Oh: FaceBook is Collecting Data on People Who Never Even Signed Up for FaceBook

Professional privacy invader Mark Zuckerberg recently defended FaceBook's spying on its customers products: You signed up for this. It spells it out in that app licensing agreement that no one reads.

Over the weekend, Android owners were displeased to discover that Facebook had been scraping their text-message and phone-call metadata, in some cases for years, an operation hidden in the fine print of a user agreement clause until Ars Technica reported. Facebook was quick to defend the practice as entirely aboveboard--small comfort to those who are beginning to realize that, because Facebook is a free service, they and their data are by necessity the products.

In its current iteration, Facebook's Messenger application requests that those who download it give it permission to access incoming and outgoing call and text logs. But, as users discovered when prompted to download a copy of their personal data before permanently deleting their Facebook accounts, a certain amount of data was covertly siphoned without explicit permissions. Buried inside those data caches was an unsettling amount of specific, detailed information--in some cases, every phone call or text message ever sent or received on their Android device.

Dylan McKay, who apparently owns an Android phone, reported that for the period between November 2016 and July 2017, his archives contained "the metadata of every cellular call I've ever made, including time and duration" and "metadata about every text message I've ever received or sent." When people like McKay agreed to share their contacts with Facebook, it appears they didn’t know the extent to which they were giving Facebook access to their personal information.

McKay related that in a twitter thread -- you can actually request all the information FaceBook has downloaded about you. McKay showed how extensive a file FaceBook had compiled on him.

Back to the first-linked article:

Facebook responded with a blog post laying out the applicable user-agreement terms and denying that Facebook collects call or SMS data surreptitiously. "Contact uploading is optional. People are expressly asked if they want to give permission to upload their contacts from their phone--it's explained right there in the apps when you get started," the company said in a statement to the Guardian. "People can delete previously uploaded information at any time and can find all the information available to them in their account and activity log from our Download Your Information tool."

But is it true that "You signed up for this"?

What if someone else signed up for this, permitted FaceBook to scrape their contact information which included you -- and then FaceBook started collecting information on you, you who had never agreed to any of this?

PJMedia reports this is what's going on.

Facebook's problems just keep accumulating, drip by drip—or more like splash by splash. It’s now been discovered that Facebook not only collects and uses the personal data of its members but also collects the data of those who never signed up for Facebook.

So if you're one of those who blames Facebook users for allowing their personal data to be compromised, don't be so smug. Facebook may be sharing your personal data as well.

Daniel Kahn Gillmor, senior staff technologist at the ACLU, discovered that, although he never joined Facebook or any other social network, Facebook has a detailed profile on him.

Facebook obtains information from those not on Facebook in two different ways: from other Facebook users and by tracking people who visit other other sites on the web.

When people sign up for Facebook, they're encouraged to upload their contacts to make it easier for Facebook to connect them with their friends. That allows Facebook to access personal contact information for people who never signed up for the platform or gave their permission to share their information. Facebook knows that these contacts are friends of the new Facebook user, and can start compiling additional details on these non-members.

While this "profile" does not contain, supposedly, "Personally Identifying Information," it does include a lot of information, enough that it might be pretty easy to guess who it is, if you know which person added this officially-unidentified person as a contact.

As Gillmore says:

Given the precision of this kind of mapping and targeting, 'PII' isn’t necessary to reveal my identity. How many vegans examine specifications for computer hardware from the ACLU's offices while reading about Cambridge Analytica?"

I'm not on FaceBook, but that makes me wonder: My own interests and hobbies are pretty evident from this blog. If someone on FaceBook has added me as a contact, which I'm sure they have, then 1, they're collecting a lot of personal information about my web activity and 2, it would not be very hard at all to guess the Personally Identifying Information and complete the data set.

Gillmore, in his article at the ACLU blog, calls FaceBook a prime mining company in the "surveillance economy."

That seems like a good new word.

posted by Ace of Spades at 07:41 PM

| Access Comments