{"id":15348,"date":"2019-06-13T00:57:55","date_gmt":"2019-06-13T00:57:55","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/facebook-collected-device-data-on-187000-users-using-banned-snooping-app.html"},"modified":"2019-06-13T00:57:55","modified_gmt":"2019-06-13T00:57:55","slug":"facebook-collected-device-data-on-187000-users-using-banned-snooping-app","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/facebook-collected-device-data-on-187000-users-using-banned-snooping-app.html","title":{"rendered":"Facebook collected device data on 187,000 users using banned snooping app"},"content":{"rendered":"

Facebook <\/a> obtained personal and sensitive device data on about 187,000 users of its now-defunct Research app, which Apple banned earlier this year after the app violated its rules.<\/p>\n

The social media giant said in a letter to Sen. Richard Blumenthal\u2019s office \u2014 which TechCrunch obtained \u2014 that it collected data on 31,000 users in the U.S., including 4,300 teenagers. The rest of the collected data came from users in India.<\/p>\n

Earlier this year, a TechCrunch investigation found both Facebook<\/a> and Google were<\/a> abusing their Apple-issued enterprise developer certificates, designed to only allow employees to run iPhone and iPad apps used only inside the company. The investigation found the companies were building and providing apps for consumers outside Apple\u2019s App Store, in violation of Apple\u2019s rules. The apps paid users in return for collecting data on how participants used their devices and to understand app habits by gaining access to all of the network data in and out of their device.<\/p>\n

Apple banned the apps<\/a> by revoking Facebook\u2019s enterprise developer certificate \u2014 and later Google\u2019s enterprise certificate<\/a>. In doing so, the revocation knocked offline both companies\u2019 fleet of internal iPhone or iPad apps that relied on the same certificates.<\/p>\n

But in response to lawmakers\u2019 questions, Apple said it didn\u2019t know how many devices installed Facebook\u2019s rule-violating app.<\/p>\n

\u201cWe know that the provisioning profile for the Facebook Research app was created on April 19, 2017, but this does not necessarily correlate to the date that Facebook distributed the provisioning profile to end users,\u201d said Timothy Powderly, Apple\u2019s director of federal affairs, in his letter.<\/p>\n

Facebook said the app dated back to 2016.<\/p>\n

\"\"<\/p>\n

A portion of Apple\u2019s letter to lawmakers. (Image: TechCrunch)<\/p>\n

TechCrunch also obtained the letters sent by Apple and Google to lawmakers in early March, but were never made public.<\/p>\n

These \u201cresearch\u201d apps relied on willing participants to download the app from outside the app store and use the Apple-issued developer certificates to install the apps. Then, the apps would install a root network certificate, allowing the app to collect all the data<\/a> out of the device \u2014 like web browsing histories, encrypted messages and mobile app activity \u2014 potentially also including data from their friends \u2014 for competitive analysis.<\/p>\n

\"\"<\/p>\n

A response by Facebook about the number of users involved in Project Atlas (Image: TechCrunch)<\/p>\n

In Facebook\u2019s case, the research app \u2014 dubbed Project Atlas \u2014 was a repackaged version of its Onavo VPN app<\/a>, which Facebook was forced to remove from Apple\u2019s App Store last year for gathering too much device data<\/a>.<\/p>\n

Just this week, Facebook relaunched its research app<\/a> as Study, only available on Google Play and for users who have been approved through Facebook\u2019s research partner, Applause. Facebook said it would be more transparent about how it collects user data.<\/p>\n

Facebook\u2019s vice president of public policy Kevin Martin defended the company\u2019s use of enterprise certificates, saying it \u201cwas a relatively well-known industry practice.\u201d When asked, a Facebook spokesperson didn\u2019t quantify this further. Later, TechCrunch found dozens of apps<\/a> that used enterprise certificates to evade the app store.<\/p>\n

Facebook previously said<\/a> it \u201cspecifically ignores information shared via financial or health apps.\u201d In its letter to lawmakers, Facebook stuck to its guns, saying its data collection was focused on \u201canalytics,\u201d but confirmed \u201cin some isolated circumstances the app received some limited non-targeted content.\u201d<\/p>\n

\u201cWe did not review all of the data to determine whether it contained health or financial data,\u201d said a Facebook spokesperson. \u201cWe have deleted all user-level market insights data that was collected from the Facebook Research app, which would include any health or financial data that may have existed.\u201d<\/p>\n

But Facebook didn\u2019t say what kind of data, only that the app didn\u2019t decrypt \u201cthe vast majority\u201d of data sent by a device.<\/p>\n

\"\"<\/p>\n

Facebook describing the type of data it collected \u2014 including \u201climited, non-targeted content\u201d (Image: TechCrunch)<\/p>\n

Google\u2019s letter, penned by public policy vice president Karan Bhatia, did not provide a number of devices or users, saying only that its app was a \u201csmall scale\u201d program. When reached, a Google spokesperson did not comment by our deadline.<\/p>\n

Google also said it found \u201cno other apps that were distributed to consumer end users,\u201d but confirmed several other apps used by the company\u2019s partners and contractors, which no longer rely on enterprise certificates.<\/p>\n

\"\"<\/p>\n

Google explaining which of its apps were improperly using Apple-issued enterprise certificates (Image: TechCrunch)<\/p>\n

Apple told TechCrunch that both Facebook and Google \u201care in compliance\u201d with its rules as of the time of publication. At its annual developer conference last week, the company said it now \u201creserves the right to review and approve or reject any internal use application.\u201d<\/p>\n

Facebook\u2019s willingness to collect this data from teenagers \u2014 despite constant scrutiny<\/a> from press and regulators \u2014 demonstrates how valuable the company sees market research on its competitors. With its restarted paid research program but with greater transparency, the company continues to leverage its data collection to keep ahead of its rivals.<\/p>\n

\u201cAfter its previous app was rightly taken down and blocked from operating, Facebook moved more quickly to reintroduce a market research product than it has to provide any substantial consumer privacy protections or resolve the significant abuse on its platform,\u201d Sen. Blumenthal told TechCrunch. \u201cAt a time when the company is under investigation for its data practices and anticompetitive actions, the Facebook Study app is at best tone-deaf and ill-considered.\u201d<\/p>\n

Facebook and Google came off worse in the enterprise app abuse scandal, but critics said in revoking enterprise certificates Apple retains too much control over what content customers have on their devices.<\/p>\n

The Justice Department and the Federal Trade Commission are said to be examining<\/a> the big four tech giants \u2014 Apple, Amazon, Facebook and Google-owner Alphabet \u2014 for potentially falling afoul of U.S. antitrust laws.<\/p>\n

\n

Everything you need to know about Facebook, Google\u2019s app scandal<\/a><\/p>\n<\/blockquote>\n

\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunch\/social\/~3\/Om-1vfQeDBo\/<\/p>","protected":false},"excerpt":{"rendered":"

Facebook obtained personal and sensitive device data on about 187,000 users of its now-defunct Research app, which Apple banned earlier this year after the app violated its rules. The social <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3],"tags":[10,7,14,15,6,12,11],"class_list":["post-15348","post","type-post","status-publish","format-standard","hentry","category-latest-update","tag-computer-news","tag-downloads","tag-microsoft-download-news","tag-networking-updates","tag-technology-update","tag-wordpress-plugin-download","tag-wordpress-theme-download"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t