Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Force Facebook into Handing Over their Secret Tracking Data

europe-v-facebook.org

Post reply on HN
Print view View original

51–60 of 107 posts

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#51

Post by kragen »

gburt wrote: post #3

There doesn't appear to be any non-facebook.com data in the example PDFs -- i.e., no "you commented on TechCrunch" or "you visited TechCrunch which has our widgets". I would suspect this means Facebook just simply did not provide it?

It's surprising that the PDF I looked at (the first one) doesn't contain any access-log data at all. Shouldn't it contain the time, date, and IP address of every time she's viewed a page on Facebook, at least as far back as they keep HTTP access logs? Or do they not log the user ID when they log HTTP accesses? Someone (in Europe, therefore not me) should ask the Irish Data Protection Commissioner to get an answer to these questions.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#52

Post by WettowelReactor »

nak3d wrote: post #22
sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

Best advice I ever heard (and it came from an ex-Facebook employee), "treat communication ("private" & "public") on all services, including Gmail, Facebook, and Tumblr, like a million people are listening."

That does not really cover it as all FUTURE people are listening as well. Time has a funny way of obliterating context.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#53

Post by incongruity »

X-Istence wrote: post #25
nak3d wrote: post #22

Earlier quoted context omitted.

Best advice I ever heard (and it came from an ex-Facebook employee), "treat communication ("private" & "public") on all services, including Gmail, Facebook, and Tumblr, like a million people are listening."

Or better yet start using OTR on these services and verify the "key" on each end before continuing to talk about private matters.

That doesn't account for the times the receiver decrypts your communication and then intentionally makes it public.

There's a deep wisdom to the idea that one ought not put into words that which they wouldn't want the world to see... Once it's out of your head, your ability to control it diminishes if not outright vanishes... Just say'n is all..

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#55

Post by toadstone »

Helianthus wrote: post #49
toadstone wrote: post #46

I don't understand this community. I thought you were wolves, but here you are taking the part of the sheep. Instead of being outraged, you should be trying to get your own piece of the data pie. Every single web startup is doing exactly that.

I don't think you understand communities. People acting in a group will act similarly and be derided by you as 'sheep.' It it is the type of thing that motivates group action that determines whether you think group members are 'wolves.' Wolves move in packs, too.

It was a predator/prey metaphor, not a individual/group metaphor.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#56

Post by sschueller »

techiferous wrote: post #8

So let's say I launch TrackMyEatingHabits.com. If a user that happens to live in the UK signs up, they can send me a request for all of their data and I have to comply, right? So this means that when I design the software for TrackMyEatingHabits.com, I should also be mindful to have a process (and data model) that makes it easy to locate this user data quickly, right? Also, I should have in place processes to verify…

Facebook's legal headquarters are in Ireland for tax reasons (12.5%) so they have to comply with EU law. (http://www.facebook.com/press/releases.php?p=59042)

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#57

Post by nl »

kragen wrote: post #51
gburt wrote: post #3

There doesn't appear to be any non-facebook.com data in the example PDFs -- i.e., no "you commented on TechCrunch" or "you visited TechCrunch which has our widgets". I would suspect this means Facebook just simply did not provide it?

It's surprising that the PDF I looked at (the first one) doesn't contain any access-log data at all. Shouldn't it contain the time, date, and IP address of every time she's viewed a page on Facebook, at least as far back as they keep HTTP access logs? Or do they not log the user ID when they log HTTP accesses? Someone (in Europe, therefore not me) should ask the Irish Data Protection Commissioner to get an answer to…

I doubt they HTTP access logs are tied directly to the user id.

It might be possible to derive this information by linking on the IP address, but that isn't the same thing as a direct link at all.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#58

Post by 1337p337 »

sek wrote: post #12
Loic wrote: post #11

Earlier quoted context omitted.

You cannot get all your logins, session time, IP address, etc. This is what you have a right to get out of a EU based company. Yes, this means that as a business, it is pretty hard to comply with the law.

When they don't save it there is nothing to get. They have a policy to remove personal data after 3 months or so.

It's at least six months, and they don't do a very good job of anonymizing: they scrub the last two digits of the IP, but not tracking cookie logs. DataLiberation further contains no information they keep when you are not logged in, and only a fraction of what they have (and keep) when you are logged in. The "privacy dashboard" points to several chunks of data that are retained but not accessible, and there is far more that actually is kept.

A simple but perhaps inconvenient way to verify this is to be criminally prosecuted for something where your Google account is relevant. Google will hand over what they have to the prosecution, and as the defendant, you'll be entitled to see the evidence. (I've not tried this and don't recommend it, but do know someone that this happened to, and have examined the contents of the provided CD.)

DataLiberation is mostly a PR site, and it's main use is migrating what data Google feels is useful to you, not finding out what Google knows.

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#59

Post by nak3d »

sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

Heads up: Google does this with Gmail, too. http://news.cnet.com/2100-1047_3-6050295.html - "Judge grants subpoena and orders that all e-mail messages, including deleted ones, be divulged."

Re: How to Force Facebook into Handing Over their Secret Tracking Data

#60

Post by _delirium »

nextparadigms wrote: post #45
sek wrote: post #13

Unbelievable: http://europe-v-facebook.org/EN/Data_Pool/data_pool.html They delete sh*t, if you delete your posts they don't remove them from their databases. This makes me really angry, there is a reason why i delete this stuff. I can't believe this, they have a responsibility. Edit: WTF http://europe-v-facebook.org/EN/Data_Pool/data_pool.html#Mac... This is maybe the most frightening: http://europe-v-facebook.org/E…

"Note: According to facebook’s privacy policy, messages on facebook can not be deleted anymore. If you click on ‘delete’ the messages will only be invisible to you. US law enforcement agencies can access this information at there own liking, without judicial review." That last one is scary indeed. People were arguing a while ago whether these companies should keep data only for 6 months, or for a year, or 18 months -…

It also seems to indicate a deliberate quasi-law-enforcement role being played by Facebook. If Facebook handed over data when presented with warrants, the "without judicial review" wouldn't be true. That can only be true if they're purposely partnering with law enforcement, to voluntarily offer them data that courts haven't requested.

Reduces any qualms I might have about calls for Facebook to be regulated as a public utility, if it's actively choosing to act as an arm of the government anyway. Public utilities are actually, despite being much more entangled with the state in some ways, more separated from the state when it comes to law-enforcement. For example, the phone company can't just choose to record all your calls and give them to the police without a warrant.

Post reply on HN