Facebook to Pay Hackers for Reporting Data Scraping Bugs and Scraped Datasets

Meta Platforms, the company formerly known as Facebook, has
announced that it’s expanding its bug bounty
program^[1] to start rewarding valid
reports of scraping vulnerabilities across its platforms as well as
include reports of scraping data sets that are available
online.

“We know that automated activity designed to scrape people’s
public and private data targets every website or service,” said Dan
Gurfinkel, security engineering manager at Meta. “We also know that
it is a highly adversarial space where scrapers — be it malicious
apps, websites or scripts — constantly adapt their tactics to evade
detection in response to the defenses we build and improve.”

To that end, the social media giant aims to monetarily compensate^[2]
for valid reports of scraping bugs in its service and identify
unprotected or openly public databases containing no less than
100,000 unique Facebook user records with personally identifiable
information (PII) such as email, phone number, physical address,
religious, or political affiliation. The only caveat is that the
reported data set must be unique and not previously known.

Should the requisite criteria be met, the company said it will
take appropriate measures, including legal actions, to remove the
data from the non-Meta website. This could also involve reaching
out to hosting providers like Amazon, Box, and Dropbox to pull the
data set offline, or working with third-party app developers to
address server misconfigurations. Reports concerning scraped
databases will be rewarded through matched charity donations of the
researchers’ choosing.

“Our goal is to quickly identify and counter scenarios that
might make scraping less costly for malicious actors to execute,”
Gurfinkel noted, adding “we want to particularly encourage research
into logic bypass issues that can allow access to information via
unintended mechanisms, even if proper rate limits exist.”

The move to curb unauthorized scraping, a technique referring to
the practice of extracting data from websites, comes as part of the
company’s efforts^[3]
to limit abuse^[4]
of people’s data on its platform in the wake of the infamous
Cambridge Analytica data scandal^[5] that resulted in the
personal information belonging to millions of Facebook users
harvested without their consent for political advertising.

The company said it has paid out over $14 million in bounties
since the inception of the program in 2011, with $2.3 million
awarded to researchers from more than 46 countries this year alone.
Most of the valid reports over the past 10 years have come from
India, the U.S., and Nepal, Meta pointed out.