In 2013, Facebook bought an Israeli VPN app for $120M and turned it into a surveillance tool that spied on 33M+ users entire phones for years. This helped Zuck buy WhatsApp for a whopping $19B and break Snapchat's encryption. The app was called Onavo Protect. It was sold as a free VPN that would secure your data and cut your mobile data usage. The justification was mundane and technically true. A VPN routes traffic through a remote server, and the server it routed through belonged to Facebook. In reality the routing was the product. Every request leaving the handset passed through infrastructure Facebook controlled, and the company kept a record of what passed through it. Captured: - apps installed on the device - session length per app - websites visited, with timestamps - volume of data moved This was not market research. It was an early-warning radar for competitors. Onavo data reportedly showed WhatsApp carrying messaging volume far above Messenger's. In February 2014, Facebook announced it was acquiring WhatsApp for $19 billion. There was just one catch. Facebook had offered roughly $3 billion in cash for Snapchat in November 2013 and been turned down by Evan Spiegel, then 23; nearly three years later Snapchat's traffic was encrypted, and Onavo could see that data was moving but not what it was. On 9 June 2016 Mark Zuckerberg wrote to his executives that the company needed "a new way to get reliable analytics about them." The effort was codenamed Project Ghostbusters, after the ghost in Snapchat's logo, and it sat inside a program called the In-App Action Panel. About a month later, in July 2016, Onavo engineers proposed kits installed on iOS and Android that would intercept traffic for specific subdomains, described in the email itself as a man-in-the-middle approach. The kit installs its own root certificate on the handset, so the phone trusts the interceptor and hands over the request in the clear. Nothing is broken. The trust model is simply pointed somewhere else. This ran on a panel of selected devices, not across all 33 million installs, and the technique was later extended to YouTube from 2017 and to Amazon from 2018, while Onavo's internal charts on rival app adoption sat among the documents released by the UK Parliament's DCMS committee in 2018. In August 2018 Apple removed Onavo Protect from the App Store for violating its data-collection rules, and Google Play pulled it in February 2019. Running alongside Onavo since 2016 was a second program, Facebook Research, which paid participants aged 13 to 35 between $10 and $20 a month for root-level access to their phone's network traffic. Its code contained numerous references to Onavo. TechCrunch published it on 29 January 2019. Apple revoked Facebook's enterprise developer certificate the following day, breaking the company's internal iOS apps worldwide. Australia's competition regulator separately sued Facebook over the representations Onavo Protect made between February 2016 and October 2017. Plaintiffs in the antitrust case that unsealed these documents in March 2024 did not describe the program as merely anticompetitive. They described it as criminal, and alleged Facebook's own lawyers were closely involved in designing and expanding it. Some of the company's senior engineers had objected internally. A privacy product is a collection point with better branding. It was downloaded 33 million times by people who wanted their data protected. They got their data measured, and Facebook got a list of what to buy or clone.