Email: Re: [] Seeking IG support to mitigate S258090

Raw text

Transcribed text as recorded, including headers and formatting fragments.

Message From: Dhiraj [/O=THEFACEBOOK/OU=EXTERNAL (FYDIBOHF25SPDLT)/CN=RECIPIENTS/CN= 2/9/2022 5:08:01 PM Sent: To: Karina Newton @fb.com]; Paniz @fb.com]; Nam @fb.com]; Sayed Otaru @fb.com]; Jonathan @fb.com] CC: Ashley (Legal) @fb.com]; Scott @fb.com]; Karuna @fb.com]; Zoe @fb.com]; David @fb.com]; Arcadiy @fb.com]; Emma @fb.com]; Preeti @fb.com]; Matt @fb.com]; Andrew @fb.com]; Omer @fb.com]; Julien @fb.com]; Aditya @fb.com] Subject: Re: [A/C Priv] Seeking IG support to mitigate S258090 Thanks Paniz, I am coordinating with Haoyang on the support for the SEV, but let me know if there any additional support needed. Also as Karina pointed out, will be interested to understand the details/reasons for this gap not being detected earlier. But we can take that as a separate thread. From: Karina Newton < @fb.com> Date: Wednesday, February 9, 2022 at 7:33 AM To: Paniz @fb.com>, Nam @fb.com>, Sayed Otaru @fb.com>, Jonathan @fb.com>, Dhiraj @fb.com> Cc: Ashley (Legal) < @fb.com>, Scott @fb.com>, Karuna @fb.com>, Zoe @fb.com>, David @fb.com>, Arcadiy @fb.com>, Emma @fb.com>, Preeti @fb.com>, Matt @fb.com>, Andrew @fb.com>, Omer @fb.com>, Julien @fb.com>, Aditya @fb.com> Subject: Re: [A/C Priv] Seeking IG support to mitigate S258090 Thanks teams for coming together to support this -- would also like to reiterate the importance and high priority of the hash matching working properly on IG and it would be helpful to understand once scoped, what our timeline for implementing MD5 on IG is. Secondarily, can someone from Cl with knowledge ping me off thread with legal counsel on how this gap was not previously known or tested? Thx, Karina From: Paniz @fb.com> Sent: Wednesday, February 9, 2022 3:17 AM To: Nam ; Sayed Otaru; Jonathan ; Dhiraj Cc: Ashley (Legal); Scott ; Karuna ; Karina Newton; Zoe Emma ; Preeti Matt Andrew ; Omer ; Julien ; David Aditya ; Arcadiy Subject: Re: [A/C Priv] Seeking IG support to mitigate S258090 Thank you! Haoyang need further support. has been in touch, we'll kick off conversations with him and circle back to this group if we CONFIDENTIAL CONFIDENTIAL META3047MDL_REPROD_VOL021 METANMAG_REPROD_VOL016 META3047MDL-168-00000496 METANMAG-041-00000553 PLTF EX-01867_0001 PLTF EX PLTF EX-01867 Best wishes, Paniz From: Nam @fb.com> Date: Wednesday, 9 February 2022 at 09:36 To: Sayed Otaru @fb.com>, Paniz @fb.com>, Jonathan @fb.com>, Dhiraj @fb.com> Cc: Ashley (Legal) < @fb.com>, Scott @fb.com>, Karuna @fb.com>, Karina Newton < @fb.com>, Zoe @fb.com>, David @fb.com>, Arcadiy @fb.com>, Emma @fb.com>, Preeti @fb.com>, Matt @fb.com>, Andrew @fb.com>, Omer @fb.com>, Julien @fb.com>, Aditya @fb.com> Subject: Re: [A/C Priv] Seeking IG support to mitigate S258090 Thanks Sayed! + Omer, Julien, Aditya (eng leads on our side) for visibility on this From: Sayed Otaru < @fb.com> Sent: 09 February 2022 02:08 To: Paniz @fb.com>; Jonathan @fb.com>; Dhiraj @fb.com> Cc: Ashley (Legal) @fb.com>; Scott @fb.com>; Karuna @fb.com>; Karina Newton < @fb.com>; Nam @fb.com>; Zoe @fb.com>; David @fb.com>; Arcadiy @fb.com>; Emma @fb.com>; Preeti @fb.com>; Matt @fb.com>; Andrew @fb.com> Subject: Re: [A/C Priv] Seeking IG support to mitigate S258090 cc @Matt Hi Paniz, @Andrew for awareness Thanks for reaching out. Our Teen Safety team may be able to partner here. Please connect with @Dhiraj (EM for our Safety sub-pillar) for alignment on next steps. Regards, Sayed. From: Paniz @fb.com> Sent: Tuesday, February 8, 2022 9:21 AM To: Jonathan Cc: Dhiraj @fb.com>; Sayed Otaru @fb.com> @fb.com>; Ashley (Legal) < @fb.com>; Scott @fb.com>; Karuna @fb.com>; Karina Newton < @fb.com>; Nam @fb.com>; Zoe @fb.com>; David @fb.com>; Arcadiy @fb.com>; Emma Subject: [A/C Priv] Seeking IG support to mitigate S258090 @fb.com>; Preeti @fb.com> CONFIDENTIAL CONFIDENTIAL META3047MDL_REPROD_VOL021 METANMAG_REPROD_VOL016 ΜΕΤΑ3047MDL-168-00000497 METANMAG-041-00000554 PLTF EX-01867_0002 Hi Jonathan, Sayed, Nice to meet you - I'm a PM in Cl working in Interaction Integrity. I'm writing to enlist some urgent support from IG to mitigate legal and legitimacy risks we're facing in the Adult Sexual Exploitation, Child Safety and Terrorism space. Context: Adult Sexual Exploitation (StopNCII.org), Child Safety (NCMEC) and Terrorism (GIFCT) space are all problem areas which participate in cross-industry hash-sharing collaborations. All three arrangements involve Meta receiving hashes from an external body (e.g. NCMEC), which we can use internally to match and remove violating content. We use PDQ as the hashing algorithm for photos and MD5 for videos. The problem: All three collaborations were launched with the assumption that MD5, the form of hash used for videos, can be matched on IG. We realised this wasn't the case only in ~January 2022, despite some of these collaborations having been running for years. While the root cause is a feature gap, rather than broken systems, we raised S258090 due to the legal and legitimacy risks involved in falling so short of the public expectations we have set. The risks: Legal: PRIV PRIV Legitimacy: All three collaborations for Child Safety, Terrorism and Adult Sexual Exploitation are very high-profile given they relate to industry working together to stop high severity harms. Our legitimacy wins from participating in these efforts could easily become a legitimacy loss due to the scale of this feature gap. Resolving the issue: We need to implement a client-side implementation of MD5 into the Instagram app so that we can match against content on IG. Common questions that usually arise at this point are: Why MD5? It's not an effective matching algorithm: This is correct, we have much more powerful algorithms at our disposal internally. However, MD5 was chosen since it's one of the only algorithms available which is both free to use and non-proprietary, making it suitable for cross-industry collaborations. Other free algorithms (e.g. TMK) were considered and ruled out due to drawbacks with implementing them client-side. Why client side? We don't believe a server-side implementation will be effective at matching, given the transcoding that takes place when media is posted on Instagram. Where we could use your help: Directing us to the right teams who might be able to build client-side MD5 hashing Your buy-in and help communicating that this should be prioritised as a matter of urgency CONFIDENTIAL CONFIDENTIAL META3047MDL_REPROD_VOL021 METANMAG_REPROD_VOL016 ΜΕΤΑ3047MDL-168-00000498 METANMAG-041-00000555 PLTF EX-01867_0003