David Bridges
The tussle between social media giant Meta (Facebook) and online Indian news publication The Wire heightened as the latter defended its article that questioned Metas’s secret XCheck programme that was published last week.
Meta, which owns WhatsApp, Facebook and Instagram, accused The Wire of publishing baseless and fabricated stories regarding the XCheck programme. The online media house claimed that Instagram gave discretionary privileges to BJP IT cell head Amit Malviya to take down posts (among other things).
In its latest response to Meta’s allegations, The Wire stated that before publishing Meta’s policy communications director Andy Stone’s leaked email conversation, one of its reporters had sent a test email via Superhuman, which allows the sender to know when the email has been opened by the recipient.
The reporter received a notification that the test email had been opened by the receiver, in this case, Andy Stone, said The Wire. The media house stated that sources in Meta leaked information that Stone uses a @meta.com email ID for external communications and his @fb.com for internal communications, in order to track any leaks and to determine if the leak was within the organisation or outside.
The Wire further stated that it uses a Python-based open-source tool called dkimpy (DomainKeys Identified Mail) to verify its email authenticity. That is to determine whether an email came from the sender using a specific domain or whether the body of attachments in the email has been tampered with in any way.
The Wire used dkimpy to ascertain whether the email from Stone was real or not, and it was. It added that before investigating the whole episode, it reached out to a trusted source that has been working in Meta for years.
“After Stone reacted to our story on Malviya’s XCheck privileges on Twitter by claiming that the document we quoted ‘appears to be fabricated’, we reached out to a source whom we trust and know to be a highly-placed Meta employee. This individual – whose identity and position we know and whom some of us have met in person as well – is the one who shared with us Stone’s email expressing consternation at the leak of the Instagram document The Wire had published. The source also shared the email message file, including the header source, email metadata and the full message with The Wire,” the online news publication stated.
Commenting on the ongoing war between Meta and The Wire, Hyderabad-based data activist Srinivas Kodali tweeted about security research. He said, “I know every cybersecurity researcher wants to weigh in on wire reporting on meta schooling them on how to do security research. Beyond DKIM verification, videos of internal portals, they verified their sources with pay slips & there were multiple sources. Demand more from facebook.”
Background of The Wire’s Meta article
On October 10, The Wire exposed Meta’s XCheck programme where it accused the social media giant of giving the Bharatiya Janata Party (BJP) IT cell president Amit Malviya exclusive rights of allowing to flout the company’s privacy rules by taking down any post which is bad press for the national political party.
In its defence, Meta ferociously denied any such claims and slammed The Wire for publishing two stories, which, according to Meta (formerly Facebook) Chief Information Security Officer Guy Rosen were “outlandish and riddled with falsities.”
“These stories are fabrications. The stories are simply incorrect about the cross-check programme, which was built to prevent potential over-enforcement mistakes. It has nothing to do with the ability to report posts, as alleged in the article,” Rosen posted on Twitter.
The Wire in its response posted screenshots of Meta’s policy communications director Andy Stone’s email asking his team how the information regarding XCheck got leaked. Andy’s email also asked for putting the journalist and The Wire’s founding editor Siddharth Varadarajan’s names to be put on the ‘watchlist’.
“The reporter and The Wire’s founding editor Siddharth Varadarajan must immediately be added to this “watchlist”, so that “any communication to them from our staff… is directly reported to me,” Andy’s email reportedly stated.
