Everything That's Wrong With Social Media And Big Internet Companies: Part 1

from the and-there's-more-to-come dept

Some of today's anxiety about social-media platforms is driven by the concern that Russian operatives somehow used Facebook and Twitter to affect our electoral process. Some of it's due a general perception that big American social-media companies, amorally or immorally driven by the profit motive, are eroding our privacy and selling our data to other companies or turning it over to the government—or both. Some of it's due to the perception that Facebook, Twitter, Instagram, and other platforms are bad for us—that maybe even Google's or Microsoft's search engines are bad for us—and that they make us worse people or debase public discourse. Taken together, it's more than enough fodder for politicians or would-be pundits to stir up generalized anxiety about big tech.

But regardless of where this moral panic came from, the current wave of anxiety about internet intermediaries and social-media platforms has its own momentum now. So we can expect many more calls for regulation of these internet tools and platforms in the coming months and years. Which is why it's a good idea to itemize the criticisms we've already seen, or are likely to see, in current and future public-policy debates about regulating the internet. We need to chart the kinds of arguments for new internet regulation that are going to confront us, so I've been compiling a list of them. It's a work in progress, but here are three major claims that are driving recent expressions of concern about social media and internet companies generally.

(1) Social media are bad for you because they use algorithms to target you, based on the data they collect about you.

It's well-understood now that Facebook and other platforms gather data about what interests you in order to shape what kinds of advertising you see and what kind of news stories you see in your news feed (if you're using a service that provides one). Some part of the anxiety here is driven by the idea (more or less correct) that an internet company is gathering data about your likes, dislikes, interests, and usage patterns, which means it knows more about you in some ways than perhaps your friends (on social media and in what we now quaintly call "real life") know about you. Possibly more worrying than that, the companies are using algorithms—computerized procedures aimed at analyzing and interpreting data—to decide what ads and topics to show you.

It's worth noting, however, that commercial interests have been gathering data about you since long before the advent of the internet. In the 1980s and before in the United States, if you joined one book club or ordered one winter coat on Land's End, you almost certainly ended up on mailing lists and received other offers and many, many mail-order catalogs. Your transactional information was marketed, packaged, and sold to other vendors (as was your payment and credit history). If false information was shared about you, you perhaps had some options ranging from writing remove-me-from-your-list letters to legal remedies under the federal Fair Credit Reporting Act. But the process was typically cumbersome, slow, and less-than-completely satisfactory (and still is when it comes to credit-bureau records). One advantage with some internet platforms is that (a) they give you options to quit seeing ads you don't like (and often to say just why you don't like them), and (b) the internet companies, anxious about regulation, don't exactly want to piss you off. (In that sense, they may be more responsive than TiVo could be.)

Of course it's fair—and, I think, prudent—to note that the combination of algorithms and "big data" may have real consequences for democracy and for freedom of speech. Yale's Jack Balkin has recently written an excellent law-review article that targets these issues. At the same time, it seems possible for internet platforms to anonymize data they collect in ways that pre-internet commercial enterprises never could.

(2) Social Media are bad for you because they allow you to create a filter bubble where you see only (or mostly) opinions you agree with. (2)(a) Social media are bad for you because they foment heated arguments between you and those you disagree with.

To some extent, these two arguments run against each other—if you only hang out online with people who think like you, it seems unlikely that you'll have quite so many fierce arguments, right? (But maybe the arguments between people who share most opinions and backgrounds are fiercer?) In any case, it seems clear that both "filter bubbles" and "flames" can occur. But when they do, statistical research suggests, it's primarily because of user choice, not algorithms. In fact, as a study in Public Opinion Quarterly reported last year, the algorithmically driven social-media platforms may be both increasing polarization and increasing users' exposures to opposing views. The authors summarize their conclusions this way:

"We find that social networks and search engines are associated with an increase in the mean ideological distance between individuals. However, somewhat counterintuitively, these same channels also are associated with an increase in an individual's exposure to material from his or her less preferred side of the political spectrum."

In contrast, the case that "filter bubbles" are a particular, polarizing problem relies to a large degree not on statistics but on anecdotal evidence. That is, the people who don't like arguing or who can't bear too different a set of political opinions tend to curate their social-media feeds accordingly, while people who don't mind arguments (or even love them) have no difficulty encountering heterodox viewpoints on Facebook or Twitter. (At various times I've fallen into one or the other category on the internet, even before the invention of social media or the rise of Google's search engine.)

The argument about “filter bubbles”—people self-segregating and self-isolating into like-minded online groups—is an argument that predates modern social media and the dominance of modern search engines. Law professor Cass Sunstein advanced it in his 2001 book, Republic.com and hosted a website forum to promote that book. I remember this well because I showed up in the forum to express my disagreement with his conclusions—hoping that my showing up as a dissenter would itself raise questions about Sunstein's version of the “filter bubble” hypothesis. I didn't imagine I'd change Sunstein's mind, though, so I was unsurprised to see the professor has revised and refined his hypothesis, first in Republic.com 2.0 in 2007 and now in #Republic: Divided Democracy in the Age of Social Media, published just this year.

(3) Social media are bad for you because they are profit-centered, mostly (including the social media that don't generate profits).

"If you're not paying for the product, you're the product." That's a maxim with real memetic resonance, I have to admit. This argument is related to argument number 1 above, except that instead of focusing on one's privacy concerns, it's aimed at the even-more-disturbing idea that we're being commodified and sold by the companies who give us free services. This necessarily includes Google and Facebook, which provide users with free access but which gather data that is used primarily to target ads. Both of those companies are profitable. Twitter, which also serves ads to its users, isn't yet profitable, but of course aspires to be.

As a former employee of the Wikimedia Foundation—which is dedicated to providing Wikipedia and other informational resources to everyone in the world, for free—I don't quite know what to make of this. Certainly the accounts of the early days of Google or of Facebook suggest that advertising as a mission typically arose after the founders realized that their new internet services needed to make money. But once any new company starts making money by the yacht-load, it's easy to dismiss the whole enterprise as essentially mercenary.

(In Europe, much more ambivalent to commercial enterprises than the United States, it's far more common to encounter this dismissiveness. This helps explain some the Europe's greater willingness to regulate the online world. The fact that so many successful internet companies are American also helps explain that impulse.)

But Wikipedia has steadfastly resisted even the temptation to sell ads—even though it could have become an internet commercial success just as IMDB.com has—because the Wikipedia volunteers and the Wikimedia Foundation see value in providing something useful and fun to everyone regardless of whether one gets rich doing so. So do the creators of free and open-source software. If creating free products and services doesn't always mean you're out to sell other people into data slavery, shouldn't we at least consider the possibility that social-media companies may really mean it when they declare their intentions to do well by doing good? (“Do Well By Doing Good” is a maxim commonly attributed to Benjamin Franklin—who of course sold advertising, and even wrote advertising copy, for his Pennsylvania Gazette.) I think it's a good idea to follow Mike Masnick's advice to stop repeating this “you're the product” slogan—unless you're ready to condemn all traditional journals that subsidize giving their content to you through advertising.

So that's the current top three chart-toppers for the Social Media-Are-Bad-For-You Greatest Hits. But this is a crowded field—only the tip of the iceberg when it comes to trendy criticisms of social-media platforms, search engines, and unregulated mischievous speech on the internet--and we expect to see many other competing criticisms of Facebook, Twitter, Google, etc. surface in the weeks and months to come. I'm already working on Part 2.

Update: It took some time, but Part 2 and Part 3 are now available.

Mike Godwin (@sfmnemonic) is a Distinguished Senior Fellow at the R Street Institute.

Filed Under: filter bubble, internet, power, privacy, social media
Companies: facebook, google, twitter

Yet Another Legal Action By Dogged Privacy Activist Brings Good News And Bad News For Facebook In EU's Highest Court

from the Max-Schrems-strikes-again dept

The Austrian privacy activist Max Schrems has appeared a few times on Techdirt, as he conducts his long-running campaign to find out what Facebook is doing with his personal data, and to take back control of it. In 2011, he obtained a CD-ROM (remember those?) containing all the information that Facebook held about him at that time. More dramatically, in 2015 Schrems persuaded the Court of Justice of the European Union (CJEU) that the Safe Harbor framework for transferring personal data from the EU to the US was illegal under EU laws because of the NSA's spying, as revealed by Edward Snowden. As Schrem's detailed commentary (pdf) on that CJEU judgment explains, the case was specifically about Facebook, although it applied much more generally. Last month, we wrote about another case, currently being referred to the CJEU, concerning Facebook's use of standard contractual clauses (SCCs) (pdf), also known as "model clauses". It's an alternative legal approach for transferring data across the Atlantic, and if the CJEU rules against Facebook again, it could make things rather difficult for the big US Internet companies (but ordinary businesses won't be affected much.)

You might think that all these Facebook cases would be more than enough for any privacy activist, but not for Schrems, apparently. He is engaged in yet another legal action that involves Facebook (pdf). As Schrems explains:

[he] has sued Facebook over his private Facebook account at his home court in Vienna, Austria. Schrems accuses Facebook to massively violate strict European privacy laws. The lawsuit includes claims from invalid privacy policies all the way to data sharing with US intelligence services. In addition to bringing his personal claims, he also invited other users to sign over their rights to him, to form a so-called "Austrian style class action" against Facebook, in which he represents other users on a pro bono basis.

This legal action is rather different from the others discussed above, and involves Schrems personally suing Facebook in Austria using civil law. Unusually, he also gathered 25,000 people to join him in a class action against Facebook, each asking for €500 damages. Because of the importance of the legal questions under discussion, Austria's supreme court referred them to the CJEU for a definitive ruling. As is usual, before the CJEU judges themselves rule, one of the court's Advocates General offered a legal opinion, which has just been published. Two questions were considered: whether Schrems could bring a case at all, and whether a class action was possible. Here's Schrems' explanation of what the Advocate General (AG) said for the first issue:

Facebook tried to argue that Mr Schrems cannot bring a lawsuit at his home court, as he would not qualify as a consumer, but as a business. This is despite the fact that the courts have found, that the lawsuit is organized on a pro bono basis and he never used his Facebook account in any commercial way.

The strategy of Facebook was to force Schrems to bring his lawsuit at Facebook's home court in Dublin -- where a single case of €500 could cost Millions in legal fees. This was clearly rejected by the AG, just like previously by the Higher Regional Court in Vienna: Individuals that fight for their rights as volunteers are not 'businesses' and can enjoy their consumer rights. The AG confirmed: Mr Schrems can bring a 'model case' in Vienna.

On the second question:

the advocate general accepted Facebook's point of view: An "Austrian style class action" is only admissible against an Austrian company -- but not if an Austrian consumer sues a company in another EU member state [Facebook's EU operations have their headquarters in Ireland].

Schrems spends some time explaining why he thinks the Advocate General is wrong, and it's worth reading his thoughts here, since Schrems is naturally something of an expert in this domain after all these years. But as he also points out, what counts is what the five judges who will consider the case at the CJEU decide. Although they usually accept the reasoning of the Advocate General, they don't have to and sometimes disagree. Schrems thinks their judgment will be handed down in January 2018, after which the case will go back to the Austrian courts to make a final ruling based on the CJEU's findings.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cjeu, data protection, eu, max schrems, privacy, social media
Companies: facebook

Dozens Of Tech Experts Tell DHS & ICE That Its Social Media Surveillance And Extreme Vetting Should Be Stopped

from the bad-policies dept

Last week dozens of well known technologists sent a letter to Homeland Security arguing that Immigration & Customs Enforcement's (ICE) plans to use technology for "extreme vetting" is a really, really dumb idea.

According to its Statement of Objectives, the Extreme Vetting Initiative seeks to make “determinations via automation” about whether an individual will become a “positively contributing member of society” and will “contribute to the national interests.” As far as we are aware, neither the federal government nor anyone else has defined, much less attempted to quantify, these characteristics. Algorithms designed to predict these undefined qualities could be used to arbitrarily flag groups of immigrants under a veneer of objectivity.

Inevitably, because these characteristics are difficult (if not impossible) to define and measure, any algorithm will depend on “proxies” that are more easily observed and may bear little or no relationship to the characteristics of interest. For example, developers could stipulate that a Facebook post criticizing U.S. foreign policy would identify a visa applicant as a threat to national interests. They could also treat income as a proxy for a person’s contributions to society, despite the fact that financial compensation fails to adequately capture people’s roles in their communities or the economy.

The Extreme Vetting Initiative also aims to make automated determinations about whether an immigrant “intends to commit” terrorism or other crime. However, there is a wealth of literature demonstrating that even the “best” automated decisionmaking models generate an unacceptable number of errors when predicting rare events. On the scale of the American population and immigration rates, criminal acts are relatively rare, and terrorist acts are extremely rare. The frequency of individuals’ “contribut[ing] to national interests” is unknown. As a result, even the most accurate possible model would generate a very large number of false positives - innocent individuals falsely identified as presenting a risk of crime or terr

In short, this is the tech world telling DHS and ICE that its belief that there's a "nerd harder" solution to using computers and algorithms to sniff out terrorists is a load of pure hooey. It may be true, as Arthur C. Clarke once stated, that "any sufficiently advanced technology is indistinguishable from magic," but the corollary does not apply: not all magical solutions can be implemented in technology. It's kind of ridiculous that actual technologists were needed to explain this to DHS, but that's where things are these days.

Filed Under: automation, bots, dhs, extreme vetting, ice, immigration, social media

Defense Department Spied On Social Media, Left All Its Collected Data Exposed To Anyone

from the not-cool-guys dept

There are two big WTFs in this story. First, the Defense Departments Central Command (Centcom) was collecting tons of data on social media posts... and then the bigger one, they somehow left all the data they collected open on an Amazon AWS server. This was discovered -- as so many examples of careless data exposure on Amazon servers -- by Chris Vickery and UpGuard, who have their own post about the mess. You may recall Vickery from such previous stories as when the GOP left personal data on 200 million voters on an open Amazon server. Or when Verizon left private data available on millions of customers. Or when a terrorist watch list was left (you guessed it) on an open server. Or when he discovered that Hollywood studios were leaving their own screeners available on an open server. In short, this is what Vickery seems particularly good at: finding large organizations leaving sensitive data exposed on a server.

You would think (wouldn't you?) that Centcom would be better about these things than, say, Verizon or the GOP or Hollywood. But, nope.

"[It's] a pretty serious leak when you're talking about intelligence information being stored in an Amazon cloud service and not properly safeguarded," said Timothy Edgar, a former White House official in the Obama administration and former U.S. intelligence official.

Centcom's response is... sketchy. It uses the important term "unauthorized access," which suggests that it may be pushing for CFAA charges against Vickery/Upguard, since "unauthorized access" is a key part of the CFAA:

"We determined that the data was accessed via unauthorized means by employing methods to circumvent security protocols," said Maj. Josh Jacques, a spokesperson for U.S. Central Command. "Once alerted to the unauthorized access, Centcom implemented additional security measures to prevent unauthorized access."

But if it was truly left open, then the access was not "unauthorized." Indeed, it appears that Centcom went for convenience over security by making its Amazon S3 bucket open for access, and hoping obscurity would hide it.

Amazon servers where data is stored, called S3 buckets, are private by default. Private means only authorized users can access them. For one to be made more widely accessible, someone would have to configure it to be available to all Amazon Web Services users, but users would need to know or find the name of the bucket in order to access it.

By searching specific keywords, Vickery identifies information that companies and organizations inadvertently expose. In this case, he looked for buckets containing the word "com."

Three S3 buckets were configured to allow anyone with an Amazon Web Services account to access them. They were labeled "centcom-backup," "centcom-archive" and "pacom-archive," Vickery said.

As for just what Centcom was doing here -- it does appear that it was publicly available social media content, so that's less of a direct concern, but it still does make you wonder why Centcom was storing all of this social media info. There are also, of course, related concerns about the US Defense Department conducting surveillance on Americans. This is from Upguard's post on the matter (linked above):

The data exposed in one of the three buckets is estimated to contain at least 1.8 billion posts of scraped internet content over the past 8 years, including content captured from news sites, comment sections, web forums, and social media sites like Facebook, featuring multiple languages and originating from countries around the world. Among those are many apparently benign public internet and social media posts by Americans, collected in an apparent Pentagon intelligence-gathering operation, raising serious questions of privacy and civil liberties.

While a cursory examination of the data reveals loose correlations of some of the scraped data to regional US security concerns, such as with posts concerning Iraqi and Pakistani politics, the apparently benign nature of the vast number of captured global posts, as well as the origination of many of them from within the US, raises serious concerns about the extent and legality of known Pentagon surveillance against US citizens. In addition, it remains unclear why and for what reasons the data was accumulated, presenting the overwhelming likelihood that the majority of posts captured originate from law-abiding civilians across the world.

I know that the US government still has this "collect it all" mentality, but as we've discussed over and over again, adding more hay to the haystack doesn't make it easier to find the needles.

Filed Under: amazon s3, aws, centcom, chris vickery, defense department, exposed, social media, surveillance
Companies: amazon, upguard

And Another Thing: Those Dumb Social Media Guidelines For Journalists Are Going To Paint A Target On Their Backs

from the unintended-consequences dept

Just last week we discussed the alarming trend in media companies for putting in place restrictive social media policies for their employees, including their opinion commentators. In that post, we focused on how this move is both dumb and bad for two reasons. First, restricting the opinions of those followed by the public for their opinions is flatly nonsensical. Second, the goal of these policies -- to have the public view companies as non-partisan -- is simply a fantasy in these hyper-partisan times. Nobody is going to decide that the New York Times or Wall Street Journal are suddenly bastions of non-partisanship simply because either muzzled its staff.

But there is another negative consequence of these policies that the original post didn't touch: it paints a target on the backs of the employees it governs. Because of, again, hyper-partisanship that has reached true trolling levels, these social media policies will be wielded like a cudgel by every trollish dissenter that doesn't like a particular media outlet. The New York Times, for example, is already having to endure this.

You can see what I mean. Because of a social media policy looking to strip anything that might even appear partisan from the social media output of its employees, the New York Times has given true partisans a weapon to wield. A weapon, I might add, vague enough to be a perfect weapon for trollish behavior. When a pair of quotation marks around a word can be used to threaten someone's employment, particularly when the person threatening has a history of contacting the employers of journalists, we have a problem.

The solution to this is quite simple. Any media property, conservative or liberal, that is contacted by someone like this bitching about partisan reporting, should have but one response for that person: shove off. Particularly in the realm of opinion politics, cries of bias have reached the level of wolf-crying. It's expected, it means nothing, and it is easily ignored. Again, I mean for that to apply to both sides of the political aisle.

But the social media policy disrupts the New York Times' ability to flick away the concerns of a partisan booger. Because of the policy, the booger must be heard and, I imagine, the booger's claims must be validated or invalidated. That, in case it wasn't clear, is fairly stupid and counterproductive.

Stop arming boogers, media companies.

Filed Under: journalism, social media, social media guidelines

ESPN Joins List Of Companies Enforcing Stringent Social Media Policies, Which Is Both Bad And Stupid

from the everything-is-politics dept

In these times in which I have spent many words and more calories lamenting the hyper-partisan uber-politicization of, well, pretty much everything, I have tended to focus on the primary effects of that silliness. It makes for bad elections, and therefore bad democracy. It grinds any kind of progress in government to a halt. It results in too many people making too little time to actualy listen to those that might not think as they do, instead devolving entirely too many conversations into soundbite name-calling, as though we were all participating on some national cable news roundtable.  

But the secondary effects of all of this are both important and terrible as well. An example of this can be found in major media companies responding to this partisanship, and particularly the silly amount of noise being made about how media itself is partisan, by instituting social media policies that are both draconian and stupid on the business side. And, if this sort of thing makes you feel any better, it happens on both sides of the political aisle. In recent weeks, for instance, both the New York Times and Wall Street Journal have rolled out social media policies disallowing their respective journalists from publishing anything partisan.

The New York Times waded back into this particular swamp when it introduced an update to its social-media guidelines earlier this month, and reinforced the fact that its journalists are not to express any “partisan opinion” on social. The Times also noted that while reporters might be using these accounts on their personal time, anything said on them is the purview of the paper because of their association with it.

Not to be outdone, The Wall Street Journal this week released an update to its social-media policy. It reiterated the existing prohibition against “posting partisan comments on social networking sites,” and added that the paper’s management believes some reporters and editors “are spending too much time tweeting.”

This is silly for a number of reasons, chief among them that it will not have the desired effect. The New York Times will still be the dirty liberal communist left for those of a certain lean, while the Wall Street Journal won't be suddenly seen as the bastion of the middle ground for those of another. Stifling the social media presence of your media personalities to cultivate some non-partisan moniker is laughable. But it's also bad for business. People follow those media personalities, many of them that do opinion-based work, because they want to know what those personalities think. Slapping duct tape over the mouths of those that are the magnet for a media company's audience is the exact opposite of what they should be doing. For those more on the journalistic side than opinion side of things, it's slightly more understandable for a media property to want to appear politically even, except that we already said that wasn't going to happen.

And if you thought this was only going on in the arena of traditional news media, you're wrong. ESPN too, in the wake of the Jemele Hill vs. the White House episode, has gone further and required that their personalities not do things that draw any attention to ESPN that it doesn't want. And if you think that sounds vague, that's how the actual policy is written.

ESPN distributed new social media guidelines to its employees Thursday, which reinforced some existing rules about not breaking news exclusively on social media, respecting colleagues, and—oh wait, here’s a new thing: “Do nothing that would undercut your colleagues’ work or embroil the company in unwanted controversy.”

How is the average sports commentator or journalist supposed to know which types of controversy the company might want and which it doesn't? It's worth remembering that ESPN is essentially a marketing company more than it is in the journalism business. It wants attention, generally speaking. More attention, more eyeballs, more money. At least the New York Times and Wall Street Journal had the common decency to list an actual offense to avoid: partisanship. ESPN's guidelines instead puts its employees' employment at the pleasure of whether or not enough of the public will be upset at what they say on social media to warrant "controversy." That's crazy.

And even more so than with straight news media outlets, sports journalism and ESPN are almost entirely opinion-based. So ESPN wants to take people that follow its personalities for their opinions...and tell them not to be opinionated on social media? That doesn't make any sense. And, again, it won't achieve its goal. ESPN is the land of the socialists. We know so because Rush Limbaugh told us as much. No social media policy is going to change that.

The ultimate cure for this is, of course, the normalization of our political discourse, moving it back to the more reasoned discussions we at least think we remember having. These social media policies are a symptom of the problem, not a cure to it.

Filed Under: bias, journalism, opinions, social media
Companies: espn

Don't Cheer For The Twitter Employee Who Deleted Donald Trump's Account

from the that's-a-bad-thing dept

As you probably have heard, last night for a period of 11 minutes, Donald Trump's Twitter account looked like this:

Not surprisingly, lots of people noticed quickly... and, then it came back. Soon after, Twitter admitted it was "inadvertently deactivated due to human error by a Twitter employee." Two hours later, this message was clarified to say that "done by a Twitter customer support employee... on the employee's last day."

This, in turn, led a bunch of folks on Twitter to start gleefully praising this employee (whose name is not yet known, but likely will be soon). Because it's Twitter, and Twitter can get giddy over stuff like this, there were lots of jokes and people calling this employee a hero and whatnot. (Update: A new report says that it wasn't even a full-time employee, but a contractor).

I take a very different view on this. Earlier this year, Cathy Gellis wrote a post here explaining why it would be a bad idea to kill Trump's Twitter account. You can read that post for details, but the larger point is that under no circumstances would such a move be viewed as anything other than a political statement. Twitter more or less admitted this a few weeks back when it made a public statement saying that it considers "newsworthiness" as a factor in determining whether a tweet violates its terms. And, by definition, the President's tweets are newsworthy.

The larger question, honestly, is how the hell a customer service rep, especially one who wasn't even a full time employee, but a contractor -- on his or her last day -- had the power to simply delete the President's twitter account. You can see how things got to this point: I'm sure in the early days, just about anyone could delete someone's account on the platform. Over time, I assume that the power was limited more and more to customer service reps -- but they were still granted the power to do so if it was necessary. But it's fairly incredible that there aren't at least some controls on this -- requiring a second person's permission? Locking certain key Twitter accounts? -- that would make what this employee did impossible.

And, of course, it's raising lots of other questions. Did this customer service rep have the ability to tweet as Trump? Considering how quickly the world reacts to Trump tweets, that could create serious havoc. I'm sure we'll be hearing plenty more on this soon, and Twitter will eventually share some sort of post mortem on new processes and controls that have been put in place, but the fact that this even happened in the first place is not a cause for celebration, but one for concern about how Twitter's controls and processes work.

Filed Under: controls, deleted accounts, donald trump, social media
Companies: twitter

Spinoff: Whatever The Reports About Russian Trolls Buying Ads Is Initially, It's Way, Way Worse

from the multiplication dept

With several reports about data breaches occurring over the past few years, we've developed something of a mantra around here: it's always, always worse than first reported. Yahoo just went through this having finally admitted that literally every email account was compromised way back in 2013 after having first said it was only a few hundred thousand accounts that were impacted. Deloitte and Equifax followed this same playbook with their own breaches, trickling out little by little just how wide an impact those hacks had achieved.

And now we're seeing something of a spinoff of that mantra when it comes to the impact Russian trolls and the now infamous Internet Research Agency (IRA) advertising buys had on Facebook. You may recall that everything about this story seemed fairly minimalist in the initial reporting. The amount of money spent on the ad-buy itself was low enough to induce eyerolls from many. Facebook itself estimated that 11.4 million people saw ads bought by the IRA over the course of two years or so, which is not the kind of number that sets off all four alarms at the democracy firehouse. But Facebook has now given everyone a better idea of how much reach these ads actually had. And these numbers are far more alarming.

Facebook will inform lawmakers this week that roughly 126 million Americans may have been exposed to content generated on its platform by the Russian government-linked troll farm known as the Internet Research Agency between June 2015 and August 2017, CNN has learned. In written testimony to the Senate Judiciary Subcommittee on Crime and Terrorism, a copy of which was obtained by CNN, Facebook General Counsel Colin Stretch says that 29 million people were served content directly from the Internet Research Agency, and that after sharing among users is accounted for, a total of "approximately 126 million people" may have seen it.

Facebook does not know, however, how many of those 126 million people actually saw one of those posts, or how many may have scrolled past it or simply not logged in on the day that one of the posts was being served in their News Feed.

The inability to nail down just how many eyeballs viewed these ads is, of course, due to the nature of social media. Buying the ads and targeting primary viewers of them is one thing, but it's the sharing and re-sharing of those ads that extend their reach exponentially. And it's quite nice of Facebook to come right out and admit that it actually has no idea how many people viewed these ads, even as it offers up estimates to the contrary.

This is a feature of a social media platform like Facebook, not a bug. And, to the IRA's credit, it's a brilliant and inexpensive method for having some measure of influence in a foreign country's democracy. Facebook builds a sharing tool and these folks take advantage of the very nature of that tool.

Which is what makes Facebook's attempt to downplay all of this all the more perplexing.

Nevertheless, Facebook says in its testimony that the posts from those pages represented "a tiny fraction of the overall content on Facebook."

"This equals about four-thousandths of one percent (0.004%) of content in News Feed, or approximately 1 out of 23,000 pieces of content," Stretch writes. "Put another way, if each of these posts were a commercial on television, you'd have to watch more than 600 hours of television to see something from the IRA."

Except, as Facebook and Colin Stretch damned well know, Facebook doesn't operate anything remotely like television. Nor do its ads. The engagement process of those ads is wildly different. The ability to share those ads is not a feature of television. The granular targeting for eyeballs of those ads is simply not something that can be achieved by television advertising. The geographic targeting specifically, with an eye on influencing votes and the outcome of an election, is simply not a feature available to traditional television advertising. I know why Facebook wants to pretend otherwise in this instance, but it simply isn't true.

So, even as some are trying to downplay the impact, and even the existence, of this foreign intervention into our election cycle, it's worth acknowledging that these things, like data breaches, tend to be worse than first reported. And no obfuscation from Facebook about how much like television it is can change the raw numbers, or its acknowledgement that it doesn't actually know how many people saw this stuff.

Filed Under: russia, social media, trolls
Companies: facebook, internet research agency, twitter

Government Drops Its Demand For Data On 6,000 Facebook Users

from the sunlight-disinfectant dept

It's amazing what effect a little public scrutiny has on government overreach. In the wake of inauguration day protests, the DOJ started fishing for information from internet service providers. First, it wanted info on all 1.2 million visitors of a protest website hosted by DreamHost. After a few months of bad publicity and legal wrangling, the DOJ was finally forced to severely restrict its demands for site visitor data.

Things went no better with the warrants served to Facebook. These demanded a long list of personal information and communications from three targeted accounts, along with the names of 6,000 Facebook users who had interacted with the protest site's Facebook page. Shortly before oral arguments were to be heard in the Washington DC court, the DOJ dropped its gag order.

The last minute removal of the gag order appears to have been done to avoid the establishment of unfavorable precedent. It looks like the government perhaps has further concerns about precedential limitations on warrants served to service providers. As Kate Conger reports for Engadget, the DOJ has decided to walk away from this particular warrant challenge.

In a court hearing today, the Department of Justice dropped its request for the names of an estimated 6,000 people who “liked” a Facebook page about an Inauguration Day protest, the American Civil Liberties Union said. The ACLU challenged several warrants related to protests against President Trump’s inauguration on Friday, one of which included the search, claiming they were over-broad.

The ACLU notes the judge seemed sympathetic to allegations of overreach. In response, the government has apparently reduced its demands to info from two arrested protestors' accounts and further limited the date range from which data is sought.

This isn't a good look for the government. Dropping demands before an order has been issued indicates the DOJ had some idea its demands were too broad. It also shows the government will make concessions, rather than risk adverse rulings.

Then there's the whole issue of seeking personal information on protesters. This sort of thing creates a very real chilling effect by threatening to turn over personal information to the same entity the protesters were protesting. Fortunately, the government has walked back most of its demands in both cases.

Filed Under: disruptj20, doj, inauguration, privacy, social media, warrant
Companies: aclu, facebook

Another Ridiculous Lawsuit Hopes To Hold Social Media Companies Responsible For Terrorist Attacks

from the from-an-alternate-reality-where-Section-230-doesn't-exist dept

Yet another lawsuit has been filed against social media companies hoping to hold them responsible for terrorist acts. The family of an American victim of a terrorist attack in Europe is suing Twitter, Facebook, and Google for providing material support to terrorists. [h/t Eric Goldman]

The lawsuit [PDF] is long and detailed, describing the rise of ISIS and use of social media by the terrorist group. It may be an interesting history lesson, but it's all meant to steer judges towards finding violations of anti-terrorism laws rather than recognize the obvious immunity given to third party platforms by Section 230.

When it does finally get around to discussing the issue, the complaint from 1-800-LAW-FIRM (not its first Twitter terrorism rodeo…) attacks immunity from an unsurprising angle. The suit attempts to portray the placement of ads on alleged terrorist content as somehow being equivalent to Google, Twitter, et al creating the terrorist content themselves.

When individuals look at a page on one of Defendants’ sites that contains postings and advertisements, that configuration has been created by Defendants. In other words, a viewer does not simply see a posting; nor does the viewer see just an advertisement. Defendants create a composite page of content from multiple sources.

Defendants create this page by selecting which advertisement to match with the content on the page. This selection is done by Defendants’ proprietary algorithms that select the advertisement based on information about the viewer and the content being. Thus there is a content triangle matching the postings, advertisements, and viewers.

Although Defendants have not created the posting, nor have they created the advertisement, Defendants have created new unique content by choosing which advertisement to combine with the posting with knowledge about the viewer.

Thus, Defendants’ active involvement in combining certain advertisements with certain postings for specific viewers means that Defendants are not simply passing along content created by third parties; rather, Defendants have incorporated ISIS postings along with advertisements matched to the viewer to create new content for which Defendants earn revenue, and thus providing material support to ISIS.

This argument isn't going to be enough to bypass Section 230 immunity. According to the law, the only thing social media companies are responsible for is the content of the ads they place. That they're placed next to alleged terrorist content may be unseemly, but it's not enough to hurdle Section 230 protections. Whatever moderation these companies engage in does not undercut these protections, even when their moderation efforts fail to weed out all terrorist content.

The lawsuit then moves on to making conclusory statements about these companies' efforts to moderate content, starting with an assertion not backed by the text of filing.

Most technology experts agree that Defendants could and should be doing more to stop ISIS from using its social network.

Following this sweeping assertion, two (2) tech experts are cited, both of whom appear to be only speaking for themselves. More assertions follow, with 1-800-LAW-FIRM drawing its own conclusions about how "easy" it would be for social media companies with millions of users to block the creation of terrorism-linked accounts [but how, if nothing is known of the content of posts until after the account is created?] and to eliminate terrorist content as soon as it goes live.

The complaint then provides an apparently infallible plan for preventing the creation of "terrorist" accounts. Noting the incremental numbering used by accounts repeatedly banned/deleted by Twitter, the complaint offers this "solution."

What the above example clearly demonstrates is that there is a pattern that is easily detectable without reference to the content. As such, a content-neutral algorithm could be easily developed that would prohibit the above behavior. First, there is a text prefix to the username that contains a numerical suffix. When an account is taken down by a Defendant, assuredly all such names are tracked by Defendants. It would be trivial to detect names that appear to have the same name root with a numerical suffix which is incremented. By limiting the ability to simply create a new account by incrementing a numerical suffix to one which has been deleted, this will disrupt the ability of individuals and organizations from using Defendants networks as an instrument for conducting terrorist operations.

Prohibiting this conduct would be simple for Defendants to implement and not impinge upon the utility of Defendants sites. There is no legitimate purpose for allowing the use of fixed prefix/incremental numerical suffix name.

Take a long, hard look at that last sentence. This is the sort of assertion someone makes when they clearly don't understand the subject matter. There are plenty of "legitimate purposes" for appending incremental numerical suffixes to social media handles. By doing this, multiple users can have the same preferred handle while allowing the system (and the users' friends/followers) to differentiate between similarly-named accounts. Everyone who isn't the first person to claim a certain handle knows the pain of being second... third… one-thousand-three-hundred-sixty-seventh in line. While this nomenclature process may allow terrorists to easily reclaim followers after account deletion, there are plenty of non-ominous reasons for allowing incremental suffixes.

That's indicative of the lawsuit's mindset: terrorist attacks are the fault of social media platforms because they've "allowed" terrorists to communicate. But that's completely the wrong party to hold responsible. Terrorist attacks are performed by terrorists, not social media companies, no matter how many ads have been placed around content litigants view as promoting terrorism.

Finally, the lawsuit sums it all up thusly: Monitoring content is easy -- therefore, any perceived lack of moderation is tantamount to direct support of terrorist activity.

Because the suspicious activity used by ISIS and other nefarious organizations engaged in illegal activities is easily detectable and preventable and that Defendants are fully aware that these organizations are using their networks to engage in illegal activity demonstrates that Defendants are acting knowingly and recklessly allowing such illegal conduct.

Unbelievably, the lawsuit continues from there, going past its "material support" Section 230 dodge to add claims of wrongful death it tries to directly link to Twitter, et al's allegedly inadequate content moderation.

The conduct of each Defendant was a direct, foreseeable and proximate cause of the wrongful deaths of Plaintiffs’ Decedent and therefore the Defendants’ are liable to Plaintiffs for their wrongful deaths.

This is probably the worst "Twitter terrorism" lawsuit filed yet, but quite possibly exactly what you would expect from a law firm with a history of stupid social media lawsuits and a phone number for a name.

Filed Under: cda 230, isis, material support, section 230, social media, terrorism
Companies: 1-800-law-firm, facebook, google, twitter