Facebook did pursue a way to analyze encrypted Snapchat traffic, according to internal communications and technical documents unsealed on March 23, 2024. The effort, called Project Ghostbusters, was tied to Facebook’s Onavo VPN and research infrastructure. But the evidence does not show that Facebook intercepted every Snapchat user’s communications or read every private Snap.
The documents describe an attempt to collect information from participating devices—such as users of Onavo or Facebook research programs—by routing traffic through Facebook-controlled systems and using trusted certificates to inspect selected connections. That makes this a story about privileged access to participants’ network traffic, not an established breach of Snapchat’s servers.
The short version
In a June 9, 2016 email reproduced in the litigation materials, Facebook CEO Mark Zuckerberg asked employees how the company could obtain reliable analytics about Snapchat. Facebook could not directly measure as much of Snapchat’s activity because the app’s traffic was encrypted.
Internal documents describe Project Ghostbusters—named for Snapchat’s ghost logo—as a proposed system for using Onavo and Facebook’s research programs to intercept and decrypt selected Snapchat traffic from enrolled devices. The plan included “kits” for iOS and Android and an “incentivized SSL bump” approach. TechCrunch’s contemporaneous report and the unsealed court filing describe the effort.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
What remains uncertain is just as important: the documents do not establish the exact number of affected users, that every proposed component reached production, that Facebook read all private messages, or that all Snapchat users were monitored.
Why Facebook wanted Snapchat data
Snapchat was a fast-growing rival, and Facebook wanted competitive intelligence. Data about usage frequency, time spent, feature adoption, engagement and growth could help Facebook assess whether Snapchat was becoming a serious threat, an acquisition target or a source of features worth copying.
Zuckerberg’s 2016 message focused on the information Facebook could not obtain because Snapchat’s traffic was encrypted. The request was not simply about seeing whether Snapchat’s servers were online. It was about gaining a detailed view of how people used a competing app.
The documents may help explain the commercial value Facebook placed on app-usage data, but they do not by themselves prove that a particular Facebook product decision or acquisition resulted from Project Ghostbusters.
How a VPN could inspect another app’s traffic
A VPN places an intermediary between a device and the internet:
- The device sends its network traffic to the VPN service.
- The VPN server forwards that traffic to its destination.
- The VPN operator can generally observe connection information and metadata, such as destinations, timing and volume.
- HTTPS normally prevents the operator from reading the encrypted contents.
That last protection can be weakened if a user installs and trusts a root certificate controlled by the VPN operator. The operator’s infrastructure can then present a substitute certificate, decrypt a selected connection, inspect it and re-encrypt it before sending it onward. To the app, the connection may still appear trusted.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
This is commonly described as a man-in-the-middle interception. It is not automatic or universal. Certificate pinning, operating-system restrictions, additional encryption inside HTTPS, app design and targeted-domain rules can prevent or limit it. A root certificate also does not magically give a provider access to every app or every type of content.
The court materials described an “incentivized SSL bump” and kits for iOS and Android. The proposed architecture can be summarized as:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSnapchat app → participating device and trusted certificate → Onavo/Facebook infrastructure → Snapchat servers
That arrangement gave Facebook a place in the network path where selected traffic could potentially be decrypted and analyzed.
What Project Ghostbusters does—and does not—establish
The unsealed materials are litigation documents and exhibits. They reveal internal emails, plans and descriptions of capabilities, alongside allegations in a consumer class action. They are not the same as a final judgment confirming every allegation.
The strongest supported conclusion is that Facebook employees designed and pursued a system intended to analyze encrypted Snapchat traffic from participating devices. The evidence does not support saying that Facebook wiretapped all Snapchat users, compromised Snapchat’s servers or captured every private conversation worldwide.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Traffic is not necessarily private messages
“Traffic” can include requests to servers, telemetry, analytics endpoints, metadata and app-usage information. Depending on the endpoint and encryption layer, it might also include content. But the available materials support claims about detailed Snapchat activity and encrypted analytics traffic; they do not, on their own, prove that Facebook read every private Snap or viewed every image and video.
It is also useful to distinguish data before encryption from data decrypted at Facebook’s infrastructure. The documents describe a technical way to gain visibility into selected connections. They do not provide a complete inventory of what was retained, for how long or which specific Facebook systems used it.
Onavo’s role
Facebook acquired Onavo in October 2013. Onavo operated VPN-like mobile products that routed users’ traffic through infrastructure controlled by Onavo and Facebook. The company used information from Onavo and related research programs for market intelligence and competitive analysis.
Onavo Protect was marketed to consumers as a privacy and security VPN. That created the central tension: the service could offer protection from some local network observers while simultaneously placing the VPN operator in a highly privileged position to observe users’ connections.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Project Ghostbusters was associated with the Onavo and Facebook “incentivized app analytics program,” or IAAP, ecosystem. The relevant participants could include:
- people who installed Onavo Protect;
- participants in Facebook’s incentivized research programs;
- users who installed research software or accepted certificate-related prompts; and
- people whose devices were not enrolled in those programs.
The evidence supports concern about enrolled or participating devices. It does not support expanding that conclusion to people who never installed or joined the relevant software and programs.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Was this legal?
There is no single answer that resolves every legal question raised by the documents. Several issues must be separated:
- What did users agree to when they installed Onavo or research software?
- Were the disclosures prominent and understandable enough to constitute informed consent?
- Did the collection comply with Apple’s or Google’s platform rules?
- Did the conduct violate consumer-protection, privacy or wiretap laws?
- Did collecting competitors’ usage data amount to anticompetitive conduct under U.S. law?
- Which allegations in the U.S. class action were ultimately proven?
One significant regulatory result came from Australia. In July 2023, the Federal Court ordered Facebook Israel and Onavo to pay combined penalties of A$20 million, or A$10 million each. The Australian Competition and Consumer Commission said the court found that the companies’ promotion of Onavo Protect was liable to mislead consumers because it did not adequately explain that activity data could be used for purposes beyond providing the VPN.
That was an adjudicated finding about consumer disclosures surrounding Onavo Protect. It was not a final judicial finding that Project Ghostbusters violated a particular U.S. wiretap statute.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Internal privacy concerns
The documents also show an important governance question: whether Facebook’s own security personnel believed user consent was meaningful.
According to the reporting and exhibits, a senior security employee questioned whether the practice could be justified even with consent, arguing that ordinary users did not understand how the technology worked. That disagreement matters because the issue was not merely whether Facebook could build the system. It was whether users understood that a product presented as protective could give Facebook visibility into activity inside other apps.
Consent obtained through a long agreement is not necessarily the same as clear, informed consent. The Australian case illustrates why regulators may focus on the overall presentation of a product, not only on whether some disclosure appeared in its terms.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
The Onavo timeline
| Date | What happened |
|---|---|
| October 2013 | Facebook acquired Onavo. |
| June 9, 2016 | Zuckerberg asked employees for better Snapchat analytics, according to an internal email reproduced in the litigation materials. |
| 2016 onward | Documents describe Project Ghostbusters and proposed iOS and Android interception kits connected to Onavo and Facebook research programs. |
| 2018 | Apple removed Onavo Protect from the App Store over developer-policy concerns involving information about other apps. |
| 2019 | Google Play removal followed, and the Onavo service ceased in May. The ACCC identifies the service as having ended that year. |
| December 2020 | The ACCC announced proceedings alleging that Facebook misled consumers about Onavo Protect’s use of data. |
| July 2023 | The Australian Federal Court ordered the combined A$20 million penalty. |
| March 23, 2024 | Relevant documents in the U.S. class-action litigation were unsealed. |
| March 26, 2024 | Major contemporaneous reporting brought Project Ghostbusters to wider public attention. |
Sources for the Onavo timeline include the ACCC’s 2020 announcement and its 2023 penalty announcement.
Did the project also involve YouTube and Amazon?
The documents and reporting indicate that Facebook later considered or extended similar analysis to traffic associated with YouTube and Amazon. This should be understood as a documented expansion of the effort’s targets—not proof that Facebook monitored every user of either service.
Can users still be affected today?
Onavo Protect is no longer operating, so this is primarily a historical account of conduct between 2016 and 2019. Deleting an old app would not, by itself, erase data that may already have been collected.
The broader lesson remains current: a VPN is a trusted intermediary. It may reduce exposure to local network observers or some internet-service-provider visibility, but the VPN provider can see more about connections than a provider outside the network path. That does not mean all VPN companies behave like Onavo; it means users should evaluate the provider’s ownership, data practices, disclosures and independent audits.
On current devices, users can review active VPN connections, device-management profiles and installed certificates through the operating system’s privacy and security settings. Exact menu names vary by iOS, Android, macOS and Windows version. Remove profiles or certificates you do not recognize, and be cautious about installing “privacy” or research apps whose data-use explanations are vague. A VPN marketed as making someone completely anonymous should also be treated skeptically.
What remains unknown
The public materials do not answer every important question. They do not establish:
- the exact number or identities of affected participants;
- the complete categories of Snapchat data captured;
- how long the data was retained;
- which Facebook products or acquisitions relied on the information;
- whether every proposed technical component entered production; or
- the final disposition of every claim in the U.S. litigation.
Those limits are why the most accurate description is not “Facebook hacked Snapchat” or “Facebook read everyone’s messages.” The evidence shows an internal effort to use Onavo-linked infrastructure to intercept and analyze selected Snapchat traffic from participating devices, while leaving important questions about deployment, scope and data use unresolved.
For the primary documents, see the unsealed court filing and its PDF mirror. For regulatory context, see the ACCC Digital Platforms Inquiry report.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
