Incident: Snapchat and Facebook Poke Videos Not Vanishing as Advertised

Published Date: 2012-12-28

Postmortem Analysis
Timeline 1. The software failure incident with Snapchat and Facebook's Poke apps occurred in December 2012 as per the article published on December 28, 2012 [55192].
System 1. Snapchat and Poke apps [55192]
Responsible Organization 1. Snapchat 2. Facebook [CNET]
Impacted Organization 1. Users of Snapchat and Facebook's Poke apps were impacted by the software failure incident [55192].
Software Causes 1. The software cause of the failure incident was a bug in the Snapchat and Facebook Poke apps that allowed videos to be retrieved from a hidden spot even after users believed they had vanished [55192].
Non-software Causes 1. Lack of proper data security measures in place for Snapchat and Facebook's Poke apps [55192].
Impacts 1. The software failure incident allowed users to retrieve supposedly vanished videos from Snapchat and Poke, potentially leading to privacy breaches and embarrassment [55192].
Preventions 1. Implementing thorough security testing during the development phase to identify and address vulnerabilities that could lead to unauthorized access to stored data [55192]. 2. Regularly conducting penetration testing to proactively identify and mitigate potential security weaknesses in the application [55192]. 3. Enforcing strict data encryption protocols to protect sensitive user data stored locally on devices [55192]. 4. Providing timely software updates and patches to address any identified bugs or security loopholes [55192].
Fixes 1. Implementing a fix for the bug that allows videos to be retrieved from a hidden spot even after users think they're gone for good [55192].
References 1. Blog site BuzzFeed FWD [55192]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to Snapchat and Poke videos not disappearing as intended has happened again within the same organization. The incident involved a bug where videos could be retrieved from a hidden spot even after users believed they had vanished [55192]. The founder of Snapchat, Evan Spiegel, acknowledged the issue and mentioned plans to fix it, emphasizing the importance of users embracing the spirit and intent of the service despite potential loopholes in the technology [55192]. (b) There is no information in the provided article about a similar incident happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in the articles is related to the design phase. The issue with Snapchat and Poke apps allowing videos to be retrieved even after they are supposed to vanish is a result of a design flaw in the apps. The articles mention that the videos can be accessed by navigating to the phone's internal storage and finding the folders where the videos are stored locally, indicating a design oversight in how the disappearing feature was implemented [55192]. (b) The software failure incident is also related to the operation phase. The failure occurred due to contributing factors introduced by the operation or misuse of the system. Users were able to exploit a loophole in the operation of the Snapchat and Poke apps by copying videos from the phone to a computer to view them, which goes against the intended operation of the disappearing feature [55192].
Boundary (Internal/External) within_system (a) The software failure incident described in the article is within_system. The issue with Snapchat and Poke apps allowing videos to be retrieved from a hidden spot even after users believe they have vanished originates from within the system itself. Users can access the videos by navigating to the phone's internal storage and finding the folders where the videos are stored locally [55192].
Nature (Human/Non-human) non-human_actions (a) The software failure incident in this case is related to non-human actions. The issue with Snapchat and Facebook's Poke apps allowing videos to be retrieved from a hidden spot even after users believe they have vanished is a result of a bug in the apps' design. This bug allows the videos to be stored locally on the device, making them accessible through certain methods like plugging the smartphone into a computer and navigating to the phone's internal storage [55192]. The failure is not directly caused by human actions but rather by a flaw in the software's functionality. (b) The software failure incident is not directly related to human actions. While human actions, such as sending compromising videos through the apps, are mentioned in the context of the potential risks associated with the bug, the root cause of the failure lies in the design and functionality of the Snapchat and Poke apps themselves. The statement from Facebook acknowledges that there are ways people can potentially save Pokes, but it emphasizes that the apps are not designed to be a secure messaging system [55192]. The issue is attributed to a loophole in the software rather than specific human actions.
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The article mentions that the Snapchat and Poke videos, which were supposed to disappear after a few seconds, could be retrieved from a hidden spot by plugging the smartphone into a computer and accessing the phone's internal storage [55192]. (b) The software failure incident related to software: - The article highlights that the Snapchat app for Android was saving versions of unwatched videos in the media gallery on Android phones, indicating a software bug [55192].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident described in the article is non-malicious. The issue with Snapchat and Facebook's Poke apps allowing videos to be retrieved even after they are supposed to vanish is not due to malicious intent but rather a flaw in the design and implementation of the apps. The article mentions that the videos can be accessed by users through certain methods, such as plugging the smartphone into a computer and navigating to the phone's internal storage [55192]. Additionally, the article includes statements from Facebook and Snapchat acknowledging the loophole and indicating plans to fix it, emphasizing the importance of users being cautious about what they share [55192].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was related to poor_decisions. The incident occurred because the Snapchat and Facebook's Poke apps were designed to allow users to share photos and videos that would vanish after a few seconds. However, a bug was discovered where the videos could be retrieved from a hidden spot even after users believed they had disappeared. This flaw in the design led to a breach of user privacy and security, indicating a poor decision in implementing the disappearing feature [55192].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the Snapchat and Poke apps as reported in Article 55192. The article highlights a bug where videos shared through these apps can be retrieved from a hidden spot even after users believe they have vanished. This flaw allows users to access potentially embarrassing or compromising videos that were supposed to disappear after a few seconds. The fact that this bug was discovered and exploited indicates a lack of professional competence in ensuring the intended functionality of the apps [55192]. (b) The accidental aspect of the software failure incident is also present in the same article. The article mentions that the Snapchat app for Android was found to save versions of unwatched videos in the media gallery on Android phones. This unintended behavior was identified as a bug, and a fix for it was released to address the issue. The accidental nature of this flaw is evident in the need for a subsequent update to rectify the unintended saving of videos on Android devices [55192].
Duration temporary (a) The software failure incident described in the articles is more of a temporary nature. The issue with Snapchat and Facebook's Poke apps allowing videos to be retrieved even after they were supposed to vanish is a specific bug that can be exploited under certain circumstances, such as plugging the smartphone into a computer and accessing the hidden folders where the videos are stored locally [55192]. The companies involved, Snapchat and Facebook, are aware of the problem and are working on fixes to address this specific loophole in the functionality of their apps.
Behaviour omission, other (a) crash: The software failure incident described in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. The issue is related to the videos not being deleted as expected, allowing users to retrieve them even after they are supposed to have vanished [55192]. (b) omission: The software failure incident can be categorized under omission, as the system omits to perform its intended function of deleting videos after a specified time period. Users found that the videos could still be retrieved from a hidden spot even after they were supposed to have disappeared [55192]. (c) timing: The software failure incident is not related to timing, where the system performs its intended functions but at the wrong time. Instead, the issue lies in the system failing to delete videos as expected [55192]. (d) value: The software failure incident does not involve the system performing its intended functions incorrectly in terms of the content or value. The problem is specifically related to the failure to delete videos as promised by the app's design [55192]. (e) byzantine: The software failure incident does not exhibit characteristics of a byzantine failure, which involves inconsistent responses and interactions within a distributed system. The issue described in the articles is more straightforward, focusing on the failure to properly delete videos as intended [55192]. (f) other: The behavior of the software failure incident can be categorized as an integrity failure. The system's integrity is compromised as it fails to maintain the expected behavior of deleting videos after a specified time, leading to potential privacy and security concerns for users [55192].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: There is no mention of any deaths resulting from the software failure incident in the provided article [55192]. (b) harm: The article does not mention any physical harm caused to individuals due to the software failure incident [55192]. (c) basic: The incident did not impact people's access to food or shelter [55192]. (d) property: The software failure incident did not result in any direct impact on people's material goods, money, or data [55192]. (e) delay: There is no indication of any activities being postponed as a result of the software failure incident [55192]. (f) non-human: The software failure incident primarily affected the functionality of the Snapchat and Poke apps, with the potential for compromising videos to be retrieved, but there is no mention of non-human entities being impacted [55192]. (g) no_consequence: The article does not mention any observed consequences resulting from the software failure incident [55192]. (h) theoretical_consequence: The article discusses potential consequences of compromising videos being retrieved due to the software failure incident, such as privacy concerns and the need for users to be cautious about what they share, but these consequences are not explicitly stated to have occurred [55192]. (i) other: The article does not mention any other specific consequences of the software failure incident beyond the potential privacy implications and the need for caution in sharing content on the apps [55192].
Domain information (a) The software failure incident reported in the articles is related to the industry of information. The incident involves Snapchat and Facebook's Poke apps, which are designed for sharing photos and videos with socially networked friends. These apps are intended for brief sharing, with the appeal being that the shared content vanishes after a short period, typically up to 10 seconds. However, a bug in the system allowed videos to be retrieved from a hidden spot even after users believed they had disappeared [Article 55192].

Sources

Back to List