Thread by @smdiehl

I don't think it's widespread public knowledge how social media companies try and fail to protect against employees prying on users. But it's a lot more widespread than the public knows and it here's how it happens... 🧵

https://twitter.com/josephfcox/status/1414990090703568896

So basically social media companies have giant databases that store user accounts, messages, profiles and these are separate tables in the databases. Associated with each user is something called a primary key or unique user identifier.

Access to the databases for rank and file employees usually has some "safety pre-processor" where all queries (written in a language called SQL) are sent to it are scanned to determine if they are looking up a specific individual or doing bulk queries.

A bulk query would be like "all users in Argentina above the age of 30" to target ads for. A individual query would be "find all messages by Elizabeth with userid 1275068417".

The former are allowed, doing the later will get you fired.

However scanning SQL queries for malicious intent is a really hard problem, and clever developers can craft queries equivalent to something like:

"find all messages by Elizabeth with userid (76 << 21 << 3) + 1"

Using bitwise and math expressions in SQL to obscure the userid.

Or you can craft bulk queries that are so specific that they could only refer to one person in the database.

"find all messages by women born on September 7, 1955 who live on Northfield Blvd in Denver and are single"

It's an important to know about because we should not assume these companies are self-policing themselves or being transparent about employee abuse. There's a incentive for them to lie and cover it up when it happens, and users should have a right to know if and when it happens.