Meta sues “scraping-for-hire” service that sells user data to law enforcement

Meta said it’s suing “scraping-for-hire” service Voyager Labs for allegedly using fake accounts, proprietary software, and a sprawling network of IP addresses to surreptitiously collect massive amounts of personal data from users of Facebook, Instagram, Twitter, and other social networking sites.

“Defendant created and used over 38,000 fake Facebook user accounts and its Surveillance Software to scrape more than 600,000 Facebook users’ viewable profile information, including posts, likes, friends lists, photos, and comments, and information from Facebook Groups and Pages,” lawyers wrote in Meta’s complaint. “Defendant designed the Surveillance Software to conceal its presence and activity from Meta and others, and sold and licensed for profit the data it scraped.”

“Bringing individuality to light”

Among the California-based Facebook users to have their data scraped, Meta said, were “employees of nonprofit organizations, universities, news media organizations, health care facilities, the armed forces of the United States, and local, state, and federal government agencies, as well as full-time parents, retirees, and union members.” Meta said the data collection and use of fake accounts violate its terms of service.

Israel-headquartered Voyager Labs bills itself as an “AI-powered investigations” service that collects data from “billions of ‘human pixels’ and signals” and uses artificial intelligence to map relationships, track geographic locations, and provide other personal data to “agencies tasked with public safety.”

“By leveraging this vast ocean of data, they can gain actionable insights on individuals, groups, and topics, and then deep dive to uncover even more,” company officials wrote in marketing material attached as exhibits to the Meta complaint. The tagline on Voyager Labs’ letterhead is: “Bringing individuality to light.”

In one case, the service used Facebook posts to identify the full names of an Italian marathon runner and his wife who had been infected with COVID-19. The service then provided a list of the friends and individuals who had interacted with the runner. In a different case, Voyager Labs identified patrons of a UK pub who may have contracted the deadly virus.

Among Voyager Labs’ customers, according to the exhibits, is the Los Angeles Police Department. A testimonial provided by one department member said Voyager Labs was “Able to identify a few new targets in a much easier to read format” and was “able to process warrants returns much faster which were much easier to read.”

Images from some of the exhibits are in the gallery below:

Meta seeks a permanent injunction that would bar Voyager Labs from continuing the practice.

In the lawsuit’s announcement, Meta Director of Platform Enforcement and Litigation Jessica Romero wrote:

Voyager developed and used proprietary software to launch scraping campaigns against Facebook and Instagram, and websites such as Twitter, YouTube, LinkedIn and Telegram. Voyager designed its scraping software to use fake accounts to scrape data accessible to a user when logged into Facebook, including users profile information, posts, friends lists, photos and comments. Voyager used a diverse system of computers and networks in different countries to hide its activity, including when Meta subjected the fake accounts to verifications or checks. Voyager did not compromise Facebook, instead it used fake accounts to scrape publicly viewable information.

Our lawsuit alleges that Voyager has violated our Terms of Service against fake accounts and unauthorized and automated scraping. We are seeking a permanent injunction against Voyager to protect people against scraping-for-hire services. Companies like Voyager are part of an industry that provides scraping services to anyone regardless of the users they target and for what purpose, including as a way to profile people for criminal behavior. This industry covertly collects information that people share with their community, family and friends, without oversight or accountability, and in a way that may implicate people’s civil rights.

Representatives of Voyager Labs didn’t immediately respond to a request for comment.

The lawsuit is at least the second time Meta has taken legal action for alleged data scraping on its platform. In July, the company sued Octopus, a US subsidiary of a Chinese national high-tech enterprise that allegedly offers to scrape any website, and sued Turkish-based individual, defendant Ekrem Ateş, for allegedly using Instagram accounts to scrape data from the profiles of more than 350,000 users of that platform.

Not that Meta has completely clean hands when it comes to unwanted scraping. In 2018, multiple Facebook users who had opted in to contact sharing were distressed to find the company had collected years’ worth of phone call metadata from their Android phones. The data included names, phone numbers, and the length of each call made or received. Facebook denied the data was collected surreptitiously.