Five Driving Forces in the Tech Sector and the Future of Meta

With 3 Billion Facebook users worldwide, the strategic marketing the company has ginned up about the impending arrival of the metaverse, the ongoing impact of  -mis, disinformation, information disorder, and the ongoing hobbling of the U.S. cognitive infrastructure – Meta matters.  

The following post is organized around five driving forces in ‘Big Tech’ (and how they have manifested in or had a recent impact on the Meta):

1. Ongoing Tech Sector Layoffs 
2. Generative AI – Meta Introduces Open Source, Multisensory AI Model
3. Cybersecurity and the Social Media Platform Attack Surface
4. Social Media and Cognitive Infrastructure
5. Computational Power: On-Chip Innovation 

1 – Ongoing Tech Sector Layoffs 

One tech commentator frames the current technology sector layoff spree as an extension of the permission structure created by Elon Musk with the layoffs at Twitter:  “The biggest impact in business this year, is not AI, it is not supply chains, it is the sonic boom heard around the world:  Elon Musk taking Twitter from 7,500 employees down to a 1000, and he did it in like 6 to 9 months. I do not think that has ever been done at a company that was break even and not in immediate distress. I have never seen….when he came into the company, it was losing money on a cash flow basis, but it was break even-ish.  There was not a burning platform other than the debt he took on.  I think it is a minimum viable product” (1).  He goes on to characterize the macro forces at work in the tech sector workforce:  

OODA Loop Sponsor

“In the information economy, the balance between capital and labor likely swung too far toward labor. Wall Street bankers decided they could do Zoom meetings and proofread deal docs at Starbucks. Big Tech was particularly under the gun, offering not just larger and larger pay packages, but a raft of perks (e.g. valet parking, red-wine-braised short ribs, and free blankets), while loading up on employees — all of which created upward pressure on wage inflation. 

Then things changed. First, Apple added opt-in tracking to iOS, threatening the ad-supported ecosystem. Then, the impact of less free money and a return to supply chain normalcy freed up the natural business cycle, and companies (and their shareholders) realized they couldn’t keep increasing their headcount 20% each year. The balance between capital and labor in the growth economy has reverted. Tellingly, these layoffs have largely been confined to tech, a relatively small portion of the economy the media covers obsessively. Perception bests reality when headlines report a five-figure layoff every week, and nobody does the math on the broader employment picture. One of the great externalities in society is an ad-supported ecosystem that turns attention to capital, resulting in a catastrophizing of all media. (2)

Source:  Disinflation | No Mercy / No Malice (profgalloway.com)

Meta Cuts 10,000 More Workers After Scrapping NFT Plans—Is the Metaverse Still On?

Zuckerberg framed the latest cuts as being part of Meta’s broader “year of efficiency” campaign

Meta’s workforce ballooned in recent years as the Facebook parent company signaled its ambitions for the metaverse—but recent moves suggest that it is feeling the sting of changing tech trends and rough market conditions. The company…announced another round of layoffs, one day after saying that it was “winding down” support for NFTs. Co-founder and CEO Mark Zuckerberg wrote in a post today that Meta will shed about 10,000 further employees in the months ahead across multiple waves, as well as close about 5,000 current listings for open positions.

The moves will affect its recruiting department…its tech groups in April…and business groups in May. Meta previously laid off about 11,000 employees in November [2022], representing about 13% of its workforce at the time, per CNBC.

As of December 31, 2022, Meta reported having a headcount of 86,482 people across all divisions—a 20% jump from the year prior—but said that the tally still included most of the people included in the November layoffs. Zuckerberg framed the latest cuts as being part of Meta’s broader “year of efficiency” campaign, in which the social media giant attempts to continue ahead with a leaner team while flattening its organizational structure, “canceling lower-priority projects,” and optimizing tools and processes across the company.

What does this mean for the metaverse then? Meta made a lot of noise in 2021 around the idea of the future 3D internet, changing its company name to reflect what Zuckerberg described as a new frontier for the dominant tech company. The news helped spur interest around Web3 metaverse games, as well, with virtual land NFT plots surging in value.

But metaverse buzz quieted down in 2022 amid an array of backlash—to the idea of an immersive internet, Meta’s early version of it, and the rising costs of digital real estate. (2b)

2 – Generative AI – Meta Introduces Open Source, Multisensory AI Model

Two segues into the generative AI gestalt in the tech sector- and Meta’s position within it.  The first is a macro view  of AI-based job destruction or creation:

“The chaser dropped on November 30, when every knowledge worker (reportedly) met their replacement: ChatGPT. With more than 30 million users, ChatGPT is arguably the fastest-growing product in history. (The iPhone sold 6 million units in its first year; granted, they cost $499 each and ChatGPT is free.) I used to say about WFH that if your job can be done from Boulder, it can be done from Bangalore. Well, in 2023, the new Bangalore may be ChatGPT.  Inflation is about supply, demand, and psychology, and the psychology of ChatGPT is that it may not be a good time to quit your job. Unless, of course, you’re joining an AI startup. History tells us the innovation in AI will likely create more jobs than it destroys.” (2)

The second –  AI as a priority at Meta, which “has increasingly pivoted its messaging towards the renewed fervor around artificial intelligence (AI) thanks to the success of rival OpenAI’s ChatGPT. Indeed, Zuckerberg’s post today mentions AI ahead of the metaverse among technologies that Meta is focused on. ‘Our single largest investment is in advancing AI and building it into every one of our products,’ he wrote. ‘Our leading work building the metaverse and shaping the next generation of computing platforms also remains central to defining the future of social connection.’”  In Meta’s Q4 2022 earnings call on February 1, Zuckerberg said that the “major technological waves driving our roadmap are AI today and over the longer term the metaverse,” adding that the firm’s “priorities haven’t changed since last year.”  (3)

Meta open-sources multisensory AI model that combines six types of data

The new ImageBind model combines text, audio, visual, movement, thermal, and depth data. It’s only a research project but shows how future AI models could be able to generate multisensory content.

The idea is that future AI systems will be able to cross-reference this data in the same way that current AI systems do for text inputs. Imagine, for example, a futuristic virtual reality device that not only generates audio and visual input but also your environment and movement on a physical stage. You might ask it to emulate a long sea voyage, and it would not only place you on a ship with the noise of the waves in the background but also the rocking of the deck under your feet and the cool breeze of the ocean air.” (4)

3 – Cybersecurity and the Social Media Platform Attack Surface

Speaking of ChatGPT as it relates to future cybersecurity threats for social media platforms:

“Security researchers have identified another threat leveraging the popularity of ChatGPT to spread malware and conduct nefarious activities. The latest attack is a fraudulent Chrome extension masquerading as ChatGPT. The threat actors behind the application forked a legitimate open source extension and added malicious code to steal Facebook session cookies from victims. The threat actors behind the extension have also created malicious sponsored search engine results in order to promote the application.

The fraudulent extension is reportedly difficult to distinguish from the legitimate version, security researchers state. The malicious code steals cookies and encrypts and exfiltrates them, allowing threat actors to obtain on-demand access to compromised accounts. In this instance, the threat actors change the log in details and lock the user out.” (5)

Meta: Chinese disinformation network was behind London front company recruiting content creators

“A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta. In a report published [in May], Meta revealed it had removed more than 100 accounts on Facebook and dozens on Instagram connected to the operation targeting “multiple internet services,” including almost all of the major social media platforms. The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited.

London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta. While the actual operators of this network attempted to conceal their identities, Meta said its investigation had “found links to individuals in China associated with Xi’an Tainwendian Network Technology, an information technology company.” The London operation created fake personas impersonating companies and institutions in the U.S. and EU, initially making posts mimicking the entity before switching to publishing negative commentary about Uyghur activists and critics of the Chinese state.” (6)

Meta’s Adversarial Threat Report, First Quarter 2023 | Meta (fb.com)

Released May 3rd, By Ben Nimmo, Global Threat Intelligence Lead, and Nathaniel Gleicher, Head of Security Policy

• We took action against three separate cyber espionage operations in South Asia linked to a group of hackers known in the security industry as Bahamut APT, another group known as Patchwork APT and a state-linked group in Pakistan.
• We took down six CIB networks — in the United States and Venezuela, Iran, China, Georgia, Burkina Faso and Togo — targeting people around the world and across many internet services.

Today, as part of our quarterly threat reporting, we’re sharing a number of security updates, including our Q1 Adversarial Threat Report and insights into our work against malware campaigns.

Over the past five years, we’ve shared our findings about threats we detect and remove across our technologies. In this threat report, we’re sharing information about six networks we took down for violating our policies against coordinated inauthentic behavior (CIB) and three cyber espionage operations we took action against. We have shared information about our findings with industry partners, researchers and policymakers. Here are the key insights from our first quarter 2023 Adversarial Threat Report:

We took action against three cyber espionage operations in South Asia. One was linked to a group of hackers known in the security industry as Bahamut APT (advanced persistent threat), one to the group known as Patchwork APT, and another to the state-linked actors in Pakistan. Here is what stood out from our threat research:

• Diversifying social engineering efforts: These APTs relied heavily on social engineering and invested in making some of their fake accounts look like more varied and elaborate fictitious personas they created across the internet so they can withstand scrutiny by their targets, platforms, and researchers. While we saw them continue using traditional lures like women looking for a romantic connection, they also posed as recruiters, journalists or military personnel.
• Continued reliance on low-sophistication malware: This investment in social engineering means that threat actors did not have to invest as much on the malware side. Our investigation into these APTs showed that cheaper, low-sophistication malware can be effective in targeting people when used together with social engineering. In fact, for two of these operations, we observed a reduction in the malicious capabilities in their apps, likely to ensure they can be published in official app stores.
• Impact of public disruptions and threat reporting: In response to the security community continuing to disrupt these APTs, these groups have been forced to set up new infrastructure, change tactics, and invest more in hiding and diversifying their operations in order to persist, which likely degraded their operations.

We also took down six covert influence operations for violating our policy against CIB. These unconnected networks originated in the United States, Venezuela, Iran, China, Georgia, Burkina Faso and Togo. More than half of them targeted audiences outside of their countries. We removed the majority of these operations before they were able to build authentic audiences. Here is what stood out from our threat research:

• Creating fictitious entities across the internet: In an attempt to build credibility, nearly all of these operations invested in creating fake entities, including news media organizations, hacktivist groups and NGOs. They operated on many services, including on Facebook, Twitter, Telegram, YouTube, Medium, TikTok, Blogspot, Reddit, WordPress, freelancer[.]com, hacking forums and their own websites.
• Fake hacktivists from Iran: The operation from Iran posted claims of having hacked organizations in Israel, Bahrain and France, including news media, logistics and transport companies, educational institutions, an airport, a dating service and a government institution. This is not the first time an Iran-origin operation claimed to have hacked government systems; a similar claim was promoted by another CIB network we removed ahead of the 2020 US election.
• For-hire operations: As we called out in our past reporting, we continue to see for-hire organizations behind covert influence operations globally, with half of the networks in this report attributed to private entities. This includes an IT company in China, a marketing firm in the United States, and a political marketing consultancy in the Central African Republic.
• The evolution of China-origin operations: This report brings the total of the China-origin CIB networks we removed since 2017 to six, with half of them reported in the last seven months. These latest takedowns signal a shift in the nature of the China-based CIB activity we’ve found with new threat actors, novel geographic targeting and new adversarial tactics. However, we continue to find and remove them before they are able to build their audience. These networks experimented with a range of tactics we haven’t seen in China-based operations before, although we’ve observed them elsewhere over the years, including in operations linked to troll farms and marketing and PR firms. The latest behaviors included creating a front media company in the West, hiring freelance writers around the world, offering to recruit protesters and co-opting an NGO in Africa.

We know that adversarial threats will keep evolving in response to our enforcement and that new malicious behaviors will emerge. We’ll continue to refine our enforcement and share our findings publicly.

We are making progress in rooting out this abuse; it is an ongoing effort and we’re committed to continually improving to stay ahead.  On May 12, the Irish Data Protection Commission (IDPC) plans to issue a decision on whether to stop Meta from transferring personal data to the United States. The IDPC is Meta’s lead European Union privacy regulator under the General Data Protection Regulation (GDPR), Meta’s 10-Q for Q1 2023 stated.

Meta discussed the upcoming EU ruling in its April 26 earnings call, in which it announced first quarter 2023 revenue hit nearly $28.7 billion, an increase of 3% year over year. The company said it’s consulting with policymakers who expect a new EU-US Data Privacy Framework before a data transfer suspension would occur. However, Meta is preparing in case this agreement comes after the deadline.

Meta doesn’t expect to be forced to comply with the data transfer ruling before the fourth quarter of 2023, according to the 10-Q filing. (7)

See the full Adversarial Threat Report for more information.

4 – Social Media and Cognitive Infrastructure

Global Regulation

Meta Preps Possible Halt of EU Services Pending Data Ruling (informationweek.com)

During an earnings call, Meta revealed that an Irish Data Protection Commission decision on data transfers could impact 10% of its ad revenue

Waiting for a transatlantic regulatory agreement might force Meta to halt Facebook and other European services.  On May 12, the Irish Data Protection Commission (IDPC) plans to issue a decision on whether to stop Meta from transferring personal data to the United States. The IDPC is Meta’s lead European Union privacy regulator under the General Data Protection Regulation (GDPR), Meta’s 10-Q for Q1 2023 stated.  Meta discussed the upcoming EU ruling in its April 26 earnings call, in which it announced first quarter 2023 revenue hit nearly $28.7 billion, an increase of 3% year over year. The company said it’s consulting with policymakers who expect a new EU-US Data Privacy Framework before a data transfer suspension would occur. However, Meta is preparing in case this agreement comes after the deadline.

Meta doesn’t expect to be forced to comply with the data transfer ruling before the fourth quarter of 2023, according to the 10-Q filing.  About 10% of Meta’s worldwide ad revenue originates from ads delivered to Facebook users in EU countries. The impact on advertisers due to a data transfer suspension is unknown, according to Meta CFO Susan Li. She said the company is hopeful a new EU-US privacy framework will be completed before a suspension occurs.  “But if it comes to that, there’s a lot that we don’t know in terms of the specifics of a final order and how long a suspension order would last, which would be important variables in determining the overall impact,” Li said. (12)

Punitive Measures

FTC moves to completely prohibit Meta from monetizing kids | TechCrunch

…the Commission notes that the breadth and significance of these deficiencies pose substantial risks to the public

The Federal Trade Commission alleges that Meta has “repeatedly violated” privacy rules and proposes to tighten the agency’s 2020 order against the company, completely barring it from monetizing data from anyone under 18 in any way, among other new restrictions.  The order in question took effect in 2020 but was created in 2019 as part of then-Facebook’s $5 billion settlement after the company violated a previous order. Now the FTC says that Facebook/Meta has violated the new order, as well as the Children’s Online Privacy Protection Act Rule.  “The company’s recklessness has put young users at risk, and Facebook needs to answer for its failures,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection, in a news release. (Due to the order and said failures spanning both names of the company, both are also used throughout.)

The 2020 order created an independent third-party assessor who would evaluate whether Meta was adhering to the privacy rules, things like having new products go through privacy reviews and restrictions on how facial recognition data and phone numbers are used.  This assessor recently gave the FTC their report, and apparently, it is not pretty, containing evidence of numerous shortcomings or violations: “the Commission notes that the breadth and significance of these deficiencies pose substantial risks to the public,” the agency wrote.  Specifically, Facebook promised (in 2018 — the timeline is long and confusing) to cut off app developers’ access to users’ data if that user had not used the app in 90 days. But it did not do so, the FTC alleges and allowed some of that data to be used well into 2020. (9)

Countermeasures

As major elections loom, Meta unveils its internal Online Operations Kill Chain (therecord.media)

“Different investigators can get together and say, ‘Hey, are we seeing the same thing?”

Next year will feature some of the most geopolitically significant elections of our times. Voters will be heading to the ballot boxes in not only the United Kingdom, United States and European Union, but also India, Turkey and Taiwan.

Anticipating an even greater need for “investigative teams across industry, civil society, and government” to collaborate against online interference in these elections, Meta published on…a new Online Operations Kill Chain framework for analyzing and responding to these threats.

The framework is a tool used internally at Meta to formally “analyze individual operations and identify the earliest moments at which they can be detected and disrupted.” The parent company of Facebook and Instagram hopes it will help other defenders detect and disrupt operations when they see them on their networks, too, and help everybody share their findings. (10) 

Image Source: The Record

The Record spoke about the new model to two of the company’s leading security experts, Ben Nimmo, Meta’s global threat intelligence lead, and Eric Hutchins, a Security Engineer Investigator on the influence operations team.  Nimmo previously helped expose foreign election interference in the United States, United Kingdom, and France. Hutchins, who previously worked at Lockheed Martin, invented the Intrusions Kill Chain model based on the military concept of a “kill chain,” which formally describes the separate phases of an attack, from identifying a target through to its destruction.

Nimmo and Hutchins introduced the model at CYBERWARCON back in November:  Breaking the silos — CYBERWARCON

The Record interview with Nimmo and Hutchins can be found here. 

Meta Swiftly Neutralizes New ‘NodeStealer’ Malware

…Meta says it disrupted a novel malware family within weeks after it emerged earlier this year.

Dubbed NodeStealer, the threat was designed to steal cookies and usernames, and passwords from browsers such as Chrome, Edge, Brave, and Opera, to compromise online accounts. A custom JavaScript malware first observed in January 2023, NodeStealer is likely of Vietnamese origin, being distributed disguised as PDF and XLSX files. This week, Meta revealed that it first identified NodeStealer roughly two weeks after it was first deployed and that it immediately took action to neutralize it, including by contacting appropriate services providers. “As part of this effort, we submitted takedown requests to third-party registrars, hosting providers, and application services such as Namecheap, which were targeted by these threat actors to facilitate distribution and malicious operations,” Meta explains.

According to the tech giant, the disruption was successful, as no new NodeStealer samples have been observed since February 27. NodeStealer is executed using the cross-platform, open-source JavaScript runtime environment Node.js, Meta explains. The threat uses the auto-launch module of Node.js to achieve persistence, adding a new registry key to ensure it runs at startup.

On infected machines, the malware harvests encrypted browser data that it then decrypts to retrieve the cookie database and stored credentials. “The malware specifically targets user credentials for Facebook, Gmail, and Outlook. We hypothesize that the malware steals email credentials to compromise the user’s contact point and potentially to access other online accounts connected to that email account,” Meta says.

NodeStealer was also observed making unauthorized requests to Facebook URLs to retrieve account details related to advertising. The threat actor behind the malware then leverages this information to run unauthorized ads using the victims’ advertising accounts.  The malware sends all harvested information to its command-and-control (C&C) server, in a Base64-encoded JSON object. The C&C domain was registered on December 27, 2022 and was suspended on January 25, 2023.  (11)

5 – Computational Power: On-Chip Innovation 

The Current “On-chip” Innovation and Physical Layer Market Dynamics of GPT Model Training, Crypto Mining, AI and the Metaverse

Meta and Qualcomm Strike Deal to make custom virtual reality chips

• Meta and Qualcomm are teaming up to develop custom chipsets for virtual reality products.
• The two U.S. technology giants have signed a multi-year agreement “to collaborate on a new era of spatial computing,” powered by Qualcomm’s Snapdragon extended reality (XR) platforms.
• Since its rebrand in 2021, the Facebook parent has staked its future on the metaverse, a term that encompasses virtual and augmented reality technology.

“Meta and Qualcomm are teaming up to develop custom chipsets for virtual reality products, the companies announced on Friday.

The two U.S. technology giants have signed a multi-year agreement “to collaborate on a new era of spatial computing,” using Qualcomm’s “extended reality” (XR) Snapdragon technology. Extended reality refers to technologies including virtual and augmented reality, which merge the physical and digital world.

The Quest products are Meta’s line of virtual reality headsets. The Meta Quest 2 headset currently uses Qualcomm’s Snapdragon XR2 chipset.

Since its rebrand in 2021, Facebook-parent Meta has staked its future on the metaverse — a term that encompasses virtual and augmented reality technology — with the aim of having people working and playing in digital worlds in the near future.

In the smartphone field, companies ranging from Apple to Samsung have designed their own custom processors to differentiate from competitors and create better products than they might have using off-the-shelf chips.

A focus on custom chips by Meta makes sense as it looks to differentiate its headsets and possibly create unique experiences for users.

“Unlike mobile phones, building virtual reality brings novel, multi-dimensional challenges in spatial computing, cost, and form factor,” Zuckerberg said. “These chipsets will help us keep pushing virtual reality to its limits and deliver awesome experiences.”

The length of the deal between the companies and the financial terms of the deal were not disclosed.

It comes as Meta gears up to launch a new virtual reality headset in October, even as losses widened in its Reality Labs division, which includes its VR business, in the second quarter of the year.” (14)

For a more detailed report of this development, see Meta Partners With Qualcomm To Develop Customized Chips for the Metaverse. 

Did Airman Teixeira Give You Concern? Just Wait For The Metaverse

AI Enabled Image Generation: MidJourney, Dall-E, Stable Diffusion

Designing, Quantifying, and Measuring Exponential Innovation