Environmental activist Greta Thunberg, of Sweden, addresses the Climate Action Summit in the United Nations General Assembly, at U.N. headquarters, Monday, Sept. 23, 2019.
Wired Magazine reports that, for several hours last Thursday night, a bad code update erroneously allowed Facebook users to see exactly which accounts were posting to Facebook pages.
For example, celebrities, politicians, businesses, and blogs often open a Facebook page that “isn’t tied to an individual profile. The accounts behind those pages are anonymous unless a Page owner opts to make the admins public. But a bug that was live from Thursday evening until Friday morning allowed anyone to easily reveal the accounts running a Page, essentially doxing anyone who posted to one.”
The edit histories of anonymous Facebook pages contained the names and profile pictures of everyone who added to a particular page.
Because this problem wasn’t fixed for many hours, eventually some users discovered they had access to this otherwise unavailable information. It didn’t take long before screenshots of the edit histories of popular pages made their way to several social media sites. According to Wired:
Facebook says the bug was the result of a code update that it pushed Thursday evening. It’s not something most people would have encountered on their own, since it took navigating to a Page, viewing an edit history, and realizing that there shouldn’t be a name and profile picture assigned to edits to exploit it. Still, despite the Friday morning fix, screenshots circulated on 4chan, Imgur, and social media appearing to show the accounts behind the official Facebook Pages of the pseudonymous artist Banksy, Russian president Vladimir Putin, former US secretary of state Hillary Clinton, Canadian prime minister Justin Trudeau, the hacking collective Anonymous, climate activist Greta Thunberg, and rapper Snoop Dogg, among others.
Facebook points out that no information beyond a name and public profile link were available, but that information isn’t supposed to appear in the edit history at all. And for people, say, running anti-regime Pages under a repressive government, making even that much information public is plenty alarming. -Wired
The edit history for Greta Thunberg’s page shows that the content has actually been written by her father, Svante Thunberg, and Adarsh Prathap, a climate activist in India who serves as a delegate at the UN’s Climate Change organization.
Greta, Inc., still claiming that Greta, rather than her father or Prathap, has written the content, posted a message on Facebook on Saturday:
Some people have been asking who manages this page. First of all, since last spring I only use Facebook to repost what I write on my Twitter and Instagram accounts. Since I have chosen not to be on Facebook personally ( I tried early on but decided it wasn’t for me) I use my father Svantes account to repost content, because you need an account to moderate a Facebook page. The rest that is shared on Facebook is reposted from Twitter and Instagram by the guy who founded the Greta Thunberg Facebook page long before I knew it existed. His name is Adarsh Prathap and he lives in India. Since a lot of people thought it was my official page in the beginning I asked if I could co-manage it and he said yes. All texts posted on my Facebook page has of course been written by me, just like everything else.
In the meantime (via Zerohedge), Lukasz Olejnik, independent privacy adviser and Oxford University Center for Technology and Global Affairs, has warned: “People who run sensitive Pages from their own Facebook should now consider that their identity may be known. While mistakes happen, this one is unexpected.”