A UK parliamentary committee has published the cache of Facebook documents it dramatically seized last week.
The documents were obtained by a legal discovery process by a startup that’s suing the social network in a California court in a case related to Facebook changing data access permissions back in 2014/15.
The court had sealed the documents but the DCMS committee used rarely deployed parliamentary powers to obtain them from the Six4Three founder, during a business trip to London.
You can read the redacted documents here — all 250 pages of them.
In a series of tweets regarding the publication, committee chair Damian Collins says he believes there is “considerable public interest” in releasing them.
“They raise important questions about how Facebook treats users data, their policies for working with app developers, and how they exercise their dominant position in the social media market,” he writes.
“We don’t feel we have had straight answers from Facebook on these important issues, which is why we are releasing the documents. We need a more public debate about the rights of social media users and the smaller businesses who are required to work with the tech giants. I hope that our committee investigation can stand up for them.”
The committee has been investigating online disinformation and election interference for the best part of this year, and has been repeatedly frustrated in its attempts to extract answers from Facebook.
But it is protected by parliamentary privilege — hence it’s now published the Six4Three files, having waited a week in order to redact certain pieces of sensitive information.
Collins has included a summary of key issues, as the committee sees them after reviewing the documents, in which he draws attention to six issues.
Here is his summary of the key issues:
- White Lists Facebook have clearly entered into whitelisting agreements with certain companies, which meant that after the platform changes in 2014/15 they maintained full access to friends data. It is not clear that there was any user consent for this, nor how Facebook decided which companies should be whitelisted or not.
- Reciprocity Data reciprocity between Facebook and app developers was a central feature in the discussions about the launch of Platform 3.0.
- Android Facebook knew that the changes to its policies on the Android mobile phone system, which enabled the Facebook app to collect a record of calls and texts sent by the user would be controversial. To mitigate any bad PR, Facebook planned to make it as hard of possible for users to know that this was one of the underlying features of the upgrade of their app.
- Onavo Facebook used Onavo to conduct global surveys of the usage of mobile apps by customers, and apparently without their knowledge. They used this data to assess not just how many people had downloaded apps, but how often they used them. This knowledge helped them to decide which companies to acquire, and which to treat as a threat.
- Targeting competitor Apps The files show evidence of Facebook taking aggressive positions against apps, with the consequence that denying them access to data led to the failure of that business.
Update: 1
Facebook has now posted a lengthy response (read it here) positing that the “set of documents, by design, tells only one side of the story and omits important context.” They give a blow-by-blow response to Collins’ points though they are ultimately pretty selective in what they actually address.
Generally they suggest that some of the issues being framed as anti-competitive were in fact designed to prevent “sketchy apps” from operating on the platform. Furthermore, Facebook claims that they delete some old call logs on Android; that using “market research” data from Onava is essentially standard practice; and that users had the choice whether data was shared reciprocally between FB and developers.
In regard to specific competitors’ apps, Facebook appears to have tried to get ahead of this release with their announcement yesterday that it was ending its platform policy of banning apps that “replicate core functionality.”
Update: 2
Zuckerberg has also now posted a response to his public Facebook page — where he seeks to push the same narrative about “sketchy apps”. He also tries to couch the discussions about charging developers for access to user data as ” similar to how developers pay to use Amazon AWS or Google Cloud”, writing: “[T]hat’s different from selling people’s data. We’ve never sold anyone’s data.”
However that’s a disingenuous argument given AWS and Google Cloud are cloud computing services that sell compute power and/or storage, not data. Whereas Facebook’s “platform” is comprised of Facebook users’ personal data. So while Facebook ultimately decided against charging developers for API access, had it done so it would indeed have been selling access to people’s data.
The publication of the files comes at an awkward moment for Facebook — which remains on the back foot after a string of data and security scandals, and has just announced a major policy change — ending a long-running ban on apps copying its own platform features.
Albeit the timing of Facebook’s policy shift announcement hardly looks incidental — given Collins said last week the committee would publish the files this week.
The policy in question has been used by Facebook to close down competitors in the past, such as — two years ago — when it cut off style transfer app Prisma’s access to its live-streaming Live API when the startup tried to launch a livestreaming art filter (Facebook subsequently launched its own style transfer filters for Live).
So its policy reversal now looks intended to diffuse regulatory scrutiny around potential antitrust concerns.
But emails in the Six4Three files suggesting that Facebook took “aggressive positions” against competing apps could spark fresh competition concerns.
In one email dated January 24, 2013, a Facebook staffer, Justin Osofsky, discusses Twitter’s launch of its short video clip app, Vine, and says Facebook’s response will be to close off its API access.
“As part of their NUX, you can find friends via FB. Unless anyone raises objections, we will shut down their friends API access today. We’ve prepared reactive PR, and I will let Jana know our decision,” he writes.
Osofsky’s email is followed by what looks like a big thumbs up from Zuckerberg, who replies: “Yup, go for it.”
Also of concern on the competition front is Facebook’s use of a VPN startup it acquired, Onavo, to gather intelligence on competing apps — either for acquisition purposes or to target as a threat to its business.
The files show various Onavo industry charts detailing reach and usage of mobile apps and social networks — with each of these graphs stamped ‘highly confidential’.
Facebook bought Onavo back in October 2013. Shortly after it shelled out $19BN to acquire rival messaging app WhatsApp — which one Onavo chart in the cache indicates was beasting Facebook on mobile, accounting for well over double the daily message sends at that time.
Onavo charts are quite an insight into facebook’s commanding view of the app-based attention marketplace pic.twitter.com/Ezdaxk6ffC
— David Carroll 🦣 (@profcarroll) December 5, 2018
The files also spotlight several issues of concern relating to privacy and data protection law, with internal documents raising fresh questions over how or even whether (in the case of Facebook’s whitelisting agreements with certain developers) it obtained consent from users to process their personal data.
The company is already facing a number of privacy complaints under the EU’s GDPR framework over its use of ‘forced consent‘, given that it does not offer users an opt-out from targeted advertising.
But the Six4Three files look set to pour fresh fuel on the consent fire.
Collins’ fourth line item — related to an Android upgrade — also speaks loudly to consent complaints.
Earlier this year Facebook was forced to deny that it collects calls and SMS data from users of its Android apps without permission. But, as we wrote at the time, it had used privacy-hostile design tricks to sneak expansive data-gobbling permissions past users. So, put simple, people clicked ‘agree’ without knowing exactly what they were agreeing to.
The Six4Three files back up the notion that Facebook was intentionally trying to mislead users.
In one email dated November 15, 2013, from Matt Scutari, manager privacy and public policy, suggests ways to prevent users from choosing to set a higher level of privacy protection, writing: “Matt is providing policy feedback on a Mark Z request that Product explore the possibility of making the Only Me audience setting unsticky. The goal of this change would be to help users avoid inadvertently posting to the Only Me audience. We are encouraging Product to explore other alternatives, such as more aggressive user education or removing stickiness for all audience settings.”
Another awkward trust issue for Facebook which the documents could stir up afresh relates to its repeat claim — including under questions from lawmakers — that it does not sell user data.
In one email from the cache — sent by Mark Zuckerberg, dated October 7, 2012 — the Facebook founder appears to be entertaining the idea of charging developers for “reading anything, including friends”.
Yet earlier this year, when he was asked by a US lawmaker how Facebook makes money, Zuckerberg replied: “Senator, we sell ads.” He did not include a caveat that he had apparently personally entertained the idea of liberally selling access to user data.
In another email, dated October 27, 2012, related to discussions about evolving the business model, the Facebook founder can be seen pushing back against data misuse concerns.
“I’m generally skeptical that there is as much data leak strategic risk as you think,” writes Zuckerberg to Sam Lessin, Facebook’s former VP of product management. “I agree there is clear risk on the advertiser side, but I haven’t figured out how that connects to the rest of the platform. I think we leak info to developers, but I just can’t think of any instances where that data has leaked from developer to developer and caused a real issue for us. Do you have examples of this?”
Less than two years later a developer on Facebook’s platform, Dr Aleksandr Kogan, used a quiz app to extract vast amounts of Facebook user data.
The data was modelled to try to build psychographic profilers of US voters and sold to Cambridge Analytica — a chain of data leaks that eventually blew up into a major global scandal for Facebook.
So Zuckerberg’s first instant to dismiss risks of data misuse ended up being a very major miscalculation.
Responding to the publication of the Six4Three documents, a Facebook spokesperson told us:
As we’ve said many times, the documents Six4Three gathered for their baseless case are only part of the story and are presented in a way that is very misleading without additional context. We stand by the platform changes we made in 2015 to stop a person from sharing their friends’ data with developers. Like any business, we had many of internal conversations about the various ways we could build a sustainable business model for our platform. But the facts are clear: we’ve never sold people’s data.
Zuckerberg has repeatedly refused to testify in person to the DCMS committee.
At its last public hearing — which was held in the form of a grand committee comprising representatives from nine international parliaments, all with burning questions for Facebook — the company sent its policy VP, Richard Allan, leaving an empty chair where Zuckerberg’s bum should be.
Comment