Seeing Around Corners

by Rita McGrath

  Social media leaders promised, promised, and promised some more that tracking people all over the Internet would stop and that users would be put back in control of where their information would show up and with whom it would be shared. In 2019, Katherine Bindley, a Wall Street Journal reporter, thought she would just test out how well the companies were doing in keeping their promises. She downloaded What to Expect’s pregnancy app, and, as she reports, “in less than 12 hours, I got a maternity-wear ad in my Instagram feed. I’m not pregnant, nor otherwise in a target market for maternity-wear. When I tried to retrace the pathway, discussing the issue with the app’s publisher, its data partners, the advertiser and Facebook itself—dozens of emails and phone calls—not one would draw a connection between the two events.” She goes on to elaborate on the many ways in which companies breach people’s privacy without their knowledge, including tracking their locations when location services are turned off, using secretive algorithms that govern why people see certain ads, and showing users ads based on activity that takes place outside of Facebook even if they opted out of Facebook being allowed to do this.

  In an even more disturbing study (if that is possible), another Wall Street Journal inquiry found that health and wellness apps were sharing highly personal information with Facebook. In their testing, they found that a heart rate app sent information to Facebook immediately after users keyed it in, an ovulation monitoring app sent information about when a user was having her period and whether she intended to get pregnant, and a real estate app sent data about what homes a user was looking at and which the user marked as favorites. Even worse, as the authors note, “none of those apps provided users any apparent way to stop that information from being sent to Facebook.” And even worse than that, the data can often be traced to a specific device and IP address, making it possible for Facebook to match it up against its existing trove of personal information, all for the benefit of advertisers who are willing to pay for targeted ads.

  There is clearly a huge gap between the data sharing people think they are permitting and what is really going on.

  Your Environment Is Watching You

  Most of us know that the Internet is a bit of a Wild West when it comes to our privacy, and we can only hope that our information doesn’t leak out to the wrong people. But what about when the rest of our world starts to take on Internet-like tracking?

  The New York Times reported in 2018 that in millions of households, so-called smart televisions are set up to track what you’re watching, and not only that, they also track information from all the other devices (such as a smartphone) that are linked to the same network as your TV. Samba TV, for instance, as part of its smart-TV setup process, asks for permission to send information about you back to its mother ship. That includes not only information about your viewing habits but also all the information flowing through any other device connected to the same network.

  This is a holy grail for advertisers, because they can capture immediate information about the effectiveness of television ads based on subsequent visits to their sites by people being tracked in this way. As Christine DiLandro, a former marketing director at Citi, discussed at an industry event, the ability to connect people’s real-time viewing behavior with their digital activity is “a little magical.” Companies can pay Samba to target individuals with specific pitches after viewers have seen a competitor’s ad, one of their own ads, or a particular show. And this is all perfectly legal, as long as the companies can claim to have provided consumers with information that accurately describes the tracking—even if it is buried in a thousand-page acceptance policy.

  For the 47.3 million people with access to a smart speaker like Alexa or Siri, it’s a guarantee that the device is listening elsewhere in their homes. And in incident after incident, it is very clear that the speakers are collecting and capturing data in the background of our lives. For instance, an Amazon Echo recorded private conversations between a husband and wife in Seattle and sent snippets of the recordings to an acquaintance hundreds of miles away. More and more for the dossier.

  Fast, Exponential, and Unchecked: Facebook’s Rise and . . . ?

  As an example of the challenges likely to face all the big advertising-supported social media platforms, let’s focus in on Facebook. From its founding in 2004 as an online social network at Harvard (and soon other colleges and universities) to its current ability to reach over a third of the world’s population, Facebook’s growth has been exponential and its influence eye-popping. Its attitude toward its use of personal data, however, has not changed much since the start. Its blind spot was failing to recognize that eventually the public, regulators, competitors, and others would catch on to what the social network was doing.

  Signs of what we could expect from Facebook with respect to privacy were available from the beginning, as the following instant message exchange between Mark Zuckerberg and a friend, first exposed by the podcast Silicon Valley Insider, reveal.

  Zuck: Yeah so if you ever need info about anyone at Harvard

  Zuck: Just ask.

  Zuck: I have over 4,000 emails, pictures, addresses, SNS [Social Security numbers]

  [Redacted Friend’s Name]: What? How’d you manage that one?

  Zuck: People just submitted it.

  Zuck: I don’t know why.

  Zuck: They “trust me”

  Zuck: Dumb fucks.

  When the network was opened up to people outside academic institutions in 2006, the company’s leaders reportedly began to think of it as “the directory of all the people in the world,” which they hoped would “dominate.”

  Fast-forward to Facebook’s IPO in 2012, when, as one observer noted, the pressure to make money from Facebook’s vast number of users became intense, precipitating its forays into targeted ads. This was only the beginning of a series of well-documented mishaps basically stemming from Facebook’s unprecedented ability to mine user information and provide automated access to advertisers.

  By 2016, the signals that the use of certain types of targeting were unacceptable became so loud that you would have needed earplugs to avoid hearing them. In just one egregious example, Facebook allowed advertisers of housing to prevent the ads from being shown to members of “affinity” groups such as African Americans, Asian Americans, and Hispanics. When ProPublica broke the story (after buying an ad in the housing category that specifically excluded ethnic affiliations), a prominent civil rights lawyer said, “This is horrifying. This is massively illegal. This is about as blatant a violation of the federal Fair Housing Act as one can find.”

  In a Faustian bargain, consumers have accepted that they can get services for free by agreeing to hand over personal information. The result is an entirely lopsided economic arrangement. What started out as a relatively modest and fun idea (Share pictures of your friends! Share photos from your vacation!) has now become a social force, fueled by billions of advertising dollars.

  Other data brokers pursue problematic practices as well. Google, for instance, has run afoul of the EU, which fined the company $5 billion for practices such as requiring manufacturers to preload Google apps on their devices and to sell only unaltered versions of Google’s Android software. Unlike Google’s leaders, who don’t deny the data collection but argue that it creates “more choices for everyone,” Facebook’s key executives have professed shock and ignorance at how the data that users have placed in their care have been deployed.

  Facebook’s CEO has now been hauled before elected representatives on two continents. The company’s response to the Cambridge Analytica revelations has been critiqued in terms of poor crisis response. That scandal involved the company selling information on over 50 million people without their knowledge for the purpose of targeting political ads. A mini-movement of people who want to abandon its ecosystem has emerged. Pundits are now saying that Facebook might well go the way of Myspace. And even luminaries such as Apple cofounder Steve Wozniak and Brian Acton, founder of WhatsApp, decla
red #DeleteFacebook.

  Social media companies face a significant inflection point, with Zuckerberg declaring that his company is “at war.” Billionaire investor George Soros went so far as to announce at the 2018 World Economic Forum meeting in Davos, Switzerland, that Facebook’s “days are numbered.”

  The Cassandras of the Personal Data Business

  We can’t say Facebook wasn’t warned.

  As I have found with virtually every major inflection point I’ve studied, there was early evidence of this one’s potential long before it landed on our doorsteps. Let’s examine the early signs that are particularly relevant to Facebook (while recognizing that the whole data brokerage/social media space is likely to be affected).

  Observers have long considered a significant risk of the World Wide Web to be how information on it could be used. Indeed, in 1996 no less a luminary than web inventor Tim Berners-Lee wondered about the effects of the Net:

  Will it enable a true democracy by informing the voting public of the realities behind state decisions, or in practice will it harbor ghettos of bigotry where emotional intensity rather than truth gains the readership? It is for us to decide, but it is not trivial to assess the impact of simple engineering decisions on the answers to such questions.

  Facebook and Google didn’t even exist at the time this futuristic question was raised. Both, however, were growing rapidly when a now prescient warning was issued in 2006. Danah Boyd, a technology and social media scholar, and a principal researcher at Microsoft, warned about the privacy dangers represented by Facebook’s News Feed feature. She observed at the time that although individual bits of data were readily obtainable by those looking for them, News Feed created feelings of exposure, in that information users had provided to the website was now being pushed to everyone they were connected to, in a way that they had not anticipated. This isn’t helped by Facebook’s blunt characterization of who counts as a “friend.” By lumping together everyone from the guy you see regularly at the coffee shop to actual friends and family, Facebook makes it difficult to be selective about who sees what. This contributes to what Boyd called a feeling of “invasion.”

  As she said then about News Feed, “It is unhealthy, socially disruptive, and far worse for the users than the lurking employers ready to strike down upon thee with great vengeance for the mere presence of a red plastic cup . . . I also think that it will be gamed.” Poignantly, Boyd’s warnings had to do with information users knowingly shared with Facebook. Even she wasn’t thinking about the use to which private data could be put when bought and sold. Her warnings went largely unheeded as the company grew exponentially. The torrid rate at which Facebook added users continued unabated.

  Another series of warnings that went unheeded were about the presence of bad actors on the platform. These people created fake accounts, initiated scams, and otherwise weaponized the relationships people established there. The presence of fakes was so pervasive that a 2011 article in Adweek advised people on “7 Surefire Signs Your New Facebook Friend Is a Fake.” Facebook’s assumption that requiring users to sign up with their real names would be a deterrent seems to have been wrong.

  More interesting than the warnings of outside observers such as Boyd were the calls to action from Facebook insiders. They warned that the data the company was collecting could be used for purposes no user ever intended. Sandy Parakilas, a platform operations manager at the network from 2011 to 2012, said in a 2018 televised interview that he told senior leaders at Facebook about inadequate protections for the sensitive data users had given it, but that he was basically ignored.

  As he said in the interview, “It was a few weeks before the IPO, and the press had been calling out these issues over and over again . . . pointing out the ways in which Facebook had not been meeting its obligations.” He went on to describe how “horrified” he was to discover that he, just nine months into his first job in tech, was responsible for the security of Facebook’s user data. As he observed, “They were not concerned about solving the problem, they were concerned about protecting their reputations inside the company.”

  In a growing chorus, ex–Facebook employees have taken issue with the societal effects of the platform. Chamath Palihapitiya, a former Facebook executive, has bemoaned the addictive nature of what Facebook has created, blaming it for “ripping apart society.”

  Some ex–tech executives have gone even further than issuing verbal critiques. In founding the Center for Humane Technology in 2018, former executives at places like Google and Facebook were trying to create a unified institutional response to what they see as the negative social consequences of social media addiction.

  The Beginning of a Tipping Point?

  It has been in the interest of the data collectors to keep people in the dark, legally covering their behavior with terms of service that run into the thousands of words. Today, data brokers can cavalierly buy and sell your most personal information (Do you smoke? Are you gay? Do you like the 50 Shades series?), virtually without oversight, and most of us don’t even know it. With the sight of company executives being hauled before Congress, the introduction of the General Data Protection Regulation (GDPR) in Europe, and ever more examples of how personal data in the wrong hands produces horrible outcomes, I believe we will look back at this time as a major inflection point in how the use of personal information is governed.

  Antonio García Martínez has his thumb on the pulse of the problem. In his Silicon Valley tell-all, Chaos Monkeys, he describes how he helped create the third-party advertising programs that follow users all around the Internet. His jaundiced perspective on Facebook limiting how its data is used? “The hard reality is that Facebook will never try to limit such use of their data unless the public uproar reaches such a crescendo as to be un-mutable.”

  There are many signs that such an uproar has arrived. In a 2016 report of Americans’ attitudes about data privacy, the TRUSTe/National Cyber Security Alliance (NCSA) Consumer Privacy Index found that more people were worried about privacy than about losing their primary source of income.

  Governments, likewise, are waking up. According to the New York Times, no fewer than fifty governments have put measures in place to claw back access. Once technology platforms became networks for peer-to-peer communication, free from governmental constraints, governments began to feel threatened and to respond accordingly. Indeed, Facebook has been banned in China since 2009 (after it was thought to have played a role in communication among protesters) despite a major charm offensive, including Mark Zuckerberg’s learning to speak Mandarin.

  It is also not inconceivable that in exchange for permission to continue to operate at all, governments might insist that Facebook be split up. With growth in its core News Feed platform flattening and all the growth taking place on WhatsApp and Instagram, that would be very bad news indeed for Facebook’s business. With data being characterized as the “new oil,” analogies are being made to the breakup of the big oil companies in the early 1900s, or to the innovation that blossomed in the 1980s after AT&T could no longer exercise monopoly power over what services and equipment consumers could buy.

  Government officials are also starting to use legal mechanisms to throttle the business models of so-called smart-TV manufacturers that use services such as Samba to pad their thin margins.

  Even more serious for Facebook in particular is its declining attractiveness to its own current and prospective employees. In late 2018, only about half said that they felt the company was making the world better, and 52 percent said that the company was on the right track. Another report said that many employees were turning to outside contacts to find work at other organizations.

  Another big challenge to Facebook’s business model is competition. While it has a deep and sticky relationship with its users, it doesn’t make money from them. It makes money by selling information about them to advertisers. And the information is all indirect—who you are, what you like, what you click on, and so forth. Ima
gine how much more powerful advertising on a platform such as Amazon could be. Not only does Amazon have a lot of information—much of it far less creepy than what Facebook collects—but it also knows what you actually buy. Observers expect Amazon to siphon off a fair amount of traffic from both Google and Facebook as it leverages the information it has to provide advertisements users can quickly turn into purchases.

  Competition might also emerge for Facebook from other platforms. Just to speculate, the founders of Instagram left the company in 2018 after reported disagreements with other company officials. In a statement that would give me pause if I were on the management team, Kevin Systrom, Instagram’s cofounder, said he was looking forward to starting “something new.” Think about it: Here’s a guy who has already created a hugely popular social media channel, out in the wild. And unlike other founders whose companies are likely to be vulnerable to being acquired by Facebook, its normal anticompetitive activity, Systrom is not likely to be tempted by any dollars Facebook might dangle in front of him.

  So my basic argument is this: the inflection point has arrived for Facebook and other advertising-fueled data-gathering organizations. The company and its peers may yet figure out how to maneuver through the inflection, but we can be fairly certain that they will look quite different as this movement unfolds.

  Insight from the Edges: Eight Ways to Address Blind Spots

  Facebook is at a pivotal moment. As of this writing, the network, with its more than 2 billion active users, $40 billion in revenue (2017), and ubiquitous presence virtually everywhere on the Internet, seems unassailable. And yet, giants have fallen before. The failure to see the storm clouds coming plays a huge role in a lurch toward irrelevance. Consider Nokia.