Facebook leaks: Zuckerberg turned data into dollars in ruthless battle with competitors

Facebook becomes an ‘information bank’

By October 2012, Zuckerberg was likening Facebook to an “information bank”. In other words, the information that Facebook collected on its users had a clear financial value.

“Even though the idea of an information bank is not identical to [a] financial bank, the comparison suggests some interesting things. For example, banks charge you interest for as long as you have their money out,” said Zuckerberg.

Facebook CEO Mark Zuckerberg likened the social media firm to an “information bank”, suggesting the information that Facebook collected on its users had a clear financial value

Ultimately, the company dropped its plans to charge developers for access to data, in favour of sharing it with app developers who were “friends” of Zuckerberg and Sandberg or spent significant sums in advertising on Facebook’s platform.

To protect the value of its user data, the social network debated the merits of restricting its APIs, selectively granting extended access to companies that either spent on advertising or had something else of “value” to offer Facebook.

Less than a year after going public, Facebook had begun to cut off access to its data for certain developers, largely based on how serious a competitor they were deemed to be.

Promise to developers overturned

Facebook’s actions overturned its earlier promise to developers to provide them with the same access to Facebook’s data as Facebook itself.

In May 2007, on stage at the F8 developer conference in San Francisco, Zuckerberg announced Facebook’s new operating system – Facebook Platform.

Platform offered third-party software developers the ability to build applications and link them into the Facebook site. 

Developers were told they could use the platform to build “robust apps” that access Facebook’s data about its users. Part of the package included software dubbed Facebook Query Language (FQL), which allowed developers to access the data they needed from Facebook.

For Facebook, which then had 12 million users and 40 billion page views a month, it was an opportunity to grow to the next level.

“Facebook Platform gives developers everywhere the tools to create applications that we just wouldn’t have the resource to build in-house,” the company told them in an FAQ. As a result, Facebook would become “an even more powerful social utility”.

Facebook promised that it would treat applications developed by third-party developers with the same equality as Facebook’s own applications, even if they competed with Facebook’s own apps.

“We’ve designed Facebook Platform so that applications from third-party developers are on a level playing field with applications built by Facebook,” it told developers.    

Yet, within a year, internal tensions had started to emerge, as rather than maintain a level playing field, Facebook placed favoured companies on a whitelist that gave them privileged access to its social graph.

Mike Vernal, then vice-president of product and engineering at Facebook, complained: “Pretty much everyone is always asking us to turn off APIs (Zuck & Photo Tagging), or whitelist APIs (Add Friend), or worse.

“One of the arguments I often have with folks is about keeping the platform both open (accessible to all, not a whitelist model) and powerful (being able to do interesting things with it),” he wrote.

The scramble to build business model after disappointing IPO

Things began to change after Facebook held its initial public offering in May 2012. It was the third largest IPO in US history, behind General Motors and Visa. But it did not go well and led to investors losing $40bn.

Internally, Facebook realised it had problems. The social network had yet to develop a strategy to create a platform for mobile phones, which were rapidly becoming the device of choice for accessing internet services.

“We don’t have a platform business model yet,” wrote Vernal. “More broadly, we don’t have any business model on mobile yet, and that’s a big issue. We think it has to be advertising based, but we haven’t figured it out yet.”

The statistics were not looking good. An internal Facebook presentation showed a “terminal decline” in the number of posts people were making on their Facebook wall between 2012 and 2014.

The presentation talked about posts to the web service “tanking”. Excluding birthdays, the volume of user posts had fallen by 63% over two years. The message was stark: “Wall posts, as a product, seem to be dying.”

Board floats plans to charge developers for data

Towards the end of August 2012, Zuckerberg and his fellow board members met to plan how they could boost Facebook’s finances by making more money. The target: web developers.

Employees prepared a presentation for Facebook’s senior executives for an updated Facebook Development Programme, giving a range of options for charging application developers to integrate with Facebook’s platform.

The first idea was to charge developers a compulsory annual fee for Facebook to review apps to ensure they did not pose a risk to Facebook’s users and to provide annual support.

On top of this, developers could request to use Facebook APIs, which provide access to each user’s personal details and photographs, lists of friends who are using the app, and potentially lists of friends of friends, by paying more fees.

The presentation proposed another money-spinning idea: charging developers to access not just data about Facebook’s users, but the results of Facebook’s analysis of that data. This “derivative data” about users’ intentions was far more valuable than raw data on friends.

It could include details of what music and books people liked, and access to Facebook’s co-efficient service, which showed the strength of relationships between different users.

Back-of-the-envelope calculations by Facebook employees in a draft presentation showed just how much Facebook could generate from developers for access to Facebook users’ data:

• Annual developer fee for each app: $17m (from 170,000 apps at $100 an app).
• Annual “recovery” fees for accessing data on Facebook users through APIs: $160m.
• Work with 16+ developers to integrate Facebook experiences on their platform: $1.6m.

Facebook wants to put monetary value on data

Back in 2012, Chris Daniels, then director of business development, who would later rise up through Facebook’s hierarchy to become vice-president of WhatsApp, summed up Facebook’s proposed new strategy succinctly: Facebook users’ data was worth dollars.

Until that point, Facebook had made its money by selling targeted ads to a relatively small number of big brands through its distribution business. In the future, Facebook’s business would also depend on charging for its customers’ data.

“Today, the fundamental trade is ‘data for distribution’, whereas we want to change it to either “data for $” and/or “$ for distribution,” Daniels wrote in an email to senior staff preparing the crucial presentation to Facebook’s board. “Essentially, we are wanting to put a $ amount on data and a $ amount on distribution.”

Facebook’s vice-president of product management, Sam Lessin, and Mike Vernal began to flesh out the details. They proposed an idea where developers could buy data derived from analysis of Facebook’s customers’ behaviour, including details of their connections and relationships with other users.

“Facebook has information about users which can be helpful to applications, and which we provide to applications that we deem appropriate,” wrote Lessin.

That could include data about users’ friends, posts they like and places they live, and data derived by Facebook, such as their likely opinions and probable location.

Zuckerberg’s U-turn: lock down access to apps

By late October 2012, however, Zuckerberg was beginning to have doubts about whether charging developers to access Facebook’s advertising network and its customers’ data would be enough to retain its dominance as a social media platform.

“There is a big question on where we get revenue from. It’s not all clear to me here that we have a model that will actually make us the revenue we want at scale,” he told Lessin in an email.

“I’m getting more on board with locking down some parts of the platform, including friends data and potentially email addresses for mobile apps,” he said in the email, extracts of which were released by the UK’s Parliamentary Digital, Culture, Media and Sport (DCMS) Committee.

Zuckerberg began to float a new strategy: to lock down developers’ access to Facebook’s data and to limit the ability of their apps to post data on Facebook – a process known internally as “distribution”.

“Without limiting distribution or access to friends who use this app, I don’t think we have any way to get developers to pay us at all, besides offering payments and ad networks,” said Zuckerberg.

During the email exchange, Lessin convinced Zuckerberg that, in order for the company to grow, it was necessary to take a tougher line on competitors integrating with Facebook.

Zuckerberg wrote: “I agree we shouldn’t help our competitors whenever possible. I think the right solution here is just to be a lot stricter about enforcing our policies and identifying companies as competitors.”

The privacy ruse

Lessin had spent time lobbying Zuckerberg to change direction. His idea was that Facebook should use its data to fuel its own growth rather than share it to openly with developers.

Facebook’s mission was to make the world more open and connected. The only way to do that was to have the best infrastructure and the best people – and that “requires a lot of money.”

Facebook should begin cutting off, or “deprecating”, access by developers to Facebook’s data, and instead use that data to promote Facebook’s own growth, he said.

“My assertion is that for us to be very profitable over a long time, we have to…have a business model where we get more profitable the bigger we are. And that means not selling off our assets in a way that transfers wealth from ourselves to others,” he told Zuckerberg.

“The number one threat to Facebook is not another scaled up social media network, it is the fracturing of information/death by a thousand small vertical apps which are loosely integrated together,” he said.

Of course, this change in direction was unlikely to sit well with developers. Lessin proposed a solution: present the project as a move to protect privacy, while claiming that there was no change in policy.

“The messaging to the ecosystem becomes that we are deprecating a few things for privacy reasons/to simplify our model for users. We are enforcing non-competitive terms we have always had, and we are opening up a series of new whitelist APIs for the best companies that build the best social servers and want to work with us deeply,” he said.

What’s good for the world is not good for Facebook

By November 2012, Zuckerberg was proposing a new business model to Facebook’s senior management team. He called it “full reciprocity”.

Rather than sell access to APIs, the idea was that Facebook would agree to give developers access to its social graph – its data on its subscribers – if they agreed to publish back all of the social actions taken on their platform.

“We’re trying to enable people to share everything they want, and to do it on Facebook,” Zuckerberg explained. “Sometimes the best way to enable people to share something is to have a developer build a special-purpose app or network for that type of content and to make that app social by having Facebook plug into it.

“However, that may be good for the world, but it’s not good for us unless people also share back to Facebook and that content increases the value of our network.”

The decision to go for full reciprocity, rather than charging for API access, appears to be have been driven by a desire to maintain Facebook’s dominant market position: “The purpose of the platform is to tie the universe of all the social apps together so we can enable a lot more sharing and still remain the central social hub.”

In real terms, this decision meant that developers either had to play along or be denied access to the social graph their product was built on.

Facebook’s stealth war against competing developers

Facebook began sketching out plans to shut down developers’ access to Facebook users’ data unless they agreed to spend huge sums on Facebook’s advertising network, Neko.

Konstantinos Papamiltiadis, strategic partnership manager at the time, set out a plan to identify applications that Facebook didn’t want to share its data with, but did spend money on advertising.

“Communicate in one go to all the apps that don’t spend that those permissions will be revoked,” he said. “Communicate to the rest that they need to spend on Neko at least $250,000 a year to maintain access to the data.”

Companies deemed to be “actually competitive” should be blocked from being able to participate in Facebook’s mobile app install network, or Neko.

Zuckerberg, Sandberg, vice-president Justin Osofsky and other senior staff had discussed the ideas in January 2013 about competitors’ access to Facebook’s advertising for mobile apps.

One executive floated the option of charging competitors such as Twitter. But, he went on: “If folks want simple, I think we should block all actually competitive apps.”

Zuckerberg agreed: “I think we should block WeChat, Kakao and Line ads. Those companies are trying to build social networks and replace us. The revenue is immaterial to us compared to any risk.”

The list of blocked apps will be added to “as new potential competitive threats are surfaced”, the group decided.

Facebook saw messaging apps as a particular competitive threat. In March 2013, an app called MessageMe – marketing itself as a “super fun messaging app” – came to the attention of Facebook’s senior leadership team.

The app was growing and downloading data about its users’ friends from Facebook’s “friends.get” API at an alarming rate.

“In the first week after launch, MessageMe didn’t make any friends.get calls,” said Osofsky. “However, MessageMe is now up to 350 monthly average users (MAU) and made 333,000 friends calls last week. We will restrict their access to friends.get shortly.”

The team began a search to identify similar messenger apps that had hit Facebook’s radar, with a view to restricting their access to APIs at the same time to manage what had been a tough time for PR for the company recently.

Developers pressured to share personal data with Facebook

The internal discussions among senior Facebook executives re-enforced the idea that reciprocity was primarily designed to allow Facebook to extract more personal data from app users and that personal data was worth money for Facebook.

Vernal summed it up in an email to Facebook’s director of business development, Doug Purdy, and vice-president of partnerships, Chris Daniels.

“We gave a bunch of stuff ‘for free’ historically (data, distribution) and we’re now making you ‘pay’ for it via reciprocal value”

“We gave a bunch of stuff ‘for free’ historically (data, distribution) and we’re now making you ‘pay’ for it via reciprocal value,” he wrote.

But Facebook, now “midway through a painful transition”, had yet to tell its partner developers that, in future, if they wanted to be part of Facebook, they would have to pay for it by supplying data.

“In long-term negotiations with key partners we’re trying to lock them into the model that is going to be, rather than the model that currently exists,” said Vernal.

Managing ‘noisy and negative’ developers

As Facebook prepared to introduce its platform simplification project, its internal spin doctors mobilised to head off negative publicity.

One of the company’s directors of communications began identifying developers they feared might complain to reporters about Facebook’s restrictions on their access to data.

She emailed her colleagues in Facebook’s communications section: “We are putting [together] a list of developers who we think could be noisy and negative in [the] press about the changes we are making. Primarily, we think it will be the list of usual suspects from past policy enforcements.”

Facebook planned to manage its communications with what it regarded as potentially troublesome app developers who might react negatively to the platform changes.

The list included dating apps such as Tinder and those with names like Bang with Friends and Girls Around Me. They featured alongside mainstream apps such as Flipboard and publications including the Guardian, the Washington Post and the Wall Street Journal.

Although app developers appeared equal, internal communications reveal Facebook reserved special treatment for app developers that spent significantly more on advertising and benefited Facebook most financially.

Developers listed as Zuckerberg and Sandberg’s friends would get more favourable treatment. The lists are confidential, but journalists have managed to identify some members by exploiting Facebook’s privacy loopholes.

Zuckerberg’s friends, for example, include Alison Pincus, wife of Mark Pincus, the co-founder of Zynga, which developed the popular Facebook game, FarmVille, the co-creator of Mozilla Firefox and the chief executive of Airbnb, a reporter at Mashable discovered.

Strategy ‘sort of unethical’

Facebook’s planned changes to its platform, dubbed PS12N, raised alarms among Facebook’s own staff.

One of its software developers emailed his colleagues with the news that Facebook planned to give favourable access to friends data to some developers, while restricting API feeds to others that could pose a competitive threat.

“So we are literally going to group apps into buckets based on how scared we are of them and give them different APIs?” software engineer Bryan Klimt wrote.

“How do we ever hope to document this? Put a link at the top of the page that says, ‘Going to be building a messenger app? Click here to filter out the APIs we won’t let you use!”

What would happen, he asked, if a developer added a feature, such as messaging, that might make it a threat to Facebook? “Shit just breaks? And a messaging app can’t use Facebook login?”

The developers, who joined Facebook as part of its acquisition of Parse in 2013, felt instinctively that the decision was wrong. Even when one of Parse’s most senior managers pointed out that the number of developers considered competitors to Facebook would be small in absolute terms, that provided little comfort.

“It is sort of unethical – every contact app is a pure competitor,” said one, as they debated Facebook’s plans.

“Or every messaging app,” Klimt chipped in.

“Realistically, only the top five messaging apps will ever raise an eyebrow,” said the Parse executive. “So, I agree this sucks, but you are reading this too absolutely.”

Another developer wrote: “That feels unethical somehow, but I’m having difficulty explaining how. It just makes me feel like a bad person.”

From blacklisting to whitelisting

The social media company, however, offered selected developers full access to friends’ data through “whitelisting agreements” with Facebook.

All whitelisted companies used a standard agreement form called a Private Extended API Addendum, which reads: “Private Extended APIs means a set of APIs and services provided to FB by Developer that enables Developer to retrieve data or functionality relating to Facebook that is not generally available under Platform.”

Facebook allowed developers selected for whitelisting to access APIs that were otherwise unavailable, allowing them to access user data. By November 2013, Facebook was managing 5,200 whitelisted apps.

Private does not always mean private

Some of Facebook’s own employees had begun raising questions as early as 2011 when they discovered their private data was visible to other people in third-party apps connected to Facebook.

Simon Cross, a partner engineer, was surprised to discover data he had marked as private on his Facebook account could be seen by his friends who were using the Guardian newspaper app.

“If I use the Guardian’s app…I can set my reads to be visible to only me. However, the app can’t see this setting and makes my reads visible to my other friends who use the app within the app’s UI [User Interface] They’re getting complaints about this,” he wrote.

It emerged during internal discussions that the privacy settings people made in their Facebook accounts, using a system known as GDP, were invisible to third-party apps when they downloaded Facebook’s data.

Another employee asked: “Shouldn’t we apply the sharing rules of the GDP on top of the rules set in the app?” Otherwise, he suggested the privacy controls meant nothing and should be removed.

“Facebook needs to make it clearer that the privacy settings only protect privacy in Facebook, not necessarily the app,” wrote Carl Sjogreen, then director of product management for platform and mobile.

“There is no way apps can keep up with our privacy model and we are asking for trouble if we ask them to try. They should figure out what makes sense for their app and clearly communicate this to users.”

“Facebook needs to make it clearer that the privacy settings only protect privacy in Facebook, not necessarily the app. There is no way apps can keep up with our privacy model and we are asking for trouble if we ask them to try”

On 27 October 2012, Zuckerberg stated that he did not think there was much “data leak strategic risk” in the data sharing arrangements with developers, adding: “I think we leak info to developers, but I just can’t think of any instances where that data has leaked from developer to developer and caused a real issue for us.”

But three years later, staff were still raising questions over the privacy of their data.

Facebook allowed users to post photographs and comments and to keep them private by selecting an option known as Only Me, but it was not as private as Facebook’s own staff thought.

Connie Yang, a product designer at Facebook, discovered that posts she had shared on Facebook apps were not as private as she had thought. They could be seen by other users of the same app. “Isn’t this directly violating what we tell users is Only Me?,” she asked in an internal post.

Facebook was already aware of the problem, as other staff revealed that the issue was more a feature than a bug. One Facebook employee chipped in that some mobile apps, such as dating app Tinder, relied on it.

“In Connie’s case, the experience was poor,” he wrote. “In Tinder’s case, the experience of letting people explicitly choose to widen the audience of Only Me or friends photos to everyone using the app is pretty good.”

Zuckerberg narrowly avoided a catastrophic breach of privacy after issues with one application sparked an internal panic, previously reported by Computer Weekly.

Michael Vernal, the executive responsible for Facebook’s platform team, warned in an email in October 2013 that an issue with Login V4 could have been “near-fatal” for Facebook platform, Login, and other technology projects.

“If Mark [Zuckerberg] had accidentally disclosed earnings ahead of time because a platform app violated his privacy...literally, that would have basically been fatal for Login/Open Graph, etc,” he said, to retorts of “holy crap” from another executive.

“I want us to follow up on this and respond urgently here, but I also do not want this story spreading inside of Facebook or off of this thread at all. I can’t tell you how terrible this would have been for all of us had this not been caught quickly,” said Vernal.

Privacy rarely discussed

Facebook has claimed the API changes made in 2014 and 2015 were driven by concerns for its users’ privacy, but in the documents seen there is little mention of privacy. When privacy is mentioned, it is in the context of public relations rather than as the basis for strategic change.

Facebook launched version 4 of its Login software in 2014, which it said would give users control over the permissions granted to the app, as well as what data it shared back into to Facebook.

Ilya Sukhar, then head of developer products, wrote to his colleagues in the run-up to the launch, pointing out a privacy loophole with the software on the iPhone operating system, iOS.

“My concern is around the perception that we can’t hold our story together,” he wrote. “We’re going all-in on the user trust message as our reasoning for doing the v4 shakeup and it’d be sad if the TechCrunch article clearly pointed out there was an easy and obvious workaround on iOS.”

Facebook repeatedly cited privacy as a reason for restricting API access when “noisy” developers, unhappy about changes that threaten their businesses, need pacifying.

Facebook public relations manager Johanna Peace produced a plan for “proactive press activities” before shutting off access to developers to Facebook’s data.

The goal, she wrote, should be reminding and educating reporters on what’s going to happen; telling the big picture of why we’re making the changes (protecting people’s information); and generating some neutral/positive coverage that hits on our messaging, giving us something to point back to after 30 April 2015 in case reporters notice apps breaking.

When user privacy is mentioned outside of public relations, it is generally only in brief, as a side note, in the leaked documents.

For example, in an extensive email from Sam Lessin to Mark Zuckerberg, Lessin outlined the incentives each “party” has to use Facebook’s system.

He talked about users wanting more apps, better experiences, and that they “will eventually appreciate things like ever better targeted ‘ads’ as a real benefit”.

“I also think they fundamentally want control,” said Lessin, but without expanding on the idea.

Clash of the titans

Facebook’s senior management singled out business with companies that could offer reciprocal value back to Facebook for special treatment.

These “Titan Partners” also known as “Tier 0” included companies that were personal favourites of Zuckerberg, such as Netflix, Dropbox, Spotify and Foursquare, among others. Other potential Titan Partners included Nike, Pinterest, Evernote and games developer Zynga.

The conversations clearly show that Facebook was prioritising some companies over others.

Douglas Purdy, then director of product, expressed further concerns about the preferential treatment of some app developers in a message thread with Zuckerberg and other senior managers.

“In general, I am not a fan of per partner opaque deals as this is counter to the notion of a platform that treats developers equally,” he said.

Zuckerberg, however, suggested negotiating up to 100 deals as a path to figuring out the real market value of the data.

“The goal here wouldn’t be the deals themselves, but that through the process of negotiating them we’d learn what developers would actually pay (which might be different from what they’d say if we just asked them about the value), and then we’d be better informed on our path to set a public rate.”

The team decided to strike deals with the top five companies as an immediate next step.

“We should get clear on our hypothesis of what we want to get these folks to agree to give us in these deals. It can be a bit different on a company-by-company basis,” said Zuckerberg.        

Amazon and Tinder get special treatment

Facebook entered into deals with other key partners in which it gave extended API access in return for spending money on advertising.

Facebook gave Amazon’s birthday gift app access to the friends data, even though it was considered a competitor.

Jackie Chang, then a strategic partner manager, explained the decision in an email: “Amazon is an advertiser and supporting this with advertisement.”

Facebook had a similarly close relationship with Tinder. Internal emails show that Facebook had been working closely with Tinder’s founder and CEO, Sean Rad. Rad was part of “a trusted group” of advisors on Facebook’s Developer Advisory Board.

Konstantinos Papamiltiadis, a strategic partner manager for Facebook’ revealed: “We have developed two new APIs that effectively allow Tinder to maintain parity of the product in the new API world.”

And when Facebook wanted to reach a settlement with Tinder, that would allow it to use Tinder’s “Moments” trademark in a photo sharing app, Facebook offered Rad access to Facebook’s data through the social network’s Audience Network API.

Leaked documents ‘cherry-picked’

Facebook argues that the leaked documents seen by Computer Weekly were “cherry-picked” by application developer Six4Three, from documents placed under seal during a legal action it is bringing against Facebook in San Mateo County, California.

Six4Three, which developed an app called Pikinis to find friends wearing bikinis, is suing Facebook for cutting off the app from Facebook’s friends data.

The documents include an unpublished cache seized when the DCMS Committee dispatched Parliament’s serjeant-at-arms to arrest Ted Kramer, founder of Six4Three, during a visit to London.

Thousands of pages of documents were leaked anonymously to investigative journalist Duncan Campbell, an expert in computer forensics, who has shared them with NBC News, Computer Weekly and Suddeutsche Zeitung.

Facebook facing regulatory actions in several countries

Computer Weekly has revealed Facebook’s extensive lobby efforts to water down data protection regulations in several countries.

Facebook is facing several regulatory actions, which have had a direct impact on its share price, and a slew of legal investigations.

Facebook is under criminal investigation in New York over its data sharing deals with other major technology companies, including Microsoft, Amazon and Apple.

A grand jury in New York has subpoenaed records from at least two prominent smartphone manufacturers that have entered into partnerships with Facebook, giving them broad access to the personal information of millions.

Further investigations are underway at the US Federal Trade Commission, the justice department and the Securities and Exchange Commission.

The tech giant is being sued in Washington DC, where attorney general Karl Racine has alleged that the company’s “misleading privacy settings” allowed the Cambridge Analytica scandal to happen.

“Facebook failed to protect the privacy of its users and deceived them about who had access to their data and how it was used,” Racine said in a statement at the time.

Back across the Atlantic, the office of the Irish Data Protection Commission (DPC) has also disclosed that it is running 15 separate investigations into Facebook for alleged breaches of the European General Data Protection Regulation (GDPR).

The Information Commissioner’s Office (ICO) in the UK fined Facebook £500,000 for failing to protect users’ personal information in October 2018 – the maximum allowable, following the scandal over Cambridge Analytica’s use of Facebook users’ personal data to influence the Brexit referendum and the US elections.

MPs from several countries “called upon Mark Zuckerberg to attend unprecedented international joint hearing in London” in November 2018, as part of an inquiry into disinformation and fake news.

Zuckerberg refused to appear before the committee, and had his vice-president of policy solutions, Richard Allan, who is also a member of the House of Lords, questioned instead.

The inquiry’s report, released in February, saw the DCMS Committee calling for a Compulsory Code of Ethics for tech companies overseen by an independent regulator that had powers to launch legal action against companies breaching the code.

“I believe the future of communication will increasingly shift to private, encrypted services where people can be confident that what they say to each other stays secure and their messages and content won’t stick around forever. This is the future I hope we will help bring about”

Zuckerberg’s privacy pivot

In March 2019, Zuckerberg made an extraordinary announcement to redesign the Facebook platform to focus on privacy first.

His vision is to build a platform that has secure, private messaging at its core, and then to layer on top of that calls, video chat, stories, payments, commerce and other private services.

“I believe the future of communication will increasingly shift to private, encrypted services where people can be confident that what they say to each other stays secure and their messages and content won’t stick around forever. This is the future I hope we will help bring about,” said Zuckerberg.

Those with a more cynical view believe Zuckerberg has simply recognised a business opportunity and is seeking to pursue it, while at the same time seeking to avoid falling foul of new and emerging privacy legislation around the world.

One side of the story

Paul Grewal, vice-president and deputy general counsel at Facebook, gave the following statement to Computer Weekly in response to our enquiries:

“As we’ve said many times, Six4Three – creators of the Pikinis app – cherry-picked these documents from years ago as part of a lawsuit to force Facebook to share information on friends of the app’s users.

“The set of documents, by design, tells only one side of the story and omits important context. We still stand by the platform changes we made in 2014/2015 to prevent people from sharing their friends information with developers like the creators of Pikinis.

“The documents were selectively leaked as part of what the court found was evidence of a crime or fraud to publish some, but not all, of the internal discussions at Facebook at the time of our platform changes. But the facts are clear: we’ve never sold people’s data,” he said. 

This report has been prepared and published in conjunction with Duncan Campbell (UK), NBC News (US) and Süddeutsche Zeitung (Germany). Additional research for Computer Weekly by Crina Boros.