Facebook Private Messages Aren't Exactly Private

(Bloomberg Gadfly) -- I'm still catching my breath after a crazy day of reports about Facebook Inc. And there is no sign the company's perma-scandal will end anytime soon. 

First, there was news that Facebook CEO Mark Zuckerberg will testify next week at a couple of congressional hearings. (Mark your calendars for April 10 and 11.) Facebook also updated its data policy and proposed revised terms governing its relationship with users. And there was Facebook's disclosure that account information from up to 87 million people was siphoned by the political consulting firm Cambridge Analytica. The volume of Facebook news coverage on Wednesday couldn't be contained on a single Bloomberg terminal screen.

I want to talk about a Facebook disclosure that received slightly less attention. Bloomberg News reporter Sarah Frier wrote on Wednesday that Facebook scans the links and images that people send one another on Messenger, the Facebook-owned app for private messages to friends or groups of friends. Facebook also reads the content of messages if they're flagged as potential violations of the company's rules. 

This disclosure stemmed from Zuckerberg's recent interview with Vox, which asked him about the misuse of Facebook last year to spread hateful propaganda against the Rohingya minority in Myanmar. Zuckerberg explained that he received a phone call because the company had detected that "people were trying to spread sensational messages" through Messenger to stir up violence in Myanmar. "Our systems detect that that’s going on. We stop those messages from going through," Zuckerberg said.

Interesting. When I read that, I searched for Messenger's privacy policies and couldn't find anything that clearly spelled out whether Facebook can screen for the content of private Messenger communications. Sarah gave me the answer: Yes.

It's likely that many providers of one-to-one messaging apps and online email do exactly this kind of scanning for incitement of violence, child pornography and other harmful material that people attempt to share privately. I'm sure many technologists and privacy diehards are well aware of these automated checks.

But I bet not many regular users realize that the links, messages, photos, videos and other communications they send privately to friends, family and other contacts might be run through computer systems to detect harmful behavior or other violations of a company's terms of service. (Public posts are another matter. Most people have learned that what they post publicly on Facebook, Twitter or YouTube can get them into trouble.) 

I want Messenger to detect when people are privately sharing photos that exploit children. I want Facebook to try to weed out malware or violent threats in my private messages. I think.

But we've learned in the last couple of years that people haven't thought much about the potential drawbacks to the technologies they let into their lives. Whether we're fine with automated scans of private digital communications -- and trust that the companies make sure humans don't improperly snoop on those computerized scans -- is another debate we probably haven't had. 

The technology companies don't necessarily make it clear what their policies allow. A combination of Facebook's complicated advertising targeting and its lack of transparency about what it does help fuel conspiracy theories -- and there are plenty of conspiracy theories about Facebook eavesdropping on private communications.

I'm fairly tech savvy, and I initially couldn't find any information about Facebook's screening of Messenger. Facebook's updated data policy now says, "Our systems automatically process content and communications you and others provide to analyze context and what's in them."

Would a non-techie read that and understand what happens with private Messenger posts? As is typical, Facebook said it was making its policies more clear, but there is still a lack of clarity.

A version of this column originally appeared in Bloomberg's Fully Charged technology newsletter. You can sign up here.

This column does not necessarily reflect the opinion of Bloomberg LP and its owners.

Shira Ovide is a Bloomberg Gadfly columnist covering technology. She previously was a reporter for the Wall Street Journal.

To contact the author of this story: Shira Ovide in New York at sovide@bloomberg.net.

To contact the editor responsible for this story: Daniel Niemi at dniemi1@bloomberg.net.

©2018 Bloomberg L.P.