top | item 16675373

Zuckerberg Takes Steps to Calm Facebook Employees

258 points| SREinSF | 8 years ago |nytimes.com

262 comments

order
[+] mehrdadn|8 years ago|reply
I feel like someone should also give Zuckerberg the memo that it's only a matter of time before an insider also goes rogue and abuses data access (edit: or otherwise; see below). Facebook fundamentally seems to trust itself way too much, and it worries me that it thinks the only threats are external entities... to me, this is another silently ticking time bomb.

EDIT: And don't forget that going rogue is just one scenario. Another is just a bigger attack surface: the more insiders have broad system access, the more credentials there are that can be phished by/leaked to/stolen by outsiders. Really, it would be completely missing the point of security to have arguments about how exactly insiders' credentials might get compromised.

[+] harryh|8 years ago|reply
You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution.

With so much to lose and so little to gain internal leaks of this sort are extremely rare.

[+] esman1|8 years ago|reply
FWIW, as a Facebook engineer you have a ton of trainings on how to handle data privacy. And not only is every place where you can touch data actively logged/audited/monitored (this includes DB reads from code, admin tools, etc.), but to access any data you have to explicitly request permission for that specific data.
[+] throwaway2041|8 years ago|reply
Correct. There are many stats relevant to the national discussion that a patriotic Facebook employee might leak. One is the effective CPM (eCPM) rate between the Trump and Clinton campaigns. My hunch is there was a massive disparity there, in favor of Trump. Facebook has only released the "paid CPM" rates, which is suspicious. Most Facebook advertisers look at eCPM, which combines paid + "organic" reach, in other words: the net reach per dollar spent.
[+] surferbayarea|8 years ago|reply
Wait till there is a REAL data leak. Just your facebook profile data is 1% of the data they have about you. Using the cookies they have all over the internet as well as partnerships with offline pos transaction systems, they know almost anything you do online/offline. So all websites you have ever visited, things you buy online, the sandwich you buy with your credit card in a local store etc etc. Imagine all that being leaked.
[+] bigiain|8 years ago|reply
You're assuming it hasn't happened already - all we know for sure is we haven't (yet) had one with Snowden's type of motivation.

(Or perhaps we have, and whichever trusted journalists they've chosen to share with are franticly poring over the exfiltrated data working out how best to angle the story without throwing the whistleblower and/or innocent FB users under the bus...)

[+] gboudrias|8 years ago|reply
Who says it hasn't happened already? How would we ever know? For that matter, how would Zuck?
[+] ronnier|8 years ago|reply
> to me, this is another silently ticking time bomb.

I agree. It'll eventually happen to some social app or email provider (think Slack, gmail, facebook, etc) where some huge portion of the database is dumped online -- not through a hack, but through a person willing to do it internally because they can and do not fear or care about the consequences. The Ashley Madison hack was a preview of what's to come.

[+] eurticket|8 years ago|reply
I would imagine we would hear a lot less information about an internal issue regarding a Facebook employee than an external one as well.
[+] feelin_googley|8 years ago|reply
"Our efforts to protect our company data or the information we receive may also be unsuccessful due to software bugs or other technical malfunctions, employee error or malfeasance, government surveillance, or other factors.

"In addition, third parties may attempt to fraudulently induce employees or users to disclose information in order to gain access to our data or our users' data."

"Although we have developed systems and processes that are designed to protect our data and user data and to prevent data loss and other security breaches, we cannot assure you that such measures will provide absolute security."

"In addition, some of our developers or other partners, such as those that help us measure the effectiveness of ads, may receive or store information provided by us or by our users through mobile or web applications integrated with Facebook. We provide limited information to such third parties based on the scope of services provided to us. However, if these third parties or developers fail to adopt or adhere to adequate data security practices, or in the event of a breach of their networks, our data or our users' data may be improperly accessed, used, or disclosed."

Source: MD&A, 2015 Facebook annual report

[+] JumpCrisscross|8 years ago|reply
Facebook's Board of Directors is a remarkable collection of silent-yet-complicit heavyweights:

-Marc Andreessen;

-Erskine Bowles ("President Emeritus of the University of North Carolina" and "White House Chief of Staff from 1996 to 1998");

-Ken Chenault ("Chairman and Chief Executive Officer of American Express Company");

-Susan Desmond-Hellmann ("Chief Executive Officer of The Gates Foundation" and former "Chancellor at University of California, San Francisco (UCSF) from 2009 to 2014");

-Reed Hastings ("Chief Executive Officer and Chairman of the board of directors of Netflix");

-Jan Koum ("co-founder and CEO of WhatsApp"); and

-Peter Thiel [1].

Might not be a bad idea to pen a letter to their Board [2] with your state attorney general [3] and perhaps a U.S. Senator [4] copied.

[1] https://investor.fb.com/corporate-governance/default.aspx

[2] https://investor.fb.com/corporate-governance/?section=contac...

[3] http://naag.org/naag/attorneys-general/whos-my-ag.php

[4] https://www.senate.gov/general/contact_information/senators_...

[+] swyx|8 years ago|reply
probably because speaking out would cause more trouble than its worth. i recall an Uber director decided to open his mouth during the incidents of last year...
[+] chrischen|8 years ago|reply
Doesn't Zuckerberg have full control of the board?
[+] feelin_googley|8 years ago|reply
"He's surrounded himself with people just like him -- Silicon Valley entrepreneurs," says Stuart Grant, who deposed the Facebook founder during a lawsuit filed by investors opposed to the company's proposal. Facebook withdrew the proposal last month, just days before Zuckerberg was set to testify in the suit in Delaware Chancery Court.

...

There's a reason for diversity -- it gives you a mix of opinions and ideas," says Grant, partner and co-founder of Grant & Eisenhofer, a Wilmington, Delaware, firm that specializes in securities and corporate-governance cases.

The board's near-uniformity of experience has led to a consensus of opinion that defers to Zuckerberg on all matters, Grant told CNBC. That can stray from what is best for shareholders."

For example, allowing Zuckerberg to reduce his economic interest in Facebook "dramatically" -- by selling tens of millions of shares -- while allowing him to maintain "absolute control" over corporate decision-making was a bad idea that the board should have voted down, Grant argues.

"You never want to divide economic consequences from decision-making," he says.

Zuckerberg's plan would have created three classes of shares, one with no voting rights, and allowed him to maintain voting control of the company even after selling most of his stake."

Source: https://www.cnbc.com/2017/10/05/attorney-who-deposed-mark-zu...

(Poll: Do you think it would be interesting to see the video from that deposition?)

Lead up:

"Discovery revealed that Zuckerberg in fact used his relationship with Andreessen to undermine the special committee process. Andreessen leaked Zuckerberg confidential information about the committee members' thoughts and concerns, and coached Zuckerberg through his negotiations with the committee. In one instance, Andreessen and Zuckerberg texted back and forth during a group call with the committee, with Andreessen telling Zuckerberg things like, "This line of argument is not helping. J" and "THIS is the key topic.""

...

"Trial was set for Tuesday, Sept. 26, 2017, with Zuckerberg slated to testify as the plaintiffs' first witness. On Thursday evening, Sept. 21, however, Zuckerberg asked Facebook's board to withdraw the reclassification, which it did. This withdrawal mooted the plaintiffs' litigation and averted the billions of dollars of harm to Class A stockholders that plaintiffs sought to prevent."

Source: http://webcache.googleusercontent.com/search?q=cache:https:/....

"But Andreessen, a venture capitalist at Andreessen Horowitz and a long-time Facebook board member, is a close Zuckerberg ally. While on the committee, Andreessen slipped Zuckerberg information about their progress and concerns, helping Zuckerberg negotiate against them, according to court documents. The documents include the transcripts of private texts between the two men, revealing the inner workings of the board of directors at a pivotal time for Facebook.

   ... 
Most of Andreessen`s texts to Zuckerberg during the negotiations over the non-voting shares focused on how to talk to the other two committee members. Susan Desmond-Hellmann, Facebook`s lead independent director and chief executive officer of the Bill & Melinda Gates Foundation, also led the special committee and discussed the matter on its behalf with Zuckerberg personally -- a call that Andreessen helped Zuckerberg prepare for.

Bowles, former President Bill Clinton`s chief of staff and past president of the University of North Carolina system, was especially skeptical of Zuckerberg`s proposition, as depicted in the suit. Many of Andreessen`s texts focused on persuading him. Among other things, Bowles worried that one of the concessions Zuckerberg wanted -- to allow the billionaire to serve two years in government without losing control of Facebook -- would look particularly irresponsible, according to court filings. Bowles did not respond to requests for comment.

Andreessen sought to persuade Bowles that if Zuckerberg went into politics, the government would likely require him to give up control of Facebook anyway, so the point was moot, according to the documents. A couple weeks later, Andreessen prevailed, and the vote was brought to shareholders. (The stock reclassification is on hold pending the results of the lawsuit, though.)

"The cat`s in the bag and the bag`s in the river,`` he messaged Zuckerberg. "Does that mean the cat`s dead?" Zuckerberg texted back, not understanding the spy speak.

   Andreessen replied: "Mission accomplished :-)""
Source: https://www.bloomberg.com/news/articles/2016-12-08/facebook-...

The deposition must have gone well. Heres what the plaintiffs lawyer had to say before Zuckerberg withdrew his proposal.

"This case is said to mark just the second time Zuckerberg testifies as a witness. He previously testified earlier this year over a lawsuit against Facebook-owned Oculus -- a case Facebook lost.

Stuart Grant, the attorney representing the shareholders in the dispute, didn't mince words. He suggested Zuckerberg's limited courtroom experience puts him at a disadvantage in this case.

"That gives me an advantage because I've been doing this for 30 plus years," Grant told CNN Tech. "If we were sitting down to do coding together, I'd bet on Mark, but we're not coding."

Source: http://money.cnn.com/2017/09/20/technology/business/mark-zuc...

[+] tuna-piano|8 years ago|reply
Can someone explain to me why the Cambridge Analytica story is making people so much angrier than the later revelation that Facebook was scraping call+text info? That seems to be the larger problem to me.

Somewhere at Facebook there is a team of people who wrote software to scrape, store and analyze the personal call+text data that users didn't explicitly mean to give to Facebook.

The data that Cambridge Analytica attained (from Facebook's API) doesn't seem surprising at all. Isn't the Cambridge Analytics headline really just, "Group doesn't follow website's terms of service from five years ago".

[+] m52go|8 years ago|reply
> Isn't the Cambridge Analytics headline really just, "Group doesn't follow website's terms of service from five years ago".

I think the the headline people are seeing is more like "Group doesn't follow website's terms of service from five years ago, and ends up helping Donald Trump win presidency."

A big part of the reason this has become so big a story is political.

[+] jnbiche|8 years ago|reply
Probably because of some of the things that Cambridge Analytica stands accused of, or else things they have blatantly admitted to while being secretly recorded: blackmail and bribery of politicians in multiple countries, hacking election results, and even more unethical acts[1,2].

People are upset that their data was essentially stolen from Facebook (it was collected for use in an academic study, then turned around and sold for profit to CA), used by a company with ethical failures as serious as Cambridge Analytica, and then Facebook buried the story. It was two years before it came to light thanks to Guardian journalist Carole Cadwalladr.

Facebook also worked closely with CA during the Trump campaign, even though they would have known by that time that data obtained under the pretense of an academic study had been sold to CA.

1. http://www.bbc.com/news/uk-43528219

2. https://www.channel4.com/news/cambridge-analytica-revealed-t...

[+] Analemma_|8 years ago|reply
Because people are really, really bad at understanding threats that have vague, uncertain consequences. For the last 15 years, trying to get people to seriously worry about privacy has had about as much success as getting them to worry about climate change: they claim to care, but their revealed preferences tell a different story. The problem is that the downsides are uncertain and in the future, whereas the upsides are immediate and certain. Our ape brains are horrible at evaluating tradeoffs of this kind.

But the flip side to this is why the CA story has blown up: for once, the consequences— "CA got Trump elected!"— are immediate and graspable, in a way that "Facebook is scraping your text info" is not (even if it's probably not true). When the effects are right in your face and not time-delayed, people sit up and pay attention.

[+] stordoff|8 years ago|reply
I'd imagine it's at least partly expectations - people know that Facebook has their data (even if not the full extent), so adding an additional class of data doesn't change that fundamental understanding or register as strongly. The fact that a third-party can pull your data out of Facebook is less obvious.

The fact that it was used for political ends probably makes a difference as well, both in the amount of coverage it is receiving and that it makes the use of data into a more concrete issue (it's much easier to understand "this is what the data was used for" then "Facebook has your data and that's bad for hypothetical/abstract reasons").

> Isn't the Cambridge Analytics headline really just, "Group doesn't follow website's terms of service from five years ago"

That's the act, but I'd say the usage/intent behind doing so is part of the story.

[+] machinehermit|8 years ago|reply
It is this weeks viral thing to be outraged about.

I am buying some FB calls in the morning because no one will care about this "movement" in a month.

[+] dawhizkid|8 years ago|reply
The CA story is the first tangible example of the societal consequences of exploiting social data for something other than selling you cat litter.
[+] forgottenpass|8 years ago|reply
Can someone explain to me why the Cambridge Analytica story is making people so much angrier than the later revelation that Facebook was scraping call+text info?

The lie that facebook (and the like) are sold on is that there are zero possible negative ramifications of giving Facebook that data. Of course that's not true. But something has caught people's attention and they're waking up to it.

Now is the time to tell them all the other reasons to not trust facebook. Loudly scratching your head about why people care about Cambridge Analytica is to miss the opportunity you have.

[+] tim333|8 years ago|reply
Personally: I don't care what facebook does with my data - there's nothing very exciting and I have ad blockers so don't even see the ads. It doesn't effect me.

However the Analytica stuff is about conning the masses into voting for Trump and Brexit and that effects me big time and pisses me off somewhat. In face worse that conning - more initing the mob to hatred through lies and bullshit. See for example the Hillary is Satan ad paid for by the russians and targeted with facebook to the kind of people who vote on the basis of that kind of stuff https://static01.nyt.com/images/2017/11/02/us/politics/02dc-...

[+] tbrock|8 years ago|reply
I respect Facebook and their engineering chops as much as the next person, they are truly world class programmers, but how the holy hell is everyone daydreaming that they don’t work for an advertising company?

You sell and use people’s data to get money: this is the business plan. Full stop.

Connecting people can definitely be lucrative and useful in other ways but facebooks particular implementation is impression based not action/outcome based.

[+] ramphastidae|8 years ago|reply
Because they’re paid well. Very well. Everyone I know that works at FB for 2+ years is making 300-500k (including stock) and already owns or is on their way to purchasing a home. That makes it a lot easier to ignore the reality of FB. Meanwhile chumps like me that consider the ethics of their employer will be renting forever. I honestly don’t blame them.
[+] et-al|8 years ago|reply
The money probably helps, especially given the Bay Area cost-of-living.

The FB employees I've met have been fine with explaining away the consequences of their actions with "oh it's just a job", "that's not my team", or "the technology is really interesting".

And as an idealist, I'll invoke Goodwin's Law depending on our relationship.

[+] swyx|8 years ago|reply
not too long ago the emphasis was on whether Facebook is a -media- or a -tech- company. Media companies have more responsibility to censor content then tech companies do.

Interesting how quickly the narrative changes.

[+] debacle|8 years ago|reply
I respect Google and their engineering chops as much as the next person, they are truly world class programmers, but how the holy hell is everyone daydreaming that they don’t work for an advertising company?

You sell and use people’s data to get money: this is the business plan.

Are people working there really so nieve(sic) as to believe that this is surprising?

[+] madez|8 years ago|reply
Facebook is an enabler for individuals to successfully undermine our democratic mechanisms. It shouldn't feel nice to work for a company that has to explain itself in front of the government. The employees of Facebook should be aware of what monster they are building.
[+] Mc_Big_G|8 years ago|reply
I hope anyone worth their weight in salt leaves Facebook as an employee and as a user. Employees should already feel shame since the election. They all know what Facebook is built on and what they've done and what they're doing.
[+] jondubois|8 years ago|reply
>> One of [the Facebook employees] said he had avoided a trip home to see his family last weekend because he did not want to answer questions about the company he worked for.

Wow, some people/families are way too media-sensitive. It's just hypocrisy. Facebook is fundamentally the same company as it was last week, last year and 5 years ago. Everyone knew this, especially Facebook employees.

Facebook today is mostly made up of two kinds of employees; money-hungry sociopaths and hypocrites.

[+] colordrops|8 years ago|reply
What could they possibly do to fix things that wouldn't destroy their business model?
[+] newscracker|8 years ago|reply
Seriously, I don’t have much respect, if any, for those working for Facebook...unless they’re working on and can implement drastic changes in how privacy, tracking and profiling are handled for the betterment of humankind. But Facebook being an advertising company that thrives on such details, I doubt if employees would have much say on these aspects or can do anything.

There ought to be a #quitfacebook topic to get many employees to quit. But I don’t believe that would get much traction due to the attractiveness of compensation/benefits and probably some challenging work. If someone working at Facebook believes that things will get better, I’d say they’re just deluding themselves. It cannot happen with the current management.

P.S.: Since this post is about Facebook, I’m not going to talk about other companies.

[+] discordance|8 years ago|reply
Sounds like Facebook is having their NSA moment
[+] stretchwithme|8 years ago|reply
This one company's unauthorized access to millions of records may just be the tip of the iceberg.
[+] bogomipz|8 years ago|reply
>"There was a feeling, said one of the people, that Facebook wanted to take aggressive steps to make sure it could regain user trust. And over all, he said, confidence was up."

I'm curious what might be the source of this regained "confidence."? The idea that this will all just blow ever in a few months?

[+] wildmusings|8 years ago|reply
I don’t really understand the outrage. Just what do you expect when you share things with hundreds of people (your FB friends) online? For it not to be used? The only reasonable assumption is that anyone and everyone can read whatever you share on FB.
[+] BadassFractal|8 years ago|reply
On the plus side, it's good to know that Facebook has employees who care about being ethical citizens of the Internet ecosystem. Hopefully they can exert pressure on the upper ranks in some way to bring things under control. Facebook has the opportunity to be a force for good, while also accomplishing its business model, but it won't naturally lean in that direction.
[+] avoidit|8 years ago|reply
Someone I know closely worked at Facebook in its heyday, but it has been a while since he left. I asked him around 2014 (he had just left the company) "So what do you think about the way Facebook handles privacy issues?" His response was not defensive at all. Rather, it was a very curious "FB is one of the most open cultures you can ever work in. Any employee can ask any question of anyone at the highest levels and expect to get a honest answer". My thought was "So you didn't have anything to ask questions about?". He was actually a pretty nice fellow, so I stopped asking anything else at that point.

But I remember thinking that it was a very funny, cult-member like response. And you can test this too. Ask your friends who work at FB and I bet you will get some pre-programmed response very similar to that.

[+] feelin_googley|8 years ago|reply
"KW: Mark, can you give us a sense of the timing and cost for this? Like, the audits that you're talking about. Is there any sense of how quickly you could do it and what kind of cost it would be to the company?

I think it depends on what we find. But we're going to be investigating and reviewing tens of thousands of apps from before 2014, and assuming that there's some suspicious activity we're probably going to be doing a number of formal audits, so I think this is going to be pretty expensive. You know, the conversations we have been having internally on this is, "Are there enough people who are trained auditors in the world to do the number of audits that we're going to need quickly?" But I think this is going to cost many millions of dollars and take a number of months and hopefully not longer than that in order to get this fully complete."

Source: https://www.recode.net/2018/3/22/17150814/transcript-intervi...

[+] brrrrr|8 years ago|reply
And even if anyone ever considers it "complete," the reality is, that it's just going to be white wash and bullshit.

Why waste the fucking money. Quit being sentimental. Just trash Facebook and pivot (lol pivot). Be a real motherfucker, and let Facebook burn. Make something cooler than Facebook. Fuck this audit stupidity.

Come on, man.

[+] jk2323|8 years ago|reply
Honestly, I am not very worried about rouge data analytic companies or Russian trolls on facebook.

I am worried that questionable semi-private German entity can block me (e.g. 30 days ban) on facebook at will. I am an US citizen and don't live in Germany. This is outrageous.

[+] joshjdr|8 years ago|reply
How fast can I kill all my karma by pointing out that the 3 of the top 4 articles on HN are some realization that Facebook does not give an ef about anybody's privacy?
[+] mankash666|8 years ago|reply
Let's cut to the chase. Would you work for Facebook in your dream role, at industry leading pay.

The answer, for most of us is an emphatic 'yes'