Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook engineers: we have no idea where we keep all your personal data

theintercept.com

Post reply on HN
Print view View original

21–30 of 137 posts

Re: Facebook engineers: we have no idea where we keep all your personal data

#21

Post by zo1 »

personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

I just started reading the transcript. They asked a lot of questions trying to figure out details about various products.

It's 850 pages long, and the few spots I jumped to the guy kept answering with "I don't know", "I'm not familiar with this", etc. Even the parts he says "I'm familiar with this service", the guy goes on to answer "I don't know more than what's written there". The guy couldn't even answer if certain databases were accessible by third parties (not implying they were).

This must have been painful to be a part of. 100 variations of "I can neither confirm nor deny".

Re: Facebook engineers: we have no idea where we keep all your personal data

#22

Post by 988747 »

namelessoracle wrote: post #13
jtbayly wrote: post #6

> The special master at times seemed in disbelief, as when he questioned the engineers over whether any documentation existed for a particular Facebook subsystem. “Someone must have a diagram that says this is where this data is stored,” he said, according to the transcript. Zarashaw responded: “We have a somewhat strange engineering culture compared to most where we don’t generate a lot of artifacts during the engin…

The cynic in me says it's building your own job security. Documentation only really gets created if leadership forces the issue in my experience. You also get to sell the refactor/rewrite because "nobody understand the existing code".

I've been a programmer for 15 years and I've never seen it done for "job security". I think this is mostly about low tolerance for boredom of most programmers: writing code is exciting, documenting it is boring, so you do not do it unless forced to.

Re: Facebook engineers: we have no idea where we keep all your personal data

#23

Post by Hauthorn »

RichardCNormos wrote: post #12
personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

[flagged]

Or maybe just implying that Meta isn't up for the task of complying with GDPR, and lack the necessary ability to comply with regulations.

Re: Facebook engineers: we have no idea where we keep all your personal data

#24

Post by fsociety »

mathgladiator wrote: post #19

I believe we need a privacy centered view of technology. Even a traditional database creates a spiderweb of 'where is your personal data spread across so many tables', and I hope there is a reckoning against this approach. I have considered pivoting my service into a privacy respecting data store ( https://www.adama-platform.com/ ), but I've yet to meet anyone that actually cares about user privacy to rethink their d…

Actually FB has some wicked privacy tech around their central data store - and are building more. Nuance gets lost in these articles, for example even with proper documentation there are simply too many things for one person to know where data flows in that company. Or data flowing through RPC calls can make it hard to know what will fail downstream if you remove a certain piece of data.

Re: Facebook engineers: we have no idea where we keep all your personal data

#26

Post by PeterisP »

gthrone wrote: post #9
personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

Ya the way he responds saying a full team would be needed to uncover this sounds like he was treating "where" holistically. Every bit of information in every server, application, etc. Feels like a trained response.

The way I read this, his response saying that a full team would be needed to uncover this is not a flaw in the question - because IMHO that's exactly what was required - but rather that Facebook has not done the work required to meet their legal requirements. Yes, it's quite plausible that Facebook might need a team to do extensive work to produce the analysis and documentation about where private data is flowing - that's not a valid excuse though, Facebook simply needs to make that team and do that work, no matter if they want to or not, until they can properly answer these questions.

They need to have an exhaustive list of how they're using private data, and they need to have a process ensuring that their engineers are not adding new sources of private data or not using existing private data without the company approving and updating that list. Yes, their current processes aren't fit for that - as Meta documents quoted in TFA say "We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose,’" - so these processes must be changed.

Re: Facebook engineers: we have no idea where we keep all your personal data

#27

Post by pavlov »

> The systemic fogginess of Facebook’s data storage made answering even the most basic question futile. At another point, the special master asked how one could find out which systems actually contain user data that was created through machine inference.

“I don’t know,” answered Zarashaw. “It’s a rather difficult conundrum.”

This is not a basic question because of how ML works. Can we say a system contains my data if my data was used as a training input to a neural network at some point in the past?

In that case, can I sue anyone using Stable Diffusion for stealing my data because the billions of images in its training set included something I created?

Re: Facebook engineers: we have no idea where we keep all your personal data

#29

Post by twanvl »

handity wrote: post #17

After reading some more of the transcript, I think the article does such a bad job of describing what was being asked for that it makes the court seem incompetent and Facebook actually rather reasonable. My original comment is below: Government contracted construction workers: We Have No Idea Where Your Tax Money Goes When tasked with answering the simple question "Which specific bricks did my tax money buy this year…

Money is fungible, personal data is not.

Re: Facebook engineers: we have no idea where we keep all your personal data

#30

Post by lupire »

jkingsbery wrote: post #16
jerf wrote: post #10

Kind of serves as a good example of "single central conspiracy" versus "many actors given common cause to act in a certain way" ways of thought. It's easy to imagine Zuckerberg going to work every day and laughing maniacally as he personally shepherds your stolen conversation with friends yesterday about your experiences with laundry detergents into The Facebook Info Vault and then personally uses that information to…

While I appreciate this distinction and is an interesting way to look at things, I don't think it's inevitable. I've never worked at Facebook, but I work for another large tech company. Every project at our company, particularly the ones that deal with personal data, must produce a threat model [1] before going into production. In another thread, someone claims "Well that's because the question is meaningless," but f…

> understand all aspects of "where" data is for the system under design.

There easy! But also useless! The data is everywhere. That's why every "where" was created. Everything is a potential threat vector and needs to be protected by layers of fallible security.

Post reply on HN