Project Ghostbusters: How Meta snooped on users' Snapchat traffic to plan competing strategy

Recently unsealed court documents from a federal case between consumers and Meta, Facebook's parent company, shed light on a secret project initiated by Facebook in 2016 aimed at intercepting and decrypting network traffic between users of Snapchat and its servers.

Dubbed "Project Ghostbusters," the endeavour was conceived to comprehend user behaviour and bolster Facebook's competitive stance against Snapchat.

The court documents, made public by a federal court in California, offer insights into Meta's efforts to gain a competitive edge over rivals like Snapchat, as well as later competitors including Amazon and YouTube.

Given the encryption utilized by these platforms, Facebook needed to develop specialised technology to bypass encryption barriers.

More from Tech

One document outlines Project Ghostbusters as part of Facebook's In-App Action Panel (IAPP) program, employing techniques to intercept and decrypt encrypted app traffic from Snapchat, and later from YouTube and Amazon users.

Internal emails from Facebook executives, including CEO Mark Zuckerberg, underscore the company's determination to obtain analytics about Snapchat despite its encrypted traffic.

Engineers at Facebook proposed leveraging Onavo, a VPN-like service acquired by Facebook in 2013, to execute the project. Onavo was later shut down in 2019 following revelations of its data collection practices involving teenagers.

The proposed solution involved deploying kits on iOS and Android devices, intercepting traffic for specific subdomains to measure in-app usage — a method referred to as a "man-in-the-middle" approach.

This approach allowed Facebook to access unencrypted network traffic before encryption occurred, facilitating detailed in-app activity measurement.

However, dissenting voices within Facebook, including Jay Parikh, the then-head of infrastructure engineering, and Pedro Canahuati, the then-head of security engineering, expressed concerns about the ethics and security implications of Project Ghostbusters.

Canahuati highlighted discomfort with the lack of consent from the general public and the ethical dilemmas posed by such data collection practices.

In 2020, a class action lawsuit was filed against Facebook by Sarah Grabert and Maximilian Klein, alleging that the company had deceived users about its data collection activities, exploited extracted data to identify competitors, and unfairly competed against emerging companies. These revelations provide further scrutiny of Facebook's data practices and raise questions about the ethical boundaries of data collection and competition in the tech industry.

(With inputs from agencies)