The curious case of personal data abuse of Quora bots

This story started one night, where I could not sleep and started to do what I like to do for fun: find information online. I absolutely love to find information on the Internet, and this time I wanted to know how people I have not seen since school are doing in their life. Sometimes, one or two newspaper articles pop up (like one acquaintance that apparently won a million euros on a TV show a few years ago), but also social media profiles pop up a lot, with more or less accessible pictures of these people.

Now, when looking through the information on a person that had a big impact in my teenage years, I found a Quora account under the name. I know Quora from occasional searches for information, but I only had limited knowledge about what the website offers, except for the known Q&A part that is: someone asks a question about any topic, other someones can answer that, and there is some voting to these answers. What I am saying here, I did not know anything else about it.

So I find this profile and it has everything:

• the full name
• last job description
• education, in this case which university the person visited
• current location (2019-now)
• languages the person speaks
• a profile picture

So, since I already had some research done, I could more or less confirm that the information provided on this profile was correct. And, wow, it is the person on the profile picture, it might not be the most recent picture, but the person is clearly identifiable as the person I know.

So I look through the profile and see that the person has asked over 3000 questions. Wow again, this person is active on this website, so I naturally want to look through these questions. What is this person interested into? What are her hobbies, or what can you learn from her questions?

And there is EVERYTHING covered in the last few days:

• Greta Thunberg as TIME person of the year
• Questions about the British election (Who is better, Johnson or Corbyn?)
• The German apprenticeship legislation
• “Why is no one talking about the protests in Iran”
• “What do you like more: theater or ballet?”
• “Do you still use SMS?”
• “How do I integrate children in my life if I do not want any of my own?”
• “How do I know a hairdresser is good?”
• “What do you think about this Huawei phone?”

So, my first reaction to this was basically: Wow, what an interesting person. How could someone be so interested in so many topic and even follow current world events!

Then, after reading more and more, I began to wonder. Does what I know about this person coincide with what I am seeing? In my next step, I go back to the profile and look at the statistics again:

Interesting observation: I found the Quora profile of an old friend on mine, complete with matching data about “what this person knows about” and using a clear photo of them.
Only that, this account has over 3k of “asked” questions vs 0 “answered” ones.

— داودي (@TheDbof) December 12, 2019

So basically, this person only ever asked questions, but never answered any. This is some strange behaviour for an active person in a community. I started to wonder if you get any benefits from posting many questions, like karma points or similar. This is when I started to dig deeper:

It seems like a legitimate account because of all the data and the questions asked are about current event, but also totally random and all more or less published one after the other.

All these questions (some are interacted with by other users) are published on the same time. pic.twitter.com/PC07whDMa8

— داودي (@TheDbof) December 12, 2019

So, not only is this person posting a lot of random questions, but also mostly at the same time. This absolutely sounds like this might be a social bot. I wanted to know for sure and started to interact with it. I created an account on Quora and wrote a question directed at this account. There is this option to “link” specific accounts to your question, so they would definitely get a notification about my question and maybe answer to it. I wrote something that, if that was any other social interaction, would be totally creepy:

Hey there, I looked for people from this school and found your profile. If you are the person on the profile picture, please tell me. Do you know who Davide is?

I wondered if I would get a reaction, so I waited a full day until the activity on the profile was still high (again posting lots of different questions in a timeframe of a few minutes), and I am not sure if there was a reaction, but: I could not see any more the “Activity” feed of the person. It just showed me nothing at all and I wondered if there was a bug with the mobile app (btw, horrible design). My first assumption was that the person had “blocked” me in a way, because publicly viewable information (when you are not logged in) was no more visible to me when I was logged in.

Deeper analysis

So, since then, I periodically check the account for activity and for answers to my question, but I guess there will be no answer. Now, the reason that sparked this blog post is not even that there is some kind of automated bot behind this Quora profile that is doing what I consider “random stuff”. No pattern in the question, no obvious promotion of products, just content targeted at a German public with national and international topics. The questions started on May 1st of this year and went on nearly every day since then. From my biased point of view, this looks like someone trying out some Machine Learning for text creation? I don’t know.

Since I did not see any profitable aspect of this account, I first suspected Quora of being behind this:

I don’t see a motivation behind the questions, so I can only assume: to improve the activity on their website, @Quora might hijack unused legitimate accounts to create questions and generate content and engagement. This is supported by the topics being about recent happenings.

— داودي (@TheDbof) December 12, 2019

Then I looked again through the account’s details and looked at the “followers” page, which showed which accounts do get notifications when something is published:

Another detail I missed before that would support my suspicions: the account is followed by three other accounts of people that work for/at @Quora.

This is such an absurd issue and I want to talk about how a company is misusing private information here! pic.twitter.com/aoDFQwkYZJ

— داودي (@TheDbof) December 12, 2019

Turns out there are three linked accounts that belong to Quora employees. What is the chance that this is just a coincidence?

I referenced all the relevant Quora accounts on Twitter to comment on this issue. If there is any update, I will put this here. There are updates!

Updates from Quora staff

A few days after my Twitter rant, Sven Perlberg, a “community manager” of Quora Germany, sent me a private message:

So a few days after this tweet I was contacted via DM by Sven Perlberg, allegedly the community manager of @Quora_DE. It was 11PM and I was pretty surprised to get a message at such a late time of the day.

Unfortunately, after I answered his question, he was no longer responding https://t.co/PzqDIsL7dK pic.twitter.com/0z94xsTYR6

— داودي (@TheDbof) December 20, 2019

In short, this community manager, that coincidentally follows the account I examined, contacted me and asked for the reasons I would tweet about it. After a little bit of back and forth, Mr. Perlberg told me privately that the behaviour of the account is pretty normal. My last question was if he could tell me how Quora checks the identity of an account owner (in general), because I am still convinced that there is someone else behind the account. Mr. Perlberg prefered not to answer that question. Which, from a company perspective, is understandable. That’s where the conversation ended, unfortunately.

Abusing personal information

Whoever is behind this profile is doing shady business. First of all, you are using real information of an existing person for this, and this is unacceptable! I can totally imagine that my acquaintance really owned this profile for a while and, when it became inactive, someone (Quora? A hacker?) took it over to spam questions. I can not tell you why, because there are different strategies to do marketing for products over these Q&A social networks (raise awareness, speaking about it etc), and the behaviour of this profile does not reflect any of the known strategies. So, until any Quora employee answers my questions or I get any response on my message on the platform since Quora’s official answer is that everything is normal, this whole topic remains a curious case of identity theft, and I would not be surprised if there are other accounts like this on Quora.