Facebook took the opportunity this week at F8 to tout its work on “data for good.” At first glance, its Disaster Maps seem like a rare positive application of Facebook’s extraordinarily detailed and Orwellian realtime archive of the global physical location and movements of its two billion users as they go about their daily lives. Yet, as governments become accustomed to turning to Facebook to map their citizens and understand their spatial patterns of life, troubling questions are raised about whether Facebook may become ever more the ultimate surveillance platform for governments across the world.
Facebook’s Disaster Maps represent a rare “feel good” application of its immense global surveillance empire, allowing governments to rapidly triage the civilian impact of a major disaster. Understanding where the remaining population in the aftermath of a disaster is situated and their likely patterns of movement are crucial to helping get the public out of harms way and provide necessary assistance. In particular, understanding the surrounding locations where people in the affected area are most likely to seek refuge, such as the homes of family and friends in nearby towns, can help authorities preposition response teams, while visualizing the outflow of civilians from a disaster zone and seeing where they are seeking shelter in realtime is a dream of disaster responders.
Mobile phone CDR records have proven immensely valuable in tracking population dispersal after natural disasters. However, unlike CDR records, which must typically be acquired in piecemeal fashion from multiple providers across every country of interest, Facebook is able to track the realtime location of its users globally in a single centralized database regardless of their cellular provider and even as they travel throughout the world. Facebook’s global presence also means it is far more exposed to legal requests from foreign nations.
As governments increasingly rely upon population-scale displacement maps like Facebook’s to assist with disaster response, they will inevitably wish to deploy similar mapping to other kinds of emergencies, such as protests and eventually simply to map their populations in peacetime.
When a protest breaks out in downtown, chances are that most of those protesters are carrying their cellphones with them, posting photos and video to Facebook. In turn, Facebook has a realtime database of the actual names and identities of each person participating in that protest. The company’s facial recognition models can extend that identification process even further, by tying surveillance camera footage back to the identities of those careful enough not to carry their phones with them.
Under the laws of many countries, all it would take is a simple court order to force Facebook to turn over a list of every person who attended that protest and their actual realtime movements throughout the protest, along with the addresses of the friends, family and fellow protesters they visited and roomed with that evening.
Of course, Facebook doesn’t just have the realtime physical location of its users, it has perhaps the world’s richest behavioral archive of their interests and communications, meaning it can tie interests to locations.
A repressive government concerned about democracy activists could request that Facebook provide it a realtime map of all citizens its algorithms believe may be interested in democracy-related topics, including a heatmap of the most common places they frequent and the homes of family and friends they spend time at. They could even require Facebook to compile a list of every person the activists have physically met with simply by looking at what phones have appeared in close proximity to theirs in the context of what appears to be a meeting.
Similarly, a country in which being LGBT is illegal could not only require Facebook to compile a list of names and addresses of everyone in the country its algorithms believe are LGBT, but it could couple that information with those individuals’ physical movements to identify social venues and private residences most frequented by LGBT individuals as well as the identities of those they interact most commonly with in private, even if they are not connected to those individuals online.
Unsurprisingly, the company did not respond when asked whether it has ever received a governmental request to map political events like protests, riots, coups and other social disturbances or whether it had ever been asked by a government to map the location of individuals matching certain advertising or behavioral selectors like being LGBT. The company also did not respond when asked what safeguards it had in place to attempt to prevent a government from using a lawful court order to forcibly compel Facebook to generate such non-disaster maps, especially of vulnerable populations in nations where their status could place them at great risk of physical harm or even death.
Of course, there is little Facebook can do to resist a lawful court order once it has demonstrated that it has the ability to construct population maps on demand for governmental use. Few courts would have required Facebook to build a national surveillance platform from scratch, but now that Facebook has demonstrated all of the necessary technology in its Disaster Maps, the company is but one court order away from deploying Protest Maps, Democracy Activist Maps, LGBT Citizen Maps and the like.
No technology is immune from being repurposed for evil. Yet, subtle technological considerations can make it more difficult for governments to abuse technologies for surveillance purposes.
Apple offers a perfect example of the kinds of safeguards a company can build into its products to dissuade governmental surveillance.
In contrast, Facebook’s unwillingness to talk about government misuse of its Disaster Maps and whether it even considered technological safeguards to mitigate such misappropriation of user data suggests the company did not consider it a defining design principle.
After all, why would it care about governments tracking their citizens when it itself would not deny using the same data to track journalists publishing unflattering stories about itself using insider sources or policymakers proposing legislation that might threaten its business models.
Putting this all together, Facebook’s Disaster Maps are at first glance a welcome societal good application of the company’s vast Orwellian archives of our daily physical movements. The reality, however, is that it is almost inevitable that governments will repurpose this platform into a realtime surveillance platform to monitor everything from lawful protests to democracy activists to minority groups.
Of course, the more cynical privacy advocates might ask whether this was the company’s intent all along, to create a feel-good platform that could offer substantial national security benefits to governments as those governments are increasingly considering greater regulation of the company. Perhaps if lawmakers see Facebook as a useful security partner they might be more willing to tolerate its grip over the informational landscape
All Rights reserved for Forbes