Facebook's Threat To NYU Researchers Is A Mistake, But It's The Inevitable Follow On To Overreaction To Cambridge Analytica
Techdirt. 2020-10-27
Summary:
Late on Friday news came out that Facebook had sent a cease and desist letter to researchers at NYU working on the Ad Observatory project. At issue was that the project had asked people to install a browser extension that would share data back to NYU regarding what ads they saw. Facebook -- responding to significant criticism -- has put forth an ad library that allows researchers to search through what ads are being shown on Facebook and who is behind them (which is good transparency!), but it does not show how those ads were targeted. This is what the researchers at NYU were trying to collect data on. And that is a reasonable research goal.
Facebook has argued that this is a breach of Facebook's terms of service -- though it does seem notable that this is coming out right around the same time that these very same researchers discovered that Facebook's promise to properly label political ads isn't working so great (it's a tangent, but this is why promising to label political ads may be problematic in the first place: you're going to miss a bunch, especially on a platform this big).
The Knight 1st Amendment Center at Columbia is representing the researchers and is condemning this move (and the researchers are refusing to comply with the cease-and-desist). Here's the Knight Center's litigation director Alex Abdo:
“Frankly it’s shocking that Facebook is trying to suppress research into political disinformation in the lead-up to the election. There’s really no question more urgent right now than the question of how Facebook’s decisions are shaping and perhaps distorting political discourse. It would be terrible for democracy if Facebook is allowed to be the gatekeeper to journalism and research about Facebook.”
This is not the first time that the Knight Center and Facebook have clashed over research. Two years ago, the Center had asked Facebook to create a special safe harbor for journalists doing research on the platform, to avoid having them face CFAA claims. Facebook declined.
I think this is a bad move by Facebook and a huge mistake. I think it's a mistake on multiple levels: political, technological, legal and just on general PR. However, I will give one sliver of a defense to Facebook: it likely feels somewhat forced into this because of the years-long over-reaction to Cambridge Analytica. Cambridge Analytica did a bunch of bad stuff, and it started out as an "academic" claiming (misleadingly) that he was merely doing "academic research" on Facebook users -- creating a Facebook app that would get users to basically cough up data about their entire social graph. The "academic" then gave the data over to the company (violating the rules), which then became part of a political advertising machine. Eventually, Facebook was pretty significantly fined, in part because of Cambridge Analytica's ability to extricate and share that data.
You may note some similarities. Ostensibly academic researchers asking users to install something to collect some data about Facebook users, and then collecting that data for "research." Given what happened with Cambridge Analytica, you might see why some folks within Facebook would be reasonably gunshy about letting this happen again -- and that may explain the company's aggressive legal response. And, you and I can say "but NYU is a respected institution -- they're not going to abuse this data" but the guy who did the data for Cambridge Analytica was initially at Cambridge, also a respected university.
You might also argue that since Facebook has been dinged by the FTC, in part over this, and the consent decree doesn't really specify that this there are separate rules for "legitimate" research, it has to do this. Indeed, that's kind of what Facebook itself is now arguing in response to this:
2/ We protect people's privacy by not only prohibiting unauthorized scraping in our terms, we have teams dedicated to finding and preventing it. And under our agreement with the FTC, we report violations like these as privacy incidents.
— Rob Leathern (@robleathern) October 25, 2020