Facebook "Bug": Explanations and Doubts
Published in Le Monde
(France) on 28 September 2012
by Michaël Szadkowski and Damien Leloup (link to
original)
Even if the idea of a technical malfunction [in the Facebook system] no longer seems topical, there are still many users who noticed messages on their timelines that, according to them, should not have been there.
No, we're not going to break out a timeline to settle the score. But what happened on Monday, Sept. 24 involving the "Facebook Bug" deserves clarification and some explanations on our part, both concerning our journalistic approach and the after-effects of the problem.
Everything started with the Métro article, published at 3:48 p.m., which stated that old private messages were appearing publicly on users' profiles, meaning that their Facebook friends could see them.
Like the majority of webzine journalists (our colleagues at Liberation and Slate describe the situation), those at Le Monde who read the Métro article immediately went to check their profiles. They realized that there were many old messages they certainly didn't want to see posted to their Facebook pages.
"I can't let something like that happen," many wrote in turmoil. Several people were sure that there were private messages visible on their timeline — but they didn't take screenshots before erasing them. Later, all they could find was a "message" notification in their inbox.
In the minutes that followed, we published an article on this blog explaining this reappearance of messages from the past and the steps to take to make them invisible, which we were quick to share on our Facebook page. What we posted would later blow up the feedback on our profile:
"So, it's been confirmed for many Facebook members: go clean up your profiles!”
“Facebook Bug Makes Private Messages Public”
At the same time, of course, we attempted to contact Facebook for an explanation. After several phone calls, a member of the Facebook France team said they didn't have any additional information, that nothing had been ruled out and that teams were figuring out if it was a "malicious manipulation" or a "technical problem."
Testimonies and Scandalous Messages
We then decided to write a second article on the "black day for Facebook," since there was a stock plunge around the same time due to a very critical report on Facebook's economic model.
Shortly after 7 p.m., following a brief internal discussion and while Facebook remained silent, we decided to send an alert to our subscribers' inboxes and smart phones. Given the gravity of the potential consequences, and the very large number of Facebook users in France, we felt it was important to warn all our readers.
We especially felt this was important at the time because, thanks to all of the dialogues we had opened up (in blog comments, on our Facebook page and by inviting readers to send their stories of any "unpleasant surprises" they had noticed to photoslemonde@gmail.com), many users confirmed that something "unusual," "bizarre," even "scandalous" was happening on their profiles.
We received pell-mell screenshots of scandalous messages, stories of university professors who discovered that their students had access to personal messages and even angry emails from people who had discovered insulting things in their friends' posts.
Facebook officially reacted at 8 p.m. and denied everything: "A small number of Facebook users were concerned to find old, supposedly private messages on their timeline. The Facebook team has analyzed these reports and confirms that the messages in question were old publications, previously visible on users' profiles. Facebook affirms that there is no threat to the security of users' information."
This began, at Le Monde and at all other sites involved, the search for definitive and irrefutable proof that would confirm what everyone — ourselves and many other journalists included — was certain that they had seen, namely, an accurate and verified screenshot of a private message and a corresponding public post.
By the following morning, after a lot of contact with readers who agreed to participate in the investigation, the conclusion was clear: We had not found such proof.
We nevertheless point out that, given the uninterrupted flow of messages and comments — dozens of which were from users up in arms over Facebook's explanations — there had indeed been a loss of user trust. So, following Facebook’s official statement at 8 p.m., we called once again for our readers to participate in our investigation.
A Factually Inaccurate Alert
By this Tuesday, however, the uproar had mostly died down. After Facebook's denial and the absence of conclusive screenshots, almost everyone agreed that it was not a bug and that French users were not discovering newly visible posts. Even so, as Slate rightfully explained, we can't prove anything. Reports of similar problems have been made overseas, and some have pointed out that this reaction was comparable to the incident that occurred in Finland in 2011.
In any case, this is a good opportunity to consider all of the paradoxes Facebook creates in private life (Jean-Marc Manach in Le Monde), the extent to which our use of the social network was different in 2008 (Vincent Glad in Slate) and even the extent to which we are greatly susceptible to a business and a social network that we love to hate while spending all of our time on it (Stéphanie Booth on her personal blog). It seems that the important thing is not the bug, but rather what it reveals about our social habits on the Internet (Olivier Tesquet in Télérama).
On the Le Monde website, many readers criticized us for crying wolf too quickly, and for again yielding to the "ravages of preventative journalism." We were also criticized for participating in the mass hysteria in response to Facebook's "innocence," as it is described on 20Minutes.
This was in light of the technical explanations about the way in which Facebook manages its databases. An old Facebook developer on the site Numérama explained, "Technically, timeline and messages are stored in completely different systems; when I heard the rumors, I had trouble believing it was possible, even if it was done on purpose.”
Such technical explanations corroborated our own discussions with a specialist in this area. We found that the database and the protocol used to store information for the instant messaging function are not the same as those used for information added to profiles, so the idea of a "simple" technical problem causing private messages to appear on the timeline remains extremely unlikely, even if technical errors have affected the use of instant messengers in the past.
However, at the time, numerous messages and personal stories continued to reach us. Some said that, bug or no bug, they were quitting the network. Others were outraged over being treated like lunatics and firmly believed that it was a technical error.
We take these accounts seriously, while recognizing, with our apologies, that our first reports and the content of our alert, which mentioned a technical problem, were factually inaccurate.
Wall-to-Wall
In our article, we presented the theory of a third pathway between partially or totally private messages (via Facebook messenger) and wall posts on users' profiles. What Facebook said in response to the bug alert was that "the messages in question were old publications, previously visible on users' profiles." Yet Facebook did not specify to whom these publications were visible, or what use Facebook members had for them.
Like others (you can find examples on Slate or Le Figaro), we dug up the "wall-to-wall" function that was used in the past on Facebook. This function showed conversations between two members via the messages that they posted on their respective walls.
When a user asked in 2007, "How do you respond to a message on your wall?” the English language site All Facebook responded by suggesting that they use “wall-to-wall” to keep up with their conversations.
Users discovered that it was enough to click on the "Friendship" tab between one's own profile and that of a friend in order to access and follow these "wall-to-wall" conversations, without the hassle of going back and forth from one wall to another.
Some Internet research about the wall-to-wall era confirmed for us that some Facebook users did not want their "wall-to-wall" conversations to be visible to all or some of their friends. For example, on Yahoo Answers in 2008 a user asked, "How can you hide your face book [sic] wall to wall?” Another user asked in 2009, "How to make my wall conversations private?”
A 2008 Yahoo Answers post explained that "You can hide your wall, by changing your privacy settings to ONLY you can see it." Another 2008 post on a forum dedicated to Facebook questions specified, "If your wall is not visible to someone, then that person will not be given the "wall-to-wall" link under your posts on other people's walls."
This meant that you could hide, from one person in particular or from everyone, all of the "wall-to-wall" statuses and conversations held with another member of Facebook.
In other words, these "wall-to-wall" conversations could be made invisible to a third person, even if one of the two participants were friends with this third person (basically, if your boyfriend or girlfriend at the time was “friends” with your current lover, your boyfriend or girlfriend couldn't see the "wall-to-wall" between you and your lover).
So it was possible to have "wall-to-wall" conversations on Facebook that were entirely or partially private; members consciously used this function, in addition to the messaging function, with the awareness that certain other people couldn't see them.
Despite the jungle of Facebook's privacy settings, we're willing to bet that a large number of users have also been cautious about the visibility of their wall posts from the beginning — for example, everyone who talked about their experiences on Le Monde these past few days.
But in light of all of the screenshots we've seen since Sept. 24, it seems very likely that it is posts of these "wall-to-wall" conversations, including those with visibility that was partially or totally restricted when they were sent, that are now being found on profiles.
Why didn't anyone notice this problem before 2012? Several developments in Facebook's features could have caused it. One possibility is the change of security settings in 2009, which made all statuses public by default — read about on this subject in a rant by the Electronic Frontier Foundation — and which Facebook was forced to withdraw six months later. Another possibility is the move to a new profile template in 2010. Yet another change was the global deployment of the timeline format, which greatly improved the visibility of all posts, classifying them by year in a right-hand column. Because of this, in January 2012, many sites recommended that everyone review the privacy settings on their profile to avoid the visibility of old, embarrassing posts on their own walls, as well as on those of their friends.
We must accept that this whole story was probably not the result of a dramatic change or a technical bug on Facebook that occurred before Sept. 24. Yet we should also consider that the Métro article, just like the outburst which followed, above all sounded an alarm: Everything that you post on Facebook could reappear on the network, which controls the visibility rules for your posts and could change years down the road.
P.S: A big thanks to all of our readers who sent in screenshots and stories; if you have any additional comments or explanations to share with us, we welcome your emails at photoslemonde@gmail.com!
No, we're not going to break out a timeline to settle the score. But what happened on Monday, Sept. 24 involving the "Facebook Bug" deserves clarification and some explanations on our part, both concerning our journalistic approach and the after-effects of the problem.
Everything started with the Métro article, published at 3:48 p.m., which stated that old private messages were appearing publicly on users' profiles, meaning that their Facebook friends could see them.
Like the majority of webzine journalists (our colleagues at Liberation and Slate describe the situation), those at Le Monde who read the Métro article immediately went to check their profiles. They realized that there were many old messages they certainly didn't want to see posted to their Facebook pages.
"I can't let something like that happen," many wrote in turmoil. Several people were sure that there were private messages visible on their timeline — but they didn't take screenshots before erasing them. Later, all they could find was a "message" notification in their inbox.
In the minutes that followed, we published an article on this blog explaining this reappearance of messages from the past and the steps to take to make them invisible, which we were quick to share on our Facebook page. What we posted would later blow up the feedback on our profile:
"So, it's been confirmed for many Facebook members: go clean up your profiles!”
“Facebook Bug Makes Private Messages Public”
At the same time, of course, we attempted to contact Facebook for an explanation. After several phone calls, a member of the Facebook France team said they didn't have any additional information, that nothing had been ruled out and that teams were figuring out if it was a "malicious manipulation" or a "technical problem."
Testimonies and Scandalous Messages
We then decided to write a second article on the "black day for Facebook," since there was a stock plunge around the same time due to a very critical report on Facebook's economic model.
Shortly after 7 p.m., following a brief internal discussion and while Facebook remained silent, we decided to send an alert to our subscribers' inboxes and smart phones. Given the gravity of the potential consequences, and the very large number of Facebook users in France, we felt it was important to warn all our readers.
We especially felt this was important at the time because, thanks to all of the dialogues we had opened up (in blog comments, on our Facebook page and by inviting readers to send their stories of any "unpleasant surprises" they had noticed to photoslemonde@gmail.com), many users confirmed that something "unusual," "bizarre," even "scandalous" was happening on their profiles.
We received pell-mell screenshots of scandalous messages, stories of university professors who discovered that their students had access to personal messages and even angry emails from people who had discovered insulting things in their friends' posts.
Facebook officially reacted at 8 p.m. and denied everything: "A small number of Facebook users were concerned to find old, supposedly private messages on their timeline. The Facebook team has analyzed these reports and confirms that the messages in question were old publications, previously visible on users' profiles. Facebook affirms that there is no threat to the security of users' information."
This began, at Le Monde and at all other sites involved, the search for definitive and irrefutable proof that would confirm what everyone — ourselves and many other journalists included — was certain that they had seen, namely, an accurate and verified screenshot of a private message and a corresponding public post.
By the following morning, after a lot of contact with readers who agreed to participate in the investigation, the conclusion was clear: We had not found such proof.
We nevertheless point out that, given the uninterrupted flow of messages and comments — dozens of which were from users up in arms over Facebook's explanations — there had indeed been a loss of user trust. So, following Facebook’s official statement at 8 p.m., we called once again for our readers to participate in our investigation.
A Factually Inaccurate Alert
By this Tuesday, however, the uproar had mostly died down. After Facebook's denial and the absence of conclusive screenshots, almost everyone agreed that it was not a bug and that French users were not discovering newly visible posts. Even so, as Slate rightfully explained, we can't prove anything. Reports of similar problems have been made overseas, and some have pointed out that this reaction was comparable to the incident that occurred in Finland in 2011.
In any case, this is a good opportunity to consider all of the paradoxes Facebook creates in private life (Jean-Marc Manach in Le Monde), the extent to which our use of the social network was different in 2008 (Vincent Glad in Slate) and even the extent to which we are greatly susceptible to a business and a social network that we love to hate while spending all of our time on it (Stéphanie Booth on her personal blog). It seems that the important thing is not the bug, but rather what it reveals about our social habits on the Internet (Olivier Tesquet in Télérama).
On the Le Monde website, many readers criticized us for crying wolf too quickly, and for again yielding to the "ravages of preventative journalism." We were also criticized for participating in the mass hysteria in response to Facebook's "innocence," as it is described on 20Minutes.
This was in light of the technical explanations about the way in which Facebook manages its databases. An old Facebook developer on the site Numérama explained, "Technically, timeline and messages are stored in completely different systems; when I heard the rumors, I had trouble believing it was possible, even if it was done on purpose.”
Such technical explanations corroborated our own discussions with a specialist in this area. We found that the database and the protocol used to store information for the instant messaging function are not the same as those used for information added to profiles, so the idea of a "simple" technical problem causing private messages to appear on the timeline remains extremely unlikely, even if technical errors have affected the use of instant messengers in the past.
However, at the time, numerous messages and personal stories continued to reach us. Some said that, bug or no bug, they were quitting the network. Others were outraged over being treated like lunatics and firmly believed that it was a technical error.
We take these accounts seriously, while recognizing, with our apologies, that our first reports and the content of our alert, which mentioned a technical problem, were factually inaccurate.
Wall-to-Wall
In our article, we presented the theory of a third pathway between partially or totally private messages (via Facebook messenger) and wall posts on users' profiles. What Facebook said in response to the bug alert was that "the messages in question were old publications, previously visible on users' profiles." Yet Facebook did not specify to whom these publications were visible, or what use Facebook members had for them.
Like others (you can find examples on Slate or Le Figaro), we dug up the "wall-to-wall" function that was used in the past on Facebook. This function showed conversations between two members via the messages that they posted on their respective walls.
When a user asked in 2007, "How do you respond to a message on your wall?” the English language site All Facebook responded by suggesting that they use “wall-to-wall” to keep up with their conversations.
Users discovered that it was enough to click on the "Friendship" tab between one's own profile and that of a friend in order to access and follow these "wall-to-wall" conversations, without the hassle of going back and forth from one wall to another.
Some Internet research about the wall-to-wall era confirmed for us that some Facebook users did not want their "wall-to-wall" conversations to be visible to all or some of their friends. For example, on Yahoo Answers in 2008 a user asked, "How can you hide your face book [sic] wall to wall?” Another user asked in 2009, "How to make my wall conversations private?”
A 2008 Yahoo Answers post explained that "You can hide your wall, by changing your privacy settings to ONLY you can see it." Another 2008 post on a forum dedicated to Facebook questions specified, "If your wall is not visible to someone, then that person will not be given the "wall-to-wall" link under your posts on other people's walls."
This meant that you could hide, from one person in particular or from everyone, all of the "wall-to-wall" statuses and conversations held with another member of Facebook.
In other words, these "wall-to-wall" conversations could be made invisible to a third person, even if one of the two participants were friends with this third person (basically, if your boyfriend or girlfriend at the time was “friends” with your current lover, your boyfriend or girlfriend couldn't see the "wall-to-wall" between you and your lover).
So it was possible to have "wall-to-wall" conversations on Facebook that were entirely or partially private; members consciously used this function, in addition to the messaging function, with the awareness that certain other people couldn't see them.
Despite the jungle of Facebook's privacy settings, we're willing to bet that a large number of users have also been cautious about the visibility of their wall posts from the beginning — for example, everyone who talked about their experiences on Le Monde these past few days.
But in light of all of the screenshots we've seen since Sept. 24, it seems very likely that it is posts of these "wall-to-wall" conversations, including those with visibility that was partially or totally restricted when they were sent, that are now being found on profiles.
Why didn't anyone notice this problem before 2012? Several developments in Facebook's features could have caused it. One possibility is the change of security settings in 2009, which made all statuses public by default — read about on this subject in a rant by the Electronic Frontier Foundation — and which Facebook was forced to withdraw six months later. Another possibility is the move to a new profile template in 2010. Yet another change was the global deployment of the timeline format, which greatly improved the visibility of all posts, classifying them by year in a right-hand column. Because of this, in January 2012, many sites recommended that everyone review the privacy settings on their profile to avoid the visibility of old, embarrassing posts on their own walls, as well as on those of their friends.
We must accept that this whole story was probably not the result of a dramatic change or a technical bug on Facebook that occurred before Sept. 24. Yet we should also consider that the Métro article, just like the outburst which followed, above all sounded an alarm: Everything that you post on Facebook could reappear on the network, which controls the visibility rules for your posts and could change years down the road.
P.S: A big thanks to all of our readers who sent in screenshots and stories; if you have any additional comments or explanations to share with us, we welcome your emails at photoslemonde@gmail.com!