Think Those Deleted Instagram Posts And Videos Were Removed? Guess Again
Serving as yet another reminder that whatever you put out there in the online world should be assumed to exist forever, it was discovered that Instagram (owned by Facebook) was not wiping deleted content from its servers like it was supposed to be doing. The discovery led to a $6,000 payday for the security researcher who discovered the flaw and submitted it to Instagram's bug bounty program.
Normally when you delete something from an online service, like a video or a post, it still remains on the service's servers for a period of time. According to Instagram, it takes around 90 days for deletions to be wiped from its systems for good. Or at least that is how it applies to wholesale account deletions, with some exceptions.
"It may take up to 90 days from the beginning of the deletion process to delete all the things you've posted. While we're deleting this information, it's not accessible to other people using Instagram.
Copies of your information may remain after the 90 days in backup storage that we use to recover in the event of a disaster, software error, or other data loss event. We may also keep your information for things like legal issues, terms violations, or harm prevention efforts," Instagram says.
Here's where things went sideways. Saugat Pokharel, an independent security researcher, downloaded his data from Instagram and found that it contained photos and private messages that he had deleted over a year ago. He then reported the bug to Instagram in October of last year, and it was just recently fixed in August 2020.
"The researcher reported an issue where someone’s deleted Instagram images and messages would be included in a copy of their information if they used our Download Your Information tool on Instagram. We’ve fixed the issue and have seen no evidence of abuse. We thank the researcher for reporting this issue to us," Instagram said in a statement.
These things happen, though it's a bad look for Instagram and its parent company, Facebook, which has had its share of privacy flubs over the years. So again, once you put something online, assume it will always be out there, somewhere, even if you delete things on your end.
