“The Big Shift.” Internal Facebook Memo Tells Employees to Do Better on Privacy.

On December 22, 2020, Facebook VP Andrew “Boz” Bosworth wrote his colleagues with a stark message on privacy. “The way we operated for a long time,” he said, “is no longer the best way to serve those who use our products.”

In an internal memo called “The Big Shift,” obtained by Big Technology and first reported here, Bosworth called on Facebook employees to prioritize privacy as they built their products, even to the detriment of the user’s experience. The public’s expectations on privacy were changing, he said, and Facebook's old approach wasn’t cutting it anymore. 

“Global sentiment has clearly shifted to the point that people are willing to accept sacrifices in the quality of the product,” Bosworth wrote. “We need to consider the consumer experience holistically rather than at optimizing for each individual feature.”

Bosworth wrote this at the end of a particularly brutal year for Facebook. The FTC and dozens of state attorneys general had sued the company. People trusted it the least among all social apps. Congress called Mark Zuckerberg to testify multiple times. Incoming President Joe Biden was no fan either. Facebook still had product ambitions, but the ill will toward the company was leading to real repercussions. It needed to change. 

Facebook’s public messaging on privacy had been similar to Bosworth’s for years, but it hadn’t meaningfully altered its growth-hungry culture to keep pace with its promises. Bosworth’s memo was notable in that it aimed directly at Facebook’s culture, the only way to generate real progress. He indicated that building the company’s algorithmic ranking and sharing tools shouldn’t come at the expense of user privacy. And at one point, he told employees that the company’s internal privacy tools “will only be effective insofar as we stop fighting them at the cultural level.”

A 15-year Facebook veteran, Bosworth is a powerful voice within the company. His missives, including “The Ugly” in 2016 and “Thoughts for 2020,” set the tone for culture inside Facebook. He posts these memos to the company’s internal version of Facebook, called Workplace, where they attract plenty of attention. So “The Big Shift” should carry weight.

As the leader of Facebook’s Reality Labs division — which handles the company’s virtual and augmented reality products — Bosworth’s path to success is directly tied to Facebook’s reputation on privacy. His group is about to roll out smart glasses, and privacy advocates are sure to have a field day with that one.

In a follow-up note to his division, Bosworth said they’d invert their product development process. “Instead of imagining a product and trimming it down to fit modern standards of data privacy and security,” he said, “we will start with the assumption that we can't collect, use, or store any data. The burden is on us to demonstrate why certain data is truly required for the product to work.”   

Bosworth likened Facebook’s challenge to Microsoft’s in the early 2000s, when people didn’t trust the company because its products were prone to viruses. After harsh criticism, Microsoft prioritized security, placing it above its other product priorities. After going through that process, Bosworth wrote, Microsoft might now be the most trusted enterprise software company in the world.

“I think this is a model for us at Facebook,” he wrote. “We should become the undisputed leaders in providing privacy-aware software.”

Facebook, which declined to comment on Bosworth's posts, got away with its casual approach to privacy for some time, but the consequences recently became impossible for it to ignore. Along with heat from regulators and the threat of legislative action under Biden, Facebook is so distrusted that a poorly worded privacy update sent users scrambling off WhatsApp en masse earlier this month. Apple, meanwhile, is warning its customers of Facebook’s propensity to track with a new, extensive label detailing the company’s data collection. 

With Facebook, it’s difficult to get too hyped about bold statements on privacy. The company’s performance to date simply doesn’t inspire much confidence. But Bosworth addressing employees in this manner means something, no matter the motivation. Now that his memo is out there, the company has some added incentive to live up to his directive. 

You can read the full memo here:

Andrew Bosworth ► Facebook Reality Labs (FRL) FYI 

Dec 22 

Starting in January we are changing the way we approach product development in FRL. Instead of imagining a product and trimming it down to fit modern standards of data privacy and security we are going to invert our process. We will start with the assumption that we can't collect, use, or store any data. The burden is on us to demonstrate why certain data is truly required for the product to work. Even then I want us to scope it as aggressively as we can, holding a higher bar for sending data to the server than we do for processing it locally. I have no problem with us giving users options to share more if they choose (opt-in) but by default we shouldn't expect it. 

I don't want us to just meet the consumer expectations for privacy today. I want us to differentiate our products on the basis of privacy. Let other companies scramble to keep up with us. 

______________________________________________________________________

Andrew Bosworth 

Dec 22 

The Big Shift 

When I joined Microsoft in 2004, the only required reading was Writing Secure Code. The company had spent years getting dragged through the mud for the viruses prevalent on their platforms. While relatively few consumers faced material negative impact from malware, the possibility of it was a constant. Getting a glance at the codebase, I could see why. They had built up decades of buffer overruns and unchecked dereferences in a sprawling code base. ‘

I sometimes wonder if Microsoft engineers before me felt the coverage of their company was unfair. Perhaps they felt that too much attention was being paid to relatively rare issues. Perhaps the trade-offs they had made enabled huge ecosystems of developers who might otherwise struggle. If that was the case, it didn't matter. Consumers didn't feel safe using Microsoft products. 

By the time I joined the quality of new code impressive. Security got more attention than anything else in code reviews. Even the most junior engineer like me was held to the highest standards. They made product decisions that in many ways made their user experience worse but in exchange (rightly) gave consumers' confidence that the system they were using was trustworthy. 

Today Microsoft is considered perhaps the most trustworthy software vendor in the world. It is trusted by an overwhelming majority of enterprise companies. Having been on the outside since 2005 it was impressive to watch their persistence yield a gradual but definitive shift in their reputation. I think this is a model for us at Facebook. We should become the undisputed leaders in providing privacy aware software. 

As it did at Microsoft, this starts with an acknowledgement that the way we operated for a long time is no longer the best way to serve those who use our products. We have always put the best consumer experience first. That meant the best ranking, the best content, and the best sharing tools. Contrary to what is often written we have always cared about privacy and balanced providing people with both a good privacy experience and a good user experience. But global sentiment has clearly shifted to the point that people are willing to accept sacrifices in the quality of the product in ways we hadn't considered in order to have stronger guarantees around data privacy. We need to consider the consumer experience holistically rather than at optimizing for each individual feature.

The good news is that this next phase of our journey is underway. It started gradually a long time ago and then suddenly in mid-2019 when we clearly put privacy first internally and redesigned the Privacy Review process to provide just such a holistic view of our products. Privacy Review is an effective backstop but is still having to escalate far too often as local teams haven't yet internalized the magnitude of the shift we are undergoing. The next step is for the priority of privacy to permeate the entirety of our culture, we've made inroads here but we have a long ways to go. Privacy Review should become a simple housekeeping exercise unless we detect further shifts in public attitudes towards privacy. 

Of course we are also building tools to make this easier. Just as Microsoft deployed fuzzing to test every input, we will build tools that make it easier to write good code and harder to write bad code. But the tools will only be effective insofar as we stop fighting them at the cultural level. The new normal is giving people choices about data usage and finding ways to provide the best value we can when data isn't available. 

With new culture and new tools, an a concerted effort to revisit old products, we are on a long road to redemption. We shouldn't expect any credit before it is due and perhaps not even until a good while afterwards. But we should nonetheless feel proud of the shift we are undertaking and confident in our ability to see it through.

Related Reading:

How Facebook wants to avoid the next AR/VR backlash (Protocol)

Facebook Is Still Prioritizing Scale Over Safety (BuzzFeed)

WhatsApp Delays Privacy Changes Amid User Backlash (New York Times)

Meet Big Technology’s Headline Sponsor: Mediaocean

Want a BIG job in TECH? Mediaocean was just ranked #1 best place to work in advertising technology by Ad Age. Go to Mediaocean.com/BigTech and check out careers.

This week on Big Technology Podcast: Under Biden, bipartisan vengeance on social media? A conversation with Bradley Tusk

As Joe Biden takes office, Big Tech’s rough and tumble four years under Donald Trump will not come to an end. Democrats and Republicans, each for their own reasons, will now be looking to exact vengeance on the platforms. With some compromise, they may even get somewhere.

Bradley Tusk, a VC who works with startups facing regulatory hurdles, has a few thoughts about what regulation the tech giants may face. Tusk joins the Big Technology Podcast to break it all down, starting with a bold prediction and ending with some thoughts about Andrew Yang’s candidacy for New York Mayor, which he is advising.

To subscribe to the podcast and hear the interview for yourself, you can check it out on ApplePodcasts, Spotify, and Overcast. You can also read the interview on OneZero.