Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook engineers: we have no idea where we keep all your personal data

theintercept.com

Post reply on HN
Print view View original

51–60 of 137 posts

Re: Facebook engineers: we have no idea where we keep all your personal data

#51

Post by nathanaldensr »

PeterisP wrote: post #34
personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

Yes. All of that. That is the right question, the very first question as a starting point. A basic requirement from a company is to provide an exhaustive, true, up-to-date list of all of these - and if they can't, they should not be permitted to handle private data.

Agreed. I'm tired of these companies assuming that it's some kind of natural order or divine right to collect this data to begin with.

Re: Facebook engineers: we have no idea where we keep all your personal data

#52

Post by pavlov »

dannyw wrote: post #44
pavlov wrote: post #27

> The systemic fogginess of Facebook’s data storage made answering even the most basic question futile. At another point, the special master asked how one could find out which systems actually contain user data that was created through machine inference. “I don’t know,” answered Zarashaw. “It’s a rather difficult conundrum.” This is not a basic question because of how ML works. Can we say a system contains my data if…

> In that case, can I sue anyone using Stable Diffusion for stealing my data because the billions of images in its training set included something I created? No, because of the landmark Authors Guild, Inc. v. Google, Inc. case which found that ML training can be considered fair use in some circumstances.

So why do we expect Meta to internally track this kind of data usage? Seems like it’s both fair use and covered by the terms of service that FB users have agreed to.

Re: Facebook engineers: we have no idea where we keep all your personal data

#53

Post by AlwaysRock »

RichardCNormos wrote: post #12
personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

[flagged]

So why would Meta send someone to explain who doesnt have the capacity to answer those questions? At best they sent the wrong person on accident or they couldnt send the right people for some unknown reason. More likely, they send people with limited knowledge and tell them to only answer questions about areas they are 100% certain about.

If Meta actually wanted to answer they could have 25 people in this room with all the answers. But they dont want to actually answer this question.

Re: Facebook engineers: we have no idea where we keep all your personal data

#54

Post by dvfjsdhgfv »

ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

As far as code goes, it's true for many companies. As for data, it was similar in many large European companies in the pre-GDPR era. Today, one crucial question is always asked: when you work with data, is this personal data? If it is, you need to deal it with a special way. Personal data is both an asset and a liability.

Most companies found a way do do it. It was a long and often very painful process, involving everything from data entry to backup processes and procedures, but somehow we managed to do it.

Re: Facebook engineers: we have no idea where we keep all your personal data

#55

Post by Delphiza »

Many here on HN are saying that such a record of what tech companies do with data is a) impossible because complex systems have evolved over time and the (historical) flows of data are unknown and b) unnecessary because the need to know what happens to data is not relevant to the user or the questioner. The old models of processing data at scale to extract value, as FAANG has been doing, are eventually going to come to an end. Maybe not where there is a power imbalance, such as between Facebook and their users, but at least where users of services have more clout and are paying for the product. I see this in B2B IoT solutions where big customers are very picky about how telemetry is collected by product vendors and, if not pushing back hard, are at least choosing not to use services that are not clear on how data is processed and handled.

The amount of data that we all see, every day, that is grossly mishandled may signal the end of the ML and AI goldrush. You can only build models, and run data through models, with the consent of the owner of that data. Large producers of data (think vehicle fleet operators) are beginning to take ownership of their data, and are only _licensing_ it to processors for very specific purposes. In the example of vehicle fleet operators, they may only want route planning, and not have their data used to sell them tyres based on mileage. Also, while governments may be busy with other stuff currently, at some point they may decide to turn on the regulatory screws.

Re: Facebook engineers: we have no idea where we keep all your personal data

#56

Post by encoderer »

kixiQu wrote: post #33
ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

I work for a large long-living tech company. Where legal compliance and security are concerned, "it is just layering and organic growth" is not something you get to say. If we were speculating about such a thing on a coffee break, maybe we'd get the kind of answer given here, but if a single reference doesn't exist for something that is necessary for compliance , people get paged until it does. (There may be other th…

Yes and it’s a good thing that most industries do not carry this governance burden.

Re: Facebook engineers: we have no idea where we keep all your personal data

#57

Post by withinboredom »

BiteCode_dev wrote: post #43
ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

Maybe, but one can find out. You can follow the chain of calls of any software, and they have access to everything, as well as the whole history. It's like when in an interview Buffets says it's very hard to know where all the money is in the financial system. Sure, it's a complex system, but it's more of a matter of incentive.

You can follow the chains to a degree, but that assumes you have access. At work, you can follow things until it gets to a spool file, but you won’t have access to the system/code that reads the file.

Re: Facebook engineers: we have no idea where we keep all your personal data

#58

Post by RHSeeger »

UncleMeat wrote: post #41
markstos wrote: post #36

Earlier quoted context omitted.

You can hire one or more data privacy people whose whole job it is to track this. They get an inventory of all the systems and talk to the managers of every system, find the answers and document them. Meta is choosing not to know or pretending not to know. They have the resources to know where your data goes.

I think you are underestimating the complexity of this task by about three orders of magnitude. This is the way to do it, but you can't do it for a company of this scale with a handful of people.

But pretending they can only afford "a handful of people" to work on the problem is a little silly, too. They don't have the answers because they choose not to devote the resources to get the answers; not because they are unable to devote the resources.

Re: Facebook engineers: we have no idea where we keep all your personal data

#59

Post by kwertyoowiyop »

personjerry wrote: post #2

Well that's because the question is meaningless - What does it mean "all your personal data"? What does "where" mean? Physically? Which tables? Which data is relevant? Friends? Friends of friends? Ad data? Behavioural data? ANY inferences, models built on user datasets that might include that user? They don't even know how to ask the right questions to get to what they want to know. Context: I worked at Facebook

Sure, and what does “is” mean exactly? And what really is “data”? Their answers seem like passive-aggressive BS. If their lives or careers depended on it, they’d come up with a lot of answers PDQ.

Re: Facebook engineers: we have no idea where we keep all your personal data

#60

Post by canoebuilder »

What are we talking about here? Data associated with specific users?

Well in order for your grandma to log into Facebook her user account must have a primary key associated with it so she sees her info when she logs in and not someone else’s.

We are talking about computers and databases. When did using a computer to search a database become a difficult, nigh impossible thing to do?

Even if design documents and flow charts or whatever don’t exist could they not fairly straightforwardly be reverse engineered by taking a sample of users and searching all databases for associated information?

This seems like a transparent ploy on the part of Facebook to avoid regulation by casting the perfectly doable, searching a database, into some sort of incomprehensible impossible task. The credulous author of the article and many comments here seem to be strangely buying into it.

FB investors don’t seem to have lost faith in the company’s ability to search databases. When it comes to making the company money from those searches, no problem at all. But regarding lawsuits or potential regulation, we can only throw our hands into the air and simply wonder and gasp at this incomprehensible mess we have made.

Post reply on HN