Big Data, Plainly Spoken (aka Numbers Rule Your World)

7 Principles of Responsible Data Collection

For my third post about the Facebook data scandal, I’m proposing solutions.

Following from my last post about the paradox of data collection, I urge that we don’t throw the baby out with the bathwater. Data collection and analyses can be beneficial to Facebook users. But we also know that the same datasets can be used to advance business goals at the expense of user interests. So solutions have to balance the two sides.

If the data collection is solely or mostly for the users’ benefits, as businesses assert, then it can be conducted in the open, and amenable to all parties.

In the face of the Facebook scandal, it’s time the industry adopted the following principles of responsible data collection:

1 - Opt Ins not Opt Outs

Currently, for most websites and mobile apps, the default is maximum data collection. Users wanting privacy then figure out how to limit the amount or type of data collected about them. This is an example of opt-out. The default should instead be opt-in: no data collection unless instructed by users.

When the default setting is opt-in, businesses have to win over the users’ trust, and so they will have a much stronger incentive to clarify and explain the benefits of the data collection. Say goodbye to the days of hand-waving claims, coercion and trickery.

Some website or app developers argue that they require certain data to better the user experience. For example, if you are searching for a local restaurant, the search engine can provide more relevant results if it knows your current location. However, the app or website developer will keep track of your location, possibly forever, and possibly for sale to third parties, and so some users may elect to suffer inconvenience to gain privacy. For these users, a few more clicks to zoom in to the right neighborhood is not a major hassle. They feel that the more private, less convenient experience is better than the less private, more convenient experience!

2 - First-person not second- or third-person permission

When you create a new Facebook account, you are asked if you’d like to upload a contact list. If you choose not to, Facebook will still have lots of suggested friends for you. How does Facebook know who you know? One source of data is your friends. If your friends agree to upload their contact lists to Facebook, and your name or email or phone number happens to be on those lists, then by a reverse lookup, Facebook knows who your friends are. Such predictions are highly accurate. By uploading their contact lists, your friends have shared your private data without asking your permission – worse, they have given Facebook permission by proxy to take your private data and profit from it.

A similar process happened with Alesandr Kogan’s app. The Mechanical Turks took less than one dollar to complete a survey, and as part of that process, they permitted Kogan to take their Facebook data, and knowingly or not (probably the latter), also their friends’ data. These Turks never asked their friends if they can share their data. But that is also beside the point. If Kogan wanted their friends’ data, Kogan needed to seek permission directly from those people. Permission by proxy is dishonest, and should be banned.

This policy imposes serious limitation on trading of user data. Either Facebook or the third party must obtain permission from users before the data transfer takes place. Users are demanding a right that has been afforded advertisers. Just as advertisers do not want to be associated with certain websites or videos, users also do not want their information disclosed to third parties with whom they don’t want to be associated.

3 - Stop mis-direction

I’d like to see strong regulation with heavy penalties for businesses that request permission from users for specific uses of their data but then fail to police their data analysts to curb abuses. For example, many websites collect mobile numbers from users, saying that the two-factor authentication is essential to protect their accounts. Once the phone numbers are stored in the database, there is no telling which data analysts will get a hold of the data. Most data analysts will utilize whatever data they can get their hands on.

To prevent mis-direction of data, companies should have a data governance function.

4 - Sunshine Policy

It is technically feasible for Facebook or other companies to keep a log of which third parties have received what data about you from Facebook. If these companies believe that the trading of private data is fundamental to their business models, then they should allow users to inspect how they collected the data, and which entities received the data. Better yet, users should be given the ability to opt out of specific transactions. For example, if Facebook has a deal to sell data to Pfizer, users should have the right to say no, you should not give our data to Pfizer.

5 - Wall off the data

If companies are willing to wall off user data, and not send them to third parties, then users are more likely to share the data. Years ago, I gave Amazon a lot of data, then when I learned that Amazon purchased a company that is in the business of selling such data to advertisers, I stopped. The incremental benefit of “better” recommendations is just not worth the potential harm done by the data flowing to unknown third parties.

6 - The right to be forgotten

Europe is ahead of the U.S. on this issue. Companies should be required to delete user data older than say five years. Aggregate statistics older than five years should be allowed. More recent data supersede the older data, so there is negligible value in keeping the old data anyway.

There are two types of data: temporal data, which do not have a fixed value; and immutable data. The latter is stuff like your ethnicity, your social security number, and for many people, their permanent home address. An example of temporal data is your favorite book or movie. The Equifax data breach is extremely hurtful because they lost a lot of immutable data (of note, other than some noisy hyperventilating when the story broke, the silence of our politicians is deafening.). Bad actors only need to get their hands on that data once.

The right to be forgotten reduces the number of copies of your immutable data in existence and thus reduces the chance that they get stolen. The right to be forgotten removes unreliable and outdated temporal data from the databases, benefitting you in myriad ways, e.g. you will no longer see every non-functional work email of relatives stretching back decades.

7 - Stop the blackmail

One reason for the pervasive data sleaze is the favorite business model of web and mobile companies – free service to all, paid for by advertisers. Users are then barred from using the service unless they sign off on extensive snooping. Sometimes, their signatures are not even required; the websites just claim that usage is taken to imply consent. This policy is about taking the cake and eating it too. The website operators don’t really want to ban any user so as to inflate their user counts (“eyeballs”).

This practice creates the perception of dishonesty, and is self-defeating, if the companies actually believe that the data collection benefits their users. If the business model is such that users get free service in exchange for their private data, then they should enforce strict access policies, only serving those who acknowledge the data collection.

***

Facebook is the center of attention; rather undeservedly because all social-media companies engage in similar practices. The regulators are absent from the scene, so there has been no pressure on them to tighten up privacy policies.

Now is the opportunity to find a solution that works for all sides.

Let me know what you think about these principles.

 

P.S.[3/28/2018] Bloomberg just reported that Facebook announces new privacy policies. A day late, and a dollar short. It's disappointing that for Facebook it is business as usual. The concept continues to be: let us collect maximal amounts of data, and each user must individually find the settings to delete individual items from the trove of data. People on twitter are finding that in some cases, Google has over the years collected over 5 gigs of data on a single user - how much time do you have to go review each element and ask to delete? In addition, the same way that Facebook cannot police Cambridge Analytica on whether or not they deleted the data, Facebook users cannot police Facebook on whether they deleted the data. Twitter users are reporting that they are finding deleted files and other deleted content in Google data. See here for an example of what people are saying on Twitter.

The paradox of data collection, and the conflict of interest

What I want to say about data collection keeps growing as the Facebook controversy picks up steam. So there will now be more than two posts about this topic.

Today, I want to first bring back my other post, called "The Paradox of Data Collection." The paradox of data collection is that average consumers claim they have “nothing to hide” while businesses believe the data benefit their customers, and yet the collection and trading of data occur largely in secret.

The Facebook scandal exposes the reality that the collection and trading of private data are executed in the shadows. The buyers of the data are invisible. What they do with the data, and how the data are used to influence people’s behavior are hidden. The data collectors deploy an array of evasive tools such as opt-outs, obscure language inside terms and conditions which the vast majority is known not to read, and site usage taken to imply consent.

***

One explanation for this paradox is the underlying conflict of interest between business growth and consumer needs.

Take an example of an airline search engine, like Kayak, or Expedia. Just last week, I searched for a flight to St. Louis since I am going there next week for my workshop and talk. Kayak has this price recommendation feature that tells users to wait for a better fare or buy now. Initially, it kept telling me wait; eventually, it said buy now (in this case, following their advice led me to a higher fare than if I just purchased the first time I searched.)

Kayak's story is that it provides value to users because it has past fare history and so can predict - allowing for some level of error - whether the current price is good or not. (I wrote an article about them for FiveThirtyEight.)

But that is really only one side of the story.

Websites like Kayak also collect extremely detailed information about every search I did. For example, it knows that I have pretty strict requirements for when to arrive in St. Louis and when to leave. It knows that I only want non-stop flights. It knows which times of the day I prefer. It even knows my second, third and fourth-choice flight dates. It knows my airline preferences.

What can it do with such data? It's obvious that I am a price-insensitive traveler because I am traveling on business and have such strict time constraints. Therefore, the airlines do not have to give me any deals. The airlines are happy to pay Kayak to get access to the search data for this reason.

In the user agreement with Kayak, I have most likely given them the right to sell my data to third parties, in this case, the airlines. If the data did flow out to the airlines, it could be used against my own interest.

If I knew that Kayak took my search data and sold it to United, and United realized that I was price-insensitive and jacked up the price, I'd be an unhappy camper. I'd consider that Kayak has betrayed my trust because I didn't want my search details to go to United. So United and Kayak would have traded the data in a hush-hush manner.

Could the same process benefit some users? Sure. The only ones that would benefit are those travelers who are wavering and therefore the airline may need to offer a discount to close the sale.

In short, business goals are frequently in conflict with consumer needs because businesses want consumers to spend more, while consumers want to get the benefits for less. Data reveal information about consumers that are not previously known to the businesses. If businesses are using the data to benefit consumers, then there should not be any need to hide behind evasive tools.

 

 

Has data sleaze reached a turning point?

Has the data sleaze industry reached a turning point?

At the end of last week, Facebook scrambled to get in front of some unsavory press coverage, by “proactively” suspending Cambridge Analytica – the data analytics outfit credited with the unlikely successes of the Brexit campaign in the U.K. and the Trump campaign in the U.S. – from its social media platform. It knew that The Guardian, and The New York Times were poised to publish critical articles about how Cambridge Analytica exploited the Facebook platform in building its invasive database on 50 million Americans, data that form the foundation for psychological scoring algorithms used to target and sway voters during the 2016 Presidential election.

As explained in my previous posts (here and here), data sleaze is the practice of taking and trading consumer data serendipitously. The third parties frequently utilize such data in ways that usurp the consumer’s self-interest.

Facebook’s response has led to an avalanche of negative publicity, and there is perhaps some hope that it, as well as other tech firms including Google, Twitter, etc., may finally take action to stop the data sleaze.

I’ve decided to split this post into two parts. Part 1 is about the inner working of the data-sleaze operation. Part 2, to be published later this week, is a call for industry leaders to take proactive action to curb the excesses of data sleaze. Part 1 explains the underlying technologies because one can never fully trust information coming mostly from conflicted actors.

In a Nutshell, How Our Personal Data Got Taken

Cambridge Analytica has boasted frequently to the media that they have amassed an extensive database of millions of Americans, which it has claimed is used to predict the psychological states of voters in support of election candidates who wanted to target and sway likely voters. A key part of this database consists of data gleaned from Facebook accounts. Cambridge Analytica purchased Facebook data from an outfit called Global Scientific Research (GSR), which is run by Aleksandr Kogan, an assistant professor of psychology at the University of Cambridge. GSR is a for-profit entity that he manages, separate from his academic appointment.

Dr. Kogan amassed the data by means of an online survey – which is a psychometric test similar to the Big 5 Personality Test – advertised on a service called Mechanical Turks, run by Amazon. Mechanical Turks are people willing to do “small tasks” for cents per task. In this case, the small task is completing the psychometric test. With a twist: Dr. Kogan also requires that the Turks download an app which they must connect to Facebook, and in so doing, they must permit him access to their Facebook data, as well as their network of Facebook friends.

Facebook data is valuable because they include real names and email addresses (only a minority of users block such snooping). These can then be used as match keys to connect with other sources of data, such as electoral rolls. See here for the kinds of data that Facebook allows partners to obtain.

Back in 2015 and 2016, the media were already on to this story. Several articles were published by The Intercept and The Guardian. Facebook at the time was slow to react. It wasn’t until 2016 that Facebook lawyers informed Kogan and his associates that they violated Facebook’s platform policies, and requested that these entities delete the data. Reporters tracked down some of the Facebook data, and a whistle-blower has come forward with documents, so it appears that Facebook, GSR, and Dr. Kogan have all been less than honest about the data sleaze. Indeed, at a hearing in the U.K., Facebook and Cambridge Analytica representatives denied that the political consulting firm has ever obtained or used Facebook data in its work.

The Enablers

The process of data sleaze outlined above is not unique to GSR or Cambridge Analytica. Many other companies in the social media ecosystem rely on variants. Let’s run down the list of enablers in this process.

1. Facebook – The popular social-media platform is at the center of this controversy, precisely because it has built such a powerful database. This database is hugely valuable to marketers who want to know what we like, and who we know. The social-media company has mastered the art of getting people to share their personal data by providing free, useful services or convenience via the platform. The same machinery that powers Facebook’s billions of revenues is driving data sleaze.

2. Terms and conditions and privacy policies – In every case including this one, tech firms expressly use terms and conditions as cover for invasion of privacy. They hide behind the façade of “if you don’t agree with our terms, then don’t use our service.” Later, many of these firms devolve to even more sly tactics, such as “if you continue to use our service, we assume you agree with our terms.” It’s a form of blackmail. Very few users read these terms and policies, but the businesses claim with a straight face that they have obtained permission from users to collect their data. Facebook and Cambridge Analytica argued that user permission was properly obtained. Dr. Kogan apparently disclosed to survey respondents that their data could be used for any reason. Because of his affiliation with University of Cambridge, some of the Turks were misled into thinking they were taking part in an academic study.

3. Bait and switch – the psychological test is a front for collecting each respondent’s Facebook Graph. The Facebook data contain information about who knows whom. Similarly, every weather app is a front for a detailed database of user locations at all times. In my view, the most important dataset Dr. Kogan wants is not the results of the psychological testing, as widely reported, but the names and emails of the network of friends and acquaintances of all those who signed up. A few hundred thousand, self-selected responses to the survey are not sufficient to create an accurate model of every American’s psychological state.

4. Data sharing technologies – a typical app delivers a service to users by pulling in various sources of data and integrating them. In order to support real-time sharing of data between app developers and data collectors like Facebook, data collectors set up automated processes by which apps can pull down the data. There are usually costs associated with these interfaces, especially when a sizable amount of data is delivered, which is a source of revenues for the data collectors. It’s hard to control access given that these systems allow automated bots to interface with them. Dr. Kogan, for example, could create both a good bot collecting data for academic research and a bad bot siphoning data to Cambridge Analytica.

5. Data governance black hole – once the data show up in one database, it is bound to show up in many databases –internally as well as at third parties. Once the data reach a third party, Facebook cannot know how many copies are made, and where those copies are. Even within Facebook, with so many employees having access to the data, it is almost impossible to monitor who has copied the data where. Facebook and other social-media outlets have community rules. For example, Facebook has “platform policies” that restrict friends’ data to noncommercial use such as improving user experience. Talk about unenforceable! Facebook can only know what data have been sent to a third party but it has no way of knowing how the third party is utilizing the data.

6. Data deletion myth – just as it takes special skills to eradicate a file on one’s PC, so it is basically impossible to remove all traces of data from existence. We have trouble even counting and locating all copies of a given dataset. Thus, Facebook didn’t even bother to check whether Cambridge Analytica, and selected third parties, truly destroyed the data they were supposed to. Facebook didn’t suspend the controversial company until the media unearthed evidence that the data haven’t been destroyed.

7. Mechanical Turks – these bit players were exploited as pawns to sell out their “friends” for mere cents.

8. Weak regulation and enforcement – Europe might be finally ready to enact laws to regulate the data collection industry but the U.S. government sees no evil.

9. Anonymity – many businesses trot out this buzz word to justify their data collection operations. To put it bluntly, we are being lied to. Anonymity is declared every time an analyst replaces identifiers (such as emails) with encrypted or scrambled versions of those entities. However, in most cases, lookup tables are available to unmask these users.

10. Slack ethics – enough said.

In Part 2, I suggest some actions.

The discontent of engineering uncertainty

Andrew Gelman likes us to "accept uncertainty and embrace variation" (link).

I was lucky to earn my Operations Research degree in a department filled with professors who have advanced our thinking about stochastics, learning from the likes of Erhan Cinlar, John Mulvey, Warren Powell, and Rob Vanderbei. In operations research, much of the early seminal work deals with "deterministic" problems in which the data are assumed to be fixed and available, but most real life problems involve data that are highly variable or missing. Replacing the distribution of values by their averages allows those deterministic solutions to be computed although it is widely known that such solutions are not optimal. In other words, we must embrace variation.

These thoughts came to mind as I started reading the Algorithms to Live By book by Christian and Griffiths. In the first 20 pages, they kept returning to the altar of deterministic, precise engineering solutions.

The book begins with the classic optimal stopping problem, in which one is faced with a sequential search problem at each step, one can either make the decision and stop searching, or delay the decision and keep searching. House buying is an example of such a problem. The authors pronounce that there is a provably optimal solution of spending first 37 percent of the house search period delaying the decision, after which one waits for the next house that is better than the previously seen.

They eventually do admit that this 37-percent solution is optimal only under a set of highly unrealistic assumptions, such as that one can never bid on a house one passed over before, and that the seller will always accept one's offer.

It's not the over-selling of the math that annoys me. Assumptions can be relaxed and complexity added to the base scenario. It's the constant harping on 37 percent. It's not 35 percent, it's not 39 percent. It is precisely 37 percent, and you better believe it!

No one should believe it because another huge assumption in these "provably optimal" solutions is that the data supplied to the problem are available, and precise. That's far from the truth! In a variant of the optimal stopping problem which the authors also describe, the decision-maker is supposed to have "full information" about the value of the house, that is to say, one knows the value of each house being viewed, expressed as the precise percentile in the distribution of all house values!

This leads to the hair-raising moment in which the authors declare on page 21, "if the cost of getting another offer is only a dollar, we’ll maximize our earnings by waiting for someone willing to offer us $499,552.79 and not a dime less." (By now, the problem setting has flipped to selling rather than buying a home.)

As formulated, the problem yields a "closed-form" formula, which spits out an answer to two decimal places. If one accepts uncertainty and embraces variation, one would not care about dimes.

***

I still plan on finishing the book, and I will write a detailed review when I finish. This post is not a refutation of the entire book. It's quite common to take formulas as god-given objects. Between unrealistic assumptions and uncertain data, one can only hope for general guidance and approximate solutions to these problems.

 

The doping story that won't go away

Yet another Tour de France winner is entangled in a doping scandal - what a surprise. This time, it is the British rider Bradley Wiggins, who is the subject of a damning report.

His team is accused of supplying Wiggins and his support riders with a banned substance under the guise of medical need. The reality is they have not violated anti-doping rules because the authorities allow so-called Therapeutic Use Exemptions (TUEs).

I addressed this and various issues surrounding anti-doping tests in my book, Numbers Rule Your World, years ago before the Lance Armstrong scandal broke the silence.

TUEs are widely abused in the sports world. For example, the data suggest that either swimming causes asthma, or that people with asthma are much more likely than the general population to engage in world-class competitive swimming.

TUE is a major source of false negatives in the world of anti-doping tests - here, I define false negative as failing to catch a doper, which is broader than dopers passing the anti-doping tests. In the book chapter, I explain why there is very low risk of dopers getting caught by the anti-doping measures.

 

Business journalists are not asking the right questions

This article in Reuters discusses an important A/B test on Facebook that looks at splitting the NewsFeed into two tabs, kind of like Gmail (if user desires) will split your emails into two or more tabs. The Facebook Newsfeed underwent the most drastic changes some years ago when they started courting advertisers and allowing them to insert messages into a space that were previously used by friends and relatives. The Newsfeed because one of the most popular areas for advertisers on Facebook; news organizations generate substantial traffic through referrals from Facebook.

Insertion of sponsored content into a personal space results in the need to balance conflicting objectives. Ads from advertisers and messages from friends are competing for the valuable real estate.

If you were to listen to the reporters in the Reuters article, Facebook does not care one bit about advertisers. The only thing it cares about is the experience of users from whom it does not directly derive any revenues. This is particularly odd because Facebook's business model is entirely dependent on advertising. if I were an advertiser, I would be highly suspicious about the split Newsfeed. It's rather likely that when my ads are separately held in a side tab, Facebook users might not open those ads. I almost never click on the Gmail tab that holds the commercial emails.

How did the journalist write a thousand words without addressing the impact of the split Newsfeed test on advertising income? Only he can tell you.

 

Bot love and hate

Some senators are calling for Facebook and others to be fined if they fail to remove bots (see here). Someone needs to give these senators a quick lesson in technology.

Bots are not all bad.

Bots are originally intended to give us nice things like convenience and speed. Lots of users love those things. Maybe they shouldn't like them so much.

Bad bots are created by bad actors to do bad things. To shut them down means you have to give up those nice things.

Not all bots are Russian.

Russians make bots that do nice things too.

Lots of non-Russians, including American companies, make bots that do things like retweeting other people's tweets automatically.

Bots are code written by people.

Removing bots does not remove the coders of those bots.