NHacker Next
login
▲Meta accessed women's health data from Flo app without consent, says courtmalwarebytes.com
114 points by amarcheschi 3 hours ago | 72 comments
Loading comments...
gruez 47 minutes ago [-]
As much as I don't like facebook as a company, I think the jury reached the wrong decision here. If you read the complaint[1], "eavesdropped on and/or recorded their conversations by using an electronic device" basically amounted to "flo using facebook's sdk and sending custom events to it" (page 12, point 49). I agree that flo should be raked over the coals for sending this information to facebook in the first place, but ruling that facebook "intentionally eavesdropped" (exact wording from the jury verdict) makes zero sense. So far as I can tell, flo sent facebook menstrual data without facebook soliciting it, and facebook specifically has a policy against sending medical/sensitive information using its SDK[2]. Suing facebook makes as much sense as suing google because it turned out a doctor was using google drive to store patient records.

[1] https://www.courtlistener.com/docket/55370837/1/frasco-v-flo...

[2] https://storage.courtlistener.com/recap/gov.uscourts.cand.37... page 6, line 1

HeavyStorm 21 minutes ago [-]
That's why in these cases you'd prefer a judgment without a jury. Technical cases like this will always confuse jurors, who can't be expected to understand details about sdk, data sharing, APIs etc.

On the other hand, in a number of highprofile tech cases, you can see judges learning and discussing engineering in a deeper level.

kubb 2 hours ago [-]
Whenever you think of a court versus Facebook, imagine one of these mini mice trying to stick it to a polar bear. Or a goblin versus a dragon, or a fly versus an elephant.

These companies are for the most part effectively outside of the law. The only time they feel pressure is when they can lose market share, and there's risk of their platform being blocked in a jurisdiction. That's it.

potato3732842 2 hours ago [-]
>These companies are for the most part effectively outside of the law

You have it wrong in the worst way. They are wholly inside the law because they have enough power to influence the people and systems that get to use discretion to determine what is and isn't inside the law. No amount of screeching about how laws ought to be enforced will affect them because they are tautologically legal, so long as they can afford to be.

HPsquared 2 hours ago [-]
It's one of those "I'm not trapped here with you; you're trapped here with me" type things.
entropi 2 hours ago [-]
I think this situation is described best as being "above" the law.
kubb 1 hours ago [-]
Pedantic, but fair. You're right.
Dylan16807 2 hours ago [-]
All they need to do is impose a three digit fine per affected user and Facebook will immediately feel intense pressure.
akudha 1 hours ago [-]
$1 for the first user, $2 for second, $4 for third...By the 30th user, it would be painful even for mega corps. By 40th, it would be an absurd number.

Might also be worth trying to force them to display a banner on every page of the site "you're on facebook, you have no privacy here", like those warnings on cigarette boxes. These might not work though, people would just see and ignore them, just like smokers ignore warnings about cigarettes.

bell-cot 45 minutes ago [-]
Who's this "they" you speak of, and why would they bother doing that?
codegladiator 2 hours ago [-]
three digit ? the only thing these folks understand is exponential growth per affected user.
lemonberry 2 hours ago [-]
The worst part for me personally is that almost everyone I know cares about this stuff and yet they keep all of their Meta accounts. I really don't get it and frankly, find it kind of disturbing.

I know people that don't see anything wrong with Meta so they keep using it. And that's fine! Your actions seem to align with your stated values.

I get human fallibility. I've been human for awhile now, and wow, have I made some mistakes and miscalculations.

What really puts a bee in my bonnet though is how dogmatic some of these people are about their own beliefs and their judgement of other people.

I love people, I really do. But what weird, inconsistent creatures we are.

kubb 1 hours ago [-]
Voting with your feet doesn't work if you don't have a place to go. People are afraid of losing their connections, which are some of the most precious things we have. Doesn't matter if it's an illusion, that's enough. Zuck is holding us hostage on our most basic human instincts. I think that's fucked up.
A4ET8a8uTh0_v2 1 hours ago [-]
Eh, I care and I don't do it, but my wife does. I do not agree with her choices in that area and voice the concerns in a way that I hoped would speak to her, but it does not work as it is now a deeply ingrained habit.

I, too, have vices she tolerates so I don't push as hard as I otherwise would have, but I would argue it is not inconsistency. It is a question of what level of compromise is acceptable.

bossyTeacher 1 hours ago [-]
> The worst part for me personally is that almost everyone I know cares about this stuff and yet they keep all of their Meta accounts.

They care as much as people who claim to care about animals but still eat them, people who claim to love their wives and still beat/cheat them. Your actions are the sole embodiment of your beliefs

ajsnigrutin 2 hours ago [-]
Everybody blames facebook, noone blames the legislators and the courts.

Stuff like this could easily make them pay multi-billion dollar fines, stuff that affects more users maybe even in the trillion range. When government workers come pick up servers, chairs and projectors from company buildings to sell at an auction, because there is not enough liquid value in the company to pay the fines, they (well, the others) would reconsider quite fast and stop with the illegal activities.

favflam 2 hours ago [-]
Sarah Williams (forgot the name) testified in US Congress as to Facebooks strategies on handling governments. Based on her book, it seems Brazil has been the most effective out of major democratic governments in confronting Facebook. Of course, you have China completely banning Facebook.

I think Mark Zuckerberg is acutely aware of the political power he holds and has been using this immense power at least for the last decade. But since Facebook is a US company and the US government is not interested in touching Faceebok, I doubt anyone will see what Zuckerberg and Facebook are up to. The US would have to put Lina Khan back in at the FTC, or put her high up in the Department of Justice to split Facebook into pieces. I guess the other hope is that states' attorneys' general when an anti-monopoly lawsuit.

kubb 1 hours ago [-]
Don't get me wrong, I don't "blame Facebook". I lament the environment that empowers Facebook to exist and do harm. These companies should be gutted by the state, but they won't because they pump the S&P.
fHr 2 hours ago [-]
Roblox lul
FirmwareBurner 2 hours ago [-]
[flagged]
kubb 2 hours ago [-]
Funny, but this kinda implies that some person designed this way. It's a resultant sum of small vectors, with corporate lobbying playing a significant role. Corporate lobbying systemically can't do anything else than try to increase profits, which usually means less regulation. Clean slate design would require a system collapse.
graemep 2 hours ago [-]
> Corporate lobbying systemically can't do anything else than try to increase profits, which usually means less regulation.

Corporate lobbying can be for more regulation. It can disadvantage competitors. Zuckerberg has spoken in favour of greater regulation of social media in the past. The UK's Online Safety Act creates barriers to entry and provides and excuse for more tracking. I can think of examples, some acknowledged by the CEOs of the companies involved, ranging from British pubs to American investment banks.

moolcool 2 hours ago [-]
When Facebook releases an AI Model for free: "Based Facebook. Zuckerberg is a genius visionary"

When Facebook does something unforgivable: "It's a systemic problem. Zuck is just a smol bean"

kubb 1 hours ago [-]
Zuck can take his model onto his private island and talk to it instead of trying to be a normal human being.

Don't conflate me with the personality worshippers on HN, I'm not one of them, even though it seems like it to you because I also post here. You won't find a single instance of me glazing tech leaders.

FirmwareBurner 2 hours ago [-]
What's with this reductionist logic? Nothing is ever 100% good or 100% evil, everything is on a spectrum.

So just because Zuck does some good stuff for the tech world, doesn't mean he's work isn't a net negative to society.

moolcool 1 hours ago [-]
> doesn't mean he's work isn't a net negative to society

Oh he absolutely is.

I'm just saying that it's common in this community to attribute the achievements of big companies to leadership (E.g. the mythology of Steve Jobs), but dismiss all the evil stuff to "systemic issues".

exe34 2 hours ago [-]
> Funny, but this kinda implies that some person designed this way

How do you get to that implication? I'm missing a step or two I think...

kubb 1 hours ago [-]
From "do you want X? this is how you get X". This invokes an image of talking to a person who decided the how, because they can be questioned on whether they want the X.
lazide 2 hours ago [-]
I once ran across Zuckerberg in a Palo Alto cafe. I only noticed him (I was in the process of ordering a sandwich, and don’t really care about shit like that) because he was being ‘eeeeeeee’d’ by a couple of random women that he didn’t seem to know. He seemed pretty uncomfortable about the whole thing. One of them had a stroller which she was profoundly ignoring during the whole thing, which I found a bit disturbing.

The next time I saw him in Palo Alto (a couple months later on the street), he had 2 totally-not-security-dudes flanking him, and I saw at least one random passerby ‘redirected’ away from him. This wasn’t at the cafe though, it wouldn’t surprise me if he didn’t go there again.

This was a decade before Luigi. Luigi was well after meta was in the news for spending massive amounts of money on security and Zuck had a lot of controversy for his ‘compound’ in PA.

I can assure you, Meta is well aware of the situation, and a Luigi isn’t going to have a chance in this situation.

The reality in my experience that is any random person given the amount of wealth these folks end up with would end up making similar (or worse) decisions, and while contra-pressure from Luigi’s is important in the overall system, folks like Zuckerberg are more a result of the system and rules than the cause of them (but then influence the next system/rules in a giant Oroborous type situation).

Kind of a we either die young a hero, or live to be the villain kind of thing. But because the only reason anyone dies a young hero is because they lost the fight against the prior old villains. If they’d won (even in a heroic fashion), life would turn them into the old villains shortly.

The wheel turns.

lightedman 2 hours ago [-]
"I can assure you, Meta is well aware of the situation, and a Luigi isn’t going to have a chance in this situation."

Luigi was a dude with a 3D printed gun.

I have LASERs with enough power to self-focus, have zero ballistic drop, and can dump as much power as a .50cal BMG in a millisecond burst of light which can hit you from the horizon's edge. All Zuck needs to do is stand by a window, and eyeballs would vaporize.

landl0rd 2 hours ago [-]
Mangione is going to either die rotting in prison, or preferably get sent to the electric chair. His life will be wasted. Meanwhile, UNH is continuing to do business as usual. One way or the other, mangione will die knowing his life was wasted, and that his legacy is not reform but cold-blooded murder.

Call it a “day of rage” or just babyrage but we build systems so our bus factor can increase above 1. Just killing people no longer breaks them. It makes someone nothing more than a juvenile murderer.

I don’t really care what lasers you have, I’d suggest you choose a different legacy for yourself.

FirmwareBurner 1 hours ago [-]
>His life will be wasted.

His life was already wasted due to his medical condition. Don't ever bet aginst people with nothing to loose.

s5300 1 hours ago [-]
[dead]
fHr 2 hours ago [-]
FBI open up
hobs 2 hours ago [-]
It's not the only way. The oppressed do not need to become the oppressor, its just the simplest rut for the wheel to turn in.
lazide 1 hours ago [-]
Sure, they can stay the oppressed?

Using the entropic model you seem to indicate (which I also favor), us vs them seems to be the lowest energy state.

It’s certainly possible to not be there at any given time, but seems to require a specific and somewhat unique set of circumstances, which are not the most energetically stable.

FirmwareBurner 2 hours ago [-]
> he was being ‘eeeeeeee’d’ by a couple of random women

Maybe I'm too old, but what in the world does being eeee'd mean?

>I can assure you, Meta is well aware of the situation, and a Luigi isn’t going to have a chance in this situation.

With all due respect, Luigi was just a CS student with a six pack, a self made gun, and a aching back on a mission.

The Donald himself nearly got got by his ear while he had the secret service of the US of A to protect him, not some private goons for hire, and that was just a random redditor with a rifle, not a professional assassin.

So what would happen if let's say meta's algorithms push a teenage girl to kill herself by exploiting her self esteem issues to sell her more beauty products, and her ex-navy seal dad with nothing more to loose grabs his McMillan TAC-338 boom stick and makes his life mission to avenge his lost daughter at the expense of his own? Zuck would need to be lucky every time, but that bad actor would need to be lucky once.

I'm not advocating for violence btw, my comment was purely hypothetical.

potato3732842 2 hours ago [-]
Pretty much anyone without presidential quality security clearing the place ahead of them stands to get clapped Franz Ferdinand style by anyone dedicated enough to camp out waiting.
lazide 2 hours ago [-]
And yet, Mr. Trump is up there trolling the world like he loves to do, and Zuck is out there doing whatever he wants.

The reality is, all those ex-navy seal Dad’s are (generally) wishing they could make the cut to get on those dudes payroll, not gunning for them. Or sucking up to the cult, in general.

The actual religious idea of Karma is not ‘bad things happen to bad people right now’, the way we would like.

Rather ‘don’t hate on king/priest/rich dude, they did something amazing in a prior life which is why they deserve all this wealth right now, and if they do bad things, they’ll go down a notch - maybe middle class - in the next life’.

It’s to justify why people end up suffering for no apparent reason in this life (because they had to have done something really terrible in a prior life), while encouraging them to do good things still for a hopefully better next life (if you think unclogging Indian sewers in this life is bad, you could get reincarnated as a roach in that sewer in the next life!). So they don’t go out murdering everyone they see, even if they get shit on constantly.

There is no magic bullet. Hoping someone else is going to solve all your problems is exactly how manipulative folks use you for their own purposes. And being a martyr to go after some asshole is being used that way too.

This is also why eventually an entire generation of hippies turned into accountants in the 80’s.

shrug

s5300 2 hours ago [-]
[dead]
mschuster91 2 hours ago [-]
> I only noticed him (I was in the process of ordering a sandwich) because he was being ‘eeeeeeee’d’ by a couple of random women that he didn’t seem to know. He seemed pretty uncomfortable about the whole thing.

Pretty funny considering that Facebook's origin story was a women comparison site, or this memorable quote:

> People just submitted it. I don't know why. They 'trust me'. Dumb fucks.

lazide 2 hours ago [-]
Have you ever ordered a really good steak, like amazing. And really huge, and inexpensive too.

And it really is amazing! And super tasty.

But it’s so big, and juicy, that by the end of it you feel sick? But you can’t stop yourself?

And then at the end of it, you’re like - damn. Okay. No more steak for awhile?

If not steak, then substitute cake. Or Whiskey.

Just because you got what you wanted doesn’t mean you’re happy with all the consequences, or can stomach an infinitely increasing quantity of it.

Of course, he can pay to mitigate most of them, and he gets all the largest steaks he could want now, so whatever. I’m not going to cry about it. I thought it was interesting to see develop however.

mschuster91 30 minutes ago [-]
Personally, I see it as poetic justice. He started off on objectifying women with FaceMash, he doesn't get to cry about being objectified and drooled over himself.
j33zusjuice 2 hours ago [-]
[flagged]
comrade1234 2 hours ago [-]
I don't think many of you read the article... the Flo app is the one in the wrong here, not meta. The app people were sending user data to meta with no restrictions on its use. Despite however the court ruled.
PunchTornado 1 hours ago [-]
> The app people were sending user data to meta with no restrictions on its use

And then meta accessed it. So unless you put restrictions on data, meta is going to access it. Don't you think it should be the other way around? Meta to ask for permission? Then we wouldn't have this sort of thing.

gruez 1 hours ago [-]
Do you think AWS should ask for permission before processing some random B2C app user's data?
paintbox 1 hours ago [-]
From the article: "The jury ruled that Meta intentionally “eavesdropped on and/or recorded their conversations by using an electronic device,” and that it did so without consent."

If AWS wanted to eavesdrop and/or record conversations of some random B2C app user, for sure they would need to ask for permission.

gruez 58 minutes ago [-]
If you read the court documents, "eavesdropped on and/or recorded" basically meant "flo used facebook's SDK to sent analytics events to facebook". It's not like they were MITMing connections to flo's servers.

https://www.courtlistener.com/docket/55370837/1/frasco-v-flo...

pllbnk 1 hours ago [-]
Everybody misses the key information here - it’s a Belarusian app. CEO and CTO are Belarusian (probably there are more C-level people who are Belarusian or Russian). Not only are users giving up their private information but they are doing so to the malevolent (by definition) regimes.

When the Western app says they don’t sell or give out private information, you can be suspicious but still somewhat trustful. When a dictator-ruled country’s app does so, you can be certain every character you type in there is logged and processed by the government.

ramanh 55 minutes ago [-]
The company cut all ties with Belarus more than three years ago, and all employees relocated to Europe.
graemep 33 minutes ago [-]
Where in Europe? Belarus is in Europe, and so is much of Russia (the largest European country). Plenty of variation in the rest of Europe.

What do you mean by cut all ties? The owners and management have no assets in Belarus or ties to the country?

ramanh 5 minutes ago [-]
you can open "contact us" page on their website.
pllbnk 31 minutes ago [-]
I can only cite myself to emphasize the point that they didn’t:

> CEO and CTO are Belarusian (probably there are more C-level people who are Belarusian or Russian).

Actually, quick google search shows slavic (either Russian or Belarusian) names for CFO and CMO. Changing physical location means very little these days.

everdrive 2 hours ago [-]
Don't use apps. It's a simple as that. 95% of the time they are not worth the incredible privacy invasion they impose on users.
amarcheschi 2 hours ago [-]
Mozilla did a comparison between period tracking apps and there are some that should respect user's privacy

https://www.mozillafoundation.org/en/privacynotincluded/cate...

setsewerd 2 hours ago [-]
Pardon my ignorance, but can't you just solve this by disabling location permissions, etc for a given app?
everdrive 1 hours ago [-]
You can -- the real problem here is that each app could violate your privacy in different ways. Unless you break TLS and inspect all the traffic coming from an app (and, do this over time since the reality of what data is sent will change over time) then you don't really know what your apps are stealing from you. For sure, many apps are quite egregious in this regard while some are legitimately benign. But, do you as a user have a real way to know this authoritatively, and to keep up with changes in the ecosystem? My argument would be that even security researchers don't have time to really do a thorough job here, and users are forced to err on the side of caution.
throwaway290 2 hours ago [-]
What they do then is create an app where location is necessary, make that app spin up a localhost server, then add js to facebook and every site with a like button to phone that localhost and basically deanon everyone.
cnity 2 hours ago [-]
How could this possibly work without port forwarding?
mzajc 1 hours ago [-]
2 months ago: https://news.ycombinator.com/item?id=44169115.

Of course Facebook's JS won't add itself to websites, so half of the blame goes to webmasters willingly sending malware to browsers.

fHr 1 hours ago [-]
The sad truth
bell-cot 2 hours ago [-]
True. Unfortunately, users are all humans - with miserably predictable response patterns to "Look at this Free New Shiny Thing you could have!" pitches, and the ruthless business models behind them.
princevegeta89 2 hours ago [-]
It's very rare to see any privacy related news without Meta being involved in the story.
josefritzishere 16 minutes ago [-]
Zuckerberg does not seem to repect the law. There really should be criminal charges by now.
bell-cot 1 hours ago [-]
For those disinclined to read the article...

> [...] users, regularly answered highly intimate questions. These ranged from the timing and comfort level of menstrual cycles, through to mood swings and preferred birth control methods, and their level of satisfaction with their sex life and romantic relationships. The app even asked when users had engaged in sexual activity and whether they were trying to get pregnant.

> [...] 150 million people were using the app, according to court documents. Flo had promised them that they could trust it.

> Flo Health shared that intimate data with companies including Facebook and Google, along with mobile marketing firm AppsFlyer, and Yahoo!-owned mobile analytics platform Flurry. Whenever someone opened the app, it would be logged. Every interaction inside the app was also logged, and this data was shared.

> "[...] the terms of service governing Flo Health’s agreement with these third parties allowed them to use the data for their own purposes, completely unrelated to services provided in connection with the App,”

Bashing on Facebook/Meta might give a quick dopamine hit, but they really aren't special here. The victims' data was routinely sold, en mass, per de facto industry practices. Victims should assume that hundreds of orgs, all over the world, now have copies of it. Ditto any government or criminal groups which thought it could be useful. :(

cindyllm 1 hours ago [-]
[dead]
chubs 1 hours ago [-]
This is really disappointing. I used to have a fertility tracking app on the iOS App Store, zero data sharing, all local thus private. But, people don’t want to pay $1 for an app, and I can’t afford the marketing drive that an investor-backed company such as this has… and so we end up with situations like this. Pity :(
itsalotoffun 2 hours ago [-]
I mean.. there's simply no repercussions for these companies, and only rivers of money on the other side. The law is laughably inept at keeping them in check. The titans of Surveillance Capitalism don't need to obey laws. CFOs line-item-ing provisional legal settlement fees as (minor) COGS. And us digital serfs, we simply have no rights. Dumb f*cks, indeed.
potato3732842 2 hours ago [-]
The line between big business and the state is blurry and the state wants to advance big business as a means to advance itself. Once you understand this everything makes sense, or as much "sense" as it can.
dkiebd 2 hours ago [-]
Users gave their data to Flo, and Flo then gave it to Meta. What repercussions do you want for Meta?
Etheryte 2 hours ago [-]
Buying stolen goods does not mean they're yours because the seller never had any ownership to begin with. The same applies here, just because there's an extra step in the middle doesn't mean that you have any rights to the data.
Ekaros 2 hours ago [-]
Some percent of their revenue as fine per case. Only way to scare these companies at this point.
j33zusjuice 2 hours ago [-]
A significant portion, too, not fractions of a percent. Frankly, I want the fines to bankrupt them. That’s the point. I want their behavior to be punished appropriately. Killing the company is an appropriate response, imo: FB/Meta is a scourge on society.
pbiggar 2 hours ago [-]
Meta should never have used them. Deeply unethical behaviour
pbiggar 2 hours ago [-]
Meta truly is the worst company. In almost everything Meta does, it truly makes the most user-hostile decisions, awful decision, every single time.

Cambridge Analytica The Rohingya Genocide Suppressing Palestinian content during a genocide Damage to teenage (and adult) mental health

Anyway, I mention this because some friends are building a social media alternative to Instagram: https://upscrolled.com, aiming to be pro-user, pro-ethics, and designed for people, not just to make money.

2 hours ago [-]
ivanmontillam 1 hours ago [-]
Your comment started very useful, then it became spam. Great way to lose goodwill.