Are All Social Media Sites Vulnerable to Profile Scrapers?

April 6, 2018 – Profile scraping technology has existed for some time. In a previous posting about social media’s vulnerability to data mining tools, I described how useful the technology is in taking old software running on mainframes and transferring the substance, look and feel to client-server environments.

And when I use a Google Agent or write my own web-crawling algorithm to help discover new scientific announcements or interesting technology breakthroughs, in effect, I am doing subject-specific screen scraping based on keywords that allow me to index web content and drop it into my email inbox.

These current practices I call good bots. And my past use of screen scraping predates the arrival of bots and so, for want of a better definition, it too can be called a good bot.

The problem is not the technology itself. When used to redesign a proprietary application, or to do good research, it is a powerful tool. But when used for nefarious purposes, screen scraping algorithms become bad bots. And there’s a history of bad bots in the Facebook world that goes back to as early as 2009

Back in 2009, just five years after Facebook debuted, the social network filed a lawsuit for copyright violations against a screen scraper startup operation that was accused of hacking the profiles of users. In 2017 LinkedIn, the business social network, sued a San Francisco startup because it was scraping public profiles from its social networking site, aggregating the data, and selling it to third parties. The LinkedIn lawsuit remains before the courts as of yet unsettled.

Can legislation stop such practices from reoccurring? The United States Congress has enacted laws to protect data but in a number of court cases have looked at the public nature of social networks and the data on them, and questioned copyright and proprietary rights over the information. So this remains a grey area.

In the latest Facebook revelation and admission, 87 million users of the social network had their data accessed by Cambridge Analytica and its minions. Considering the more than 2.2 billion Facebook users, we are talking about a mere 4% of the network. But it is the subsequent revelation by Facebook CTO Mike Schroepfer that is more concerning. In an April 4, 2018 release he states that Cambridge Analytica was not alone in mining Facebook personal data and goes on to describe the many security weaknesses of the application. These include the events, groups, and pages API, the login, the search and account recovery, call and text history, app controls, and third-party partner rights of access. In fact, with all these deficiencies that in the past may have made Facebook open and accessible, the social network is in danger of exposing all of its users, all 2.2 billion, to having their posted and shared information grabbed without their knowledge.

Facebook has named the Russian Internet Research Agency (IRA), and Instagram, representing 70 and 65 accounts respectively, as two who have been kicked off the social network. But certainly, there are more third parties that still have access and can still take advantage of the many deficiencies that have been brought to light.

LinkedIn, the social network previously mentioned in this posting is a social network focused on business-t0-business. In comparison to Facebook, it has over 500 million users, less than a quarter of the number. Most LinkedIn users post their profiles and resumes on the site for free. LinkedIn also has paid subscribers and offers a range of paid for services to link job providers and recruiters with job seekers. LinkedIn makes no bones about its business-to-business purpose. That’s one of the reasons Microsoft purchased it for $26.2 billion in 2017.

But LinkedIn is just as susceptible to hackers as Facebook from screen scraping bad bots who continue to thrive because legislators and courts cannot seem to shut them down.

So in answer to the title of this article, I would say that as long as we continue to use social network applications largely for free, and are willing to share our profiles, work history, education, phone numbers, vacation pictures, likes and dislikes, group affiliations, and more, all of that data is open to the world to be exploited and sold. If Microsoft is the buyer, maybe the data gets used in an ethical way. But if it is the IRA or another nefarious organization, maybe our data is being used for purposes we would never have expected.

Here are two questions to ask yourself:

Would you pay for a social network account knowing that your data is secure?

Or is the only reason you use social networking because it is free?

I wonder how quickly the more than 2.2 billion current users of Facebook would melt away if the social network charged an annual subscription of $50 to $100.

The LinkedIn business model includes paid subscribers as well as freebies. The paying ones (I’m not one of them), the paid-for services, and advertising on the site make LinkedIn a viable business, certainly attractive enough to have Microsoft purchase the network. Does that mean there is a future in not free social networks?