[harianus]

They need to change their business model to be able to become privacy friendly, I totally agree. Not even sure which huge company is privacy friendly. Maybe it's not even possible at that level. But that doesn't mean you shouldn't.

I will try to ask as much as possible, and really like your questions of what data points are useful and are they privacy sensitive.

Thanks!

[mehrdadn]

Can I ask you to ask a question that's not about their apps?

"I understand many if not all of your employees, and even your interns, are technically capable of accessing at least some data from any user, should they decide to do so against Facebook's will. I also understand the repercussion for this is that they would get fired and potentially sued. However, this is not accepted practice in every company that handle such sensitive data on users' personal lives. Moreover, it is easy to imagine adversaries and targets for which the risk of getting fired and/or sued is easily worth the benefit of obtaining a particular user's private data. How, then, do your security experts, who take security seriously and who surely understand the notion of 'defense in depth', justify that the proper safeguard is an employment/legal threat, and that there should not be a technical barrier preventing interns or other normal employees from accessing any user data?"

Bonus points if you can get them to talk such occurrences, which they almost certainly won't tell you, and why users should trust that they're handling this properly when they're unwilling to report sufficiently precise information on such incidents.

[rock_hard]

I might highlight that there is significant internal technical barriers to access user data!

And it would be very, very hard to circumvent the protection mechanisms without getting caught!

[mehrdadn]

> there is significant internal technical barriers to access user data

Is this a new thing or has it always been the case? Because I'm pretty sure I've heard otherwise before. (Unless by "technical barrier" you don't mean the same thing I do.)

Also what do you mean by "very hard without getting caught"? Is it like hacking their database from the outside/open internet? Or is it like "they can, but it'll trip fifty alarms" [but they'd still get the data].

[rock_hard]

1. It’s been in place for a long time now...at least since IPO

2. Yes, it’s like hacking the database from the outside in most cases in others it trips alarms and starts an investigation. It all data is created equal here...but generally speaking PII data is highly guarded