Skip to content
Recently unsealed court documents from a federal case between consumers and Meta, Facebook’s parent company, shed light on a secret project initiated by Facebook in 2016 aimed at intercepting and decrypting network traffic between users of Snapchat and its servers.
“Project Ghostbusters” was conceived to comprehend user behavior and bolster Facebook’s competitive stance against Snapchat.
The court documents, made public by a federal court in California, offer insights into Meta’s efforts to gain a competitive edge over rivals like Snapchat and later competitors like Amazon and YouTube.
Given the encryption utilized by these platforms, Facebook needed to develop specialized technology to bypass encryption barriers.
One document outlines Project Ghostbusters as part of Facebook’s In-App Action Panel (IAPP) program, which employs techniques to intercept and decrypt encrypted app traffic from Snapchat and later from YouTube and Amazon users.
Internal emails from Facebook executives, including CEO Mark Zuckerberg, underscore the company’s determination to obtain analytics about Snapchat despite its encrypted traffic.
Engineers at Facebook proposed executing the project using Onavo, a VPN-like service acquired by Facebook in 2013. Onavo was later shut down in 2019 following revelations of its data collection practices involving teenagers.
The proposed solution involved deploying kits on iOS and Android devices and intercepting traffic for specific subdomains to measure in-app usage—a method referred to as a “man-in-the-middle” approach.
This approach allowed Facebook to access unencrypted network traffic before encryption occurred, facilitating detailed in-app activity measurement.
However, dissenting voices within Facebook, including Jay Parikh, the then-head of infrastructure engineering, and Pedro Canahuati, the then-head of security engineering, expressed concerns about the ethics and security implications of Project Ghostbusters.
Canahuati highlighted discomfort with the lack of consent from the general public and the ethical dilemmas posed by such data collection practices.
In 2020, Sarah Grabert and Maximilian Klein filed a class action lawsuit against Facebook, alleging that the company had deceived users about its data collection activities, exploited extracted data to identify competitors, and unfairly competed against emerging companies. These revelations further scrutinize Facebook’s data practices and raise questions about the ethical boundaries of data collection and competition in the tech industry.
