The most unethical thing I was asked to build while working at Twitter in 2015

&gt; <i>And, for the any employees still at Twitter, don’t underestimate the power of a pocket veto.</i><p>This is something I&#x27;ve been repeating to some of my younger colleagues.<p>Engineers aren&#x27;t really fungible resources, to the extent that these projects require. Ask any manager how easy it is to swap &quot;allocated resources&quot;, and they&#x27;ll probably sigh heavily.<p>People are afraid that if they don&#x27;t follow their manager&#x27;s every request, they will be fired. But remember that hiring is <i>hard</i>, and managers are loath to fire someone they&#x27;ve already spent so much effort finding, hiring, and onboarding. Finding someone else to do it can take weeks, months, or longer! Which in many cases risks killing the project altogether.<p>Even if you&#x27;re at the bottom of the chain, as the person who does the actual <i>implementation</i>, you have a lot of power on what gets prioritized.<p>See also the oft-circulated OSS &quot;Simple Sabotage Field Manual&quot; <a href="http:&#x2F;&#x2F;svn.cacert.org&#x2F;CAcert&#x2F;CAcert_Inc&#x2F;Board&#x2F;oss&#x2F;oss_sabotage.html" rel="nofollow">http:&#x2F;&#x2F;svn.cacert.org&#x2F;CAcert&#x2F;CAcert_Inc&#x2F;Board&#x2F;oss&#x2F;oss_sabota...</a>

“We should know when users leave their house, their commute to work, and everywhere they go throughout the day. Anything less is useless. We get a lot more than that from other tech companies.”<p>This should be posted absolutely everywhere with <i>this</i> as the hook. This type of request and the admittance that <i>companies give even more than that all the time</i> is headline news worthy.

The Tim Hortons mobile app in Canada did this very thing: monitoring your GPS location 24&#x2F;7, and logging special events when you entered a competitor&#x27;s store, like Starbucks.<p><a href="https:&#x2F;&#x2F;www.reuters.com&#x2F;technology&#x2F;investigation-finds-tim-hortons-app-violated-privacy-laws-says-canadian-2022-06-01&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reuters.com&#x2F;technology&#x2F;investigation-finds-tim-h...</a>

&gt; Most people don&#x27;t really appreciate how close Twitter was to shutting down.<p>&gt; Twitter was on its death bed and was desperate for money.<p>I worked at Twitter at the same time, and while the company definitely was going through a rough patch at that time, it was absolutely not anywhere close to &#x27;shutting down&#x27; or &#x27;on its death bed&#x27; financially.

Finally, someone who quit.<p>So many of these stories are from someone who built the thing, profited, left, and then took up a new chapter of their career talking about how everything they did at &lt;BAD COMPANY&gt; was bad and that they should now receive funding, back pats, and NPR airtime for their new &lt;GOOD COMPANY&gt;.<p>My question is always: &quot;So, are you going to give the money back?&quot;<p>There really is a middle ground between just following orders and dedicating your life to sabotaging a company from the inside because someone there once thought about doing something that didn&#x27;t 100% align with your personal mission.<p>You can refuse and you can quit.<p>More people need to read books on engineering ethics.

<a href="https:&#x2F;&#x2F;nitter.net&#x2F;stevekrenzel&#x2F;status&#x2F;1589700721121058817" rel="nofollow">https:&#x2F;&#x2F;nitter.net&#x2F;stevekrenzel&#x2F;status&#x2F;1589700721121058817</a><p>If you&#x27;re not interested in visiting twitter directly.

&gt; …Elon will do far worse things…<p>Non-sequitur. The story is about middle management doing evil things for almost no incentive except a small pat on the back for padding a short-term revenue number, while the actual owner-leader who benefits the most shuts it down.

All individuals are incentivized to do the wrong thing. CEO&#x27;s are incentivized to sell data to make money. Engineers are incentivized to create bad software via making the people who pay them happier. Users are incentivized to give up their data in exchange for a free service. Politicians are incentivized by political donations and getting information they aren&#x27;t constitutionally privileged to get.<p>Doing the ethical thing requires making less money (or losing money) for nearly all parties involved. Doing the right thing requires sacrifice.<p>In a happy world, the CEO has long term vision and sees the long term cost of loss of trust. The engineers see the ethical problem or betraying their peers and use their pocket veto to do the right thing. The user should be willing to pay a reasonable cost to receive the service they use. Politicians should see that the individual incentives harm the whole and create regulations that disincentivize the poor behavior.<p>Non-rhetorically: How do we ensure as a society that we live in the latter, and not the former?

For one story like this which emerges because the engineer refused, how many stories we will never heard about because it was simply done?<p>As software engineers, we are just like medical experts talking about the toxicity of cigarettes while ourselves buying cigarettes and distributing them to our own children.

Good reminder that while Google gets a lot of negative privacy attention it is telcos, ISPs, and lesser-known apps that are the most deplorable actors data collection and selling.

&gt; <i>As far as I know, the project actually got canned. Jack genuinely didn’t like it. I don’t know if this mindset will hold true with the new owner of Twitter though. I would assume Elon will do far worse things with the data.</i><p>yeah, this is a major concern of mine now. while a few months ago i had some minor concerns with elon discussing taking it over, his behavior since this started has elevated those concerns to an absolute red alert level. the kind of data he has access to is terrifying.<p>i’m predicting whatever it is will make the facebook&#x2F;cambridge analytica thing look tame in comparison.

Why does he assume Elon will do far worse with the data? The anti-Elon narrative is pretty dull and so far generally unsubstantiated.

He won the battle (pyrrhic-ly) but not the war. Fine grained location is commonly bought and sold in the USA: <a href="https:&#x2F;&#x2F;www.vice.com&#x2F;en&#x2F;article&#x2F;v7v34a&#x2F;fog-reveal-local-cops-phone-location-data-manual" rel="nofollow">https:&#x2F;&#x2F;www.vice.com&#x2F;en&#x2F;article&#x2F;v7v34a&#x2F;fog-reveal-local-cops...</a>

This really isn&#x27;t a just for <i>Twitter</i>; this is the danger of selling any application with a large install-base. Doesn&#x27;t really matter if it&#x27;s a social network app, borderline-useless mobile app, Facebook App (I&#x27;m looking at you, Cambridge Analytica), chrome extension, or pypi&#x2F;npm module, all of these things are <i>capable</i> of collecting extremely fine-grained user detail, and selling it off.<p>It doesn&#x27;t matter if the current owners don&#x27;t&#x2F;won&#x27;t do it, there is essentially nothing that prevents someone else from buying it up, and doing nefarious things with the existing install base.<p>And as far as &quot;Terms of Service&quot; go, there is essentially nothing to prevent a future owner from updating the Terms of Service, and then doing the above.

Anyone using social media services need to pay attention to this story. When the profit margins shift ever so slightly, or say massively like with the Apple changes, then these companies will take meetings with executives like this Telco who wanted data on when people are going into their competitors stores. Unbelievable, or should I say, totally believable and totally expected.

<a href="https:&#x2F;&#x2F;threadreaderapp.com&#x2F;thread&#x2F;1589700721121058817.html" rel="nofollow">https:&#x2F;&#x2F;threadreaderapp.com&#x2F;thread&#x2F;1589700721121058817.html</a>

&gt; As far as I know, the project actually got canned. Jack genuinely didn’t like it.<p>&gt; I don’t know if this mindset will hold true with the new owner of Twitter though. I would assume Elon will do far worse things with the data.<p>When has Elon been against user privacy? Also, isn&#x27;t Elon good friends with Jack? I feel like they would see eye to eye with this. In fact Elon seems like the type that would try to champion emerging fads like crypto, differential privacy, and zero knowledge proofs. Harvesting data is boring and easy.

&gt; With Twitter&#x27;s _change in ownership_ last week, I&#x27;m probably in the clear to talk about the most unethical thing I was asked to build while working at Twitter.<p>Generally not true&#x2F;safe. Any NDA still in effect would be transferred to the new owner. If the author genuinely believes this, they may want to delete this tweet asap. If it&#x27;s just rhetorical, well ok then.

Very true about the pocket veto, and I&#x27;ve said this to my team before - I can give advice, I can argue for my values, but my lever as a manager is hire or fire. I don&#x27;t have time to do the implementation, and the person doing the implementation realistically is going to decide the inplementation. I can influence, but really, they decide.

&quot;We get a lot more than that from other tech companies.&quot;<p>And hence why almost every app on my phone has location access &#x27;never&#x27; and only the ones that really need it have it &#x27;while using app&#x27;.<p>Of course, I never even got the Twitter app, I&#x27;ve always just used it in Safari on my phone.

&gt; We ran an alternative by the telco. They didn’t like it and were frustrated. So was Sales. I was asked to go to telco’s HQ and figure out exactly what they want.<p>Sales. Sales at Twitter sells user data to Twitter&#x27;s customers [who aren&#x27;t necessarily even advertisers].<p>Got it.

This made me cringe:<p>&gt; Legal said the request was fine – none of it violated the user ToS.<p>Almost as if was watching an episode of some dystopian show happening somewhere in the future. It&#x27;s sad to learn it&#x27;s already happened.

&gt; Twitter, like most mobile apps, logs <i>everything</i> users do – every swipe, tap, edit, delay, etc… – for debugging, metrics, and experiments.<p>Maybe other things too

The worst part of these types of stories is every time I tell my non-tech friends and family about this stuff, the vast majority respond with: “so what?” They genuinely do not care about their own privacy from companies. Then they bash Facebook or who ever else is in the news most recently about misusing data and can’t connect the dots. It really feels like a losing battle of trying to save people from themselves. :(

Intriguing:<p>&gt; I wound up meeting with a Director who came in huffing and puffing.<p>&gt; The Director said “We should know when users leave their house, their commute to work, and everywhere they go throughout the day. Anything less is useless. <i>We get a lot more than that from other tech companies.”</i><p>If they have so much data on us, why is the ad targeting so laughably bad? Facebook has recently been pushing me to watch Hocus Pocus 2. -_-

There are tons of data brokers that get near real time user level location data from mobile apps (usually not from ‘name brand’ apps but from the long tail) and then sell this as aggregated data products to others: eg <a href="https:&#x2F;&#x2F;docs.safegraph.com&#x2F;docs&#x2F;monthly-patterns" rel="nofollow">https:&#x2F;&#x2F;docs.safegraph.com&#x2F;docs&#x2F;monthly-patterns</a> .

&gt; <i>One of the first areas I worked on was improving the way our mobile apps uploaded logs. Twitter, like most mobile apps, logs </i>everything* users do – every swipe, tap, edit, delay, etc… – for debugging, metrics, and experiments.*<p>A reminder: use the mobile web version of any services you use, not the app, and use NextDNS to block all the tracker hosts at DNS level.

<i>&gt; And, for the any employees still at Twitter, don’t underestimate the power of a pocket veto.</i><p>Here&#x27;s a comment I made a month ago, or so: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=33001139" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=33001139</a><p>I was asked to do an unethical thing, just after being promoted.<p>I declined, but everything turned out OK.

I think this post buried the lead a little bit.<p>&quot;All other social media companies give us more than is&quot;<p>An app logging signal strength can pin point your location, which is then commonly sold to companies such as telcos as alleged in this story.<p>Owning a phone without GPS turned on, any app can track and sell your every movement without violation of any T&amp;C or local laws.<p>That is beyond distressing.

This is just one reason why I <i>always</i> prefer to use the website rather than an app.<p>If I use the website I&#x27;m browsing on my terms: adblocking enabled, no location data, a lot less surface area for tracking.<p>When you use the app then you&#x27;re browsing on their terms: geolocation, tracking, ads, everything.

I&#x27;m confused by the bit that says it&#x27;s ok now??? If an NDA applied before the buyout it still applies, so why mention it now? Attention? Confusion about how employee contracts and NDAs apply? Not entirely true?<p>Can&#x27;t figure out which from the thread

I also assume that Elon and his backers will do far worse things with Twitter users&#x27; data.

It&#x27;s not explicitly said so I gota ask: it&#x27;s illegal (in the U.S.) right?

I don&#x27;t know what&#x27;s more disturbing. The request, Legal&#x27;s response, or the people responding to the thread and finding none of this is unethical.<p>Seems like we have lost something along the way.

What would a Telco do to me with such data? Anything that I would care about?

The author was asked to work on several unethical projects while at Twitter. As stated in the title, this is only &quot;the most&quot; unethical one. Did he refuse to fulfil the other requests.

I wonder how many stories like this are waiting to come out from the 2010s, the era that turned the internet into a centralized hellscape that ran on ads and creepy data collection.

This revelation just shows that doing the right thing depends on the accidental and rare &quot;good guy&quot; to hold their foot down. It&#x27;s not something we can rely on.<p>The Elon Musk burn in that sense is distracting. He hasn&#x27;t done anything in this direction yet. He very well may, but he hasn&#x27;t. So it&#x27;s a false accusation&#x2F;speculation.<p>Counter to that, there is the <i>fact</i> that Twitter&#x27;s legal and sales departments (pre-Musk) were totally cool with sending fine-grained location data to whoever pays for it.<p>Controversy should focus on actual events, not imaginary ones. As such, old Twitter has some explaining to do and it&#x27;s worrying that no actual Telco is named. Finally, a quote like &quot;other tech companies give us far more&quot; should launch a swarm of journalists to dig as deep as possible.

&gt; I wound up meeting with a Director who came in huffing and puffing. &gt; The Director said “We should know when users leave their house, their commute to work, and everywhere they go throughout the day. Anything less is useless. We get a lot more than that from other tech companies.”<p>First thing today I did, was uninstalling the Twitter app. Even if it&#x27;s not in (who knows). Totally forgot about the big apps deals with the global spying business.

This reminded me to uninstall the Twitter app, just in case they build in new shenanigans like these now.

How can I protect against this while still using Twitter?<p>Use a VPN? Don’t give Twitter access to location?

Genuinely curious. Why and how would Twitter have access to all this customer data?

This feels like a fluff piece.

&gt; We get a lot more than that from other tech companies<p>This is why I don&#x27;t install apps

This take of &quot;Elon will do a lot worse things with the data&quot; is my own personal take on WHY Musk bought Twitter.<p>He&#x27;s of a libertarian bent, so it could well be a real part of the story that he wants more free speech, and less censorship of similar folks.<p>However, I do believe he is playing that up to try and avoid any discussion of the monumental tranche of data he is sitting on top of and the potential value of it. I recall in the early days, the entire Twitter database was made available to researchers, who found they could predict overall market movement (up, down, some basic idea how much) about 3 days ahead of time by looking at sentiment trends.<p>All of that is worth &quot;Take over the World&quot; kind of money, where as the free speech stuff is, well. Worth percentage points at best.

&gt; I would assume Elon will do far worse things with the data.<p>I notice here the casual dismissal of actual, observed harm for the sake of fantasies of future harm. I wish that the similar casual dismissal of government censorship laundered through private media monopolies came with some similar sort of fear of how President Trump or President DeSantis will handle their brand-new tools in a couple of years.<p>That being said, Democrats saw what Bush did with his unchecked executive powers, and didn&#x27;t roll a thing back when they later had the Presidency and both houses of Congress. Instead, they continued doing politics by executive order, and cemented AUMF as a declaration of a permanent state of emergency.

Makes me wonder how much “dump trucks” of money is.

Sounds like a good story for Darknet Diaries....

For as much shit as GDPR gets (sometimes rightfully so), I&#x27;m really glad there is at least some data protection in the EU. The free-for-all that is hiding stuff in the TOS is atrocious and terrifying. Twitter and Facebook being each in control of one person at the top, each with &quot;eccentric&quot; tendencies, makes this situation really dystopian.

This is a perfect example of why EU implemented GDPR. We can&#x27;t trust companies to protect their users. Once money is involved, the outcome often depends on a few conscientious employees with the strength to say &quot;NO&quot;<p>Som may say that

&gt; Most people don&#x27;t really appreciate how close Twitter was to shutting down. The 2016 election was the only thing that saved them and made them relevant again<p>So in the Good Timeline there&#x27;s no Twitter _and_ no President Trump?

What scares me is that Elon Musk has now technically access to all the logs and even to the DMs.

&gt; I don’t know if this mindset will hold true with the new owner of Twitter though. I would assume Elon will do far worse things with the data.<p>The story is interesting, but this line is petty. It&#x27;s also more than a bit ironic, given that the OP just spent N tweets describing how the <i>previous</i> management wasn&#x27;t exactly setting high ethical bars.<p>The worst aspect of &quot;Twitter culture&quot; is the tendency -- illustrated here, perfectly -- to slander people, just to make the mob shake their pitchforks harder.<p>I sincerely hope Musk finds a way to fix that.

I&#x27;m not Musk fanboy, but the leap in the end to put the dirt on him is outrageous (&quot;I don’t know if this mindset will hold true with the new owner of Twitter though. I would assume Elon will do far worse things with the data.&quot;).<p>Let me try to summarize what author actually said in the end: &quot;I left, I sent email to then CEO of twitter and PER MY KNOWLEDGE the project was canned, I don&#x27;t know if it actually was. But new guy still could do worse things&quot;.<p>If you&#x27;re so moral, why not blow whistle to public when you left previously, and not write unsubstantiated claims about new owner now.