Ask HN: Invited by Facebook for privacy roundtable. What questions should I ask?

Hypothetically, some businesses should not exist. For instance, although a children's-heroin-selling business might be in great demand and turn a huge profit, such a business is not in the best interests of society. Simply optimizing the delivery of things people want is not sufficient to make a good business. "Heavy equipment rental for people under the influence of narcotics" is similar. Without getting into a discussion of social good, or what's moral or not, we can all agree that at times people are willing to make trades for which they themselves would find stupid at other times.

Once data is captured it never goes away. As time passes and as it aggregates with other similar data, it actually becomes much more valuable.

So, continuing along, hypothetically, what are you going to do if capturing personal data in exchange for "free" services is not a business that should exist?

I understand that right now you're engaged in a long and drawn-out split-the-baby campaign, where you try to assure privacy advocates of your intentions and that's there some magic sauce involving algorithms that will solve everything, but what if that is not the case? What if your business model is built on harming people by encouraging them to make trades for personal information where, once we all figure out what we're doing, none of us would agree to fifty years from now? How will you know? Will you tell us? Do you already know? What are your plans?

If you truly want to respect privacy and are on the side of people living their lives without being constantly examined like lab rats and having every piece of their existence recorded for any hacker to see forevermore, what are your plans for knowing that it's not working out? What's your tripwire, your exit plan?

Because frankly, if you don't have one of those, then this is all just a PR exercise, right? You've already decided that you win, you just haven't figured the details out yet.

You can restate the question several different ways, but it all boils down to "How do we know you're serious about this?" Because so far it just looks like a bunch of the usual public relations BS.

This is already known, yes, and they're called shadow profiles.

You should go. But be aware that they're likely using you to look like they legitimately care about their user's privacy. So just don't let yourself be used in that way unless you want to be.

The question I've always wanted to ask Facebook is how much is their data worth? No discussion of privacy at Facebook is interesting unless the discussion concerns money and their bottom line. They undoubtably have people inside Facebook calculating how much spcecific bits of PII are worth to them, and what it would to their bottom line if they stopped collecting them. IMO any discussion of privacy that doesn't quantify it in terms of money is basically a waste of time. They're a company and money is all they care about.

As a corollary to value ask them about risk. How much do they calculate the risk of holding all that PII to be? How much would their bottom line be hurt if they lost it in a breach?

Can I ask you to ask a question that's not about their apps?

"I understand many if not all of your employees, and even your interns, are technically capable of accessing at least some data from any user, should they decide to do so against Facebook's will. I also understand the repercussion for this is that they would get fired and potentially sued. However, this is not accepted practice in every company that handle such sensitive data on users' personal lives. Moreover, it is easy to imagine adversaries and targets for which the risk of getting fired and/or sued is easily worth the benefit of obtaining a particular user's private data. How, then, do your security experts, who take security seriously and who surely understand the notion of 'defense in depth', justify that the proper safeguard is an employment/legal threat, and that there should not be a technical barrier preventing interns or other normal employees from accessing any user data?"

Bonus points if you can get them to talk such occurrences, which they almost certainly won't tell you, and why users should trust that they're handling this properly when they're unwilling to report sufficiently precise information on such incidents.

Ask them why the exposed moderators who now live in constant fear for their lives in their own countries were not offered serious compensation that could last them a significant chunk of their lifetimes (which would be on the order of hundreds of thousands of dollars). [1] Facebook will most likely respond that their threat assessments didn't warrant it. To which you'd ideally respond by asking them why a reasonable victim should consider it fair or reasonable to be forced to trust Facebook's security chops when Facebook already failed him once and put his life in danger.

Seriously, it's ludicrous to offer just a "home alarm system" and a ride to work (which I also assume is to their current job... why the hell should they keep doing the same job?) for a moderator who's now going to be in perpetual fear of getting killed. Those people may well no longer be able to work like they used to, for any employer.

[1] https://www.theguardian.com/technology/2017/jun/16/facebook-...