Because The Defense Department's Secure Communications Options Don't Work For Everyone, Soldiers Are Turning To Signal And WhatsApp

from the breaking-the-rules-to-stay-in-touch dept

The military has an obvious need for secure communications. It offered its support of encryption even as the NSA tried to find ways to undercut to make its surveillance ends easier to achieve.

The problem is the military doesn't have a great plan for securing communications between personnel. Due to tech limitations the Defense Department has yet to overcome (despite billions in annual funding), soldiers are turning to third-party messaging services to communicate orders and disseminate information.

The use of the encrypted messaging app Signal is ubiquitous within the Department of Defense. Service members have received briefings about operational security (OPSEC) and information security (INFOSEC) and have taken the dangers of living in a digital world seriously by making sure that the work-related text messages they send on their cell phones are encrypted. The contradiction is that using Signal for official military business is against regulations.

Securing communications apparently means breaking the rules. The DoD forbids the use of non-DoD-controlled messaging services to handle the distribution of nonpublic DoD information. The Defense Department insists personnel use its services, but those services can't be accessed by employees who don't have military-issued cell phones. And everyone has a cell phone, so it's often easier to use third-party platforms to communicate.

When this happens, it raises the risk that unauthorized access or sharing of information could occur. It also puts many communications beyond the reach of public records requests, which often cannot access communications between privately owned devices.

And there appears to be no fix on the immediate horizon. The Defense Department is quick to point out the use of Signal and WhatsApp violates regulations. But it has nothing in place that would allow the many military members not in possession of government-issued cell phones to communicate when out in the field.

This is what the Secretary of Defense's Public Affairs Officer (Russell Goemaere) told Audacy when asked about how military members were expected to use DoD-approved communications platforms they didn't actually have access to on their personal devices.

"DoD365 provides a messaging capability that is approved for CUI and use on DoD mobile devices. The Services are in the final stages of testing Bring Your Own Approved Device (BYOAD) and Bring Your Own Device (BYOD) solutions that provide access to the DoD365 collaboration capability on service member's personal devices," Goemaere said.

It's 2022 and the Defense Department is only at the "final stage of testing" for solutions it needed years ago. Cell phone usage has been ubiquitous for nearly two decades at this point. For the Department to still be weeks or months away from a solution should be considered unacceptable. Denying soldiers access to third-party options means cutting them off from communications that can often have life-or-death implications.

This also means the Defense Department is still weeks or months away from ensuring communications subject to FOIA law are being captured and retained. The priority should still be personnel safety, but this is another downside of the Defense Department's slow roll into the 21st century.

Filed Under: dod, encrypted messaging, encryption, military, soldiers
Companies: meta, signal, whatsapp

Patent Applications Hint That Facebook's VR World Might Just Be Web Mutton Dressed Up As Metaverse Lamb

from the all-gussied-up,-and-nowhere-to-go dept

The unexpected rebranding of Facebook's holding company as "Meta" has prompted a good deal of head scratching. Was it because Mark Zuckerberg is now a true believer in the metaverse religion, as the rather cringe-worthy video released at the time of the name change is meant to suggest? Was it perhaps an attempt to change the conversation in the wake of the damning testimony and leaks of Frances Haugen? Or maybe it was just a desperate bid to find a way of attracting younger users now that Facebook is increasingly an old person's social network, as the New York Times pointed out recently:

The truth is that Facebook's thirst for young users is less about dominating a new market and more about staving off irrelevance. Facebook use among teenagers in the United States has been declining for years, and is expected to plummet even further soon -- internal researchers predicted that daily use would decline 45 percent by 2023. The researchers also revealed that Instagram, whose growth offset declining interest in Facebook's core app for years, is losing market share to faster-growing rivals like TikTok, and younger users aren't posting as much content as they used to.

Whatever the reason, there is no doubting the seriousness of Facebook's corporate swerve to virtual reality (VR). The company has said that it is spending at least $10 billion on its new VR division this year, and that it will create 10,000 new jobs at Facebook across the EU to "help build the metaverse". The new strategy may not be in doubt, but one thing is: how will Meta make money in this brave, new virtual world?

At the heart of Facebook's current business model and profitability are two things: surveillance and advertising. Everything that a Facebook user does on the site -- and on thousands of other major sites around the Internet -- is tracked and analyzed in the minutest detail. The personal profile that results is then sold online -- algorithmically, in real-time -- to the highest bidder, who buys the opportunity to display online advertising targeted at the person in question, as they visit a Web site.

At the moment, the surveillance takes the form of recording which pages people visit on which sites, and where they click. It's not hard to extrapolate that to a virtual world, where Facebook/Meta records everything a user looks at, talks to, touches or interacts with in any way. In addition to using eye gaze direction and pupil activity monitored within the virtual reality headsets to gauge user interest, there may be other biometric inputs -- things like heartbeat, blood pressure and skin conductivity. In-world advertising is also easy to visualize. These could be in the form of virtual ad hoardings in the metaverse, or the more subtle use of product placement.

None of these are particularly novel suggestions -- they've been around for years. But it is fascinating to see precisely these ideas mentioned in a Financial Times article (paywall alert) looking at "dozens of patents recently granted to Facebook's parent company". Among the patents reviewed by the FT there are several that concern mapping users and their movements onto avatars in the metaverse as realistically as possible:

There is a "wearable magnetic sensor system" to be placed around a torso for "body pose tracking". The patent includes sketches of a user wearing the device but appearing in virtual reality as a soldier complete with a sword and armour.

Another patent proposes an "avatar personalisation engine" that can create three dimensional avatars based on a user's photos, using tools including a so-called skin replicator.

To do that requires even closer surveillance of what users do, both online and offline, which potentially allows even more information to be sold to advertisers:

One patent explores how to present users with personalised advertising in augmented reality, based on age, gender, interest and "how the users interact with a social media platform", including their likes and comments.

Another seeks to allow third parties to "sponsor the appearance of an object" in a virtual store that mirrors the layout of a retail store, through a bidding process similar to the company's existing advertising auction process.

As the FT notes, these kind of approaches would allow Meta to offer an immersive virtual world that is even more personalized than the existing Web-based system.

It's important to note that these are just patents. Nowadays, companies apply for as many of them as they can, just in case. Most are never used. But the similarity between today's Facebook and the one that the approaches detailed in the patents might produce is striking, as is the absence of anything truly radical or innovative. And that could be a problem for Meta. If young people aren't interested in what today's Web-based Facebook has to offer, are they really going to want to spend time as an avatar moving through the same thing gussied up into a virtual world?

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: business models, data, metaverse, patents, surveillance, vr
Companies: facebook, meta

Yet Another Really Dumb Lawsuit Filed Against Meta Because Some People Who Did A Bad Thing May Have Met On Facebook

from the this-is-not-a-good-lawsuit dept

Everyone wants to blame internet companies for everything. A couple weeks back, a woman sued Meta over the death of her brother, claiming Facebook was to blame. This is the latest in a ridiculously long line of failed lawsuits that look to hold Facebook liable for the deaths of people, just because either the killers or people connected to them somehow communicated on social media. It's like suing AT&T because two people plotting a crime spoke on the phone. These are nonsense lawsuits and they are nuisance lawsuits. This one is no different.

The underlying story here is tragic: two men, who were a part of the "boogaloo bois" (one of the many extremist groups who believe that a new civil war is coming, and that they need to help it along), killed a Federal Protective Services officer, Dave Patrick Underwood. They literally believed that this was part of the process to start this civil war. Its quite understandable while Underwood's family would be furious about this, and the two murderers are going to be in prison for a long, long time.

But trying to demand money from Facebook?

The entire complaint argues that because the two murderers talked on Facebook, Facebook is somehow responsible. It tries to get around Section 230 by arguing that the murderers found each other due to Facebook's algorithms, and somehow that gets around Section 230 (it doesn't).

Facebook, as originally conceived, may have functioned like an enormous virtual bulletin board, where content was published by authors. But Facebook has evolved over time with the addition of numerous features and products designed by Meta to engage users. The earliest of these – the search function and the “like” button – were user-controlled features. In more recent years, however, Meta has taken an active role in shaping the user-experience on the platform with more complex features and products that are not triggered by user requests. The most visible of these are curated recommendations, which are pushed to each user in a steady stream as the user navigates the website and in notifications sent to the user’s smartphone and email addresses when the user is off-platform. These proprietary Facebook products include News Feed (a newsfeed of stories and posts published on the platform, some of which are posted by your Facebook friends or members of groups you have joined, and others that are suggested for you by Facebook), People You May Know (introductions to persons with common connections or background), and Suggested for You, Groups You Should Join, and Discover (recommendations for Facebook groups to join).

These curated and bundled recommendations are developed through sophisticated algorithms. As distinguished from the earliest search functions that were used to navigate websites during the Internet’s infancy, Meta’s algorithms are not based exclusively on user requests or even user inputs. Meta’s algorithms combine the user’s profile (e.g., the information posted by the user on the platform) and the user’s dossier (the data collected and synthesized by Meta to which Meta assigns categorical designations), make assumptions about that user’s interests and preferences, make predictions about what else might appeal to the user, and then make very specific recommendations of posts and pages to view and groups to visit and join based on rankings that will optimize Meta’s key performance indicators.

This is a variation on the "algorithmic recommendations don't deserve 230 protections" argument. There are efforts in Congress to make that explicit, but it's nonsensical -- in large part because recommendations are protected by the 1st Amendment. So even if you got past the Section 230 issue, you're still killed by the 1st Amendment.

And the lawsuit here more or less admits that by saying that these are all opinions:

Meta’s algorithms are carefully protected intellectual property. While they are often characterized as automated and impersonal, they are, in actuality, dynamic and subject to frequent refinement. They also reflect the inferences, judgments, priorities, and decision-making of human programmers, managers, and executives at Meta.

Specifically, they're arguing "negligent design" -- an argument that has been tried repeatedly in 230 cases and fails.

In 2017, Meta changed its mission to giving “people the power to build community and bring the world closer together.”

To accomplish this new mission, Meta redesigned its social media platform and its recommendation algorithms to promote and emphasize user engagement in hobby clubs, civil society organizations, and other community groups.

Meta built a superstructure to support groups, built algorithms to recruit members for those groups, and built algorithms that created an insular world view for members of those groups.

In an interview with CNN, CEO Zuckerberg recognized the real world implications of achieving its goal to expand group membership on its platform: “Once people are coming together in these smaller groups, that actually grows and it ends up with much bigger changes in the world.”

Meta knew or should have known that these changes in the world could very well be negative—even dangerous and harmful to the public—as demonstrated by its own internal research.

I mean, this claim alone actually does a good job of demonstrating why Section 230 is so important in two different ways. First, the whole reason that Facebook changed its efforts towards focusing on community was in response to people freaking out about the 2016 election and misinformation. Facebook took those concerns and tried to respond to them by saying it was changing its emphasis away from news -- in the hopes that this would lessen things like the impact on elections -- and towards community. And yet here, they're being blamed for that attempt (weak as it may have been) to improve their service.

Basically, this shows how any decision on how to run your platform will be second guessed, and (if you're big enough) someone will sue you over it. The very nature of Section 230 is that it allows for these kinds of changes and experimentation to figure out what's best, and recognizes that it's a constant need for adjusting and adapting.

The second reason why this highlights the importance of Section 230 is that 230 is useful in getting these cases kicked out of court quickly, as they should be. Because without Section 230, this case is still a complete loser.

The entire basis of the lawsuit is that because these men met on Facebook, and then later decided to kill someone, Facebook is somehow to blame for the murder. But under that theory, if two people meet at a bowling alley, or a bar, or a restaurant, and later commit a crime, you could hold those meeting places liable? That's ridiculous and clearly cannot fly. Section 230 is helpful in getting such obviously bogus lawsuits kicked out early. Without 230, Facebook still wins this case, but it's just a lot more expensive.

This is a nonsense lawsuit and the lawyers who filed it should be embarrassed. The underlying story is sad, and I feel terrible for the family, but the decision to sue here is a bad one that will not end well.

Filed Under: boogaloo bois, dave underwood, intermediary liability, section 230
Companies: facebook, meta

FTC's Second Antitrust Attempt Against Facebook Gets Past The First Hurdle

from the slightly-better dept

As you'll recall, at the end of 2020, the FTC filed an antitrust case against Facebook. Last summer, the district court dismissed the case, noting that the complaint was "legally insufficient," and didn't really back up its central claims. Based on that, the FTC went back to the drawing board and filed an amended complaint last August. As we noted, the amended complaint was better than the first one -- which was heavy on narrative, but little on support to back it up. The amended complaint had more in it, though we still felt that the market definition was odd, and some of the complaint seemed to undermine other parts of it.

Either way, Facebook again asked the court to dismiss it, but this time, they're letting the case move forward. Basically, the court says that on a second pass, the FTC has actually provided at least some support of the central arguments in the complaint:

Eagerly accepting such invitation, the FTC has filed an Amended Complaint containing significant additions and revisions aimed at addressing the shortcomings identified in the Court’s prior Opinion. The core theory of the lawsuit remains essentially unchanged. The Commission continues to allege that Facebook has long had a monopoly in the market for PSN services and that it has unlawfully maintained that monopoly via two types of actions: first, by acquiring competitors and potential competitors — most notably, Instagram and WhatsApp — that it believed were well situated to eat into its monopoly; and second, by implementing and enforcing policies that prevented interoperability between Facebook and other apps that it viewed as nascent threats. The facts alleged this time around to fortify those theories, however, are far more robust and detailed than before, particularly in regard to the contours of Defendant’s alleged monopoly.

The court more or less says that Facebook may still prevail in the end -- noting that the FTC will "face a tall task down the road in proving its allegations," but, at this stage of the game, the allegations are enough to allow the case to move on to the next stage.

The court does reject one part of the FTC's case -- that Facebook's interoperability policies were anti-competitive:

The Court will not, however, allow the allegations surrounding Facebook’s interoperability policies (also known as the Platform policies) to move forward; they founder for the same fundamental reasons as explained before: Facebook abandoned the policies in 2018, and its last alleged enforcement was even further in the past.

Given the beefed up filing, this isn't a huge surprise. I still think that the FTC's case here remains surprisingly weak. I honestly expected something a lot more damning than the weird market definition and the allegations -- many of which are presented in ways that could easily be removing important context (such as reasons for actions that were not anti-competitive, but for the benefit of users).

Either way, the case is about to get a lot more expensive for Facebook, and even if the odds are that it would still prevail in the end, it might try to settle the case to avoid having to go through the process. That said, with Lina Khan leading the FTC, I'm guessing the FTC is willing to press this case forward as far as possible, even if it means an eventual loss in court...

Filed Under: antitrust, competition, discovery, ftc, market definition, motion to dismiss
Companies: facebook, meta

Meta Sues Firm For Data Scraping; Claims That Signing Up For New Accounts After Being Banned Is Equivalent Of Hacking

from the why-is-this-a-problem? dept

For years we've talked about the infamous Facebook lawsuit against Power.com. As you may recall, this was a key CFAA case against a site, Power.com, that was trying to create a social media aggregator dashboard -- in which you could login through a single interface, and access content from and post to a variety of different social media platforms. Facebook alleged that this was a form of hacking -- claiming it was "unauthorized access" to Facebook. This was even though there was no actual unauthorized access. Individual users gave Power their login credentials, so everything was completely authorized. After years of winding through the courts, unfortunately, it was decided that this was a violation of the CFAA, mainly because Facebook sent a cease & desist letter, and somehow going against that now made it "unauthorized." In my mind, this is one of the biggest reasons why Facebook has much less competition today than it otherwise might -- because it used the CFAA and cases against Power.com to create a "you can check in, but you can't check out" kind of data arrangement. Things like Power.com were an empowering system that might have made people much less reliant on Facebook -- but it was killed.

In an age now where people are increasingly talking about the importance of data portability and interoperability, something like Power.com would be a useful tool.

So, it's interesting (and a little disturbing) to see that Facebook's new corporate identity, Meta, has now sued another company for data scraping. It is notable that in this case, the defendant, Social Data Trading Ltd., is a lot less sympathetic a character than Power.com was. And -- more importantly -- Facebook is not using the CFAA this time (other cases have suggested that what Facebook got away with in the Power case it would no longer be able to get away with under that law). However, it is trying to use California's state law equivalent of the CFAA. And now matter how you look at it, it's still at least a little worrisome that Facebook (ok, whatever, Meta) believes it has a legal right to stop scraping of otherwise public data.

So first, Social Data Trading is not sympathetic. It appears to be a sketchy service in its own right, scraping data on social media users to sell "in-depth insights into the demographics and psychographics of influencers and their audiences." Meta put in place some technical blocks to try to stop the company from scraping (which seems like fair game), but SDT would then just register new domains and continue scraping. Facebook had apparently tried to stop a predecessor company to Social Data Trading called "Deep.Social," though the complaint seems to imply that SDT is just a reworking of Deep.Social.

The more difficult issue here is that part of the way that SDT did its scraping was by creating fake accounts on Facebook and Instagram, and then using those fake accounts to scrape the data. And that does bring things into a legally more complex area, but also gives Meta the route around to go after these guys without using the CFAA.

At issue is that when you create one of those accounts... you agree to the terms of service, and those terms say you can't use the site for "collecting information in an automated way." Thus, the core argument here is that it's a breach of contract case, and that the SDT folks agreed to the terms and then broke them by using their fake accounts to scrape.

Since January 2019, Defendant created and used multiple Instagram accounts and agreed to Instagram’s Terms. Defendant agreed to Instagram's Terms no later than January 30, 2019.

In addition, since September 2020, Defendant has used thousands of Instagram accounts to scrape Instagram.

Defendant breached the Terms by using unauthorized automated means to access Instagram and collect data from Meta computers without permission, including after Meta revoked Defendant’s access to its platform.

Of course, it seems to me that if this is a breach, the remedy should simply be removal of service, not anything more. But Meta claims damages "in excess of $75,000" (the minimum needed to get into federal court).

The second claim in the lawsuit seems... a lot sketchier. It claims violations of California Penal Code Section 502, which is (more or less) California's equivalent to the CFAA. While, apparently, Meta's lawyers know enough to not go to the well again on the federal CFAA, the use of the state equivalent is still quite concerning.

Beginning no later than June 2021, Defendant, without permission, knowingly accessed and otherwise used Meta’s computers, computer system, and computer network in order to (a) devise or execute any scheme or artifice to defraud and deceive, and (b) to wrongfully obtain money, property, or data, in violation of California Penal Code § 502(c)(1).

Beginning no later than June 2021, Defendant, without permission, knowingly accessed and took, copied, and made use of data from Meta’s computers, computer system, and computer network in violation of California Penal Code § 502(c)(2).

Beginning no later than June 2021, Defendant knowingly and without permission used or caused to be used Meta’s computer services in violation of California Penal Code § 502(c)(3).

Since June 2021, Defendant knowingly and without permission accessed and caused to be accessed Meta’s computers, computer systems, and/or computer networks in violation of California Penal Code § 502(c)(7). Defendant accessed Meta’s computer network after Meta disabled its Instagram accounts, blocked its domain, and sent correspondence to Defendant revoking its access.

Because Meta suffered damages and losses as a result of Defendant’s actions and continues to suffer damages and losses as a result of Defendant’s actions, Meta is entitled to compensatory damages in an amount to be determined at trial, attorney fees, any other amount of damages proven at trial, and injunctive relief under California Penal Code § 502(e)(1) and (2).

Because Defendant willfully violated California Penal Code § 502, and there is clear and convincing evidence that Defendant committed “fraud” as defined by section 3294 of the Civil Code, Meta is entitled to punitive and exemplary damages under California Penal Code § 502(e)(4).

All of this should be concerning to folks. It basically says that if you get kicked off a site and then create a new account... you could face serious consequences (and while this is a civil suit, Section 502 violations can lead to criminal liability as well). This should be cause for alarm. Yes, even if the defendant is a sketchy data operation, and even if Meta really didn't want them scraping their site, to turn around and use what is, ostensibly, a computer "hacking" law against them for setting up new accounts seems incredibly dangerous and could lead to very bad consequences.

Finally there's an "unjust enrichment" claim which also seems a bit silly -- especially for a company like Facebook, which makes so much of its money by collecting data in surreptitious ways, to argue that another firm doing that back to Facebook is somehow "unjustly" enriching itself is pretty rich.

Still, it's claim two that should raise some eyebrows, and I wish that Facebook recognized what a dangerous game its playing in trying to argue that signing up for a new account after you've been banned somehow violates an anti-hacking law.

Filed Under: analytics, cfaa, data, data scraping, hacking, privacy, public information
Companies: facebook, meta, social data trading

A Fight Between Facebook And The British Medical Journal Highlights The Difficulty Of Moderating 'Medical Misinformation'

from the what-a-disaster dept

There are multiple efforts under way in the US to pass laws that require social media sites to take down "medical misinformation." As we've described repeatedly, these are really dangerous ideas. Bills like those from Senators Amy Klobuchar and Ben Ray Lujan seek to force social media to remove medical misinformation as declared by the Ministry of Truth... er... Secretary of Health & Human Services. Of course, it was not all that long ago that we had an administration that was actively anti-science, and wanted to declare anything that made the president look bad as "fake news."

Also, in the midst of a pandemic, when the data and the science are rapidly evolving, what might seem reasonable at one point, may later turn out to be misinformation -- and vice versa. Forcing down misinformation leads to all sorts of dangerous consequences. Hell, we saw this in China, where such a law was used to silence a doctor who tried to raise the alarm about COVID-19, and was forced to apologize for spreading "untruthful information online."

But there's another aspect of this which people rarely try to deal with: content moderation involves a lot of very gray areas and an awful lot of context, much of which may not be immediately obvious. An ongoing war of words between the former British Medical Journal (now just "The BMJ") and Meta/Facebook demonstrates nicely just how impossible it is to claim that "medical misinformation" must be taken offline. There's a bit of background here, and it's a, well, touchy subject, so try to go through the whole thing before you react.

First off, the BMJ is not, in any way, anti-vaccine. Somewhat famously, the BMJ was a key player in exposing the fraudulent behavior of Dr. Andrew Wakefield, whose fraudulent study created the modern anti-vax movement. That said, in November, The BMJ published an investigative journalism piece, based on a supposed "whistleblower" suggesting that there was some data integrity issues with the way Pfizer's vaccine was tested, specifically involving a research partner of Pfizer, Ventavia Research Group.

Ventavia responded to the allegations by noting that the supposed whistleblower in question had raised the issues a year earlier, and they were investigated and found to be unsubstantiated. That said, many reasonable people noted that this should be further investigated and worried that it might lead to further damaging the public's trust in science.

But, of course, you can fully predict what happened next. It didn't just "damage the public's trust in science," the BMJ article instead was instantly championed by all of the big anti-vax voices all over social media as "proof" that the COVID vaccine was dangerous and rushed into approval -- key talking points among that crowd, repeated despite tons of evidence that the vaccine is both incredibly effective and incredibly safe.

This resulted in Lead Stories, a fact checking organization, to fact check the article, and slap it with a "missing context" label, and calling into question the way that people were interpreting the article:

Did the British Medical Association's news blog reveal flaws that disqualify the results of a contractor's field testing of Pfizer's COVID-19 vaccine, and were the problems ignored by the Food & Drug Administration and by Pfizer? No, that's not true: Pfizer and the FDA were made aware of the allegations about the contractor in 2020. Medical experts say the claims aren't serious enough to discredit data from the clinical trials, which is also what Pfizer and the FDA say they concluded. The FDA says its position is unchanged: The benefits of the Pfizer vaccine far outweigh rare side effects and the clinical trial data are solid.

Because of this fact check and because of the way the article was being used in a misleading way by thousands of anti-vaxxers, users who tried to share The BMJ article were flagged with fact check warnings saying: "Missing context ... Independent fact-checkers say this information could mislead people," which is accurate, but incomplete, and very dependent on the context of who was sharing it and for what purpose.

The BMJ kinda flipped out about this and published an angry open letter to Mark Zuckerberg (who, I assure you, had nothing to do with the decision on the fact check and flagging). To be honest, I find the BMJ's anger here completely disingenuous. They act like they don't understand at all why Lead Stories highlighted the "missing context" point on their story, when -- of anyone -- the BMJ should be willing to acknowledge how their own article was being weaponized by ignorant anti-vaxxers.

But from November 10, readers began reporting a variety of problems when trying to share our article. Some reported being unable to share it. Many others reported having their posts flagged with a warning about “Missing context ... Independent fact-checkers say this information could mislead people.” Those trying to post the article were informed by Facebook that people who repeatedly share “false information” might have their posts moved lower in Facebook’s News Feed. Group administrators where the article was shared received messages from Facebook informing them that such posts were “partly false.”

Readers were directed to a “fact check” performed by a Facebook contractor named Lead Stories.[2]

We find the “fact check” performed by Lead Stories to be inaccurate, incompetent and irresponsible.

-- It fails to provide any assertions of fact that The BMJ article got wrong

-- It has a nonsensical title: “Fact Check: The British Medical Journal Did NOT Reveal Disqualifying And Ignored Reports Of Flaws In Pfizer COVID-19 Vaccine Trials”

-- The first paragraph inaccurately labels The BMJ a “news blog”

-- It contains a screenshot of our article with a stamp over it stating “Flaws Reviewed,” despite the Lead Stories article not identifying anything false or untrue in The BMJ article

-- It published the story on its website under a URL that contains the phrase “hoax-alert”

We have contacted Lead Stories, but they refuse to change anything about their article or actions that have led to Facebook flagging our article.

The BMJ open letter also gets unnecessarily snarky (which also seems out of character for a prestigious medical journal):

Rather than investing a proportion of Meta’s substantial profits to help ensure the accuracy of medical information shared through social media, you have apparently delegated responsibility to people incompetent in carrying out this crucial task.

That's ridiculous. Clearly this is a difficult situation. Even if the reporting was accurate -- there is crucial context here. Did the revelations support the claims of anti-vaxxers who were using it as evidence that the Pfizer vaccine was not safe? The answer is no, it did not. And there's a strong argument that The BMJ could have and should have made that point a lot clearer in their own reporting, recognizing how the article would be weaponized by grifters and fed to the ignorant.

Lead Stories then responded to the BMJ, in fairly great detail, more or less saying "you can't honestly be that naïve."

It is ironic to read that BMJ.com objects to the headline on Lead Stories' fact check of a BMJ.com article when the original BMJ piece carries a scare headline that oversells the whistleblower and overstates the jeopardy. Their November 2, 2021, headline "Covid-19: Researcher blows the whistle on data integrity issues in Pfizer's vaccine trial" is the reason BMJ.com's article has appeared in hundreds of Facebook posts and tweets, many by anti-vaccine activists using it as "proof" the entire clinical trial was fraudulent and the vaccine unsafe.

Lead Stories also points out that The BMJ's headline to its article is extremely misleading, as it can be read to say that there were data integrity issues with the entirety of the Pfizer vaccine test, rather than 3 sites out of 153, and then also highlights that the whistleblower in question is not a scientist who is an expert on this. It also notes that the whistleblower appears to have some... questionable beliefs and associations regarding vaccines:

The BMJ.com article eventually gets around to saying she worked at the lab for just two weeks. But BMJ's open letter fails to mention important context: The Brook Jackson Twitter account agreed with leading COVID misinformation-spreader Robert F. Kennedy Jr.'s criticism of the "Sesame Street" episode in which Big Bird encourages kids to get a COVID-19 vaccine. "Shocking, actually." she wrote in a November 9, 2021, response to a Kennedy tweet blasting Sesame Street (archived here). Elsewhere on Twitter, the Brook Jackson account wrote to a vaccine-hesitant person that vaccination makes sense if a person is in a high-risk category. When the U.S. 5th Circuit Court of Appeals ruled against a federal employee vaccine mandate, she tweeted "HUGE!" and not with a frowny emoji.

Lead Stories talked to Jackson, looked at available documents (after BMJ refused to permit us to see their basis for the story and did not make the documents available on a transparency site). Unlike BMJ.com, Lead Stories then tested Jackson's assertions with Pfizer, with the lab contractor in question and with the FDA and then published their responses. It's not at all clear yet whether there are data integrity issues if you ask the other stakeholders, and that's the crucial missing context. We also talked to experienced medical researchers for perspective, one of whose credentials BMJ editorial staff demeaned for reasons we can only imagine.

By talking to Ventavia, we contributed context BMJ.com missed: Ventavia said the whistleblower had not worked on the Pfizer trial, but Lead Stories set that straight by embedding in its story a copy of a letter, provided by Jackson in which she was expressly welcomed to the Pfizer trial team. That's what we mean by context.

The BMJ has thus far failed to document what is "inaccurate" in the Lead Stories fact check, but again oversells by using that and other name-calling to vent frustration at our documentation of obvious missing context

All of this involves an awful lot of judgment calls, understanding of context, and a lot more. But under a law that requires the pulling down of medical misinformation, how the hell would anyone handle this kind of scenario? The BMJ story isn't wrong per se, but there is a lot of important context that seems like it's missing (which Lead Stories highlighted above). On top of that, there's all the important context around how people are using the article and stretching an already weaker-than-it-seems story to pretend to be a lot more damning on the overall vaccine.

In other words, how the article is being represented and used is an important piece of context as well. And this is frequently the case with medical misinformation. People will take something that is factual or accurate, and present it out of context or in a misleading light, in order to make an argument that doesn't support it. So which part is the "misinformation" and how do you police that?

In an ideal world, we'd be able to see all the details and the back and forth, and figure it all out. Frankly, when I first heard about this -- via The BMJ's open letter -- I initially thought that the details would support The BMJ, and that Facebook mislabeled something (which, of course, happens all the time because of the old Masnick Impossibility Theorem). It was only after reading multiple articles on both sides of this, and going through the details of Lead Stories' process, that I realized that they had (to me) a much stronger argument, that there's an awful lot of important context that is missing from The BMJ piece that you would hope a journal like that would have considered before publishing the article the way in which it did.

But to expect every social media platform to be able to determine this on every piece of medical sharing out there is next to impossible -- and putting legal liability on top of it, as Senators Klobuchar and Lujan want to do -- would be dangerously impossible.

Filed Under: content moderation, context, covid, fact checking, health, health misinformation, journalism, misinformation, reporting, vaccines
Companies: facebook, lead stories, meta, pfizer, the bmj

Oversight Board Overturning Instagram Takedown Of Ayahuasca Post Demonstrates The Impossibility Of Content Moderation

from the this-is-not-easy dept

Congress has been holding lots of "but think of the children online!" hearings over the past couple of months, and one prominent topic that comes up over and over again is the fact that people can find "drug" information online. Fears about kids and drugs goes back decades, but politicians love it, because it always works. And, of course, the media loves to run these overhyped stories. A quick search finds dozens of stories like the following in just the last month or so:

• Teens have easier access to drugs as illegal trade booms on social media
• Instagram pushes drug content to teens
• Social media platforms becoming sites of illegal fentanyl drug sales targeting teens, L.A. officials warn
• WARNING: Dealers tempt kids with edible drugs via social media
• Record number of drug overdose deaths brings new scrutiny to social media apps
• Instagram offers 'drug pipeline' to kids, tech advocacy group claims

There are many more such stories, but you get the idea. The Instagram stories, in particular, were targeted by the recent Senate hearing which was focused on allowing Senators to grandstand on how bad Instagram supposedly is for kids. Instagram responded to the report by pointing out that it's doing a ton of stuff to try to block such content:

"We removed 1.8 million pieces of content related to drug sales in the last quarter alone, and due to our improving detection technology, the prevalence of such content is about 0.05 percent of content viewed, or about 5 views per every 10,000. We'll continue to improve in this area in our ongoing efforts to keep Instagram safe, particularly for our youngest community members."

But, within a day of that report getting so much attention, you had the Oversight Board step in to demonstrate how much more difficult an issue this is than it sounds to grandstanding politicians or narrative-driving journalists. The Oversight Board overturned Instagram's decision to take down a post that was promoting ayahuasca as medicine. Instagram took down the post (which had just started trending) because it was promoting it as medical treatment:

In July 2021, an Instagram account for a spiritual school based in Brazil posted a picture of a dark brown liquid in a jar and two bottles, described as ayahuasca in the accompanying text in Portuguese. Ayahuasca is a plant-based brew with psychoactive properties that has deeply-rooted religious and ceremonial uses among Indigenous and other groups in some South American countries, and related communities elsewhere. Ayahuasca contains plants which are sources of dimethyltryptamine (DMT), a substance that is prohibited under Schedule I of the 1971 UN Convention on Psychotropic Substances and the law of many countries, though there are relevant exceptions under international law for substances containing DMT such as ayahuasca, and exceptions under some national laws, including in Brazil, for other uses such as religious and Indigenous use.

The text states that “AYAHUASCA IS FOR THOSE WHO HAVE THE COURAGE TO FACE THEMSELVES” and includes statements that ayahuasca is for those who want to “correct themselves,” “enlighten,” “overcome fear” and “break free.” It further states ayahuasca is a “remedy” and “can help you” if one has humility and respect. It ends with “Ayahuasca, Ayahuasca!/Gratitude, Queen of the Forest!”

The content was viewed over 15,500 times and no users reported it. The post was flagged for review by Meta’s automated systems because it had received around 4,000 views and was “trending.” Meta specified neither the image nor the text triggered automatic review. The post was subsequently reviewed by a human moderator and removed. Meta told the Board that it was removed for violating Facebook’s Community Standard on Regulated Goods, but later stated it removed the content for “violating the Instagram Community Guidelines, which include a link to the Facebook Community Standard on Regulated Goods.” Meta notified the user that the post went against Instagram’s Community Guidelines, stating “post removed for sale of illegal or regulated goods.” The messaging also noted that Meta removes “posts promoting the use of hard drugs.”

So, there are a few interesting tidbits there worth pointing out. Contrary to the fear-mongering and grandstanding, this notes that Instagram has a system to proactively flag this kind of content, and that some of the priority of such reviews is based on whether or not the content is getting a lot of attention and going viral (these are both things that many critics of Facebook/Instagram/Meta insist the company does not do). And, if you just listened to the Senators at hearings, or just read all those news articles above, you might not realize th.

But, the more important thing that this case showcases, is just how difficult it is to make these kinds of calls at scale. What seems obvious to some is not so obvious, and there's a lot of subjectivity involved. This can be seen in the way the two sides (the poster of the original content and the company) explained their thinking. The organization that made the original post about ayahuasca says that it was just an image of a regulated and legal ceremony:

The user stated in their appeal that they are certain the post does not violate Instagram’s Community Guidelines, as their page is informative and never encouraged or recommended the purchase or sale of any product prohibited by the Community Guidelines. They said that they took the photo at one of their ceremonies, which are regulated and legal. According to the user, the account aims to demystify the sacred ayahuasca drink. They said that there is a great lack of knowledge about ayahuasca. The user stated that it brings spiritual comfort to people and their ceremonies can improve societal wellbeing. They further state that they have posted the same content previously on their account and that post remains online.

Instagram, for its part, takes the more hardline "drugs bad, mmkay" line that Congress and the press seems to want them to take:

Meta stated that the content violated Facebook’s Community Standards because “the user described ayahuasca with a heart emoji, referred to it as ‘medicine,’ and stated that it ‘can help you.’” Following a question from the Board about whether the content was removed for violating Instagram’s Community Guidelines or Facebook’s Community Standards, Meta responded the content was removed “for violating the Instagram Community Guidelines, which include a link to the Facebook Community Standards on Regulated Goods.” Specifically, the user violated Instagram’s prohibition on content “buying or selling illegal or prescription drugs (even if legal in your region).” Meta also cited another line of the Community Guidelines which links to the Community Standard on Regulated Goods, which “clarifies that Facebook prohibits content that ‘[c]oordinates or promotes (by which we mean speaks positively about [...] non-medical drugs.’”

Referring to Meta’s values, the company stated that “Safety” displaced “Voice.” Meta noted that users are permitted to advocate for the legalization of non-medical drugs and to discuss the medical and scientific benefits of non-medical drugs, but that there is no religious or traditional use allowance. Meta argued that this rule strikes the correct balance between “Voice” and “Safety.”

Meta also stated that prohibiting this content follows human rights principles. It stated that it considered the right to freedom of expression under Article 19 ICCPR and the right to freedom of religion or belief under Article 18 ICCPR, and argued that its decision satisfied the conditions required to restrict these rights.

According to Meta, Facebook’s Community Standard is easily accessible and its non-public definition of non-medical drug as a “substance that causes ‘a marked change in consciousness’” is apparent. It further argued that the decision sought to protect public health. It stated that dimethyltryptamine (DMT), one of the active hallucinogenic substances in ayahuasca, poses significant safety risks, citing the 1971 UN Convention on Psychotropic Substances.

The final ruling by the Oversight Board overturn's Instagram's decision to take it down, citing that Instagram's own community guidelines were somewhat confusing and focused on the buying and selling of illegal drugs (though it notes that the rules are confusing, because they said "illegal or prescription drugs (even if legal in your region)" which is, as the Board notes "confusing and contradictory." There was also some level of conflict between Instagram's rules and Facebook's rules, and an unclear delineation of which one should apply where.

But where the impossibility of content moderation on topics like this really shines through is in the discussion about "voice" vs. "safety," which was one of the key points that Instagram made in defending its decision. The Board says it values things differently than the company:

The Board concludes that Meta’s decision to remove the content was not consistent with the company’s values. In this case, as in many, Meta's values of “Voice,” “Safety,” and “Dignity” point in different directions. Meta's decision to take down the post weighted “Safety” over “Voice.” The Board would balance the values differently, believing that the genuine but not particularly strong interests in “Safety” are outweighed in this context by the value of “Voice” and the importance of recognizing the “Dignity” of those engaging in traditional or religious uses where there is historic evidence of such use, including by Indigenous and religious communities. Scientific research indicates that the use of ayahuasca in a controlled context in traditional and religious ceremonies is not linked to a serious risk of harm. Meta cited the European Court of Human Rights case of Franklin-Beentjes and Ceflu-Luz da Floresta v. The Netherlands (Case No. 28167/07, European Court of Human Rights, May 6, 2014) to demonstrate the risks of ayahuasca use. Other courts, however, have reached different conclusions – for example, the United States Supreme Court, in considering the risk of harm from “the circumscribed, sacramental use of hoasca” by members of an ayahuasca based religion, found that the government had not put forward sufficient evidence of harm from religious use, which was its burden, to justify the prohibition in these circumstances. Meta’s rationale does not appear to have taken into account controlled uses of ayahuasca which aim to mitigate health risks. In light of scientific research, Meta’s rationale did not demonstrate the danger of this post to the value of “Safety” in a manner sufficient to displace “Voice” and “Dignity” to the extent to justify removal of the post.

There should be no way to look at that paragraph and not realize just how subjective all of this is. Every one of these involves judgment calls and people weigh different values in very different ways. Even people who work at the same company. Figuring out how to (1) write rules that take all this into account, (2) express those rules in AI moderation systems, (3) express those rules clearly to tens of thousands of human moderators across hundreds of languages and cultures, (4) and expect it to work at a scale of billions of users and millions of posts per day... is literally impossible. It cannot be done well.

That doesn't mean that everyone should give up, but there should at least be some level of humility in recognizing the level of this task, and highlighting individual decisions that we disagree with is not evidence that people or the company "don't care" about this issue, but rather evidence of just how impossible a task this truly is.

Filed Under: ayahuasca, brazil, content moderation, drugs, health misinformation
Companies: facebook, instagram, meta, oversight board

A Grope In Meta's Space

from the the-value-of-user-tools-in-moderation dept

Horizon Worlds is a VR (virtual reality) social space and world building game created by Facebook. In early December, a beta tester wrote about being virtually groped by another Horizon Worlds user. A few weeks later, The Verge and other outlets published stories about the incident. However, their coverage omits key details from the victim’s account. As a result, it presents the assault as a failure of user operated moderation tools rather than the limits of top-down moderation. Nevertheless, this VR groping illustrates the difficulty of moderating VR, and the enduring value of tools that let users solve problems for themselves.

The user explains that they reported and blocked the groper, and a Facebook “guide”, an experienced user trained and certified by Facebook, failed to intervene. They write, “I think what made it worse, was even after I reported, and eventually blocked the assaulter, the guide in the plaza did and said nothing.” In the interest of transparency, I have republished the beta user’s post in full, sans identifying information, here;

**Trigger Warning** Sexual Harassment. My apologies for the long post: Feel free to move on.

Good morning,

I rarely wake up with a heavy heart and a feeling of anger to start a fresh new day, but that is how I feel this morning. I want to be seen and heard. I reach out to my fellow community members in hopes of understanding and reassurance that they will be proactive in supporting victims and eliminating certain types of behavior in horizon worlds. My expectations as a creator in horizon worlds aren't unreasonable and I'm sure many will agree.

You see this isn't the first time, I'm sure it won't be the last time that someone has sexually harassed me in virtual reality. Sexual harassment is no joke on the regular Internet but being in VR adds another layer that makes the event more intense. Not only was I groped last night, but there were other people there who supported this behavior which made me feel isolated in the Plaza. I think what made it worse, was even after I reported, and eventually blocked the assaulter, the guide in the plaza did and said nothing. He moved himself far across the map as if to say, you're on your now.

Even though my physical body was far removed from the event, my brain is tricked into thinking it's real, because.....you know......Virtual REALITY. We can't tout VR's realness and then lay claim that it is not a real assault. Mind you, this all happened within one minute of arriving in the plaza, I hadn't spoken a word yet and could have possibly been a 12-year-old girl.

MY ASK:

I would like a personal bubble that will force people away from my avatar and I would like to be able to upload my own recording with my harassment ticket. I would also like that all guides are given sensitivity training on this specific subject, so they will understand what is expected. If META won't give guides tools that will allow them to remove a player immediately from a situation, at least train them to deal with it and not run away.

Rant over, I'm still mad, but I will sort through and process. I love this community and the thought of leaving it makes me deeply sad. So I am hopeful we can evolve as a community and foster behaviors that support collaboration, understand, and a willingness to speak out against gross behaviors.

Initial coverage in The Verge did not mention the victim’s use of the block feature, even as the user describes using it in the post above. Instead, reporter Alex Heath relayed Facebook’s account of the incident, saying “the company determined that the beta tester didn’t utilize the safety features built into Horizon Worlds, including the ability to block someone from interacting with you.”

These details are important because subsequent writing about the incident builds on the false, but purported non-use of the blocking feature to make the case that offering users tools to control their virtual experience is “unfair and doesn’t work.” In Technology Review, Tanya Basu makes hay of the user’s failure to use the “safe zone” feature, which temporarily removes users from their surroundings. Yet this is a red herring. The user might not have immediately disappeared into her safe zone, but she used the block feature to do away with her assailant.

In reality, contra Basu or Facebook’s description of events, it seems that user-directed blocking put a stop to the harm while the platform provided community guide failed to intervene. VR groping is a serious issue, but it is not one that will be solved from the top-down. Inaccurate reporting that casts user-operated moderation tools as ineffective may spur platforms to pursue less effective solutions to sexual harassment in VR.

Implications of the incident’s misreporting aside, it provides a useful case study in the difficulties of moderating VR. One suggestion put forward by the user and backed by University of Washington Professor Katherine Cross warrants discussion. Closer inspection of their proposals illustrates the careful tradeoffs that inform the current safe zone and blocking tools offered to Horizon users.

They request a “personal bubble that will force people away from my avatar” or “automatic personal distance unless two people mutually agreed to be closer.” This might make some groping harder, but it creates other opportunities for abuse.

If players’ avatars can take up physical space and block movement, keeping others at bay, then they can block doorways and trap other players in corners or against other parts of world. Player collision could render abuse inescapable or allow players to hold others’ avatars prisoner.

MMOs (Massively Multiplayer Online games) have long struggled with this problem – “holding the door” is only a contextually heroic action. Player collision makes gameplay more realistic, but allows some players to limit everyone else’s access to important buildings by loitering in the doorway.

Currently, players’ avatars in Horizon may pass through one another. They can retreat into a safe zone, disappearing from the world. They can also “block” other users – preventing both the blocked and blocking users from seeing one another. Even through a block, they can still see one each other’s nametags – total invisibility created problems I covered here. As such, the current suite of user moderation tools strikes a good balance between empowering users and minimizing new opportunities for misuse.

Finally, given the similarity of the transgression, it is worth recalling Julian Dibbell’s “A Rape in Cyberspace”, one of the first serious accounts of community governance online. In this Village Voice article, Dibbell relates how users of role-playing chatroom LambdaMOO (the best virtual reality to be had in 1993) responded to a string of virtual sexual assaults. After fruitless deliberation, a LambdaMOO coder banned the offending user. After the incident, LambdaMOO established democratic procedures for banning abusive users, and created a “boot” command allowing users to temporarily remove troublemakers.

As the internet has developed content moderation has centralized. Today, users are usually expected to let platforms moderate for them. However, just as in the web’s early days, empowering users remains the best solution to interpersonal abuse. The tools they need to keep themselves safe may be different, but in virtual reality as in role-playing chat, those closest to abuse are best positioned to address it. Users being harassed should not be expected to wait for the mods.

Will Duffield is a Policy Analyst at the Cato Institute

Filed Under: blocking, content moderation, horizon worlds, sexual harassment, user tools, vr
Companies: facebook, meta

Documents Shows Just How Much The FBI Can Obtain From Encrypted Communication Services

from the plenty-of-data-but-content-not-so-much dept

There is no "going dark." Consecutive FBI heads may insist there is, but a document created by their own agency contradicts their dire claims that end-to-end encryption lets the criminals and terrorists win.

Andy Kroll has the document and the details for Rolling Stone:

[I]n a previously unreported FBI document obtained by Rolling Stone, the bureau claims that it’s particularly easy to harvest data from Facebook’s WhatsApp and Apple’s iMessage services, as long as the FBI has a warrant or subpoena. Judging by this document, “the most popular encrypted messaging apps iMessage and WhatsApp are also the most permissive,” according to Mallory Knodel, the chief technology officer at the Center for Democracy and Technology.

The document [PDF] shows what can be obtained from which messaging service, with the FBI noting WhatsApp has plenty of information investigators can obtain, including almost real time collection of communications metadata.

WhatsApp will produce certain user metadata, though not actual message content, every 15 minutes in response to a pen register, the FBI says. The FBI guide explains that most messaging services do not or cannot do this and instead provide data with a lag and not in anything close to real time: “Return data provided by the companies listed below, with the exception of WhatsApp, are actually logs of latent data that are provided to law enforcement in a non-real-time manner and may impact investigations due to delivery delays.”

The FBI can obtain this info with a pen register order -- the legal request used for years to obtain ongoing call data on targeted numbers, including numbers called and length of conversations. With a warrant, the FBI can get even more information. A surprising amount, actually. According to the document, WhatsApp turns over address book contacts for targeted users as well as other WhatsApp users who happen to have the targeted person in their address books.

Combine this form of contact chaining with a few pen register orders, and the FBI can basically eavesdrop on hundreds of conversations in near-real time. The caveat, of course, is that the FBI has no access to the content of the conversations. That remains locked up by WhatsApp's encryption. Communications remain "warrant-proof," to use a phrase bandied about by FBI directors. But is it really?

If investigators are able to access the contents of a phone (by seizing the phone or receiving permission from someone to view their end of conversations), encryption is no longer a problem. That's one way to get past the going darkness. Then there's stuff stored in the cloud, which can give law enforcement access to communications despite the presence of end-to-end encryption. Backups of messages might not be encrypted and -- as the document points out -- a warrant will put those in the hands of law enforcement.

If target is using an iPhone and iCloud backups enabled, iCloud returns may contain WhatsApp data, to include message content.

This is a feature of cloud backups -- a way to retrieve messages if something goes wrong with someone's phone or their WhatsApp account. It's also a bug that makes encryption irrelevant. The same goes for Apple's iMessage service. Encryption or no, backups are not encrypted by service providers. In the case of Apple's iMessage, warrants for iCloud backups will give law enforcement the encryption key needed to decrypt the stashed messages.

On the other side, there are truly secure options that the FBI considers dead ends, starting with Signal. Signal retains no user info, which means there's nothing to be had no matter what paperwork the feds produce. But, for the most part, even encrypted messaging and email services generate metadata that can be obtained without a warrant. If investigators want more, warrants can actually result in investigators obtaining a great deal of information about users, their interactions, and their communications. And, as is noted directly above, it can also grant access to communications users mistakenly believed were beyond the reach of law enforcement.

But not everyone using encrypted services is a criminal, no matter what FBI directors say in public. Communications metadata being only a subpoena or pen register order away is concerning, especially for those who use encrypted services not only to maintain their own privacy, but to protect those they communicate with.

“WhatsApp offering all of this information is devastating to a reporter communicating with a confidential source,” says Daniel Kahn Gillmor, a senior staff technologist at the ACLU.

Those who truly understand the protocols and platforms they use for communications will understand the tradeoffs. For everyone else, there's this handy tip sheet, compiled by none other than the FBI, which explains exactly what each service retains and what each service will hand over in response to government paperwork.

It also shows that encryption isn't keeping law enforcement from pursuing investigations. In rare cases, investigators may have zero access to communications. But every communications platform or service creates a digital paper trail investigators can follow until they find something that breaks the case open. "Going dark" -- the idea that law enforcement is helpless in the face of increased use of encryption -- is a lie. And the FBI knows it.

Filed Under: 4th amendment, encryption, fbi, going dark, lawful access, subpoena, warrant
Companies: apple, facebook, meta, whatsapp

Facebook (Again) Tells Law Enforcement That Setting Up Fake Accounts Violates Its Terms Of Use

from the LAPD-teaching-respect-for-the-law-by-playing-by-its-own-rules-wtaf dept

Law enforcement agencies routinely engage in surveillance of social media accounts. Some of this is accomplished with third-party tools that use keywords and geofences to give cops info that may be relevant to investigations. These tools also give cops a lot of garbage data that law enforcement is free to sift through for officers' own entertainment or to bypass constitutional protections surrounding speech and warrantless searches.

Does it actually help combat crime? The jury (if a court would ever allow one to consider these issues…) is still out on that. But social media surveillance continues under the theory that anything someone published publicly should be accessible by cops since it's accessible by everyone else.

But the constitutional metric changes (or at least should) when cops set up fake accounts to engage in surveillance of suspected criminals. In these cases, cops may be welcomed into more private circles where information can't be accessed unless a person has been given access.

This isn't a new problem. It dates back to 2009, when Facebook was gaining critical mass and Twitter was just starting to generate enough interest to become (very eventually) sustainable. Twitter's account verification process allows users to engage without turning over much personal info. The same can't be said for Facebook, which would prefer to have its user base verified with as much personal info as possible -- something that was supposed to limit abusive behavior but just ended up giving the platform plenty of actionable (and sellable) demographic info. Facebook insisted on real people and real names and altered its policy to inform users that setting up bogus accounts was something that could result in account termination.

Cops didn't care. They had online lurking to do in hopes of finding something prosecutable without ever leaving the office. Facebook warned law enforcement that setting up fake accounts wasn't permissible in 2018 after news surfaced showing cops were bypassing these rules to do a little online fishing for potential criminals.

Facebook is now Meta. It is also still Facebook, albeit under a new umbrella corporation. The rules about "real names" still apply to Facebook account creation. And law enforcement officers are still continuing to ignore this rule. Three years after its last letter addressed to cops about terms of service violation Meta is sending out another one [PDF]. It reiterates what officers already know but are apparently of the belief Facebook/Meta won't actually do much to enforce.

The letter references Los Angeles Police Department activities exposed by the Brennan Center. The LAPD apparently encourages officers to set up fake accounts to locate and surveil criminal suspects. The practice is common enough that the LAPD actually has policies governing the use of social media surveillance via dummy accounts. But the policies ignore Facebook's rules, which take precedence over the LAPD's rules. After all, it's Facebook's platform, not the LAPD's playground.

According to the Brennan Center for Justice and media reports the Los Angeles Police Department (“LAPD”) has been instructing its officers to create fake (or “dummy”) Facebook accounts and impersonate legitimate users. Not only do LAPD instructional documents use Facebook as an explicit example in advising officers to set up fake social media accounts, but documents also indicate that LAPD policies simply allow officers to create fake accounts for “online investigative activity.” To the extent these practices are ongoing they violate our terms of service. While the legitimacy of such policies may be up to the LAPD, officers must abide by Facebook’s policies when creating accounts on our services. The Police Department should cease all activities on Facebook that involve the use of fake accounts, impersonation of others, and collection of data for surveillance purposes.

This alone won't prevent the LAPD from violating Facebook's terms of service to engage in online surveillance. Facebook will have to determine which accounts are fake and terminate them. But this letter gives the LAPD notice that when its bogus accounts are terminated, it will have zero recourse.

The letter also says the LAPD is violating other Facebook rules, albeit indirectly.

It has also come to our attention that the LAPD has used a third-party vendor to collect data on our platforms regarding our users. Under our policies, developers are prohibited from using data obtained on our platforms for surveillance, including the processing of platform data about people, groups, or events for law enforcement or national security purposes (https://developers.facebook.com/terms/#control).

Again, this won't stop the LAPD from utilizing services it's paid for. But it does make it clear that if Facebook ever decides to terminate access to this firehose being abused by third parties, neither the third parties or their LAPD beneficiaries will be able to do anything but bitch ineffectively about the loss of access to a surveillance tool.

Subterfuge is often essential to law enforcement investigations. But that doesn't mean private companies are obliged to provide cover for undercover surveillance. Law enforcement has been told (at least twice) that govern regular people also govern government employees -- people who often seem to believe they're above rules, laws, and even the rule of law.

Filed Under: fake accounts, impersonation, lapd, law enforcement, police
Companies: facebook, meta