Facebook engineers: we have no idea where we keep all your personal data • Hacker News Board

Re: Facebook engineers: we have no idea where we keep all your personal data

#31

Post by lupire » Wed, Sep 07, 2022, 2:31 PM UTC

jerf wrote: post #10

Kind of serves as a good example of "single central conspiracy" versus "many actors given common cause to act in a certain way" ways of thought. It's easy to imagine Zuckerberg going to work every day and laughing maniacally as he personally shepherds your stolen conversation with friends yesterday about your experiences with laundry detergents into The Facebook Info Vault and then personally uses that information to…

Not even conspiracy. Governments, free markert, natural world all works the same way. Many semi-independent actors making local optimizations, with varying levels of sophistication in organization and hierarchy. Many emergent properties. IT in the large is like physics, chemistry, biology, psychology anthropology, and sociology. It's not building one precise bridge over and over again.

Re: Facebook engineers: we have no idea where we keep all your personal data

#32

Post by alexhill » Wed, Sep 07, 2022, 2:31 PM UTC

personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

> They don't even know how to ask the right questions to get to what they want to know.

You're right. If the questions were being asked of someone who was genuinely motivated to answer them, this wouldn't be an obstacle.

The phrase "all your personal data" (or the quote from the article, "every bit of data associated with a given user account") feels vague and imprecise only if you have an internal understanding that for practical purposes, it really is impossible. The Facebook engineers know that and everyone here knows that. It's not literally impossible - an internal team of digital archaeologists with unlimited resources and no deadline might be able to do it for a single user. But practically impossible across the whole userbase.

If you were genuinely interested in providing insight to the hearing, you could explain all that, and then explain how you could go about creating a rough sketch of an answer, and how you'd go about adding some detail to that sketch.

The Facebook engineers have no real motivation to provide insight off their own bat. They can take the question literally, and answer honestly that they don't know, that nobody else knows, and that it's probably impossible TO know. I'm not even sure if this is acting in bad faith. I can easily imagine feeling cagey in this situation, and responding as such. Experiencing an emotion isn't acting in bad faith.

All that said...these questions were asked by a court-appointed subject matter expert. Either the subject matter expert is not the right person for the job, or...and now I realise that of course I haven't read the transcript and there's every chance that what's quoted in the article is not the most insight the court managed to prise out of the engineers. posting anyway in 3 2 1

Re: Facebook engineers: we have no idea where we keep all your personal data

#33

Post by kixiQu » Wed, Sep 07, 2022, 2:31 PM UTC

ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

I work for a large long-living tech company. Where legal compliance and security are concerned, "it is just layering and organic growth" is not something you get to say. If we were speculating about such a thing on a coffee break, maybe we'd get the kind of answer given here, but if a single reference doesn't exist for something that is necessary for compliance, people get paged until it does.

(There may be other things taken as seriously I'm not thinking of, but compliance and security are the two I've seen drag people out of their beds by their ankles)

Re: Facebook engineers: we have no idea where we keep all your personal data

#34

Post by PeterisP » Wed, Sep 07, 2022, 2:32 PM UTC

personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

Yes. All of that. That is the right question, the very first question as a starting point. A basic requirement from a company is to provide an exhaustive, true, up-to-date list of all of these - and if they can't, they should not be permitted to handle private data.

Re: Facebook engineers: we have no idea where we keep all your personal data

#35

Post by jtbayly » Wed, Sep 07, 2022, 2:32 PM UTC

handity wrote: post #17

After reading some more of the transcript, I think the article does such a bad job of describing what was being asked for that it makes the court seem incompetent and Facebook actually rather reasonable. My original comment is below: Government contracted construction workers: We Have No Idea Where Your Tax Money Goes When tasked with answering the simple question "Which specific bricks did my tax money buy this year…

That’s an absurd analogy that doesn’t fit at all.

FB uses the data it can’t find or tell you anything about to successfully sell ad space to third parties targeted back at you.

Let’s make it concrete.

We know FB keeps track of which webpages you visit. We also know they use that data as a way to help target ads. That data isn’t in the data export they give you, as far as I can tell from a brief search.

Is there data coming in about which Instagram profiles you follow and what pics you clicked and liked? Is there other data they keep track of? Undoubtedly.

I’m not surprised nobody knows the answer to what all it might be. But pretending that data is fungible like money is just misdirection.

Re: Facebook engineers: we have no idea where we keep all your personal data

#36

Post by markstos » Wed, Sep 07, 2022, 2:33 PM UTC

ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

You can hire one or more data privacy people whose whole job it is to track this. They get an inventory of all the systems and talk to the managers of every system, find the answers and document them.

Meta is choosing not to know or pretending not to know. They have the resources to know where your data goes.

Re: Facebook engineers: we have no idea where we keep all your personal data

#37

Post by mathgladiator » Wed, Sep 07, 2022, 2:33 PM UTC

fsociety wrote: post #24

mathgladiator wrote: post #19

I believe we need a privacy centered view of technology. Even a traditional database creates a spiderweb of 'where is your personal data spread across so many tables', and I hope there is a reckoning against this approach. I have considered pivoting my service into a privacy respecting data store ( https://www.adama-platform.com/ ), but I've yet to meet anyone that actually cares about user privacy to rethink their d…

Actually FB has some wicked privacy tech around their central data store - and are building more. Nuance gets lost in these articles, for example even with proper documentation there are simply too many things for one person to know where data flows in that company. Or data flowing through RPC calls can make it hard to know what will fail downstream if you remove a certain piece of data.

Alternatively, how that privacy logic is built and the infra is an albatross. And worse, a checkbox without any guarantees.

Re: Facebook engineers: we have no idea where we keep all your personal data

#38

Post by jtbayly » Wed, Sep 07, 2022, 2:33 PM UTC

twanvl wrote: post #29

handity wrote: post #17

After reading some more of the transcript, I think the article does such a bad job of describing what was being asked for that it makes the court seem incompetent and Facebook actually rather reasonable. My original comment is below: Government contracted construction workers: We Have No Idea Where Your Tax Money Goes When tasked with answering the simple question "Which specific bricks did my tax money buy this year…

Money is fungible, personal data is not.

Ha! “Fungible” is the word I settled on, too.

Re: Facebook engineers: we have no idea where we keep all your personal data

#39

Post by mistrial9 » Wed, Sep 07, 2022, 2:35 PM UTC

ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

this useful excuse-insight will be provided to all compliance personnel at the next staff meeting, in writing.

Re: Facebook engineers: we have no idea where we keep all your personal data

#40

Post by lupire » Wed, Sep 07, 2022, 2:37 PM UTC

seanhunter wrote: post #7

personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

Companies which deal with personal data do so in the context of regulatory frameworks (CCPA, GDPR etc) which define specifically what the definition is and what’s covered. They also have to record what they collect and process and for what purpose. If you’re Facebook you have to know this in order to process that data. You can’t pretend not to understand the question.

The people who write the question don't understand the question. They are "not even wrong". They are telling the businesses to figure it out. Maybe that's desirable, or maybe it's pointless. In prod strokes you can say data is either fully controlled by the users, shared with other user data for product model building, or also used for ad targeting. But it's unclear if being more specific is useful to anyone. You can point to an example like equal housing opportunity enforcement, as it interacts with ML-targeted or attribute -targeted ads. It's equivalent to detecting discrimination anywhere a human makes an opinionated choice. It's a problem no one knows how to solve. It' not a law like "don't shoot or stab people" (which is also complex in some ways).