Facebook tracked encrypted usage in Snapchat in secret project, documents show

In a revelation that underscores the depth of competitive rivalry in the tech industry, court documents unearthed from a class action lawsuit between consumers and Meta, Facebook’s parent company, have brought to light a clandestine endeavor dubbed Ghostbusters project. The project, initiated by Facebook in 2016, aimed to intercept and decrypt network traffic between users of Snapchat’s app and its servers, in a bid to gain insights into user behavior and bolster Facebook’s competitive stance against Snapchat.

The newly unsealed court documents, released by a federal court in California, shed light on Meta’s concerted efforts to gain a competitive edge over rivals such as Snapchat, Amazon, and YouTube. At the heart of Ghostbusters project was Meta’s In-App Action Panel (IAPP) program, which employed techniques to intercept and decrypt encrypted app traffic from users of various platforms, including Snapchat, YouTube, and Amazon.

Internal emails exchanged among Facebook executives, including Meta CEO Mark Zuckerberg, reveal the strategic imperative behind the project. Zuckerberg’s email dated June 9, 2016, underscores Meta’s urgency in devising methods to obtain actionable analytics on Snapchat, given its rapid growth trajectory. In response, Facebook’s engineers proposed leveraging Onavo, a VPN-like service acquired by Facebook in 2013, to circumvent encryption barriers and glean valuable insights into user interactions.

The proposed solution involved deploying kits on iOS and Android devices, capable of intercepting traffic for specific subdomains, thereby enabling the extraction of encrypted data for analysis. This approach, akin to a man-in-the-middle attack, raised ethical concerns within Facebook, with some employees questioning the legitimacy of the project. Jay Parikh, Facebook’s then-head of infrastructure engineering, and Pedro Canahuati, the then-head of security engineering, voiced apprehensions regarding the potential privacy implications and ethical ramifications of the initiative.

Despite internal dissent, Facebook proceeded with the project, expanding its scope to encompass other platforms like Amazon and YouTube. The program, however, faced scrutiny and legal challenges, culminating in a class action lawsuit filed against Facebook in 2020 by Sarah Grabert and Maximilian Klein. The lawsuit alleges that Facebook misled users about its data collection practices and exploited extracted data to gain an unfair advantage over competitors.