Meta accused of snarfing people's Snapchat data via traffic decryption

To spy on rival Snapchat and get data on how the app was being used, Meta – when it was operating as Facebook – allegedly initiated a program called Project Ghostbusters, which intercepted data traffic from mobile apps. And it used that data to harm its competitors' ad business. The name of the program was "an apparent reference to Snapchat's corporate logo, a white ghost on a yellow background," according to a recently unsealed court document [PDF]. Project Ghostbusters was run by Onavo, acquired by Facebook in 2013 and described by the US Federal Trade Commission as a "user surveillance company." Onavo offered a notional VPN service that was shut down in 2019 for – ironically – its lack of privacy. The Snapchat data-interception scheme is described in that newly unsealed court document as a "man-in-the-middle" approach, in which Facebook essentially paid people to snoop on their mobile phones. Facebook ran low-key studies with groups of willing participants – from teenagers to adults – who were rewarded for installing an Onavo-made research app that monitored their smartphone usage [PDF] to give the tech giant a better idea of how folks used their devices. That app, it's alleged, installed a root Certificate Authority allowing Facebook to intercept and analyze panel participants' internet usage. Not only did it enable Facebook to issue itself digital certificates to intercept people's encrypted SSL/TLS connections, it also quietly redirected Snapchat analytics traffic (and ...