Facebook's Terrible, Horrible, No Good, Very Bad Privacy Week

from the isn't-that-every-week dept

I know that some will argue that "every week" is a bad week for Facebook with regards to privacy, but this week in particular is looking especially awful, with (last I checked!) three "big" stories regarding the company's bad decisions and handling regarding data. Of course, because this is Facebook, I still think the reporting is getting the story a bit wrong. The story that has gotten the most attention is the least concerning, while the ones getting less attention are the real problems.

First up is the NBC News story going through a big pile of leaked internal documents from its ongoing lawsuit with app developer Six4Three. If you don't recall, the company, which made a skeezy app to let you find pictures of other people on Facebook wearing bikinis, got mad and sued Facebook when Facebook (finally) realized that maybe it shouldn't give app developers access to so much data, and cut them all off (effectively killing Six4Three's entire ability to operate). Many people reacted to this week's story as if it was some big reveal that Facebook cut favorable data deals with some partners, and that it toyed around with business models selling access to data, but frankly, I don't see all that much that's different from the cache of documents that was released back in December.

As I said then, most of the stuff that people are freaking out about appears to be taken out of context. Facebook investigating different business models isn't inherently bad. And many people are framing those discussions completely outside of the context of what Facebook was actually doing at the time or how people viewed the data it had access to. A lot of focus is on the fact that Facebook put a dollar value on the data -- but that doesn't actually mean (as many are suggesting) that it ever planned to "sell the data." It did look at charging app developers to access the data, but that's not a particularly crazy idea -- and one that lots of people discussed at the time, and one that plenty of companies with lots of data use.

There are, certainly, reasonable concerns to be raised about Facebook looking to deliberately undermine competitive services via its platform -- and that was the part that most concerned me back in December as possible antitrust violations. But, there doesn't really appear to be that much new on that front. Facebook looks sketchy, but when hasn't it looked sketchy?

And, because some will erroneously call me a Facebook shill, let's look at the other two privacy blunders this week because there's nothing redeeming about either of them. Both are straight up awful. They're the kinds of security mistakes that tiny startups with no real understanding of security make. Not something that a company like Facebook should ever make. If you want to be concerned about Facebook and privacy, focus on these two stories that suggest not so much a cavalier attitude towards privacy as an incompetent implementation of basic security practices.

First up, Business Insider revealed that Facebook was asking users for their email password and then sucking up all your contacts without asking for permission. While you might wonder what idiot would hand Facebook his or her email password for no obvious reason (a valid question) that doesn't absolve Facebook from even asking. After pressing Facebook on this, the company admitted that it sucked up the email contacts of 1.5 million users this way, and that it's now deleting it.

Since May 2016, the social-networking company has collected the contact lists of 1.5 million users new to the social network, Business Insider can reveal. The Silicon Valley company said the contact data was "unintentionally uploaded to Facebook," and it is now deleting them.

The revelation comes after pseudononymous security researcher e-sushi noticed that Facebook was asking some users to enter their email passwords when they signed up for new accounts to verify their identities, a move widely condemned by security experts. Business Insider then discovered that if you entered your email password, a message popped up saying it was "importing" your contacts without asking for permission first.

This is a very bad security practice, and certainly could lead to legal issues for Facebook. Sucking up that kind of data without permission is super bad. Facebook's excuse here is not good either:

A Facebook spokesperson said before May 2016, it offered an option to verify a user's account using their email password and voluntarily upload their contacts at the same time. However, they said, the company changed the feature, and the text informing users that their contacts would be uploaded was deleted — but the underlying functionality was not.

How does someone not catch that? How does someone not catch that asking for your (non-Facebook!) email account is just a bad idea in general? This reflects extremely poorly on Facebook's security review process.

The second story may be even worse. TechCrunch has the story that Facebook is now admitting that the really bad screwup first reported last month, concerning the company "accidentally" storing plaintext passwords of some Instagram users, actually impacted millions of users, rather than just a few thousand as originally reported. This of course, goes back to the general law of security breaches that we've discussed for over a decade: it's always worse than originally reported. It's difficult to think of a big security breach where the number of impacted people wasn't updated upwards at a later date.

As we noted last month, what caused this was legitimately a bug, rather than nefarious intent, but for a company of Facebook's size, and with the security talent it has on staff, this is the kind of bug that is unacceptable -- especially with something such as protecting passwords (an area of security that is very well developed). I guess these are just more things to add to the neverending Facebook apology tour.

Filed Under: contacts, data, passwords, plaintext, privacy, security breaches
Companies: facebook

NSA Collects Email Contact Lists, Instant Messaging Chat Buddy Lists From Overseas With No Oversight At All

from the well,-there's-that dept

The Washington Post is out with the latest revelations from the Snowden leaks and it shows that the NSA relies on foreign telcos and "allied" intelligence agencies to scoop up data on email contact lists and instant messaging buddy lists to help build its giant database of connections. Remember a few weeks ago how it was reported that the NSA was basically building a secret shadow social network? It seems like this might be one of the ways it's able to tell who your friends are.

There are a variety of important points here. First off, this information is not coming directly from the tech companies (which, again, suggests that earlier claims that the NSA had direct access to all their servers was mistaken). Rather they're picking this information up off the backbone connections in foreign countries. It also explains why they get so much data from Yahoo -- because, for no good reason at all, Yahoo hasn't forced encryption on its webmail users until... the news of this started to come out.

And here's the big problem: because all of this information is collected overseas, rather than at home, it's not subject to "oversight" (and I use that term loosely) by the FISA court or Congress. Those two only cover oversight for domestic intelligence. The fact that the NSA can scoop up all this data overseas is just a bonus.

Also, while the program is ostensibly targeted at "metadata" concerning connections between individuals, the fact that it collects "inboxes" and "buddy lists" appears to reveal content at times. With buddy lists, it can often collect content that was sent while one participant was offline (where a server holds the message until the recipient is back online), and with inboxes, they often display the beginning of messages, which the NSA collects. Separately, because this is allowing them to gather so much data, it apparently overwhelmed the NSA's datacenters. At times, this is because they get inundated with... spam. For example, one of the documents revealed show that a target they had been following in Iran had his Yahoo email address hacked for spamming, and that presented a problem:

In fall 2011, according to an NSA presentation, the Yahoo account of an Iranian target was “hacked by an unknown actor,” who used it to send spam. The Iranian had “a number of Yahoo groups in his/her contact list, some with many hundreds or thousands of members.”

The cascading effects of repeated spam messages, compounded by the automatic addition of the Iranian’s contacts to other people’s address books, led to a massive spike in the volume of traffic collected by the Australian intelligence service on the NSA’s behalf.

After nine days of data-bombing, the Iranian’s contact book and contact books for several people within it were “emergency detasked.”

Because of this mess, the NSA has tried to stop collecting certain types of information, doing "emergency detasks" of certain collections. This, yet again, shows how ridiculous Keith Alexander's "collect it all" mantra is. When you collect it all, you get inundated with a ton of bogus data, and the information presented here seems to support that.

Filed Under: buddy lists, chat, contacts, email, information, nsa, nsa spying, nsa surveillance, telcos

Can A Company Keep An Employee's LinkedIn Account After They're No Longer Employed?

from the how-does-that-make-sense dept

Venkat Balasubramani has the story of a bizarre fight between a company, Sawabeh Information Services, and the founders of Edcomm, a company that Sawabeh bought in 2010. A few months later, the founders of Edcomm were fired, and the lawsuits commenced. There are a variety of issues here, and Venkat's post goes through most of them in detail, but I wanted to focus on just one: the fight over who gets to control Dr. Linda Eagle's LinkedIn account. Eagle was one of the founders of Edcomm and the key figure in this fight. Sawabeh claims that Eagle "misappropriated" her own LinkedIn account and the contacts associated with it, by continuing to use it after being fired.

While I can kind of understand some of the legal fights over who gets to control Twitter accounts, the entire point of a LinkedIn account is to represent an individual and their job history. How would it possibly make sense for a company to control an ex-employee's LinkedIn account?

The company seems to think that the LinkedIn account was more like a rolodex. Because (for reasons that are beyond me), Eagle had let others in the company access and manage her account, as soon as she was fired, people at the company accessed her account and then changed her "name" and profile picture to someone else at the company. That would be pretty shocking for her connections, who might not know who the guy was at all. They also tried to do this with the account of one of the other fired founders, but they didn't have his password. Apparently the company asked LinkedIn to hand over the password, and LinkedIn, properly, told the company to get lost.

Either way, the court digs into the "misappropriation" question with the LinkedIn account and refuses to dismiss it out of hand (at this stage of the case), which seems too bad. However, there's an unclear issue of who "developed" the contacts in the account:

The Counterclaim Complaint expressly alleges that, with respect to the LinkedIn account connections and content, "Edcomm personnel, not Dr. Eagle, developed and maintained all connections and much of the content on the LinkedIn Account, actions that were taken solely at Edcomm’s expense and exclusively for its own benefit." ... While Plaintiff argues that Edcomm fails to allege facts that would show that it made a substantial investment of time, effort, and money into creating the cell phone number or LinkedIn account, Edcomm counters that its employees developed the accounts and maintained the connections, which are the route through which Edcomm contacts instructors and specific personnel within its clients. As these conflicting allegations create an issue of fact requiring further discovery, the Court must deny the Motion for Judgment on the Pleadings as to the misappropriation counterclaim.

Of course, I wonder if they're arguing about the wrong thing here. If the company developed the contacts, perhaps it has a right to ask for a copy of the contacts, but the account itself seems like it should belong to Eagle. Part of the problem here is the idea that contacts are some scarce resource. Both parties can have them, and the simplest thing would be, if there is a legitimate claim that the company developed those relationships, to require that their contact info be provided to the company -- but leave the account in the hands of Eagle.

Either way, the case should be a warning for any company that wants to control the LinkedIn accounts of its employees.

Filed Under: contacts, linda eagle, ownership, social media
Companies: edcomm, linkedin, sawabeh information services, siscom

Hot News Doctrine Already Being Stretched; Company Says Its Contact Database Is Hot News

from the hot-news-needs-to-burn dept

In the last year, there's been a sudden resurgence in interest in the concept of "hot news," a doctrine that most people thought was dead and buried, which allowed a judicially-created form of intellectual property on factual information that was deemed to be "hot news." There's no statute that covers this. Just a court decision. And that was a century or so ago. But... the concept started showing back up in court recently, and in March a ruling came down, blocking a website from reporting on news for two hours, using this doctrine. With that on the books, other "hot news" lawsuits were quickly filed.

However, one such recent lawsuit seems to stretch the concept of hot news so far that you can only sit back and admire the audacity of including it in the lawsuit, while fearing the results should a court actually buy it. Thomas O'Toole has the details of what is likely to be a very interesting lawsuit on a few different factors, beyond just the hot news claim (but we'll get to those other issues, so read on...).

The case apparently involves an employee at Goldman Sachs (or potentially multiple employees) who got the username and password of another account holder on a database put together by a company called Ipreo Networks, called "Bigdough." Bigdough is apparently a database of contact info on 80,000 financial industry people. The Goldman Sachs employee(s) logged in with someone else's username/password and downloaded a bunch of information.

This sort of thing happens all of the time. People share logins all of the time. Violating it is basically a terms of service violation, but here the company has broken out the big guns. Yes, it's claiming that the contact info in its database represents "hot news," and Goldman accessing it is a violation of the "hot news" doctrine. Think about that for a second. Contact information. "Hot news?" And, of course, the whole purpose of the "hot news" doctrine is about another publisher republishing the information -- something that Goldman Sachs didn't do here at all. The whole "hot news" claim here seems to stretch the (already questionable) concept way past the breaking point. Hopefully that part gets tossed quickly. Otherwise, imagine what else will suddenly be called "hot news."

But that's not all that's interesting in this case. As O'Toole notes in his report, there are two other interesting legal questions, having to do with the use of someone else's login. First, there's the question of whether or not Goldman Sachs is liable here, even if the actions are just that of a rogue employee (or group of employees). O'Toole points out that the legal standard to get GS on the hook here is pretty damn high. The second question, of course, is whether or not just using a login that someone shared with you is a violation of the Computer Fraud and Abuse Act (CFAA). We recently discussed how there are also a growing series of cases trying to stretch the CFAA to make all sorts of activities classified as "unauthorized access." CFAA was really designed as an anti-hacking law -- which was about people really breaking in to a computer system. If someone simply shares their login credentials with you, does that really count as criminal hacking? If that's the case, an awful lot of people may be guilty of doing so.

So, this should be a fun one to follow. Three separate interesting legal questions, and in all three cases, Ipreo appears to be trying to stretch the law beyond its intentions, so hopefully the court recognizes this. If you want to see the full filing, it's below:

Filed Under: bigdough, cfaa, contacts, database, hacking, hot news
Companies: goldman sachs, ipreo networks

Do You Own Your Social Networking Friends? Or Does Your Employer?

from the do-you-own-your-rolodex? dept

In the sales world, you're often judged on the size and quality of your "rolodex" of contacts. No one expects a salesperson jumping from one job to another to somehow "forget" everyone they know -- or to cough up their entire list of contacts to the previous company. Yet that seems to be what happened in the UK. Slashdot points us to the news of a court ruling where a guy was forced to give up his LinkedIn contact list to his former employer after he left the company to start his own business. In this case, the original company had actively encouraged its employees to make use of LinkedIn, even though it was under the individual's control, rather than the employer's.

Expect to see plenty more lawsuits like this going forward. For many users of social networks from LinkedIn to MySpace to Facebook, the connections you make blur the lines between professional and personal -- and the questions of who actually "owns" those contacts will become a legal issue that the courts will decide over and over again. Of course, the truth is that this is a silly debate. No one "owns" a contact in the first place. If the company has a rule requiring employees to hand over contacts to the company, then it should employ a CRM system which the company controls. Otherwise, reaching into a personal social networking account seems to go beyond what's reasonable.

Filed Under: contacts, social networks
Companies: linkedin