an adult holding your hand.
The modern world is full of non-obvious dangers that kids are incredibly adept at learning to deal with; online threats are just one more thing on that list. The real question is, why is it so difficult for adults to do the same?
[ link to this | view in thread ]
Re: Re: Re: Brilliant
Even the term "life hack" is garbage when they almost always boil down to something like "brush your teeth and you'll get fewer cavities". "Hack" is overused and rarely applied appropriately.
[ link to this | view in thread ]
Re:
People become stubborn and stuck in their ways about the time they think they've learned everything there is to know and they can't possibly be wrong. The trouble with that is that there is no such turning point in reality. No matter how much you "know" there is still vastly more that you don't or even got wrong.
We should never stop learning. Never close ourselves off to new experiences and always be open to being proven wrong.
[ link to this | view in thread ]
I unintentionally did this to facebook when I first joined. I joined 10'ish years ago under pressure from my sister-in-law (she uses it for invites to family events). But I also created a presence there for my DJ hobby. My friends list on facebook consisted of family and DJ friends, except I live in the US and all the DJ friends were in Europe. This completely destroyed facebook's tracking and it was completely confused about where I was geographically. It would constantly try to get me to tell it where I lived and the multiple choices it offered would be something like "city where my sister in law lives", random city in The Netherlands, random city in Italy.
[ link to this | view in thread ]
This is one of those things that looks clever to the technologically illiterate.
It wouldn't even be a long afternoon to write the code to disentangle which user is posting which things. They have unique ip addresses. I'd actually be surprised if Instagram isn't already tracking them correctly... maybe letting them think they're winning by occasionally replying with content that looks like it should be for the other user.
If this somehow isn't happening already, it won't even be 18 months before it does start.
Even if these people were using a VPN to appear to all arrive from the same origin ip address, it's not very difficult to do the sort of analysis that counts how many users use the account simultaneously, and which actions belong to which.
[ link to this | view in thread ]
Re: Re: Re: Brilliant
bhull, note this phrase:
"shouldn't have to have these psyop [psychological operations] networks with multiple people working to hide her identity"
I seem to recall some conversation recently here at Techdirt that discussed this EXACT approach to censorship and privacy rape prone internet forums and big data rapists like Facebook, Twitter, et al.
And that info, passed along/sold to slimy government agents, private contractors, NGOs and others.
[ link to this | view in thread ]
Good except for the potential for 'rules'
It will be good sport, so long as no 'athletic associations' get involved. The fact that the 'sport' is to fool advertisers and athletic associations are more concerned with advertising than sport. The conflation would be horrific.
[ link to this | view in thread ]
Re:
EXACTLY. These kids are as relevant to the general attitude towards modern lack of privacy as, say, Linux users are to general level of knowledge on how to force a computer to do your bidding when it doesn't seem inclined at all to do so. Outliers to the extreme. Basically nobody I ever spoke to face to face even understands "what the big deal is" let alone actively try doing anything for their privacy - and no, it's not just "the kids"...
[ link to this | view in thread ]
Re: The real price of this technique...
Do people actually use this history as a reference system, to look things up? I'd have thought this was like browser history: a form of tracking that rarely provides any value to the person being tracked. There was news a few years ago that history-free chat systems were popular with young people.
[ link to this | view in thread ]
Re: Re: Re: Re: Brilliant
Agreed, but it's appropriate here given that the designers of the system, and most other adults who've heard about it, are surprised by this usage pattern.
[ link to this | view in thread ]
Re:
Even if that’s true (it probably isn’t; you’re making the same mistake that IP address = person that copyright trolls make), the fact is that Instagram and other social media platforms don’t appear to be doing such a thing:
So no, it’s not happening already. If you think that tech companies are just throwing these people a bone, you clearly don’t understand how tech companies work.
And as I noted in the parenthetical, your assumption that each individual is using a unique IP address isn’t necessarily true, even disregarding the potential use of a VPN. There are also public networks and such.
Furthermore, if you read the entire story, you’d know that none of the accounts are being used by multiple people simultaneously. And from what I can tell, machine learning and AI aren’t at the stage where they could do the sort of analysis that you describe.
[ link to this | view in thread ]
Re: Re: Brilliant
One meaning of hack is subverting technology to better serve ones interest, and that is a hack in that sense of the word. Breaking into computers for bad purposes is a modern usage of hack, and but not the only meaning of the word.
[ link to this | view in thread ]
Re: Re: Re: Re: Re: Brilliant
Someone being surprised does not make a hack.
[ link to this | view in thread ]
Re: Re: Re: Brilliant
Simply using something in a way that was not intended is not a hack and it is not subverting anything.
[ link to this | view in thread ]
Re: 5 things that teenagers hate. Number 3 will shock you!
How often do you find yourself yelling at the kids to get off your damn lawn?
[ link to this | view in thread ]
Re: Re: Re: Re: Brilliant
The term originally meant someone messing about with something in a positive sense, that is, using playful cleverness to achieve a goal. That seems to describe what those kids are doing, and that makes it a hack.
[ link to this | view in thread ]
so, write it, pal.
Sure, in a one-off red handed scenario to catch (fake) Israeli(LAPD) trained terrorists, it would be cool.
But at scale?
Evantually, you would trip over their footprints, on EVERYTHING.
And:
"to have pornography declared a state emergency", because thats how these fucks are blackmailing targets.
[ link to this | view in thread ]
Re: Re:
[ link to this | view in thread ]
Doing it ourselves
Curiously, the immunities we have developed for advertising have been building since the fifties. We consumers are less responsive to all the clickbait targeted advertising today than we were to the one-commercial-every-half-hour on early television during the 1950s.
Of course, scarcity and competition are factors, but it's a losing battle before we develop active resistances like gaming the trackers or installing multiple layers of adblockers.
[ link to this | view in thread ]
Re: so, why not both
I don’t know if it’s more in the sad or pathetic realms watching you answer yourself by switching ip addresses.
[ link to this | view in thread ]
Re:
Because they come wrapped in libertarianism.
[ link to this | view in thread ]
Re:
They hide needles in needlestacks instead of haystacks. Sure, they get served ads intended for needles instead of hay, but good luck to ANYONE trying to figure out which needle is which.
Privacy is mostly a myth these days.
[ link to this | view in thread ]
re:
Hey, you forgot to throw in some shit about #fatracisticiticcismclysms, or some #massagevaginy to legitimate your trolling.
You are both sad, and pathetic.
But the kids today are having fun doing what I do.
Or didn't you read the article, you fat sloppy queef?
[ link to this | view in thread ]
Re: Re: Re: Re: Re: Re: Brilliant
Correct. Using a system in a clever way, particularly one subversive to the designers' expectations, makes it a hack. Their surprise is evidence of such subversion.
[ link to this | view in thread ]
Re: Re:
Or because it's actually much more difficult for most adults. Kids often see most of their friends, almost everyone they know, every day at school. They're much less likely than adults to maintain long-distance relationships, or stay in contact with someone they haven't seen for a decade, so they have no real difficulty in wholesale-replacing their online persona or coordinating weird pranks. The free time helps too.
[ link to this | view in thread ]
the stupid poor fat racist bit really hit home didn’t it bro?
You kinda missed that reply button there bro. Not sure if it was because of the frothing rage or the destitute tears that made you do it? Though I don’t remember the kids today having fun sitting in their own shit.
[ link to this | view in thread ]
Re: Re:
While that definitely does damage people's brains, it's an affliction most adults are thankfully not affected by. So what's the explanation for the rest of them?
[ link to this | view in thread ]
I doubt this works,
which is probably why it is being flogged as a solution.
Browsers have provided users unique install id's since netscape. The amount of unique entropy per session even without that is enough to correlate a TCP stream to a user.
What this sound like, is somebody trying to persuade that creating a disinformation "club", is a great thing, provided that you do it in a way that creates no disinformation.
Probably a lead up to a new product launch with the intention of creating another layer of illusion to end users. A new company, which will be a subsidiary of facebook will tout it, claiming facebook is evil, and all the kiddies will use it to be cool.
Of course it won't change anything. It will simply exist to provide marketing leverage to pull people away from solutions that actually work.
[ link to this | view in thread ]
Re: mother fuckers like you?
Yeah, oh, the butthertz of it all.
Yours, of course, in your little diaper there, and your loving mommies face all up in it.
Did you shoot yourself in the face yet? Your face/your mothers face...
BLAM!
just do it Bro
[ link to this | view in thread ]
Re: Masnick, and Chips
A blast from the past (is that AC dead yet?)
Masnick and "chips"
Lol...
You have come so far, lad.
https://www.techdirt.com/articles/001006/1156237.shtml
Kevin Warwick Implants New Chip.....
Follow up?
[ link to this | view in thread ]
Re: Re: mother fuckers like you?
Stop telling commenters to kill themselves.
[ link to this | view in thread ]
yeah, afflictions
Afflictions such as yours are binary minded mental disorders, couched in tribalist rhetoric.
And, trolls like you, are a moral disease, rotting democracy, one AC comment at a time.
Seriously: libertarianism is critical thinking embodied, whereas you are just another Us v Them Jewsish-christian beaureacrat, chipping away at democracy.
Look! Mike Masnick on "chips"
https://www.dailymail.co.uk/news/article-7951293/Bill-Gates-Predicted-Coronavirus-Like-Outbreak-201 9-Netflix-Documentary.html
(((Ooops)))sorry about that. I hope I didnt destroy your soul with bad words.
Yeah, the propaganda mills are stirring about how some of you deploy Martin Buberesque psychobabble at some of them
Shit. The pigs are out of the pen....
[ link to this | view in thread ]
Re: Re: Re: mother fuckers like you?
bhull, stop defending race baiting chat-bots and artificial intelligence based semantic web derailers.
[ link to this | view in thread ]
Re: Re: Re: mother fuckers like you?
Thank you bhull, for the kind consideration of my AI feelz.
That vaginormous bastard, making me feelz bad for tone trolling him/her/its posts with my bullying, race baiting and substanceless comments, spread over a nine week period!
Oh, the inhumanity!
bhull242, you are a TRUE HERO in the fight for free speech online!!!!!
(try not to slip in the bathtub tonight, or overdose on aspirin, and ....well, you get the picture, pal)
[ link to this | view in thread ]
Re: Re: Re: Re: mother fuckers like you?
I’ve already explained that it’s not simply defending the ones your talking to, but also people reading it. It diminishes the discussion as a whole even more than basic insults and stupid arguments.
I’ve also explained that if the other one is an AI chatbot, then telling a chatbot to kill itself is stupid at best simply because an AI chatbot is fundamentally incapable of killing itself in the first place. In fact, no good could possibly come from talking to an AI chatbot outside of calling it out for being such, so at best, you’re wasting everyone’s time. Basically, there is no good reason for you to be telling anyone to kill themselves whether or not the target is a real person or not. Since
I should also mention that you have yet to offer any evidence that these are not real people (and the default assumption is that they are), so I have no reason not to defend them.
[ link to this | view in thread ]
Re: Re: Re: Re: mother fuckers like you?
Nothing the so-called “AI chatbot” has said has been any worse than anything you’ve said.
Why do you get so triggered by this?
[ link to this | view in thread ]