{"id":14098,"date":"2019-02-01T07:03:38","date_gmt":"2019-02-01T07:03:38","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/we-dismantle-facebooks-memo-defending-its-research.html"},"modified":"2019-02-01T07:03:38","modified_gmt":"2019-02-01T07:03:38","slug":"we-dismantle-facebooks-memo-defending-its-research","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/we-dismantle-facebooks-memo-defending-its-research.html","title":{"rendered":"We dismantle Facebook\u2019s memo defending its \u201cResearch\u201d"},"content":{"rendered":"

Facebook <\/a> published an internal memo today trying to minimize the morale damage of TechCrunch\u2019s investigation that revealed it\u2019d been paying people to suck in all their phone data<\/a>. Attained by Business Insider\u2019s Rob Price<\/a>, the memo from Facebook\u2019s VP of production engineering and security Pedro Canahuati\u00a0gives us more detail about exactly what data Facebook was trying to collect from teens and adults in the US and India. But it also tries to claim the program wasn\u2019t secret, wasn\u2019t spying, and that Facebook doesn\u2019t see it as a violation of Apple\u2019s policy against using its Enterprise Certificate system to distribute apps to non-employees \u2014 despite Apple punishing it<\/a> for the violation.<\/p>\n

For reference, Facebook was recruiting users age 13-35 to install a Research app, VPN, and give it root network access so it could analyze all their traffic. It\u2019s pretty sketchy to be buying people\u2019s privacy<\/a>, and despite being shut down on iOS, it\u2019s still running on Android.<\/p>\n

Here we lay out the memo with section by section responses to Facebook\u2019s claims challenging TechCrunch\u2019s reporting. Our responses are in bold and we\u2019ve added images.<\/p>\n

Memo from Facebook VP\u00a0Pedro Canahuati<\/h2>\n

APPLE ENTERPRISE CERTS REINSTATED<\/strong><\/em><\/h2>\n

Early this morning, we received agreement from Apple <\/a> to issue a new enterprise certificate; this has allowed us to produce new builds of our public and enterprise apps for use by employees and contractors. Because we have a few dozen apps to rebuild, we\u2019re initially focusing on the most critical ones, prioritized by usage and importance: Facebook, Messenger, Workplace, Work Chat, Instagram, and Mobile Home.<\/em><\/p>\n

New builds of these apps will soon be available and we\u2019ll email all iOS users for detailed instructions on how to reinstall. We\u2019ll also post to iOS FYI with full details.<\/em><\/p>\n

Meanwhile, we\u2019re expecting a follow-up article from the New York Times later today, so I wanted to share a bit more information and background on the situation<\/em>.<\/p>\n

\"\"<\/p>\n

What happened?<\/em><\/h2>\n

On Tuesday TechCrunch reported on our Facebook Research program. This is a market research program that helps us understand consumer behavior and trends to build better mobile products.<\/em><\/p>\n

TechCrunch implied we hid the fact that this is by Facebook \u2013 we don\u2019t. Participants have to download an app called Facebook Research App to be involved in the stud. They also characterized this as \u201cspying,\u201d which we don\u2019t agree with. People participated in this program with full knowledge that Facebook was sponsoring this research, and were paid for it. They could opt-out at any time. As we built this program, we specifically wanted to make sure we were as transparent as possible about what we were doing, what information we were gathering, and what it was for \u2014 see the screenshots below.<\/em><\/p>\n

We used an app that we built ourselves, which wasn\u2019t distributed via the App Store, to do this work. Instead it was side-loaded via our enterprise certificate. Apple has indicated that this broke their Terms of Service so disabled our enterprise certificates which allow us to install our own apps on devices outside of the official app store for internal dogfooding.<\/em><\/p>\n

Author\u2019s response: To start, \u201cbuild better products\u201d is a vague way of saying determining what\u2019s popular and buying or building it. Facebook has used competitive analysis gathered by its similar Onavo Protect app and Facebook Research\u00a0app for years to figure out what apps were gaining momentum and either bring them in or box them out. Onavo\u2019s data is how Facebook knew<\/a> WhatsApp was sending twice as many messages as Messenger, and it should invest $19 billion to acquire it.<\/strong><\/p>\n

Facebook claims it didn\u2019t hide the program, but it was never formally announced like every other Facebook product. There were no Facebook Help pages, blog posts, or support info from the company. It used intermediaries Applause (which owns uTest) and CentreCode (which owns Betabound) to run the program under names like Project Atlas and Project Kodiak. Users only found out Facebook was involved once they started the sign-up process and signed a non-disclosure agreement prohibiting them from discussing it publicly. <\/strong><\/p>\n

TechCrunch has reviewed communications indicating Facebook would threaten legal action if a user spoke publicly about being part of the Research program. While the program had run since 2016, it had never been reported on. We believe that these facts combined justify characterizing the program as \u201csecret\u201d<\/strong><\/p>\n

\"\"<\/p>\n

The Facebook Research program was called Project Atlas until you signed up<\/p>\n

How does this program work?<\/em><\/h2>\n

We partner with a couple of market research companies (Applause and CentreCode) to source and onboard candidates based in India and USA for this research project. Once people are onboarded through a generic registration page, they are informed that this research will be for Facebook and can decline to participate or opt out at any point. We rely on a 3rd party vendor for a number of reasons, including their ability to target a Diverse and representative pool of participants. They use a generic initial Registration Page to avoid bias in the people who choose to participate.<\/em><\/p>\n

After generic onboarding people are asked to download an app called the \u2018Facebook Research App,\u2019 which takes them through a consent flow that requires people to check boxes to confirm they understand what information will be collected. As mentioned above, we worked hard to make this as explicit and clear as possible.<\/em><\/p>\n

This is part of a broader set of research programs we conduct. Asking users to allow us to collect data on their device usage is a highly efficient way of getting industry data from closed ecosystems, such as iOS and Android. We believe this is a valid method of market research.<\/em><\/p>\n

Author\u2019s response: Facebook claims it wasn\u2019t \u201cspying\u201d, yet it never fully laid out the specific kinds of information it would collect. In some cases, descriptions of the app\u2019s data collection power were included in merely a footnote. The program did not specify specific data types gathered, only saying it would scoop up \u201cwhich apps are on your phone, how and when you use them\u201d and \u201cinformation about your internet browsing activity\u201d <\/strong><\/p>\n

The parental consent form from Facebook and Applause lists none of the specific types of data collected or the extent of Facebook\u2019s access. Under \u201cRisks\/Benefits\u201d, the form states \u201cThere are no known risks associated with this project however you acknowledge that the\u00a0inherent nature of the project involves the tracking of personal information via your\u00a0child\u2019s use of Apps. You will be compensated by Applause for your child\u2019s participation.\u201d It gives parents no information about what data their kids are giving up.<\/strong><\/p>\n

Facebook claims it uses third-parties to target a diverse pool of participants. Yet Facebook conducts other user feedback and research programs on its own without the need for intermediaries that obscure its identity, and only ran the program in two countries. It claims to use a generic signup page to avoid biasing who will choose to participate, yet the cash incentive and technical process of installing the root certificate also bias who will participate, and the intermediaries conveniently prevent Facebook from being publicly associated with the program at first glance. Meanwhile, other clients of the Betabound testing platform like Amazon<\/a>, Norton, and SanDisk reveal their names immediately before users sign up.<\/strong><\/p>\n

\"\"<\/p>\n

Facebook\u2019s ads recruiting teens for the program didn\u2019t disclose its involvement<\/p>\n

Did we intentionally hide our identity as Facebook?<\/em><\/h2>\n

No \u2014 The Facebook brand is very prominent throughout the download and installation process, before any data is collected. Also, the app name of the device appears as \u201cFacebook Research\u201d \u2014 see attached screenshots. We use third parties to source participants in the research study, to avoid bias in the people who choose to participate. But as soon as they register, they become aware this is research for Facebook<\/em><\/p>\n

Author\u2019s\u00a0response: Facebook here admits that users did not know Facebook was involved before they registered.<\/strong><\/p>\n

What data do we collect? Do we read people\u2019s private messages?<\/strong><\/em><\/h2>\n

No, we don\u2019t read private messages. We collect data to understand how people use apps, but this market research was not designed to look at what they share or see. We\u2019re interested in information such as watch time, video duration, and message length, not that actual content of videos, messages, stories or photos. The app specifically ignores information shared via financial or health apps.<\/em><\/p>\n

Author\u2019s response: We never reported that Facebook was reading people\u2019s private messages, but that it had the ability to collect them. Facebook here admits that the program was \u201cnot designed to look at what they share or see\u201d, but stops far short of saying that data wasn\u2019t collected. Fascinatingly, Facebook reveals it was that it was closely monitoring how much time people spent on different media types.<\/strong><\/p>\n

\"\"<\/p>\n

Facebook Research abused the Enterprise Certificate system meant for employee-only apps<\/p>\n

Did we break Apple\u2019s terms of service?<\/strong><\/em><\/h2>\n

Apple\u2019s view is that we violated their terms by sideloading this app, and they decide the rules for their platform, We\u2019ve worked with Apple to address any issues; as a result, our internal apps are back up and running. Our relationship with Apple is really important \u2014 many of us use Apple products at work every day, and we rely on iOS for many of our employee apps, so we wouldn\u2019t put that relationship at any risk intentionally. Mark and others will be available to talk about this further at QA later today.<\/em><\/p>\n

Author\u2019s response: TechCrunch reported that Apple\u2019s policy plainly states that the Enterprise Certificate program requires companies to \u201cDistribute Provisioning Profiles only to Your Employees and only in conjunction with Your Internal Use Applications for the purpose of developing and testing\u201d and that \u201cYou may not use, distribute or otherwise make Your Internal Use Applications available to Your Customers\u201d. Apple took a firm stance in its statement that Facebook did violate the program\u2019s policies, stating \u201cFacebook has been using their membership to distribute a data-collecting app to consumers, which is a clear breach of their agreement with Apple.\u201d<\/strong><\/p>\n

Given Facebook distributed the Research apps to teenagers that never signed tax forms or formal employment agreements, they were obviously not employees or contractors, and most likely use some Facebook-owned service that qualifies them as customers. Also, I\u2019m pretty sure you can\u2019t pay employees in gift cards.<\/strong><\/p>\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/NAOnK2xcRPM\/<\/p>","protected":false},"excerpt":{"rendered":"

Facebook published an internal memo today trying to minimize the morale damage of TechCrunch\u2019s investigation that revealed it\u2019d been paying people to suck in all their phone data. Attained by <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-14098","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t