Author: Devin Coldewey

Facebook loses its chief security officer Alex Stamos

Alex Stamos, Facebook’s chief security officer since 2015, announced that he is leaving the company to take a position at Stanford University. The company has been shedding leadership over the last half a year largely owing to fallout from its response, or lack thereof, to the ongoing troubles relating to user data security and election interference on the social network.

“While I have greatly enjoyed this work, the time has come for me to move on from my position as Chief Security Officer at Facebook,” he wrote in a public Facebook post. “Starting in September, I will join Stanford University full-time as a teacher and researcher.”

Rumors that Stamos was not long for the company spread in March; he was said to have disagreed considerably with the tack Facebook had taken in disclosure and investigation of its role in hosting state-sponsored disinformation seeded by Russian intelligence. To be specific, he is said to have preferred more and better disclosures rather than the slow drip-feed of half-apologies, walkbacks, and admissions we’ve gotten from the company over the last year or so.

He said at in March that “despite the rumors, I’m still fully engaged with my work at Facebook,” though he acknowledged that his role now focused on “emerging security risks and working on election security.”

Funnily enough, that is exactly the topic he will be looking into at Stanford as a new adjunct professor, where he will be joining a new group called Information Warfare, the New York Times reported.

“This fall, I am very excited to launch a course teaching hands-on offensive and defensive techniques and to contribute to the new cybersecurity master’s specialty at [the Freeman-Spogli Institute for International Studies],” Stamos wrote.

Leaving because of a major policy disagreement with his employer would not be out of character for Stamos. He reportedly left Yahoo (which of course was absorbed into Aol to form TechCrunch’s parent company, Oath) because of the company’s choice to allow U.S. intelligence access to certain user data. One may imagine a similar gulf in understanding between him and others at Facebook, especially on something as powerfully divisive as this election interference story or the Cambridge Analytica troubles.

“My last day at Facebook will be August 17th,” he wrote, “and while I will no longer have the pleasure of working side by side with my friends there, I am encouraged that there are so many dedicated, thoughtful and skilled people continuing to tackle these challenges. It is critical that we as an industry live up to our collective responsibility to consider the impact of what we build, and I look forward to continued collaboration and partnership with the security and safety teams at Facebook.”

Stamos is far from the only Facebook official to leave recently; Colin Stretch, chief legal officer, announced his departure last month after more than eight years at the company; its similarly long-serving head of policy and comms, Elliot Schrage, left the month before; WhatsApp cofounder Jan Koum left that company in April.

Facebook directed me to Stamos’s post when asked for comment; we have asked Stamos for more information directly and will update if we hear back.

Facebook suspends analytics firm Crimson Hexagon over data use concerns

As part of its ongoing mission to close the barn doors after the cows have got out, Facebook has suspended the accounts of British data analytics firm Crimson Hexagon over concerns that it may be improperly handling user data.

The ominously named company has for years used official APIs to siphon public posts from Facebook, Instagram, Twitter and other sources online, collating and analyzing for various purposes, such as to gauge public opinion on a political candidate or issue. It has clients around the world, serving Russia and Turkey as well as the U.S. and United Kingdom.

Facebook, it seems, was not fully aware of the extent of Crimson Hexagon’s use of user data, however, including in several government contracts which it didn’t have the opportunity to evaluate before they took effect. The possibility that the company is not complying with its data use rules, specifically that they may have been helping build surveillance tools, was apparently real enough for Facebook to take action. Perhaps the bar for suspension has been lowered somewhat over the last year, and with good reason.

“We are investigating the claims about Crimson Hexagon to see if they violated any of our policies,” said Facebook VP Product Partnerships Ime Archibong in a statement.

The Wall Street Journal, which first reported the suspension, noted that Crimson Hexagon currently has a contract with FEMA to monitor online discussion for various disaster-related purposes, but a deal with ICE fell through because Twitter resisted this application of their “firehose” data.

However, beyond the suggestion that the company has undertaken work that skirts the edge of what the social media companies consider appropriate use of public data, Crimson Hexagon doesn’t seem to have done anything as egregious as the wholesale network collection done by others. It restricts itself to publicly available data that it pays to access, and applies its own methods to produce its own brand of insight and intelligence.

The company also isn’t (at least, not obviously) a quasi-independent arm of a big, shady network of companies working actively to obscure their connections and deals, as Cambridge Analytica was. Crimson Hexagon is more above the board, with ordinary venture investment and partnerships. Its work is in a way similar to CA, in that it is gleaning insights of a perhaps troublingly specific nature from billions of public posts, but it’s at least doing it in full view.

As before, the onus of responsibility is equally on Facebook to enforce as it is on partners to engage in scrupulous handling of user data. It’s hardly good data custodianship for Facebook to let companies take what they need under a handshake agreement that they’ll do no evil, and then take them to task years later when the damage has already been done. But that seems to be the company’s main priority now: To reiterate the folksy metaphor from above, it is frantically counting the cows that have bolted while apologizing for having left the door open for the last decade or so.

Incidentally, Crimson Hexagon was co-founded by the same person who was put in charge of Facebook’s new social science initiative: Harvard’s Gary King. In a statement, he denied any involvement in the former’s everyday work, although he is chairman. No doubt this connection will receive a bit of scrutiny on Facebook’s side as well.

Undercover report shows the Facebook moderation sausage being made

An undercover reporter with the UK’s Channel 4 visited a content moderation outsourcing firm in Dublin and came away rather discouraged at what they saw: queues of flagged content waiting, videos of kids fighting staying online, orders from above not to take action on underage users. It sounds bad, but the truth is there are pretty good reasons for most of it and in the end the report comes off as rather naive.

Not that it’s a bad thing for journalists to keep big companies (and their small contractors) honest, but the situations called out by Channel 4’s reporter seem to reflect a misunderstanding of the moderation process rather than problems with the process itself. I’m not a big Facebook fan, but in the matter of moderation I think they are sincere, if hugely unprepared.

The bullet points raised by the report are all addressed in a letter from Facebook to the filmmakers. The company points out that some content needs to be left up because abhorrent as it is, it isn’t in violation of the company’s stated standards and may be informative; underage users and content has some special requirements but in other ways can’t be assumed to be real; popular pages do need to exist on different terms than small ones, whether they’re radical partisans or celebrities (or both); hate speech is a delicate and complex matter that often needs to be reviewed multiple times; and so on.

The biggest problem doesn’t at all seem to be negligence by Facebook: there are reasons for everything, and as is often the case with moderation, those reasons are often unsatisfying but effective compromises. The problem is that the company has dragged its feet for years on taking responsibility for content and as such its moderation resources are simply overtaxed. The volume of content flagged by both automated processes and users is immense and Facebook hasn’t staffed up. Why do you think it’s outsourcing the work?

By the way, did you know that this is a horrible job?

Facebook in a blog post says that it is working on doubling its “safety and security” staff to 20,000, among which 6,500 will be on moderation duty. I’ve asked what the current number is, and whether that includes people at companies like this one (which has about 650 reviewers) and will update if I hear back.

Even with a staff of thousands the judgments that need to be made are often so subjective, and the volume of content so great, that there will always be backlogs and mistakes. It doesn’t mean anyone should be let off the hook, but it doesn’t necessarily indicate a systematic failure other than, perhaps, a lack of labor.

If people want Facebook to be effectively moderated they may need to accept that the process will be done by thousands of humans who imperfectly execute the task. Automated processes are useful but no replacement for the real thing. The result is a huge international group of moderators, overworked and cynical by profession, doing a messy and at times inadequate job of it.

Facebook independent research commission ‘Social Science One’ will share a petabyte of user data

Back in April, Facebook announced it would be working with a group of academics to establish an independent research commission to look into issues of social and political significance using the company’s own extensive data collection. That commission just came out of stealth; it’s called Social Science One, and its first project will have researchers analyzing about a petabyte’s worth of sharing data.

The way the commission works is basically that a group of academics is created and given full access to the processes and data sets that Facebook could potentially provide. They identify and help design interesting sets based on their experience as researchers themselves, then document them publicly — for instance, “this data set consists of 10 million status updates taken during the week of the Brexit vote, structured in such and such a way.”

This documentation describing the set doubles as a “request for proposals” from the research community. Other researchers interested in the data propose analyses or experiments, which are evaluated by commission. These proposals are then granted (according to their merit) access to the data, funding and other privileges. Resulting papers will be peer-reviewed with help from the Social Science Research Council, and can be published without being approved (or even seen) by Facebook.

“The data collected by private companies has vast potential to help social scientists understand and solve society’s greatest challenges. But until now that data has typically been unavailable for academic research,” said Social Science One co-founder, Harvard’s Gary King, in a blog post announcing the initiative. “Social Science One has established an ethical structure for marshaling privacy preserving industry data for the greater social good while ensuring full academic publishing freedom.”

If you’re curious about the specifics of the partnership, it’s actually been described in a paper of its own, available here.

The first data set is a juicy one: “almost all” public URLs shared and clicked by Facebook users globally, accompanied by a host of useful metadata.

It will contain “on the order of 2 million unique URLs shared in 300 million posts, per week,” reads a document describing the set. “We estimate that the data will contain on the order of 30 billion rows, translating to an effective raw size on the order of a petabyte.”

The metadata includes country, user age, device and so on, but also dozens of other items, such as “ideological affiliation bucket,” the proportion of friends versus non-friends who viewed a post, feed position, the number of total shares, clicks, likes, hearts, flags… there’s going to be quite a lot to sort through. Naturally all this is carefully pruned to protect user privacy — this is a proper research data set, not a Cambridge Analytica-style catch-all siphoned from the service.

In a call accompanying the announcement, King explained that the commission had much more data coming down the pipeline, with a focus on disinformation, polarization, election integrity, political advertising and civic engagement.

“It really does get at some of the fundamental questions of social media and democracy,” King said on the call.

The other sets are in various stages of completeness or permission: post-election survey participants in Mexico and elsewhere are being asked if their responses can be connected with their Facebook profiles; the political ad archive will be formally made available; they’re working on something with CrowdTangle; there are various partnerships with other researchers and institutions around the world.

A “continuous feed of all public posts on Facebook and Instagram” and “a large random sample of Facebook newsfeeds” are also under consideration, probably encountering serious scrutiny and caveats from the company.

Of course, quality research must be paid for, and it would be irresponsible not to note that Social Science One is funded not by Facebook but by a number of foundations: the Laura and John Arnold Foundation, The Democracy Fund, The William and Flora Hewlett Foundation, The John S. and James L. Knight Foundation, The Charles Koch Foundation, Omidyar Network’s Tech and Society Solutions Lab and The Alfred P. Sloan Foundation.

You can keep up with the organization’s work here; it really is a promising endeavor and will almost certainly produce some interesting science — though not for some time. We’ll keep an eye out for any research emerging from the partnership.

Study calls out ‘dark patterns’ in Facebook and Google that push users towards less privacy

More scrutiny than ever is in place on the tech industry, and while high-profile cases like Mark Zuckerberg’s appearance in front of lawmakers garner headlines, there are subtler forces at work. This study from a Norway watchdog group eloquently and painstakingly describes the ways that companies like Facebook and Google push their users towards making choices that negatively affect their own privacy.

It was spurred, like many other new inquiries, by Europe’s GDPR, which has caused no small amount of consternation among companies for whom collecting and leveraging user data is their main source of income.

The report (PDF) goes into detail on exactly how these companies create an illusion of control over your data while simultaneously nudging you towards making choices that limit that control.

Although the companies and their products will be quick to point out that they are in compliance with the requirements of the GDPR, there are still plenty of ways in which they can be consumer-unfriendly.

In going through a set of privacy popups put out in May by Facebook, Google, and Microsoft, the researchers found that the first two especially feature “dark patterns, techniques and features of interface design mean to manipulate users…used to nudge users towards privacy intrusive options.”

Flowchart illustrating the Facebook privacy options process – the green boxes are the “easy” route.

It’s not big obvious things — in fact, that’s the point of these “dark patterns”: that they are small and subtle yet effective ways of guiding people towards the outcome preferred by the designers.

For instance, in Facebook and Google’s privacy settings process, the more private options are simply disabled by default, and users not paying close attention will not know that there was a choice to begin with. You’re always opting out of things, not in. To enable these options is also a considerably longer process: 13 clicks or taps versus 4 in Facebook’s case.

That’s especially troubling when the companies are also forcing this action to take place at a time of their choosing, not yours. And Facebook added a cherry on top, almost literally, with the fake red dots that appeared behind the privacy popup, suggesting users had messages and notifications waiting for them even if that wasn’t the case.

When choosing the privacy-enhancing option, such as disabling face recognition, users are presented with a tailored set of consequences: “we won’t be able to use this technology if a stranger uses your photo to impersonate you,” for instance, to scare the user into enabling it. But nothing is said about what you will be opting into, such as how your likeness could be used in ad targeting or automatically matched to photos taken by others.

Disabling ad targeting on Google, meanwhile, warns you that you will not be able to mute some ads going forward. People who don’t understand the mechanism of muting being referred to here will be scared of the possibility — what if an ad pops up at work or during a show and I can’t mute it? So they agree to share their data.

Before you make a choice, you have to hear Facebook’s case.

In this way users are punished for choosing privacy over sharing, and are always presented only with a carefully curated set of pros and cons intended to cue the user to decide in favor of sharing. “You’re in control,” the user is constantly told, though those controls are deliberately designed to undermine what control you do have and exert.

Microsoft, while guilty of the biased phrasing, received much better marks in the report. Its privacy setup process put the less and more private options right next to each other, presenting them as equally valid choices rather than some tedious configuration tool that might break something if you’re not careful. Subtle cues do push users towards sharing more data or enabling voice recognition, but users aren’t punished or deceived the way they are elsewhere.

You may already have been aware of some of these tactics, as I was, but it makes for interesting reading nevertheless. We tend to discount these things when it’s just one screen here or there, but seeing them all together along with a calm explanation of why they are the way they are makes it rather obvious that there’s something insidious at play here.

Facebook says it gave ‘identical support’ to Trump and Clinton campaigns

Facebook’s hundreds of pages of follow-ups to Senators make for decidedly uninteresting reading. Give lawyers a couple months and they will always find a way to respond non-substantively to the most penetrating questions. One section may at least help put a few rumors to rest about Facebook’s role in the 2016 Presidential campaigns, though of course much is still left to the imagination.

Senator Kamala Harris (D-CA), whose dogged questioning managed to put Mark Zuckerberg on his back foot during the questioning, had several pages of questions sent over afterwards. Among the many topics was that of the 2016 campaign and reports that Facebook employees were “embedded” in the Trump campaign specifically, as claimed by the person who ran the digital side of that campaign.

This has raised questions as to whether Facebook was offering some kind of premium service to one candidate or another, or whether one candidate got tips on how to juice the algorithm, how to target better, and so on.

Here are the takeaways from the answers, which you can find in full on page 167 of the document at the bottom of this post.

  • The advice to the campaigns is described as similar to that given to “other, non-political” accounts.
  • No one was “assigned full-time” on either the Trump or Clinton campaign.
  • Campaigns did not get to hand pick who from Facebook came to advise them.
  • Facebook provided “identical support” and tools to both campaigns.
  • Sales reps are trained to comply with federal election law, and to report “improper activity.”
  • No such “improper activity” was reported by Facebook employees on either campaign.
  • Facebook employees did work directly with Cambridge Analytica employees.
  • No one identified any issues with Cambridge Analytica, its data, or its intended use of that data.
  • Facebook did not work with Cambridge Analytica or related companies on other campaigns (e.g. Brexit).

It’s not exactly fire, but we don’t really need more fire these days. This at least is on the record and relatively straightforward; whatever Facebook’s sins during the election cycle may have been, it does not appear that preferential treatment of the two major campaigns was among them.

Incidentally, if you’re curious whether Facebook finally answered Sen. Harris’s questions about who made the decision not to inform users of the Cambridge Analytica issue back in 2015, or how that decision was made — no, it didn’t. In fact the silence here is so deafening it almost certainly indicates a direct hit.

Harris asked how and when it came to the decision not to inform users that their data had been misappropriated, who made that decision and why, and lastly when Zuckerberg entered the loop. Facebook’s response does not even come close to answering any of these questions:

When Facebook learned about Kogan’s breach of Facebook’s data use policies in December 2015, it took immediate action. The company retained an outside firm to assist in investigating Kogan’s actions, to demand that Kogan and each party he had shared data with delete the data and any derivatives of the data, and to obtain certifications that they had done so. Because Kogan’s app could no longer collect most categories of data due to changes in Facebook’s platform, the company’s highest priority at that time was ensuring deletion of the data that Kogan may have accessed before these changes took place. With the benefit of hindsight, we wish we had notified people whose information may have been impacted. Facebook has since notified all people potentially impacted with a detailed notice at the top of their newsfeed.

This answer has literally nothing to do with the questions.

It seems likely from the company’s careful and repeated refusal to answer this question that the story is an ugly one — top executives making a decision to keep users in the dark for as long as possible, if I had to guess.

At least with the campaign issues Facebook was more forthcoming, and as a result will put down several lines of speculation. Not so with this evasive maneuver.

Embedded below are Facebook’s answers to the Senate Judiciary Committee, and the other set is here:

How Facebook’s new 3D photos work

In May, Facebook teased a new feature called 3D photos, and it’s just what it sounds like. But beyond a short video and the name, little was said about it. But the company’s computational photography team has just published the research behind how the feature feature works and, having tried it myself, I can attest that the results are really quite compelling.

In case you missed the teaser, 3D photos will live in your news feed just like any other photos, except when you scroll by them, touch or click them, or tilt your phone, they respond as if the photo is actually a window into a tiny diorama, with corresponding changes in perspective. It will work for both ordinary pictures of people and dogs, but also landscapes and panoramas.

It sounds a little hokey, and I’m about as skeptical as they come, but the effect won me over quite quickly. The illusion of depth is very convincing, and it does feel like a little magic window looking into a time and place rather than some 3D model — which, of course, it is. Here’s what it looks like in action:

I talked about the method of creating these little experiences with Johannes Kopf, a research scientist at Facebook’s Seattle office, where its Camera and computational photography departments are based. Kopf is co-author (with University College London’s Peter Hedman) of the paper describing the methods by which the depth-enhanced imagery is created; they will present it at SIGGRAPH in August.

Interestingly, the origin of 3D photos wasn’t an idea for how to enhance snapshots, but rather how to democratize the creation of VR content. It’s all synthetic, Kopf pointed out. And no casual Facebook user has the tools or inclination to build 3D models and populate a virtual space.

One exception to that is panoramic and 360 imagery, which is usually wide enough that it can be effectively explored via VR. But the experience is little better than looking at the picture printed on butcher paper floating a few feet away. Not exactly transformative. What’s lacking is any sense of depth — so Kopf decided to add it.

The first version I saw had users moving their ordinary cameras in a pattern capturing a whole scene; by careful analysis of parallax (essentially how objects at different distances shift different amounts when the camera moves) and phone motion, that scene could be reconstructed very nicely in 3D (complete with normal maps, if you know what those are).

But inferring depth data from a single camera’s rapid-fire images is a CPU-hungry process and, though effective in a way, also rather dated as a technique. Especially when many modern cameras actually have two cameras, like a tiny pair of eyes. And it is dual-camera phones that will be able to create 3D photos (though there are plans to bring the feature downmarket).

By capturing images with both cameras at the same time, parallax differences can be observed even for objects in motion. And because the device is in the exact same position for both shots, the depth data is far less noisy, involving less number-crunching to get into usable shape.

Here’s how it works. The phone’s two cameras take a pair of images, and immediately the device does its own work to calculate a “depth map” from them, an image encoding the calculated distance of everything in the frame. The result looks something like this:

Apple, Samsung, Huawei, Google — they all have their own methods for doing this baked into their phones, though so far it’s mainly been used to create artificial background blur.

The problem with that is that the depth map created doesn’t have some kind of absolute scale — for example, light yellow doesn’t mean 10 feet, while dark red means 100 feet. An image taken a few feet to the left with a person in it might have yellow indicating 1 foot and red meaning 10. The scale is different for every photo, which means if you take more than one, let alone dozens or a hundred, there’s little consistent indication of how far away a given object actually is, which makes stitching them together realistically a pain.

That’s the problem Kopf and Hedman and their colleagues took on. In their system, the user takes multiple images of their surroundings by moving their phone around; it captures an image (technically two images and a resulting depth map) every second and starts adding it to its collection.

In the background, an algorithm looks at both the depth maps and the tiny movements of the camera captured by the phone’s motion detection systems. Then the depth maps are essentially massaged into the correct shape to line up with their neighbors. This part is impossible for me to explain because it’s the secret mathematical sauce that the researchers cooked up. If you’re curious and like Greek, click here.

Not only does this create a smooth and accurate depth map across multiple exposures, but it does so really quickly: about a second per image, which is why the tool they created shoots at that rate, and why they call the paper “Instant 3D Photography.”

Next the actual images are stitched together, the way a panorama normally would be. But by utilizing the new and improved depth map, this process can be expedited and reduced in difficulty by, they claim, around an order of magnitude.

Because different images captured depth differently, aligning them can be difficult, as the left and center examples show — many parts will be excluded or produce incorrect depth data. The one on the right is Facebook’s method.

Then the depth maps are turned into 3D meshes (a sort of two-dimensional model or shell) — think of it like a papier-mache version of the landscape. But then the mesh is examined for obvious edges, such as a railing in the foreground occluding the landscape in the background, and “torn” along these edges. This spaces out the various objects so they appear to be at their various depths, and move with changes in perspective as if they are.

Although this effectively creates the diorama effect I described at first, you may have guessed that the foreground would appear to be little more than a paper cutout, since, if it were a person’s face captured from straight on, there would be no information about the sides or back of their head.

This is where the final step comes in of “hallucinating” the remainder of the image via a convolutional neural network. It’s a bit like a content-aware fill, guessing on what goes where by what’s nearby. If there’s hair, well, that hair probably continues along. And if it’s a skin tone, it probably continues too. So it convincingly recreates those textures along an estimation of how the object might be shaped, closing the gap so that when you change perspective slightly, it appears that you’re really looking “around” the object.

The end result is an image that responds realistically to changes in perspective, making it viewable in VR or as a diorama-type 3D photo in the news feed.

In practice it doesn’t require anyone to do anything different, like download a plug-in or learn a new gesture. Scrolling past these photos changes the perspective slightly, alerting people to their presence, and from there all the interactions feel natural. It isn’t perfect — there are artifacts and weirdness in the stitched images if you look closely and of course mileage varies on the hallucinated content — but it is fun and engaging, which is much more important.

The plan is to roll the feature out mid-summer. For now the creation of 3D photos will be limited to devices with two cameras — that’s a limitation of the technique — but anyone will be able to view them.

But the paper does also address the possibility of single-camera creation by way of another convolutional neural network. The results, only briefly touched on, are not as good as the dual-camera systems, but still respectable and better and faster than some other methods currently in use. So those of us still living in the dark age of single cameras have something to hope for.