Facebook violated federal law with its secret program, according to some lawyers.
Facebook secretly obtained proprietary data from competitors, including Snapchat, according to newly unsealed court documents.
At the request of CEO Mark Zuckerberg, Facebook officials developed a program called In-App Action Panel (IAAP) that they deployed in 2016, and the program was in use through mid-2019, according to the documents, which include internal emails.
The program used cyberattacks to intercept information from Snapchat, YouTube, and Amazon. The program then decrypted the information.
Lawyers said in one of the documents, “Facebook’s IAAP Program used nation-state-level hacking technology developed by the company’s Onavo team, in which Facebook paid contractors (including teens) to designate Facebook a trusted ‘root’ certificate authority on their mobile devices, then generated fake digital certificates to redirect secure Snapchat analytics traffic (and later, analytics from YouTube and Amazon) from Snapchat’s servers to Onavo’s; decrypted these analytics and used them for competitive gain, including to inform Facebook’s product strategy; reencrypted them; and sent them up to Snapchat’s servers as though it came straight from Snapchat’s app, with Facebook’s Social Advertising competitor none the wiser.”
The lawyers, representing plaintiffs in a lawsuit that accuses Facebook of anti-competitive behavior, were describing emails they obtained through discovery.
In one email, Mr. Zuckerberg wrote that there was a need to receive information about Snapchat but that their traffic was encrypted.
“Given how quickly they’re growing, it seems important to figure out a new way to get reliable analytics about them,” he wrote. “Perhaps we need to do panels or write custom software. You should figure out how to do this.”
After Facebook employees started working on figuring it out, Facebook Chief Operating Officer Javier Olivan wrote that the program could pay users to let Facebook “install a really heavy piece of software (that could even do man in the middle, etc.).”
“Man in the middle” is a type of cyberattack during which attackers secretly intercept information.
“We are going to figure out a plan for a lockdown effort during June to bring a step change to our Snapchat visibility,” Guy Rosen, founder of Onavo, later wrote. “This is an opportunity for our team to shine.”
Onavo was started in Israel and bought by Facebook in 2013.
