Incident: Facebook Privacy Bug Exposed 14 Million Users' Posts Publicly

Published Date: 2018-06-07

Postmortem Analysis
Timeline 1. The software failure incident of the Facebook privacy bug affecting 14 million users occurred between May 18 and May 22, 2018 as reported in [Article 72691] and [Article 72675].
System 1. Facebook's post sharing feature system [72691, 72675]
Responsible Organization 1. Facebook [72691, 72675]
Impacted Organization 1. Facebook users [Article 72691, Article 72675]
Software Causes 1. The software bug in Facebook's system that automatically suggested posting publicly when users were creating their posts, affecting 14 million users [72691, 72675].
Non-software Causes 1. The failure incident was caused by a software bug that automatically suggested posting publicly when users were creating their Facebook posts, leading to unintended sharing of private information [72691, 72675]. 2. The bug occurred while Facebook was testing a new feature, indicating a potential issue with the testing process or implementation [72675]. 3. The glitch was active between 18 and 22 May, but it took the site until 27 May to switch posts back to private, suggesting a delay in identifying and resolving the issue [72691]. 4. The incident was exacerbated by the fact that affected users may not have noticed the setting change, leading to unintended public sharing of posts [72691].
Impacts 1. The software bug on Facebook affected approximately 14 million users, causing their default sharing setting for all new posts to be set to public without their knowledge [72691, 72675]. 2. Users may have unknowingly posted private information to the public during the period of the glitch, potentially sharing content that was not intended for a wider audience [72691]. 3. The incident led to a breach of user privacy and raised concerns over data security and the handling of personal information on the platform [72691]. 4. Facebook had to notify the affected users about the bug and prompt them to review their posts made during the glitch period to ensure they were shared as intended [72691, 72675]. 5. The software failure incident added to Facebook's existing privacy concerns and controversies, contributing to the company's ongoing challenges in maintaining user trust and data protection [72691].
Preventions 1. Regular and thorough testing of new features before deploying them to production could have potentially caught the bug that caused the default sharing setting to be set to public for 14 million Facebook users [72675]. 2. Implementing stricter code review processes to catch any potential issues related to privacy settings or user data handling could have helped prevent such a bug from going unnoticed [72691]. 3. Conducting more extensive quality assurance checks on changes made to the platform, especially those related to user privacy settings, could have identified the bug before it affected millions of users [72675].
Fixes 1. Implement thorough testing procedures before rolling out new features to catch bugs before they affect users [72675]. 2. Enhance monitoring systems to quickly detect and address software bugs once they are identified [72691]. 3. Improve the software development process to prevent similar bugs from occurring in the future [72691]. 4. Enhance user notification systems to promptly inform affected users of any software failures and provide guidance on how to address the issue [72675].
References 1. Facebook's head of privacy, Erin Egan [Article 72691] 2. Facebook spokesperson [Article 72675]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to Facebook's privacy bug affecting 14 million users is an example of a similar incident happening again within the same organization. This incident is another embarrassing slip-up for Facebook, which has been facing heavy criticism over privacy concerns [72691]. (b) The incident of a software bug causing privacy issues for users is not unique to Facebook. Similar incidents have happened at other organizations as well. This incident serves as a reminder of the importance of privacy and data protection in the digital age [72675].
Phase (Design/Operation) design, operation (a) The software failure incident in the Facebook privacy bug affecting 14 million users was due to a design issue. The bug occurred while Facebook was testing a new feature, and during this testing phase, the default sharing setting for all new posts was set to public for about 14 million users from May 18 to May 22 [Article 72675]. (b) The software failure incident was also influenced by operation factors as users may not have noticed the setting change that set their posts to public instead of their intended private settings. This operation-related issue led to users unknowingly posting private information to the public [Article 72691].
Boundary (Internal/External) within_system (a) The software failure incident reported in the news articles is categorized as within_system. The incident was caused by a software bug within Facebook's system that automatically suggested posting publicly when users were creating their Facebook posts, leading to private information being shared with a wider audience without the users' intention [72691, 72675]. The glitch originated from within Facebook's system and affected the default sharing settings for posts, impacting approximately 14 million users between May 18 and May 22.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in this case was due to non-human_actions. The incident was caused by a software bug that automatically suggested posting publicly on Facebook when some users were creating their posts, even if they had previously chosen a more restricted audience setting. This bug led to approximately 14 million users unknowingly sharing private information publicly between May 18 and May 22. Facebook employees discovered the bug during testing of a new feature, and the company took five days to change the privacy settings for all posts shared by the affected users during that time period [Article 72691, Article 72675]. (b) The software failure incident was not directly caused by human actions but rather by a software bug that automatically changed the default sharing setting for new posts to public for approximately 14 million Facebook users. However, human actions were involved in the sense that users could have manually switched the setting themselves if they noticed the change. Facebook's chief privacy officer, Erin Egan, mentioned that the bug did not impact anything people had posted before, and users could still choose their audience just as they always have [Article 72675].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles was not due to hardware issues but rather a software bug. The bug in Facebook's software caused the default sharing setting for new posts to be set to public for about 14 million users between May 18 and May 22 [72691, 72675]. This indicates that the failure originated in the software itself, specifically a bug that automatically suggested posting publicly when users were creating their Facebook posts. (b) The software failure incident was attributed to a software bug in Facebook's system, which automatically set users' posts to be shared publicly even if they had previously chosen a more restricted audience setting [72691, 72675]. This bug originated in the software code that handled the default sharing settings for posts, leading to unintended public sharing of users' content.
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident related to the Facebook privacy bug affecting 14 million users was non-malicious. The incident was caused by a software bug that automatically suggested posting publicly when users were creating their Facebook posts, leading to private information being shared with a wider audience unintentionally. Facebook's chief privacy officer, Erin Egan, mentioned that it was a mistake and that the bug did not impact anything people had posted before, indicating that there was no malicious intent behind the failure [72691, 72675].
Intent (Poor/Accidental Decisions) accidental_decisions (a) The intent of the software failure incident was accidental_decisions. The incident was caused by a software bug that automatically suggested posting publicly when users were creating their Facebook posts, even if they had previously chosen a more restricted audience setting. This unintended behavior led to approximately 14 million users unknowingly sharing private information publicly [72691, 72675].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the Facebook privacy bug incident. The glitch that set users' posts to be shared publicly, affecting 14 million users, was due to a software bug introduced during the development process. This bug automatically suggested posting publicly when users were creating their Facebook posts, overriding their previous privacy settings without their knowledge [72691, 72675]. (b) The software failure incident also had elements of accidental factors. The bug that caused users' posts to be shared publicly was not intentional but occurred accidentally during a period when Facebook was testing a new feature. The bug affected users from May 18 to May 22, and Facebook employees discovered it after the fact, leading to corrective actions to change the privacy settings for affected posts [72675].
Duration temporary The software failure incident reported in the news articles was temporary. The incident lasted for a specific duration from May 18 to May 22, affecting about 14 million Facebook users during that time period. Facebook employees discovered the bug and took five days to change the privacy settings for all posts shared by those users during the affected period [Article 72675]. The glitch was active between May 18 and May 22, and Facebook took until May 27 to switch posts back to private or to their previous settings [Article 72691].
Behaviour other (a) crash: The software failure incident reported in the articles does not involve a crash where the system loses state and does not perform any of its intended functions [72691, 72675]. (b) omission: The software failure incident does not involve omission where the system omits to perform its intended functions at an instance(s) [72691, 72675]. (c) timing: The software failure incident does not involve timing issues where the system performs its intended functions correctly but too late or too early [72691, 72675]. (d) value: The software failure incident does not involve the system performing its intended functions incorrectly [72691, 72675]. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions [72691, 72675]. (f) other: The behavior of the software failure incident is related to a bug that automatically suggested posting publicly when some people were creating their Facebook posts, even if they had previously chosen a more restricted option. This behavior led to private information being unknowingly posted to the public, affecting 14 million users [72691, 72675].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident on Facebook resulted in a bug that set the default sharing setting for all new posts to public for about 14 million users between May 18 and May 22. This meant that users may have unknowingly posted private information to the public, potentially impacting their data privacy and security [Article 72691, Article 72675].
Domain information (a) The software failure incident reported in the news articles is related to the information industry, specifically affecting Facebook users who unknowingly posted private information to the public due to a software bug [Article 72691, Article 72675].

Sources

Back to List