Finding Facebook Friends Through Lens Scratches

I spend a lot of my life talking to people about all the ways data is harvested about you. This post begins a series where I delve deeper into some of the more surprising ways tech companies are collecting data about you.

Our first example comes from Facebook. Say you’re at a conference and someone you don’t really know takes a picture of you at a reception. You like the picture and ask them to send it to you. Someone else at the reception, unbeknownst to you, does the same thing. You each post the pictures taken by this stranger to your Facebook pages. Facebook analyzes the patterns of lens scratches and dust on the camera lens that appear almost invisibly in the picture. From this, they can tell that the photo of you and the other person were taken by the same camera at about the same time, and guess you might know each other.

Why does Facebook do this? To feed their "People you may know" section, which recommends friends to you. This is one of the ways Facebook keeps you engaged with the platform, so they really want to know who to connect you to.

Even if you cleaned the lens between pictures, Facebook may use other metadata, like the number of the picture file names (e.g. 100032.jpg and 100033.jpg) to help guess the pictures were taken by the same camera.

Facebook's patent for identifying pics taken by the same camera

Source: USPTO/Facebook Patent

It is unclear if or how Facebook is using this technology currently. It was uncovered in a patent, and in 2018, Facebook said they had not implemented it. However, why patent it if they never planned to do it? We have no insight into what Facebook is doing behind the scenes and thus can't know if they ever decided to deploy this on the platform.

Facebook's attempt to link people in the past has caused headaches. Wired reports "Facebook's algorithm has linked psychiatric patients seeing the same doctor, exposed the identities of attendees at anonymous support groups to one another, outed sex workers to their clients and suggested to victims of violence that they should friend their abusers."

For us as individuals, this is one of those technologies that goes well beyond what we intuitively think may be revealed though our actions. For me, this raises serious concerns about consent. I personally am not ok with Facebook doing this type of analysis on my own data, but as many examples in this forthcoming series will show, our consent is not required and largely not a concern for the companies seeking to understand our secrets.