Correcting the Record on Meta’s Involvement in Nebraska Case
about.fb.com
about.fb.com
The press release only enforces my concern about how easy it seems for governments to get private conversations between a mother and daughter. Also that apparently Facebook stores the conversations in plain (or easily decryptable) text.
I struggle to understand how anyone can still think that facebook (and any other major social media platform) has any issue (moral, technical, or otherwise) with giving away any and all data from their systems, to anyone willing to pay enough or who can threaten them with fines. Why would they? Their business model is selling user data to advertisers. Do people really think they're just leaving money on the table and saying "well, that's private, people might not like that data being sold." They don't give a shit!
I also struggle to understand how anyone can look at the current social media landscape, where seemingly everyone has accounts on multiple platforms and uses them to post/message about their personal lives, and not think the us government/law enforcement is involved somehow. Does anyone really think the microphones we all willingly put inside our homes that are controlled by one of the largest corporations in the entire world aren't readily available for intelligence agencies?
I admit I am very cynical, but it's very difficult not to be. It feels like every month we hear about how some massive platform was actually lying about handling data that they totally promised they were keeping safe and private, which is followed up some new expansion of their ability to collect said data. But we all continue to give them the benefit of the doubt, and act surprised when things like this happen.
Dear kids: if it could embarrass you or get you in trouble, don't send it with a messaging app.
Kind of like "If you don't have anything nice to say, don't say anything at all"... except it doesn't roll off the tongue.
But once it happens, you learn that what you say online is a persistent written record which outsiders will occasionally access. I don't think that people can credibly claim to be unaware that all of their social media activity exists in a grey area between "public" and "private".
Is it possible that most people just don't care? It seems like the "I'm not doing anything wrong, so I don't care" impulse is very beguiling. Maybe events like this will be enough to snap people out of it, but I wouldn't bet on it.
This. Even with E2EE enabled, that only protects your conversations as they travel between you and facebook's servers. It does not mean that the messages are protected from facebook being able to see them. People should have zero expectation of privacy on facebook's platform(s).
Or was that feature scrapped or did I misremember?
I only don't remember exactly.
Here is my issue with WhatsApp though:
How will I know that Meta is still shipping an application based on an uncompromised version of the Signal protocol, without malicious modifications? Auditing is the normal answer.
Sadly, Meta is not ISO27001 certified, so there's no trustworthy external audit trail.
Barring that, who is capable of auditing Meta to confirm this? Who can see the client and server sources to confirm that there is no MITM? Only Meta, on both counts.
I have to trust their word for it and I'm incapable of trusting them.
And it is not like Facebook doesn't have options here. They can fight the warrant and they can publish the private information of the people involved with the warrant.
For example, Twitter fought an attempt to expose somebody mocking Rep Devin Nunes: https://www.theguardian.com/us-news/2021/may/18/devin-nunes-...
In this case, the warrant appears to have been issued to an officer in the Norfolk PD, who then asked FB for any messages between the two suspects.
What's not clear to me (IANAL) is what power FB had to refuse to comply with the warrant. If they refused to comply, would the police start seizing servers? Or, would FB be held in contempt (usually applies to subpoenas, not sure if that would apply with a warrant).
All that said, the "easy" answer for FB (Apple, Google, etc) is E2E encryption of messages. Then all they can do it produce the encrypted "gibberish" and the PD has to hack it or move on.
Ok, I just double-checked that, and apparently Facebook has a Nebraska data center. So the information could possibly be there. But I have a hard time imagining Nebraska PD going into a 10-acre data center and just grabbing servers.
“Court documents indicate that police were at that time investigating the alleged illegal burning and burial of a stillborn infant.”
Facebook, has among many choices, two clear and easily territories in which to advance user privacy: technically and legally.
Technically, Facebook could implement E2E for private messages. Doing so would make disclosure not something they were unwilling to do, but unable to do.
The other, and this is much more juicy, would be to lobby the California legislature to make it illegal under state law to disclose private conversations re: abortion to states where abortion is prohibited.
The fact that these are possible, but not likely to happen is another issue altogether.
You're not kidding. Doing state-by-state battle over jurisdiction and the right of each state to create its own laws would be ... interesting. I'd expect it to be very destructive overall. Not saying it would necessarily lead to an end of the union, but it's a step.
Seems to be a pattern, lately, and specific to abortion as well. The ends justifying the means, regardless of collateral damage.
We'd have to figure out how the nukes are divided up, however. Though what is it they say about possession being 9/10ths of the law...
The US in many ways legitimizes itself as a government in the traditional of the "western european project," by evoking the ritual, esthetic, ideals, and historical lineage of ancient Greece and Rome. From names and architecture, to values and ritual, there is an establishment of ties, real or imagined to be real.
On one hand, this works fantastically to mentally cement the US in the greatest of greats, but we cannot ignore the visibly obvious - that ancient Greece and Rome declined and fell. By drawing a parallel to ourselves(us-centric obvs) we draw a parallel to our own decline. We we're honest with this comparison, we have to be honest about the demise of these governments too. It's not possible to separate the too.
Also a bunch of other examples where the countries aren't necessarily the best to live in, but pretty much everyone is happy they split - Yugoslavia, India/Pakistan, West Pakistan/East Pakistan. Singapore/Malaysia (to be fair Singapore were kicked out).
A split of the US among the crazily politicised duopoly wouldn't be the end of the world. One part would be reactionary as hell and move time back (on social and ecological issues), the other.. who knows.
The Lord's our shepherd, goes the psalm When Alabama gets the bomb.
~ Tom Lehrer, "Who's next"
Well, the USSR broke up without too much fuss about who got the bombs; as far as I can see, only Russia was interested. But I can imagine a Divided States of America in which both successor states have nukes. I suspect they'd be reluctant to attack one-another. They might even both choose to disarm, depending on the nature of the break-up.
> both successor states
Why would there be only two?
Sure. You could abolish the Union entirely, and just have states. I don't think it's obvious that that would be a terrible thing - either for USAians or for the rest of us. My sense is that a lot of USAians don't really want a Union. I suspect that many USAians think the Union was effectively a coup.
The question remains: how do you spread the nukes around?
My guess is that the residents of Wyoming could do without nukes. They have a lot of land-based nukes, that serve no defensive purpose (for Wyoming); they just make Wyoming a target. I wonder which state might decide that they need nukes, to defend themselves from someone outside North America?
Second question: how you divide up the military equipment that isn't nuclear - ships, tanks, rockets, planes etc. All that equipment carries a heavy cost - it has to be maintained, replaced, tested etc.
Yes, to me (not from USA) it looks as if would get worse for most USAians if the Union broke up. Especially marginalized people. But I think that for the rest of us, it would be cool if the US government would agree to work together, or agree to divorce. It's shit, being in the blast-radius of a marital crisis that's lasted 30 years.
There's a fair argument that it never ended; the South was defeated, but never gave in. Or at least, part of the South didn't. Come on, isn't that the meaning of the Confederate flag? Doesn't it mean "Fuck you, Union"?
/me a brit, I don't have a dog in this race. I'd just feel massively more comfortable if the most powerful country in the world knew who it was, what it's policies are, and who it's friends are. If they can't figure that out, and have to break up, that's miles better than the USA being balanced 49% to 51% on every policy and every federal court judgement.
I'd prefer it if the USA split, rather than having a schizophrenic USA, with the biggest army in the world, that can't agree who it is, what it's economic policy is, or what it's foreign policy is. Schizo USA is screwing everyone else up.
I like the goal you're looking at, I just don't think that's a viable path from where we're standing; which is to say in reality a broken US gives you more potential chaos, not less?
I've come to believe that "nation" is somewhat of a weird and artificial concept and so that in many ways it almost doesn't make sense to compare e.g. the US and Russia. And so, while "no lopsidedly strong nation" would be optimal, from here I do think that US in its current form is a pretty good hedge against the others, for the most part.
Make such assistance illegal so that Facebook doesn't have a choice in the matter. Facebook certainly has the political power[money] to successfully lobby for such a legislative change, but it doesn't have the will to do so.
From The Verge's article[1]:
> However, campaigners note that Meta always has to comply with legal requests for data, and that the company can only change this if it stops collecting that data in the first place. In the case of Celeste and Jessica Burgess, this would have meant making end-to-end encryption (E2EE) the default in Facebook Messenger. This would have meant that police would have had to gain access to the pair’s phones directly to read their chats. (E2EE is available in Messenger but has to be toggled on manually. It’s on by default in WhatsApp.)
[1]: https://www.theverge.com/2022/8/10/23299502/facebook-chat-me...
The question I think you meant to ask if it is a good thing for companies to obey the state.
In what way are they "a different story" from Messenger?
There's nothing preventing the government from forcing Meta to implement a backdoor that exfiltrates the unencrypted key, of course, but that's true of non-web-based systems as well.
Genuinely asking as I would love to implement something for my customers which gives them control over their data while it resides on my servers.
The server only serves encrypted data that gets decoded in the browser.
The primary usability problem for that approach is that there’s no way to recover the data (messages) if the user ever forgets the keys passphrase.
Another problem is that all of the rendering that uses such encrypted data needs to happen client side in JS, WASM or similar.
I am not in security but think that XSS might be a concern here with something so sensitive.
And UX problems that come with it. Sounds interesting though to at least discuss with customers to see if the benefits are worth the costs to them.
(Lest you think I'm exaggerating, inventory is literally an industry term: https://smallbusiness.chron.com/advertising-inventory-mean-3...)
Or are you saying it’s not E2EE unless the clients are auditable?
Maybe I'm not the audience.
In many organizations there is a lot of pressure after a dramatic event to come out with a statement right away and this denies people the chance to deliberate about what the message should be.
A big problem with Facebook's PR is that they reflexively deny that Facebook has any negative effects, that they had responsibility for anything, that anything is their fault, etc. It's a major reason why people think they are out of touch and why Zuckerberg has such low favorables. You're better off keeping your mouth shut and letting people think you don't give a f--k as opposed to writing a press release like that and proving it.
They've been outmaneuvered for one thing because even before the supreme court struck down Roe there has been a drumbeat about the risks that people could have social media and other digital communications used against them in an abortion case and those people have been waiting for a real case to turn up.
It's concise and to the point, mostly factual with a twist of putting in their understanding and framing. No fluff.
Laying that aside, are they saying that they will not turn over user data when they know the request for data relates to a person being prosecuted for seeking or helping with an abortion? I don’t think they are saying that, but they are trying to get good will as if they would fight such a request, even though they wouldn’t.
It also felt like a shot across the bow for Nebraska that a correction was mentioned at all, and so tersely as im sure legislators in the state of two million were expecting business as usual.
either way this is a 117bn company that owns the eyes and ears of nearly the entire planet. piss in their cheerios and 'the algorythm' might make your next re-election a lost cause.
However, this should be a fairly huge signal that Facebook needs to move to E2EE by default for Messenger.
Though I would say, they appear to be choosing to not use end to end encryption. I don't know if that's due to technical limitations or because they don't want to, but I imagine they could figure something out if they wanted to.
The solution is obvious. Individual humans should stop using corporate controlled communication services for personal, or private, communications. Corporations both cannot and will not protect you from authoritarian government abuses.
I've been saying this since the early 2000s but like with most things, people will never care until it effects them personally.
> We received valid legal warrants from local law enforcement ... investigating the alleged illegal burning and burial of a stillborn infant.
Law enforcement should not be investigating this IMHO; and the availability of people's Facebook interactions record lets the police access additional information they would not otherwise have had in their misplaced investigation.
> The warrants were accompanied by non-disclosure orders, which prevented us from sharing information about them.
That's just dandy, the government will order large corporations to keep everything secret from you, and of course Facebook is a law-abiding corporation, so of course they will hide this from you.
Secret investigations, constant mass surveillance used in secret investigations, extremely carcerally-minded legal system, and a trigger-happy police in case you somehow get the wrong idea about resisting anything. Verily, the USA is the land of the free.
If you want to really say that something "begs the question", then you could say what the question is supposed to be. For "begging the question", the question is one or other of the propositions in an argument, and "begging" it means assuming it's truth or falsehood.
I find it pretentious to use terms like "beg the question" incorrectly. Instead of using these erudite-sounding formulations, one could just say what one means. Apart from anything else, I think simple, straight talk is more convincing. Especially if your audience might include people for whom English is a second language.
The only hill I'm willing to die on anymore is the now-accepted use of the word "literally" when the writer/speaker would be more accurate in saying "figuratively".
People love the "language evolves!" argument, but my thought is that language evolutions shouldn't be accepted if they actively make communication more difficult or less clear.
Oh, $DEITY. That one really pisses me off; but that hill is almost a guaranteed death sentence. It's in Merriam Webster, saying it means one thing, as well as it's negation. I'm sure there are better hills to fight for.
You can call me a deserter or a fugitive, if you like. I don't care. I won't die on the hill called "literally".
But would any other company have done anything different?
The only thing you, as a user, can really do is use a messaging service that has end-to-end encryption so the company doesn't have that ability. But do they really not have that ability? It's harder to say. Signal? WhatsApp? Telegram?