Slashdot Mirror
Mark Zuckerberg Denies Knowledge of Non-Consensual Shadow Profiles Facebook Has Been Building of Non-Users For Years
It has been widely reported that Facebook builds profile of people even if they have never signed up for its services. However, in a hearing with the House Energy & Commerce Committee on Wednesday, when New Mexico Representative Ben Lujan asked Facebook CEO Mark Zuckerberg if he was aware of the so-called practice of building "shadow profiles", Zuckerberg denied knowledge of it. Here's the exchange: Lujan: Facebook has detailed profiles on people who have never signed up for Facebook, yes or no?
Zuckerberg: Congressman, in general we collect data on people who have not signed up for Facebook for security purposes to prevent the kind of scraping you were just referring to [reverse searches based on public info like phone numbers].
Lujan: So these are called shadow profiles, is that what they've been referred to by some?
Zuckerberg: Congressman, I'm not, I'm not familiar with that.
Lujan: I'll refer to them as shadow profiles for today's hearing. On average, how many data points does Facebook have on each Facebook user?
Zuckerberg: I do not know off the top of my head.
Lujan: Do you know how many points of data Facebook has on the average non-Facebook user?
Zuckerberg: Congressman, I do not know off the top of my head but I can have our team get back to you afterward.
Lujan: It's been admitted by Facebook that you do collect data points on non-[Facebook users]. My question is, can someone who does not have a Facebook account opt out of Facebook's involuntary data collection?
Zuckerberg: Anyone can turn off and opt out of any data collection for ads, whether they use our services or not but in order to prevent people from scraping public information ... we need to know when someone is repeatedly trying to access our services.
Zuckerberg: Congressman, in general we collect data on people who have not signed up for Facebook for security purposes to prevent the kind of scraping you were just referring to [reverse searches based on public info like phone numbers].
Lujan: So these are called shadow profiles, is that what they've been referred to by some?
Zuckerberg: Congressman, I'm not, I'm not familiar with that.
Lujan: I'll refer to them as shadow profiles for today's hearing. On average, how many data points does Facebook have on each Facebook user?
Zuckerberg: I do not know off the top of my head.
Lujan: Do you know how many points of data Facebook has on the average non-Facebook user?
Zuckerberg: Congressman, I do not know off the top of my head but I can have our team get back to you afterward.
Lujan: It's been admitted by Facebook that you do collect data points on non-[Facebook users]. My question is, can someone who does not have a Facebook account opt out of Facebook's involuntary data collection?
Zuckerberg: Anyone can turn off and opt out of any data collection for ads, whether they use our services or not but in order to prevent people from scraping public information ... we need to know when someone is repeatedly trying to access our services.
Until you create an account, you are neither a user nor a non-user. You are a cluster of IP and MAC addresses with details about your browsing habits.
"His name was James Damore."
zuck is such an asshat
He doesn't deny knowledge of it, he says they do! And he just doesn't have the data on hand. Sheesh, what a misleading title.
Everyone knows Shadow Profiles are real, that is how they know all the info they do when you sign up.
"Congressman, in general we collect data on people who have not signed up for Facebook for security purposes to prevent the kind of scraping you were just referring to [reverse searches based on public info like phone numbers]. "
So, then, you're telling us that you're collecting the data to ensure nobody is collecting that data, is that correct?
I don't understand why they left him off the hook so easily on this point. They could never collect consent from someone that didn't sign up for FB, so how is data collection could be legal?
Zuckerberg's nose is growing. Just sayin'
because his lips are moving, he is the biggest liar in washington right now
Politics is Treachery, Religion is Brainwashing
How is collecting data on non-users helpful in preventing reverse searches? It would seem to me that by not having that data non-users are best protected from searches?
Mod me down with all of your hatred and your journey towards the dark side will be complete!
Zuck: Yeah so if you ever need info about anyone at Harvard
Zuck: Just ask
Zuck: I have over 4,000 emails, pictures, addresses, SNS
[Redacted Friend's Name]: What? How'd you manage that one?
Zuck: People just submitted it.
Zuck: I don't know why.
Zuck: They "trust me"
Zuck: Dumb fucks
Don't be a dumb fuck.
then how can they opt out from getting their data collected?
i think facebook should be shut down, all their computer hardware confiscated and run through a shredder and the employees personal computers and other gadgets searched for other people's personal info and if any is found they should be investigated for identity theft
Politics is Treachery, Religion is Brainwashing
Lujan: I don't have a Facebook account. What does your shadow profile of me say?
Zuckerberg: Just a sec...it says you enjoy viewing Natalie Portman on Wikibellybutton.
Lujan: Wtf, I just jer...did that for the first time last night!
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
"Zuckerberg: Anyone can turn off and opt out of any data collection for ads, whether they use our services or not... " ...how, precisely do I turn off and opt out of FB data collection without signing up for FB?
I'm rather curious.
-Styopa
They absolutely do exist and he knows it.
I would start by hounding facebook to forget everything in their "shadow" profile of me.
*cough* linkedin *cough*
How is this any different than the cookies that any other site uses?
I remember things about perfect strangers. How am I violating anybody's rights?
What about the privacy rights of attorney / client privilege that were violated by Mueller? How is that not an autocratic takeover of elected government?
What about the people who get kicked off facebook for being Republicans? How is that not newsworthy but this is?
It might happen with badly configured IPv6.
Among other, IPv6 addresses can be created by adding a suffix derived from you MAC address to the prefix advertised by your router.
Of course, there are privacy extensions, which generate addresses by adding random nonsensical suffices to the prefix, and a well configured IPv6 stack should generate several of those and prefer them over the MAC-derived one.
(i.e.: your laptop will respond when called by it's MAC-based IPv6 - useful for services, e.g.: SSH - but when contacting the web, it will present itself with a random addresses so your mac address should never be revealed in some webserver's logs).
Facebook supports IPv6.
A badly configured IPv6 combined with some clever javascripting (e.g.: the "like" button that you see on virtually any website when you don't have FSF's "Privacy Badger" activated) makes it possible for Facebook to track you by your mac address no matter which network you're connecting from.
(I'm saying facebook, but it works just as well with any other IPv6 support social website that has its buttons plastered all over the web: Twitter, etc.)
So, if you use IPv6, remember to enable the bloody privacy option on.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
With all the hate suddenly piled up on the company, someone has to point out, that they've done nothing illegal. Not even unethical — certainly, not grossly so.
The information they keep about people was given to them voluntarily — either by users themselves, or by their friends and acquaintances. And what they now know, they are free to share — sell, give away, publicize, it is up to them.
Contrary to frequent assertions by the weaker-minded, there is no "right to be forgotten".
This whole "grilling" and questioning is quite extraordinary and barely constitutional, for it has most of the markings of a criminal prosecution without any crime.
That said, Zuckerberg does seem like a dork and an "accidental" billionaire, without the faculties, abilities, and guts normally necessary to achieve the power he wields.
In Soviet Washington the swamp drains you.
How could Fuckerberg not have known data was being collected about non-FB users???
I am not a FB user. Someone tagged me in some photos of me that my wife posted in her account. Data... Collection... about me... a non-user.
FUCK Facebook! FUCK Fuckerberg! Asshole.
"Lujan: I'll refer to them as shadow profiles for today's hearing. On average, how many data points does Facebook have on each Facebook user?
Zuckerberg: I do not know off the top of my head."
This is actually an interesting question, and the answer is probably very complicated. The answer is probably a multi-dimensional vector that the congressman wouldn't understand if Zuckerberg tried to explain it.
Riiiiight.
Like he doesn't make a profit in Germany with strict anti-hate laws or all of the EU and Canada with strong privacy rights.
And he doesn't let FB apps track you beyond the site ... or at least did until Firefox and others started disabling his FB app tracking cookies that kept running.
This guy must be a nightmare in a poker game, he lies so much.
-- Tigger warning: This post may contain tiggers! --
Zuckerberg took maximum advantage of the fact that the questions came from people mostly lacking the technical knowledge to judge his responses. For example, when asked if Facebook could track users across devices, he acted as though he didn't know. Is there anyone here who believes that? I wish we could ask him a few questions on Slashdot!
Zuckerberg also said that Facebook doesn't share user data, just uses it to predict which advertisements users are likely to respond to. In that case I'd really like to see what gets sent when someone uses Facebook to sign into a third party website.
" Zuckerberg: Anyone can turn off and opt out of any data collection for ads, whether they use our services or not but in order to prevent people from scraping public information ... we need to know when someone is repeatedly trying to access our services."
Yes anyone can opt out of tracking on the internet, its called running an ad blocker and no script or any other script blocking add-on.
The second part of the reply is simply him admitting that he has no idea what is going on within his own company and has nothing to do with his company scraping data from people. When someone loads a facebook like button on to their article, they are not trying to access facebooks services until they log in via the website or api. Its either that or facebook allows unfettered access to its api with out authorization, which i highly doubt.
What boggles my mind is how do investors think that he is incredibly smart for lying in the hearing like that? by the uptick in the stock price it would give them the impression that they think he is intelligent yet this entire thing gives me ammunition and actually makes it easier for me to explain to those less technically savy about how facebook actually handles the data. Turning people off of facebook is now becoming a fun game to me, i sure hope other people are taking advantage of this teaching opportunity as well. Yet in the end i guess i can understand why investors would see this as a good thing, they just do not understand the long term ramifications of his actions, they just see that he has avoided regulation with this meeting.
I don't know what a shadow profile is, but collecting data on anonymous visitors to your website is not a privacy violation, it's practicing security.
I'm surprised that the comprehension around here seems to be about on par with the congresscritters.
The Daddy casts sleep on the Baby. The Baby resists!
Zuckerberg declined to be open when it comes to deleting info from Facebook. Given Facebook is a subset of the Internet and you can not guarantee deletion of information from the Internet, how can you guarantee deletion of all copies of Facebook users' data? You fucking can not. 600lb elephant or what?
Also, since I just stated an immutable fact... if Facebook says they delete a user's data and it shows up someplace else somehow later... Facebook says prove it was us. You can not. Since you can't prove they deleted it or not they really do not have to delete it. So it is all a moot point and bullshitting the entire globe.
Why did nobody in Congress mention this? Usually the are down for scaring the public but not this time eh?
Jew=berg. Zucker=berg.
Zucker=Jew.
Not to mention this: Since the public has access to posted data and messaging data... and since the FBI and every other spy agency worldwide is the public too... You are posting your data directly to law enforcement in no uncertain terms. If they get it on their own volition it's one thing, if you hand it directly to them not "the public" that is another thing. Both one thing and another thing are the same outcome. Who just now found out that Facebook is Fedbook?
Any idea how many international moles scrape externally and how many international moles have been hired and/or contracted by Facebook? Notice how Congress "acted like tough questions" but really they were passing out neckbones when they didn't give breasts and thighs to the viewing public?
I am not new to the planet but this was not a case of some extraordinary disclosure or clever angle of questioning by Congress. How can I Joe Six Pack just casually beating my meat on myfreecams know this but Congress didn't ask? Something fishy about that is there not?
And social media is lame as hell.
You gave me a FB account, without my knowledge or consent, and added data to it which you then sold to third parties.
Further, the only way to tell FB I want to opt out is create an account, but not the shadow account, even though I don't use FB.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Requiem for the American Dream
It's far from obvious to me how he thinks I can do that.
Does he mean I sign up for an account, click some boxes, and then never use the service again?
Or does he image that the HTTP specification has an explicit provision for a header flag FBFO=true?
Does that flag also imply that if someone I know uploads a picture with me somewhere in the background, they won't match my likeness against all social media wallflowers, everywhere?
And then if I later sign up, that information won't be used to advertise to me from day one?
By contracting with companies to plant invisible trackers known as WEBBUGs on their web sites, such as these that are pinged every time you click on a techcrunch.com page:
cdn.tinypass.com/
d1z2jf7jlzjs58.cloudfront.net/
dashboard.tinypass.com/
dpm.demdex.net/
geo.yahoo.com/
o.aolcdn.com/
p.typekit.net/
plugin.mediavoice.com/
s.sa.aol.com/
s.yimg.com/
sb.scorecardresearch.com/
stats.wp.com/
use.typekit.net/
www.google-analytics.com/
www.npttech.com/
And these ones that are pinged when you click on a slashdot article:
a.fsdn.com/
ads.pro-market.net/
analytics.slashdotmedia.com/
cdn-social.janrain.com/
cdn.taboola.com/
consent.trustarc.com/
d1o5u7ifbz3swt.cloudfront.net/
ml314.com/
rpxnow.com/
snap.licdn.com/
ssl.google-analytics.com/
tag.crsspxl.com/
www.stack-sonar.com/
I don't get what the fuzz is all about. My Ghostery plug-in mentions a whopping 99 trackers on this slashdot page alone. Google, Yahoo, DoubleClick, LinkedIn, Amazon, Adobe, MySpace to name the big names (funny but no Facebook apparently unless they just use the tracker under another name).
I maybe use a few of these services (and none of the 90+ other trackers). Still they are logging me being on this page (or my ip or whatever my webbrowser gives out as information). Why are they suddenly blaming Facebook for doing the same thing? If I was in a hotel, 99 trackers would know I was in that hotel. The telco would know I was in that hotel. The hotel would know I was in that hotel. All of them would use that information to target ads or do something with it.
You know, Zuckerberg is right, they only just log all that information. It's not their fault that they can put two and two together, so can everybody else.
Zuckerberg says he is not familiar with Section 230 (the law that protects ISPs from liability for third-party content.) That would be like the CEO of SmithKline saying he doesnt know anything about pharmaceutical testing rules.
If his lawyers after all this time never briefed him on Section 230, he is either lying, willfully ignorant, or being poorly served by his legal team.
but the congessman who asked if Zuck would mind sharing what hotel he was staying made me laugh. Zuck said he would prefer not to. Hilarious. Maybe the congressman should have known and mentioned it in a followup question. Just to see how Zuck reacted to his personal info being shared.
Your first point is basically what they were banking on. Most of Congress lacks the technical expertise to verbally spar with him on most of these issues. He is employing the tactic every software engineer ever has when talking to non-tech executives. Plead ignorance to simple but damning questions and give overly complex answers to others such that management won't understand and doesn't want to look stupid. I really wish they would have pulled in some of his engineering leads that HAVE to be familiar with the product implementation so he couldn't plead ignorance so easily.
You second statement I think he was just abusing the double meaning. They aren't sharing data in the sense of a business deal where they get paid for the data, but they absolutely know they share a ton of information with developers and anyone plugging into the site to provide "enhancements" to their service.
Lujan: It's been admitted by Facebook that you do collect data points on non-[Facebook users]. My question is, can someone who does not have a Facebook account opt out of Facebook's involuntary data collection?
Zuckerberg: Anyone can turn off and opt out of any data collection
HOW? How can someone, who isn't a facebook user, opt out of this data collection? If by "turn off" he means "not use the internet", that's not an answer. Zucktard.
- First they ignore you, then they laugh at you, then ???, then profit.
This ^^^
This sig is false.
Comment removed based on user account deletion
They did ask and are well aware of what Fuckbook does. For example there were specific questions about the link itself being present at all and what level of tracking is done with it. Cuckerberg tried to act like there was none.
Many sites inline their stupid icon creating a 3rd party request to Facebook. It's where the whole tracking while you're not logged in, even came from.
Just wait until the new GDPR regulations kick in...
Having Leeched on
Shadow Profiles have been CALLED Shadow Profiles for at least 10, maybe as much as 15 years. I am pretty sure in fact that I have talked to facebook staff who referred to them as such (off the record obviously!) The data collection they have been doing was a large part of why they became so popular in the mid 00s, along with LinkedIn's stealing of contact info from the addressbooks of anyone who signed up. Remember those annoying 'So and so asked you to join LinkedIn Now!' emails you used to get, unsolicited?
A number of other companies used similiar tactics, whereas Facebook's approach was that 'you register an account and all your friends are already there!'
Both are scary, both should be illegal, yet somehow they are not.
I predict this will cost Facebook several billion dollars from several class action lawsuits and the addition of several countries fining it for the policy.
"I'm not I'm not familiar with that" means he's familiar with that.
from Facebook. What's not to understand?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Seriously that is what "being grilled" means to the US government? Grill me any day.
And ./ editors cannot dissect this either, as the headline clearly shows. No, he did not deny knowledge of anything. He said about shadow profiles that he is not familiar with that. Doesn't mean he doesn't know about it or it doesn't exist. I'm not familiar with the workings of my car engine. I know it's there, I know what it does, but aside from a general basic knowledge of engines, that's it.
And they let him off the hook with that. Either they never intended to actually ask any serious questions, or the whole stunt is just a "my re-election campaign is coming up soon" reminder to him, or they are just incredibly badly prepared. What do these people pay their staff for? Making coffee?
Which exact data does FB collect on non-users? How long is it stored? How do you identify people repeatedly visiting FB from different locations? Different browsers? Different devices? How do you identify scrapers using scripts instead of browsers? Which other services or companies cooperate with you on this? Names of the responsible people we can question there? If I go to FB right now from this notebook without logging in, which data will be generated? Can you identify a FB user before he logs in? Do you share the results of your analysis with third parties? With whom and for what purpose?
It's a pathetic show, really. High cringe factor. If you needed any more evidence that business is calling the shots in Washington, there it is.
Assorted stuff I do sometimes: Lemuria.org
regulate it? If folks don't like the way Facebook does business they can stop doing business with Facebook. Install no-script, delete your FB account (or don't make one in the first place). Problem solved.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Worked for Reagan , why not Zuck? And as I mentioned elsewhere, 45 of the 55 people "grilling" him get large donations from his company...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
It really don't like Zuckerberg, but in this case, the questions seemed very unfair, or at least uninformed.
So Facebook has those like-buttons everywhere, and there is a legitimate use for those. They will obviously save standard log information of the people that retrieve those buttons. Those buttons are often Javascript and/or an iframe. So Facebook can also gather rather standard things like screen size, browser headers, etc.
Just with that information, they can start doing fingerprinting of these anonymous users. I would quite frankly do this in a heartbeat if I had code of mine everywhere.
They can also use this for security purposes, and user modelling ("hmm...what can we gather about people that don't use our services? Why won't they? What can we do to appeal to them?").
But calling it 'shadow profiles' seems very misleading.
Why -1? That post should +5.
The only missing data points for non-users are the credentials.
The others are the same. It's just that the users have more complete and richer data points than non-users.
Comment removed based on user account deletion
Congressman: "How many employees are working at your company? a) 1,000 - 10,000 b) >10,000 - 500,000 ?"
Zuckerberg: "Congressman, I don't know off the top of my head".
This is totally correct. I was watching him weasel out of so many questions, using the gaps in the senators' knowledge. They use a vague term or phrasing... boom! Generic, safe answer delivered. The messed up thing is, you could tell he knew what the senators were really trying to get at but then used the gaps to avoid having to answer the tough questions on privacy and data collection.
"they've done nothing illegal. Not even unethical"... but it is immoral. And he knows it's wrong, the very fact that he has different controls on his private information on Facebook than everyone else shows this. Why don't we get the ability to immediately and forever delete a post? Why isn't he fine with the same levels of control of his Profile as everyone else, if everything they are doing is fine? He knows that he's sold everyone down the river.
They were certainly briefed on the issues, but I didn't get the impression that many--if any--had much real understanding of the topic. Especially when it comes to the ramifications of AI working with the data.
On the subject of third party icons, I was specifically referring not to the 'like' buttons, but those offering to log-in new users via a Facebook link to their identities. I expect that these transmit a lot more data in both directions. (Then again, I certainly could be wrong. The 'like' button may do more than I have assumed.) It would be very interesting to know if any /. folks have examined the operation of these things and what was found.
These hearings are just a way to reduce the effectiveness of the population's actions anyway. The only effective action is to stop using Facebook.
There once was a great effort in government to create something called Total Information Awareness. It was basically a desire for mass surveillance. Facebook data satisfies many of the stated goals of TIA. When Facebook first became noteworthy a common story or editorial was about the mysterious sources of income for Facebook.
Really it takes MUCH more imagination to believe that Facebook is NOT gathering info for mass surveillance of the population for the US government than to see that they obviously are.
Now Facebook's use in elections is a matter of concern for Senators, but Facebook itself is a source of power for the government. Any regulation will just address the needs of the Senators and completely ignore the mass surveillance of the populace.
So these hearings are a false way to give people a sense that something is being done to protect them.
In fact the only effective means people now have to protect themselves against this mass data collection is to stop using Facebook.
Does this mean they are misusing CISA to collect information on everyone? Who are they share sharing this information with "for purposes of security"?
Maybe, maybe not, but what is indisputable is that collecting data from visitors to thousands of other websites certainly is a privacy violation. It is utterly disingenuous to pretend that we are discussing a single website's log files.