How to Force Facebook into Handing Over their Secret Tracking Data • Hacker News Board

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#21

Post by rmc » Sun, Sep 25, 2011, 7:04 PM UTC

techiferous wrote: post #8

So let's say I launch TrackMyEatingHabits.com. If a user that happens to live in the UK signs up, they can send me a request for all of their data and I have to comply, right? So this means that when I design the software for TrackMyEatingHabits.com, I should also be mindful to have a process (and data model) that makes it easy to locate this user data quickly, right? Also, I should have in place processes to verify…

No, probably not. Usually you only have to abide by a countries laws if your server are based there, or you have a company incorporated there. If you have a US company with servers hosted in the US, acbd an EU citizen uses it, and claims you are breaking their laws, then there its nothing the courts in that country can do to make you abide them.

To put it another way, are you worried if your US company breaks Chinese censorship laws? That's illegal in China. Are you worried if your company denies that the Holocaust happened? That's illegal in Germany.

You only need to abide by laws in the country you are in. Unless you have a EU server you don't have to abide by EU laws.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#22

Post by nak3d » Sun, Sep 25, 2011, 7:05 PM UTC

sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

Best advice I ever heard (and it came from an ex-Facebook employee), "treat communication ("private" & "public") on all services, including Gmail, Facebook, and Tumblr, like a million people are listening."

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#23

Post by FuzzyDunlop » Sun, Sep 25, 2011, 7:06 PM UTC

sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

You may be surprised that many (at a guess, maybe most?) companies/websites actually consider a delete function to be changing a 'deleted' flag to 1 in a database. The data persists, but is no longer shown.

I would also make a very big assumption that the only companies who wouldn't do this are those run by developers or other people who have had experience implementing that sort of system.

There's nothing bosses love more than storing whatever data they can get their hands on, no matter how relevant it is, and how reluctant they are to actually delete it. Or secure it properly. Hell, it's just data, who gives a shit right?

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#24

Post by _delirium » Sun, Sep 25, 2011, 7:07 PM UTC

dbbo wrote: post #4

Is there a similar law in the United States? If so, I've never heard of it.

No, there's no general right-to-data law. There are general right-to-government-data laws, so you can e.g. request your own FBI record. But private businesses don't normally have to disclose what data they collect on you. There are a few exceptions for specific areas; for example, the credit-ratings agencies have to provide you with a copy of your credit report, and in some cases an employer may be required to provide you with a copy of certain personnel records. But they apply to fairly limited situations.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#25

Post by X-Istence » Sun, Sep 25, 2011, 7:17 PM UTC

nak3d wrote: post #22

sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

Best advice I ever heard (and it came from an ex-Facebook employee), "treat communication ("private" & "public") on all services, including Gmail, Facebook, and Tumblr, like a million people are listening."

Or better yet start using OTR on these services and verify the "key" on each end before continuing to talk about private matters.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#26

Post by ldd- » Sun, Sep 25, 2011, 7:23 PM UTC

kiiski wrote: post #19

ldd- wrote: post #15

I have a dual citizenship . . . U.S./France. While I live in the U.S., I may try this with my French passport.

Facebook TOS says: "If you are a resident of or have your principal place of business in the US or Canada, this Statement is an agreement between you and Facebook, Inc. Otherwise, this Statement is an agreement between you and Facebook Ireland Limited." So if you're living in USA it seems like they don't need to comply with your requests.

Thanks for the head's up on the TOS. Actually, there WAS a period of time when I was on FB when I was living in Germany. In fact, when I signed up for FB, I was living in Germany (not in the military), so still probably worth a shot.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#27

Post by gus_massa » Sun, Sep 25, 2011, 7:41 PM UTC

sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

There are also some technical problems with deletion. For example: What to do if the post has subposts from other user? What happens is someone steals your account and erases all your posts?

And, when you click on the delete, should they erase the information:

* From the cache

* From the database (not only mark it for deletion)

* From the weekly/monthly/yearly backup

* From the old backup system that is not longer in use, and was connected to the old backend that is not longer in use.

And remember the man that gets his Flirk account erased by mistake. Luckily they got a secret mode to restore it. http://bindermichi.posterous.com/how-to-subdue-a-major-inter...

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#28

Post by sek » Sun, Sep 25, 2011, 7:55 PM UTC

gus_massa wrote: post #27

sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

There are also some technical problems with deletion. For example: What to do if the post has subposts from other user? What happens is someone steals your account and erases all your posts? And, when you click on the delete, should they erase the information: * From the cache * From the database (not only mark it for deletion) * From the weekly/monthly/yearly backup * From the old backup system that is not longer in…

Well i don't expect them to do it instantly, but just "never" deleting anything is what bugs me.

There is no necessity to change backups, just to remove it from the current database and when the last backup is outdated it is gone.

You can't come up with a realistic example that cannot be solved by 6 months old backups.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#29

Post by mattm » Sun, Sep 25, 2011, 7:58 PM UTC

FuzzyDunlop wrote: post #23

sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

You may be surprised that many (at a guess, maybe most?) companies/websites actually consider a delete function to be changing a 'deleted' flag to 1 in a database. The data persists, but is no longer shown. I would also make a very big assumption that the only companies who wouldn't do this are those run by developers or other people who have had experience implementing that sort of system. There's nothing bosses lov…

This is how I usually implement delete. Deleting a record can have many cascading effects and there is no possibility for undoing it if it was an error. I think this is a pretty standard way of doing it.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#30

Post by chc » Sun, Sep 25, 2011, 8:05 PM UTC

FuzzyDunlop wrote: post #23

sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

You may be surprised that many (at a guess, maybe most?) companies/websites actually consider a delete function to be changing a 'deleted' flag to 1 in a database. The data persists, but is no longer shown. I would also make a very big assumption that the only companies who wouldn't do this are those run by developers or other people who have had experience implementing that sort of system. There's nothing bosses lov…

I think you're close, but missing something: The companies who wouldn't do this are run by developers or other people who don't interact much with the actual users. Irreversible actions are horrible UX, and any irreversible action in a commonly used area of the app will make a large number of people steaming mad on a daily basis — guaranteed.

People who will blithely click "Delete" — and then click "Yes" even though they don't mean it on the confirmation dialog that comes up — vastly outnumber people who care that an invisible copy of their content might be buried in some Facebook database somewhere. Next to the unintentional deleters, the second group looks like a rounding error. And that's not even counting people who get their accounts hijacked.

So I would say people who know users are more likely to go with the delete flag, since that leaves you an avenue to help the user who emails support with "I got really drunk last night at the wake and thought it might be funny to delete everything on my Facebook and now all my photos of my dead Nanna are gone."