Facebook Vs. NYU and Transparency

On August 3, 2021, Facebook, showed off its full 800-pound gorilla physique by attempting to crush the work of two New York University (NYU) researchers, Laura Edelson and Damon McCoy and their tool Ad Observer. Facebook said the project was scraping data in an unauthorized manner and violated the social media platform’s terms of service. Edelson took to Twitter to detail how her “Facebook account and the accounts of several people associated with the “Cybersecurity for Democracy” team at NYU” were suspended. The suspension effectively terminated their access to Facebook’s Ad Library and CrowdTangle, a public insights tool created by Facebook.

Who and What is the Cybersecurity for Democracy Project?

The Cybersecurity for Democracy project team is hosted by New York University Tandon School of Engineering and focuses on how social networks have been “proven vulnerable to misinformation aimed at weakening democratic norms.”  The project team is comprised of six individuals, including McCoy, an assistant professor at the Tandon School and Edelson, a doctoral candidate at the school. The project’s work is funded by the National Science Foundation, Media Democracy Fund and the Democracy Fund. Two of the group’s identified projects are Ad Observatory and Ad Observer. The former consists of their “analysis of Facebook advertising, and search for messaging trends, microtargeting,” etc., while the latter is a plug-in tool that allows Facebook and YouTube users to contribute Facebook ads they see to the corpus for analysis by Ad Observatory.

An Oxymoron: Facebook and Transparency

One would think that, after the actual manipulation of their platform with disinformation and misinformation, that having an external and independent entity policing the Facebook algorithms used to permit or reject political ads would be useful to the company, but apparently the emu quotient was preferred over that of the giraffe.

Facebook’s policy communications director Andy Stone took to Twitter to counter Edelson’s claim and attempt to get ahead of the avalanche of criticism. Stone explained, “Research is not an excuse to break privacy rules and scrape user data—no matter the intent. As most will remember, we paid a $5 billion fine to the FTC for a developer scraping data under the auspices of ‘research.’ We took action against NYU researchers to stop unauthorized scraping and protect people’s privacy in line with our privacy program under the FTC Order.”

McCoy commented that “Facebook should not be able to cynically invoke user privacy to shut down research that puts them in an unflattering light, particularly when the “users” Facebook is talking about are advertisers who have consented to making their ads public.”

In lockstep with Stone’s tweet, Mike Clark, product management director at Facebook, published a blog post asserting that “research cannot be the justification for compromising people’s privacy.” Clark makes clear that Facebook cut off the Cybersecurity for Democracy group’s access to Facebook; accounts, apps, pages and all platform access was curtailed. Clark repeated the line that the project was scraping data in an unauthorized manner and violated terms of service, again rolling out the canard, “We took these actions to stop unauthorized scraping and protect people’s privacy in line with our privacy program under the FTC Order.”

The FTC Would Like a Word

Word of the incident traveled and eventually reached the FTC.

The same FTC that, in July 2019, fined Facebook $5 billion as part of a settlement for the company’s failure to protect the privacy of its users. Indeed, at that time the FTC Chairman, Joe Simons, noted that “Despite repeated promises to its billions of users worldwide that they could control how their personal information is shared, Facebook undermined consumers’ choices.”

In this case, however, the FTC, on August 5, 2021, saw things differently and took Facebook to task with a pointed letter from the acting director of the Bureau of Consumer Protection, Samuel Levine, in which he notes the “recent insinuation that its [Facebook’s] actions against an academic research project conducted by NYU’s Ad Observatory were required by the company’s consent decree with the FTC” was inaccurate.

What seemed to get under Facebook’s skin was that users were voluntarily participating in the data collection, using the fully transparent Ad Observer plug-in. This is juxtaposed against the Cambridge Analytica experience where 87 million users were unwittingly hoodwinked with Facebook’s full knowledge. The data collected, coupled with that provided by Facebook itself via CrowdTangle and the Ad Library, provided a more complete view of the advertising ecosystem within Facebook than the company was comfortable with the researchers having.

The researchers’ lawyers blasted Facebook with, “As a pretext for preventing NYU’s researchers from exposing flaws on Facebook’s platform, the company is making the truly remarkable claim that political advertising is private. But the whole point of advertising is that it is intended to be public. For this research, Facebook users voluntarily donate their advertising information while remaining completely anonymous, and the researchers do not collect any private user information. Facebook’s primary justification for trying to shut down this important research simply doesn’t hold up.”

The FTC’s Levine noted in his missive how Facebook has since retreated from its position that the expulsion was due to the FTC’s regulations, yet they still have not rescinded the expulsion, nor edited their blog to reflect this position.

Levine, for his part, wasn’t finished. He continued with a pointed admonition that reiterated the FTC’s position with respect to Facebook is one where “we hope that the company is not invoking privacy—much less the FTC consent order—as a pretext to advance others aims.”

Facebook will now have to decide if they will embrace transparency.

Christopher Burgess

Christopher Burgess (@burgessct) is a writer, speaker and commentator on security issues. He is a former Senior Security Advisor to Cisco and served 30+ years within the CIA which awarded him the Distinguished Career Intelligence Medal upon his retirement. Christopher co-authored the book, “Secrets Stolen, Fortunes Lost, Preventing Intellectual Property Theft and Economic Espionage in the 21st Century”. He also founded the non-profit: Senior Online Safety.

burgesschristopher has 186 posts and counting.See all posts by burgesschristopher