Facebook Spied on Snapchat Users With Its Secret Project

In 2016, Facebook initiated a secret project called “Project Ghostbusters” to intercept and decrypt network traffic between users of the Snapchat app and its servers. This effort aimed to gain insights into user behaviour and bolster Facebook’s competitive stance against Snapchat, as revealed by recently unsealed court documents. The project’s name, “Ghostbusters,” was a nod to Snapchat’s ghost logo.

Newly released documents from a federal court in California shed light on Meta’s (Facebook’s parent company) strategies to gain an edge over competitors like Snapchat, Amazon, and YouTube. Meta sought to analyze how users interacted with these platforms by decrypting their encrypted network traffic, which required developing specialized technology.

Facebook Spied on Snapchat Users With Its Secret Project

One document outlines Project Ghostbusters as part of Facebook’s In-App Action Panel (IAPP) program. This program employed a technique to intercept and decrypt encrypted app traffic from Snapchat users, later extending to YouTube and Amazon users, as detailed by the consumers’ lawyers.

Internal Facebook emails referenced in the documents provide insight into the project. In one email from June 9, 2016, Mark Zuckerberg expressed the need to find a way to obtain analytics about Snapchat despite its encrypted traffic, emphasizing the importance of Snapchat’s rapid growth.

Facebook’s engineers proposed using Onavo, a VPN-like service acquired by Facebook in 2013, as a solution. However, in 2019, Facebook shut down Onavo after it was revealed that the company had been paying teenagers to use it, allowing access to all their web activity.

Following Zuckerberg’s directive, the Onavo team developed “kits” for iOS and Android that intercepted traffic for specific subdomains, enabling the reading of otherwise encrypted traffic to measure in-app usage—a “man-in-the-middle” approach.

While some Facebook employees supported Project Ghostbusters, others, including Jay Parikh and Pedro Canahuati, expressed concern. Canahuati wrote in an email that no security person would be comfortable with such an approach, regardless of public consent.

In 2020, Sarah Grabert and Maximilian Klein filed a class action lawsuit against Facebook, alleging that the company deceived users about its data collection practices and unfairly targeted competitors using extracted data.

Amazon declined to comment on the matter, while Google, Meta, and Snap did not respond to requests for comment.