Court docs: Facebook employees discussed security issues with long-lasting access tokens, one of the reasons behind Sept. 2018 breach, at least since Dec. 2017
Facebook's September 2018 breach was first framed as a surprise: the company said it discovered the issue on September 25 affecting roughly 50M accounts, then attributed it to three distinct bugs introduced in July 2017 in what became an attack touching ~29M people. The court documents reported here change the timeline's meaning — employees were discussing long-lasting access token problems internally as early as December 2017, nine months before attackers exploited them.
That matters because Facebook was already operating under an FTC consent decree it insisted it had not violated even when internal docs showed ~150 companies got more user data than disclosed. Evidence that engineers saw the token risk before the breach gives regulators and litigators a 'knew-but-didn't-fix' narrative to test against the company's own account of events.
First-order effects
Facebook's legal position shifts from 'we found and patched a novel bug chain' to 'the underlying token weakness was internally documented since December 2017' — directly relevant to FTC decree enforcement and any class-action claims over the ~29M compromised accounts.
The disclosure timeline itself becomes contested: statements that the September 25 discovery was the starting point now sit alongside court-documented internal discussion from nine months earlier.
Second-order effects
Regulators auditing Facebook's post-breach remediation will likely widen scope from the three named bugs to the broader token-lifetime architecture employees flagged, raising the cost and depth of any mandated security review.
Rival platforms face pressure to audit their own long-lived session and access token practices before their equivalents surface in litigation, since the court-docs route has now proven an effective way to expose pre-breach internal knowledge.
Third-order effects
If the pattern holds, breach accountability will hinge less on technical root cause and more on provable internal foreknowledge — pushing platforms toward documented, timestamped security-decision trails they must be willing to defend in court.
Long-lived access tokens themselves become a structural liability: expect industry drift toward shorter-lived credentials and tighter privileged-access controls as the default posture, since the alternative is now a documented legal exposure.
The trend: Platform breaches are increasingly adjudicated on when a company knew internally rather than when it disclosed publicly, with court-discovered documents becoming the decisive evidence.
The entire regulatory system around information security is bonkers as it incentivizes companies to hide non-PII breaches and put up legal shields if PII is taken. We need safe harbors for disclosure, fixed statutory damages and a competent investigatory body with subpoena power.
Because this is a civil lawsuit and the goal is to force a big settlement, the root cause analysis is compressed down to Facebook being negligent. This is ridiculous. FB probably has the third most advanced product security program in big tech, after MSFT and Google.
I was thinking of this over the weekend again, thanks to this story about the Facebook View As bug civil trial wrapping up. @LFDodds quotes from my deposition and the emails of several engineers. https://twitter.com/...
But there were mistakes made in not designing certain features for defense in depth, incorrect triaging of bugs and failures in internal communication. In a sane world, we would be able to learn from those mistakes instead of a fraction of the emails/depositions being leaked,
EXCLUSIVE: In Sep 2018, Facebook suffered its biggest ever data breach, affecting 29m people. But internal documents reveal that employees had been warning about a key security flaw for nine months beforehand - and it was not fixed. https://www.telegraph.co.uk/ ...
This is my shocked face... (⊙⊙)(☉_☉ )(⊙⊙) ¯\_(ツ)_/¯ （ ^_^）o自自o（ ^_^ ） Facebook was repeatedly warned of security flaw that led to biggest data breach in its history 'https://www.telegraph.co.uk/ ...
You can read the story, read the documents and take your own view on the thorny question of responsibility. What we do know is that if employees' warnings in 2017/18 had been heeded faster & more urgently, this breach would not have been possible on the same scale. C'est la vie.
FB further suggests that this was a reasonable decision. Access tokens issue alone could not have created the Sep 2018 breach. Nobody predicted that it would combine with other issues in this unprecedented way. Here's what its lawyers argued in court. https://twitter.com/...
There's much more in the full story, which you can read in @TeleTech here. But let's pause to note FB's side of the story, too. The company says that it didn't neglect the access tokens issue, and was working on it; it just didn't prioritise it urgently. https://www.telegraph.co.…
Here's one employee who had been concerned about access tokens, talking just after the breach about his “guilt” failing to prevent it. His chat partner is the engineer who first raised the issue back in Dec 2017. (Again, names redacted; this isn't a story about any one employee) …
One said: “No single team owned or prioritised the work to do even basic checks to make first party tokens less useful for attacks”. Another noted: “We had planned to migrate this access token issue but it was never done.” https://www.telegraph.co.uk/ ...
Employees first raised concerns about this use of tokens in Dec 2017. Here's the initial discussion thread, plus a passage from a forensic report commissioned by the plaintiffs (I've redacted employees' names so as not to single them out. Except @AlexStamos who is quite famous!) …
FB disputes any suggestion that it failed to act, saying that work had already begun to fix the problem when the hack occurred. Nevertheless, after the hack, some employees were pretty scathing about how the company had responded to reports which could have stopped it.
FB's lawyers would later describe this combination of glitches as “unforeseen” and “very obscure”. That's true - but on a deeper level, the attack would not have been possible if FB had not used such broad, long-lasting access tokens to enable basic features.
Last month, Facebook quietly settled one of those lawsuits, agreeing to implement a security plan. Yet documents disclosed as part of the suit show that employees repeatedly warned that something was wrong - and later expressed “guilt” that it could have been prevented.
The warnings continued throughout 2018. Here's two examples from May 2018 and July 2018, plus a potted history from the forensic report. In the July example, users were actually being gulled into handing over their own access tokens to unscrupulous third parties https://twitter.c…
In a moment of bleak comedy, this discussion is from an area of Facebook's internal social networks called Clowntown, apparently devoted to mocking company failures. These folks are returning to an OLD Clowntown thread from Dec 2017, saying “wait, did THIS cause the breach?” http…
When the breach was announced in 2018, it prompted an immediate flurry of lawsuits, investigations, an FBI investigation and an crisis press conference with Mark Zuckerberg. At the time, I had been reporting on the company for about two weeks. https://www.telegraph.co.uk/ ...
Facebook repeatedly warned internally of a huge security flaw that let hackers steal personal data from millions of its users almost one year before the crime, yet failed to fix it in time. Employees describe ‘remorse’ & ‘guilt’ over attack affecting 29M https://www.telegraph.co.…