Meta CTO says employee-tracking data landed ‘where it wasn’t supposed to go’

Meta CTO Andrew Bosworth revealed that a researcher moved sensitive employee keystroke and mouse-tracking data to an unauthorized internal location, forcing the company to pause its Model Capability Initiative. The program, which collected data from most US employees without opt-out, faced backlash and privacy concerns, and Bosworth also cited data redundancy as a reason for expanding opt-outs.

Meta’s chief technology officer has given the fullest account yet of the mishap that forced the company to halt its most contentious AI project, the keystroke-logging scheme it calls the Model Capability Initiative. Andrew Bosworth said a researcher had moved sensitive employee data somewhere it was never meant to sit, though he insisted there was no outside intrusion. Speaking to The Atlantic chief executive Nicholas Thompson in an interview released on Wednesday and filmed in late June, Bosworth described the data as “quite secure,” with only a handful of people able to reach it. The trouble, he said, came from within. It was the latest turn in a saga that has run from tracking software on staff laptops https://thenextweb.com/news/meta-employee-keystrokes-mouse-movements-ai-training to a company-wide pause https://thenextweb.com/news/meta-pauses-mouse-tracking-data-security . “One of the researchers who was working downstream with that data, and there was no breach here, but had put it in a place it wasn’t supposed to go,” Bosworth told Thompson. The information, in a transformed state, had “landed someplace that it shouldn’t have landed internally,” he added, saying Meta did not suspect foul play. The company was “locking the whole thing down” until it could establish what had happened, he said. Meta had paused the programme in June after a leak left sensitive employee data readable across the organisation, according to screenshots seen by Business Insider. The Model Capability Initiative was introduced in April. It involved installing software on the majority of Meta’s US employees to record their keystrokes and mouse movements, the raw material for training the company’s AI models. Meta’s insistence that staff could not opt out drew a fierce backlash. “We have carefully designed this program with privacy safeguards, and while we have no indication at this time that any data was improperly accessed by Meta employees, we’re pausing it while we investigate,” a Meta spokesperson told Business Insider in June. The company declined to comment further for the follow-up. The initiative arrived at a bruising moment for staff. Bosworth himself said during an internal meeting that employee morale https://thenextweb.com/news/meta-mouse-tracking-protest-layoffs was “probably one of the worst it’s ever been” in Meta’s two-decade history, as layoffs and a heavy pivot to AI unsettled the workforce. Resistance to the tracking was immediate and organised. More than 1,600 employees signed a petition against the software, and one office reportedly nicknamed it the “Employee Data Extraction Factory.” Privacy lawyers separately warned that the tool risked collecting European employee data https://thenextweb.com/news/meta-mci-employee-mouse-tracking-eu-gdpr-collision in ways that could clash with the GDPR. In the interview, Bosworth offered a second reason the project had faltered, one rooted in the science rather than the politics. The scheme was gathering too much of the same thing, he said, when what an AI model really needs is variety. “Variance is far more important than a high volume of the same thing that gets collapsed into one example, basically,” he told Thompson. That realisation, he said, prompted Meta to widen the opt-outs it had initially withheld. “So that was why, a couple of weeks after we initially launched it, we added expanded opt-outs for people who didn’t want to do it,” Bosworth said. “A pause, infinite pause. Whenever you don’t want to have it, just press pause.” That marks a softening from the original no-opt-out policy, which Meta had earlier tried to blunt with a 30-minute reprieve https://thenextweb.com/news/meta-will-let-employees-stop-being-tracked-for-30-minutes-at-a-time at a time. Whether the programme returns in its original form is unclear. Bosworth cast the pause as a precaution rather than a retreat, but the episode has handed critics inside and outside the company a case study in how surveillance built to feed AI can turn on the workforce it was meant to measure. For now, the keystroke logging is dormant, the investigation continues, and the researcher at the centre of the mishap remains unnamed. What Meta does with the data it has already gathered is the harder question the CTO left unanswered. Get the TNW newsletter Get the most important tech news in your inbox each week.