A Thursday evening software update at Facebook accidentally allowed anyone to view exactly who is posting under the accounts of public figures, businesses and other entities, according to Wired.
8The result? For starters, some 3 million followers of teenage climate activist Greta Thunberg have been reading posts written by her father, Svante Thunberg, and a climate activist in India who serves as a delegate at the UN’s Climate Change organization, Adarsh Prathap. Thunberg, Inc. claims Greta is still the one writing the content.
Greta, Inc. explained this in a Saturday Facebook post purporting to be the young climate activist.
“Some people have been asking who manages this page. First of all, since last spring I only use Facebook to repost what I write on my Twitter and Instagram accounts,” reads the post, in which ‘she’ says she tried Facebook “early on,” but didn’t like it, so she uses “my father Svantes account to repost content.”
“The rest that is shared on Facebook is reposted from Twitter and Instagram by the guy who founded the Greta Thunberg Facebook page long before I knew it existed. His name is Adarsh Prathap and he lives in India. Since a lot of people thought it was my official page in the beginning I asked if I could co-manage it and he said yes.“
Greta claims to have written all the content posted by her father and Prathap.
In other words, “of course it’s not me silly – you should have known I just ‘co-manage’ the fan page.”
Except – by all outward appearances it appeared to be her page alone.
Facebook’s ‘page transparency’ shows Greta as the confirmed owner – with the only clue suggesting she might have help being a page manager located in India.
According to Facebook, the flaw was quickly fixed – but not before the people behind famous accounts were revealed and shared on public forums such as 4chan.
“We quickly fixed an issue where someone could see who edited or published a post on behalf of a Page when looking at its edit history,” said the company in a statement. “We are grateful to the security researcher who alerted us to this issue.”
Facebook says the bug was the result of a code update that it pushed Thursday evening. It’s not something most people would have encountered on their own, since it took navigating to a Page, viewing an edit history, and realizing that there shouldn’t be a name and profile picture assigned to edits to exploit it. Still, despite the Friday morning fix, screenshots circulated on 4chan, Imgur, and social media appearing to show the accounts behind the official Facebook Pages of the pseudonymous artist Banksy, Russian president Vladimir Putin, former US secretary of state Hillary Clinton, Canadian prime minister Justin Trudeau, the hacking collective Anonymous, climate activist Greta Thunberg, and rapper Snoop Dogg, among others.
Facebook points out that no information beyond a name and public profile link were available, but that information isn’t supposed to appear in the edit history at all. And for people, say, running anti-regime Pages under a repressive government, making even that much information public is plenty alarming. –Wired
“People who run sensitive Pages from their own Facebook should now consider that their identity may be known,” said Lukasz Olejnik independent privacy adviser and Oxford University Center for Technology and Global Affairs. “While mistakes happen, this one is unexpected.”