Facebook Says Russian Firms 'Scraped' Data, Some for Facial Recognition
Posted October 12, 2018 8:51 p.m. EDT
Updated October 13, 2018 8:59 a.m. EDT
San Francisco — On the same day Facebook announced that it had carried out its biggest purge yet of American accounts peddling disinformation, the company quietly made another revelation: It had removed 66 accounts, pages and apps linked to Russian firms that build facial recognition software for the Russian government.
Facebook said Thursday that it had removed any accounts associated with SocialDataHub and its sister firm, Fubutech, because the companies violated its policies by scraping data from the social network.
“Facebook has reason to believe your work for the government has included matching photos from individuals’ personal social media accounts in order to identify them,” the company said in a cease-and-desist letter to SocialDataHub that was dated Tuesday and viewed by The New York Times.
Facebook gave the companies until Friday to detail what data they had taken and then delete it all.
The case illustrates a new reality for Facebook. SocialDataHub and Fubutech have been around for at least four years, relying in part on Facebook data to build products that might alarm some civil-liberty advocates.
As Facebook is taking a closer look at its own products amid increasing scrutiny and public outcry, it is increasingly finding examples of companies that have been exploiting its global social network for questionable ends.
SocialDataHub and Fubutech also present another challenge because, Facebook said, at least some of their data collection occurred through web scraping.
Scraping is a rudimentary technique in which computer programmers can pull information off a website. It is difficult to detect and prevent, Facebook said. Scraping can pull any data that’s left public on a Facebook profile — and, theoretically, more private data about the user’s Facebook friends.
Artur Khachuyan, the 26-year-old chief executive of SocialDataHub and Fubutech, said in an interview Friday that Facebook had deleted his companies’ accounts unfairly.
Fubutech does build facial-recognition software for the Russian government and uses Facebook data, but it scrapes Google search results for that information — not Facebook, he said. And SocialDataHub’s main product — a system that assigns scores to Russian citizens based on their social-media profiles for insurers and banks — required permission from the users it rates, he said.
Khachuyan said he taught Russian journalism students how to scrape the web and that two of them had scraped Facebook for the public profiles of their classmates. He believes Facebook mistook the students’ activity for his companies’ work.
“Maybe it’s a reason to deactivate our accounts,” Khachuyan said. “But I don’t know why Facebook deletes Instagram account of my dog.” That account, for “Mars the Blue Corgi,” had 176 followers.
Katy Dormer, a Facebook spokeswoman, rejected Khachuyan’s claim that Facebook had conflated his students’ activity with the actions of his companies.
“We don’t take these actions lightly,” she said. “The fact we took the action and sent the letter means we saw enough evidence.”
Facebook’s removal of SocialDataHub and Fubutech reflects a larger problem for the social media company as it evaluates its relationship with third-party apps that have access to people’s Facebook data.
In the wake of reporting by The New York Times and others that the political firm Cambridge Analytica harvested the data of more than 87 million Facebook users through a third-party app, Facebook announced that it was reviewing its data-sharing policy with apps. After an audit, the company said it was suspending 200 apps. Some have since had their access to Facebook restored.
Khachuyan said the letter from Facebook had surprised him, particularly because his companies have been operating the same way for years.
“All in Russia know about us for minimum four years,” he said. “I don’t know why that Facebook sent that only now.”
He said Fubutech scraped data from the web, particularly Google search and the Russian search engine Yandex, to build a database of Russian citizens and their images that the government can use for facial recognition. “We don’t know exactly what they do with it,” he said.
“Maybe government clients connect our software to CC cameras,” Khachuyan said, referring to closed-circuit cameras. “Maybe they connect it to social profiles.”
Khachuyan compared Fubutech to Palantir, the Palo Alto, California, tech company that does data analysis for the U.S. government. At one point in a 30-minute phone interview, he said the Russian Defense Ministry was a client but later said he could not name Fubutech’s government clients.
His other firm, SocialDataHub, works with insurers and banks to evaluate potential customers. Between 30,000 and 50,000 Russian citizens have given SocialDataHub permission to analyze their Facebook profiles to assign a score between zero and 10, which insurers and banks use to help set rates or approve credit cards.
“If you’re a bad client, you have zero to three,” Khachuyan said.
He said his companies, which share 52 employees in Moscow, complied with Facebook policies; they use Facebook data only when it is public and available on Google search, or if the user has granted them permission. He said the techniques were also legal in Russia.
“It’s a trick in our federal law to use that data, but that works only with Russian citizens,” Khachuyan said.
At the top of the SocialDataHub’s website, there is a single line: “We know everything about everybody.”