How Facebook turned a VPN into a surveillance engine to spy on Snapchat, YouTube and more

In 2013, Facebook made a significant acquisition when it purchased the Israeli firm Onavo for approximately $120 million. Initially promoted as a VPN service aimed at safeguarding user data and minimizing mobile data consumption, the app's true purpose was far more intrusive. Users, under the impression they were enhancing their privacy, unknowingly granted Facebook unfettered access to their smartphones. Onavo enabled Facebook to track nearly every aspect of users' online behavior, including the apps they accessed, the duration of their usage, and the websites they visited. With over 33 million downloads, many believed they were securing their online activity, while in reality, they were unwittingly contributing to a vast surveillance operation. Legal documents and regulatory reports reveal that Facebook leveraged Onavo to detect emerging trends and monitor competition. The company meticulously analyzed the usage patterns of popular platforms such as Houseparty, YouTube, and Snapchat to gauge potential threats. Notably, Snapchat became a primary focus as its user base surged; however, the app's encrypted traffic made it challenging for Facebook to obtain detailed engagement data. This led to the inception of 'Project Ghostbusters,' a covert initiative aimed at circumventing Snapchat's encryption to gain insights into user interactions. The objective was clear: utilize the decrypted information to refine strategies, guide product development, and inform acquisition decisions. When Snapchat's CEO Evan Spiegel declined Facebook's $3 billion acquisition offer, Facebook retaliated by replicating Snapchat’s key feature through Instagram Stories, marking a pivotal moment in social media history. This wasn't merely about imitation; it represented a strategic use of internal surveillance to preemptively neutralize competitive threats and sustain market dominance. Despite Onavo's eventual ban from the App Store by Apple in 2018 for breaching data privacy regulations, Facebook swiftly pivoted. The company rebranded its surveillance efforts through a new initiative called Facebook Research, also known internally as Project Atlas. This program incentivized users, some as young as 13, to participate by offering payments of up to $20 per month in exchange for the same intrusive access to their activities. Apple's discovery of this initiative resulted in the revocation of Facebook's enterprise developer certificates, temporarily disrupting the functionality of its internal iOS applications, a decision seen as a significant enforcement move. In 2020, the Australian Competition and Consumer Commission (ACCC) took action against Facebook, accusing the company of misleading consumers regarding Onavo's privacy assurances. By 2023, Meta's subsidiaries faced penalties amounting to AUD 20 million for deceptive practices, marking an important moment of accountability for a major tech entity. This narrative extends beyond the tale of a dubious app. It illustrates how a leading tech giant crafted a surveillance apparatus cloaked as a privacy solution, exploiting user data to enhance its competitive edge. Even years later, Onavo serves as a stark reminder of the lengths to which corporations will go in the pursuit of data-driven power.