Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meta accessed women's health data from Flo app without consent, says court

malwarebytes.com

Post reply on HN
Print view View original

211–220 of 236 posts

Re: Meta accessed women's health data from Flo app without consent, says court

#211

Post by gruez »

banannaise wrote: post #193
gruez wrote: post #131

Earlier quoted context omitted.

>Facebook is guilty because they turned around and used the medical data themselves to advertise without checking if it was legal to do so. What exactly did this entail? I haven't read all the court documents, but at least in the initial/amended complaint the plaintiffs didn't make this argument, probably because it's totally irrelevant to the charge of whether they "intentionally eavesdropped" or not. Either they we…

> What do you think this should look like? Institutions that handle sensitive data that is subject to access regulations generally have a compliance process that must be followed prior to accessing and using that data, and a compliance department staffed with experts who review and approve/deny access requests. But Facebook would rather move fast, break things, pay some fines, and reap the benefits of their illegal b…

>Institutions that handle sensitive data that is subject to access regulations generally have a compliance process that must be followed prior to accessing and using that data, and a compliance department staffed with experts who review and approve/deny access requests.

Facebook isn't running an electronic medical records business. It has no expectation that it's going to be receiving sensitive data, and specifically discourages it. What more are you expecting? That any company dealing with bits should have a moderation team poring over all records to make sure they don't contain "sensitive data"?

>But Facebook would rather move fast, break things, pay some fines, and reap the benefits of their illegal behavior.

Running an analytics service that allows apps to send arbitrary events is "move fast, break things" now?

Re: Meta accessed women's health data from Flo app without consent, says court

#212

Post by gruez »

mlyle wrote: post #179
SilasX wrote: post #142

Earlier quoted context omitted.

Yeah, I'm not sure if I'm missing something, and I don't like to defend FB, but ... AIUI, they have a system for using data they receive to target ads. They tell people not to put sensitive data in it. Someone does anyway, and it gets automatically picked up to target ads. What are they supposed to do on their end? Even if they apply heuristics for "probably sensitive data we shouldn't use"[1], some stuff is still go…

The problem is, the opposite approach is... "We're scot free, because we told *wink* people to not sell us sensitive data. We get the benefit from it, and we make it really easy for people to sign up and get paid to give us this data that we 'don't want.'" Please don't sell me cocaine *snifffffffff* > The fault should still lie with the entity that passed on the sensitive data. Some benefits to making it be both: * C…

>"We're scot free, because we told wink people to not sell us sensitive data. We get the benefit from it, and we make it really easy for people to sign up and get paid to give us this data that we 'don't want.'"

>Please don't sell me cocaine snifffffffff

Maybe there's something in discovery that substantiates this, but so far as I can tell there's no "wink" happening, officially or unofficially. A better analogy would be charging amazon with drug distributing because some enterprising drug dealer decided to use FBA to ship drugs, but amazon was unaware.

Re: Meta accessed women's health data from Flo app without consent, says court

#213

Post by gruez »

jdashg wrote: post #203
dehrmann wrote: post #162

Earlier quoted context omitted.

Not at Facebook, but I used to work on an ML system that took well-defined and free-form JSON data and ran ML on it. Both were used in training and classification. Unless a human looked, we had no idea what those custom fields were. We also had customers lie about what the fields represent for valid and less valid reasons. Without knowing how it works at Facebook, it's quite possible the data points got slurped in, t…

How it happened internally is irrelevant to whether Facebook is responsible. Deploying systems they do not properly control or understand does not shield against legal or normal responsibilities! There is a trail of people who signed off on this implementation. It is the fault of one or more people, not machines.

>Deploying systems they do not properly control or understand does not shield against legal or normal responsibilities!

We can argue the "moral" aspect until we're both blue in the face, but did facebook have any legal responsibilities to ensure its systems didn't contain sensitive data?

Re: Meta accessed women's health data from Flo app without consent, says court

#214

Post by gruez »

ryandrake wrote: post #151
decisionsmatter wrote: post #144

Earlier quoted context omitted.

No one is arguing that FB has not engaged in egregious and illegal behavior in the past. What pc86 and I are trying to explain is that in this instance, based on the details of the court docs, Facebook did not make a conscious decision to process this data. It just did. Because this data, combined with the billion+ data points that Facebook receives every single second, was sent to Facebook with the label that it was…

If FB is going to use the data, then it should have the responsibility to check whether they can legally use it. Having their supplier say "It's not sensitive health data, bro, and if it is, it's consented. Trust us" should not be enough. To use an extreme example, if someone posts CSAM through Facebook and says "It's not CSAM, trust me bro" and Facebook publishes it, then both the poster and Facebook have done wrong…

>To use an extreme example, if someone posts CSAM through Facebook and says "It's not CSAM, trust me bro" and Facebook publishes it, then both the poster and Facebook have done wrong and should be in trouble.

AFAIK that's only because of mandatory scanning laws for CSAM, which were only enacted recently. There's no such obligations for other sensitive data.

Re: Meta accessed women's health data from Flo app without consent, says court

#215

Post by gruez »

hedgehog wrote: post #157
gruez wrote: post #115

Earlier quoted context omitted.

>Flo gets the largest blame but meta needs to show they did their part to ensure this didn't happen. (I would not call terms of use enough unless they can show they make you understand it) Court documents says that they blocked access as soon as they were aware of it. They also "built out its systems to detect and filter out “potentially health-related terms.”". Are you expecting more, like some sort of KYC/audit reg…

Facebook chose to pool the data they received from customers and allow its use by others, so they are also responsible for the outcomes. If it's too hard to provide strong assurance that errors like Flo's won't result in adverse outcomes for the public, perhaps they should have designed a system that didn't work that way.

>Facebook chose to pool the data they received from customers and allow its use by others, so they are also responsible for the outcomes.

"chose" is doing a lot of the heavy lifting here. Suppose you ran a Mastodon server and it turned out some people were using it to share revenge porn unbeknownst to you. Suppose further that they did it in a way that didn't make it easily detectable by you (eg. they did it in DMs/group chats). Sure, you can dump out the database and pore over everything just to be sure, but it's not like you're going to notice it day to day. If a few months later the revenge porn ring got busted should you be charged with "intentionally eavesdropping" on revenge porn or whatever? After all, to some extent, you "chose" to run the Mastodon server.

Re: Meta accessed women's health data from Flo app without consent, says court

#216

Post by gruez »

WhyCause wrote: post #195
hennell wrote: post #190

Earlier quoted context omitted.

I have the type of email address that regularly receives email meant for other people with a similar name. Invites, receipts, and at one point someones Disney+ account. At one point I was getting a strangers fertility app updates - didn't know her name, but I could tell you where she was in her cycle. I've also had NHS records sent to me, again entirely unsolicited, although that had enough I could find who it was me…

> ...you can't control what others send you. Of course not. You can, however, control what you then do with said data. If a courier accidentally dropped a folder full of nuclear secrets in your mailbox, I promise you that if you do anything with it other than call the FBI (in the US), you will be in trouble.

Except in this case it's unclear whether any intentional decision went on at meta. A better analogy would be if someone sent you a bunch of CSAM, it went to your spam folder, but then because you have backups enabled the CSAM got replicated to 3 different servers across state lines, and the FBI is charging you with "distributing" CSAM.

Re: Meta accessed women's health data from Flo app without consent, says court

#217

Post by gruez »

Spivak wrote: post #140
gruez wrote: post #70

Earlier quoted context omitted.

If you read the court documents, "eavesdropped on and/or recorded" basically meant "flo used facebook's SDK to sent analytics events to facebook". It's not like they were MITMing connections to flo's servers. https://www.courtlistener.com/docket/55370837/1/frasco-v-flo...

I think it a distinction without a difference. To make it more obvious imagine it was one of those AI assistant devices that records your conversations so you can recall them later. Plainly obvious that accessing this data for any purpose other than servicing user requests is morally equivalent to easedropping on a person's conversations in the most traditional sense. If the company sends your conversation data to Fa…

To extend your analogy further, what if instead of an AI assistant, it was your friend who listened to your secret, and instead of him sending your data to facebook, he told that to google (eg. "hey gemini, my friend has hemorrhoids..."). Suppose further that google uses Gemini queries for advertising purposes (eg. upranking ad results for hemorrhoid creams). Should gemini be on the hook for this breach of trust? What if, instead of a big evil tech company, it was the owner of a local corner shop, who uses this factoid to inform his purchasing decisions?

Re: Meta accessed women's health data from Flo app without consent, says court

#218

Post by gpm »

gruez wrote: post #209
gpm wrote: post #204

Earlier quoted context omitted.

No... In the part of my post that you quoted I'm literally just talking about the cover page of [1] where the defendants are listed, and at the time only Flo is listed. So nothing against Facebook/Meta is being alleged in [1]. They got added to the suit sometime between that document and [3] - at a glance probably as part of consolidating some other case with this one. Reading [1] for allegations against Facebook doe…

>Reading [1] for allegations against Facebook doesn't make any sense, because it isn't supposed to include those. The quote from my previous comment was taken from the amended complaint ([3]) that you posted. Skimming that document it's unclear what facebook actually did between 2019 and 2021. The complaint only claims flo sent data to facebook between 2016 and 2019, and after a quick skim the only connection I could…

Ah, sorry, the paragraphs in [3] I'm looking at are

21 - For the claim that there was public reporting that Facebook was presumably aware of in 2019.

26 - For the claim that in February 2021 Facebook refused to review and destroy the data they had collected from Flo to that date, and thus presumably still had and were deriving value from the data.

I can't say I read the whole thing closely though.

Re: Meta accessed women's health data from Flo app without consent, says court

#219

Post by azemetre »

tracker1 wrote: post #183
azemetre wrote: post #85

Earlier quoted context omitted.

I mean it totally depends what your views on democracy are. Juries are one of the few, likely only, practices taken from Ancient Athenian democracy which was truly led by the people. The fact that juries still work this way is a testament to the practice. With this in mind, I personally believe groups will always come to better conclusions than individuals. Being tried by 12 instead of 1 means more diversity of thoug…

I mostly agree here, but would add there's definitely a social pressure to go along with the group a lot of the time, even in jury trials. How many people genuinely have the fortitude to stand up to a group of 10+ others with a countering pov.

I don't disagree, but think of the pressures a judge has as an individual as well. Pressures from the legal community, the electorate, and being seen as impartial.

There is a wisdom of the crowd, and that wisdom comes in believing that we are all equal under the law. This wisdom is more self evident in democratic systems, like juries.

Re: Meta accessed women's health data from Flo app without consent, says court

#220

Post by 1vuio0pswjnm7 »

aboringusername wrote: post #80

Another aspect of this is why Apple/Google let this happen in the first place. GrapheneOS is the only mobile OS I can think of that lets you disable networking on an per-app level. Why does a period tracking app need to send data to meta (why does it even need networking access at all )? Why is there no affordance of user-level choice/control that allows users to explicitly see the exact packets of data being sent of…

"GrapheneOS is the only mobile OS I can think of that lets you disable networking on a per-app level."

Don't need to "root" mobile phone and install GrapheneOS. Netguard app blocks connections on a per-app basis. It generally works.

But having to take these measures, i.e., installing GrapheneOS or Netguard (plus Nebulo, etc.), is why "mobile OS" all suck. People call them "corporate OS" because the OS is not under the control of the computer owner, it is controlled by a corporation. Even GrapheneOS depends on Google's Android OS, relies on Google hardware, makes default remote connections to a mothership that happen without any user input (just like any corporate OS), and uses a Chromium-based default browser. If one is concerned about being tracked, perhaps it is best to avoid these corporate, mobile OS.

It is easy to control remote connections on a non-corporate, non-mobile OS where the user can compile the OS from source on a modestly resourced computer. The computer user can edit the source and make whatever changes they want. For example, I use one where, after compilation from source, everything is disabled by default (this is not Linux). The user must choose whether to create and enable network interfaces for remote connectivity.

Post reply on HN