Why Did Facebook Need Ten More Minutes?

The Facebook livestream from the Zamboanga school shooting was reportedly taken down about 14 minutes after it began. At first, I thought the main question was why Facebook needed almost 15 minutes to recognize what was happening.

The August 20 Senate hearing gave us a better question.

Cybercrime Investigation and Coordinating Center (CICC) Executive Director Renato Paraiso told senators that CICC gained visibility on the livestream and reported it to Meta at around the five-minute mark. The video then remained on Facebook for roughly nine to ten more minutes.

That changes how I look at the delay.

The first five minutes appear to involve detection. The next nine or ten minutes happened after a Philippine government cybercrime agency says it had already alerted Meta.

So I wanted to know what Facebook has to do after receiving a report like that, and why an urgent report about an ongoing violent livestream does not mean an immediate takedown.

I am deliberately staying away from the details of the shooting itself. There is no need to replay, reconstruct, or describe the violence to examine Facebook's response.

THE FIRST FIVE MINUTES

Facebook Live was built around immediacy.

Meta's own engineering team wrote in 2015 about bringing livestream transmission latency down to roughly two to three seconds. The technology has changed since then, but the basic product design is obvious every time someone presses the Live button: viewers are supposed to see the broadcast almost as it happens.

Moderation has to operate while that broadcast is already moving.

Meta has publicly described a content-review process that combines automated detection with human review. Its systems can identify some likely violations automatically, rank potentially harmful content for faster review, and remove material automatically when confidence is high enough.

Lower-confidence cases can require human judgment, and real-world violence creates a difficult classification problem.

A machine can identify objects, sound, movement, text, and other signals. It still has to determine whether those signals add up to an actual emergency.

A firearm on camera can appear in news footage, police video, training, films, games, sporting activity, historical material, or criminal violence. A moderation system that treats every visual match as an emergency would generate false alarms on an enormous scale.

Meta explained a version of this problem after the 2019 Christchurch terrorist attack.

Facebook said the original livestream did not trigger its automatic detection systems. No user reported it while the broadcast was live, and the first report arrived 29 minutes after the stream began.

Meta said rare first-person violent events are difficult for machine-learning systems because there are far fewer examples available for training. It also warned that visually similar material, including livestreamed video games, could trigger false positives and swamp reviewers.

The comparison helps explain why Facebook may not identify a new violent livestream immediately.

It does not explain the whole Zamboanga timeline.

CICC DID IDENTIFY IT

Paraiso told the Senate that CICC became aware of the livestream at around five minutes and reported it to Meta. He also said CICC did not learn about it through a caller to its hotline.

According to Paraiso, the stream appeared in the agency's threat-monitoring operation because it had already spread enough to draw its attention.

Paraiso also told senators that Meta's automated systems probably would not have identified the stream reliably. He said artificial intelligence cannot reliably interpret a video in real time according to its full context.

That statement needs to be attributed correctly. It was Paraiso's assessment at the hearing, not a public admission from Meta about this particular incident.

Still, his explanation closely resembles the problem Meta itself described after Christchurch.

There is now a harder question.

Once CICC sent the report, Meta was no longer dealing only with an algorithm trying to classify unfamiliar footage. According to Paraiso, a Philippine government cybercrime agency had already told the company that the content needed to be taken down.

The stream remained online for roughly nine to ten more minutes.

WHAT HAPPENS AFTER THE REPORT?

This is the part Meta needs to explain.

A report reaching Facebook does not necessarily mean a person with authority to stop a livestream sees it at that same second. Reports can be classified, prioritized, routed, checked against policy, and, where required, sent for human review.

Meta has said that reports concerning an active Facebook Live can receive accelerated review. Its 2019 Christchurch report said reports received while a video is still broadcasting are prioritized because real-world harm may still be occurring.

We do not know what exact internal route the CICC report took on August 18.

We do not know when Meta acknowledged receiving it, whether an automated process handled it first, when a human reviewer opened it, or whether that reviewer could terminate the livestream without another approval.

Those are no longer questions about the first five minutes. They concern the period after Meta had reportedly been alerted.

THE GOVERNMENT COULD REPORT IT, BUT COULD NOT ORDER FACEBOOK TO REMOVE IT

Paraiso raised another problem at the hearing.

CICC cannot simply reach into Facebook and switch off a livestream. He told senators that Philippine agencies cannot immediately compel foreign platforms such as Meta to remove content because the government lacks jurisdiction over the platforms in that way.

CICC therefore relied on Meta's own rules and community standards when requesting the takedown.

That limits what the Philippine government can do during an online emergency. Giving government agencies unrestricted power to erase social-media content instantly would also create serious free-expression and abuse concerns.

An emergency reporting process for an active threat to life presents a much narrower problem.

How quickly can a credible emergency report reach somebody at Meta who has the authority to act?

The Philippine government had already raised a related problem with Meta months before Zamboanga.

THE GOVERNMENT ASKED META FOR FASTER EMERGENCY CHANNELS MONTHS AGO

On April 10, the Department of Information and Communications Technology (DICT) and Presidential Communications Office (PCO) sent Meta a formal letter demanding stronger action on high-risk online content.

The dispute concerned false information, including fabricated claims about the President's health and death, oil prices, economic disruption, government actions, and other content the government said could cause panic or threaten public order.

The letter went further than asking Meta to remove individual posts.

DICT and PCO asked for an expedited government flagging and takedown protocol, a senior-level contact available 24 hours a day, defined escalation paths, enforceable response times for high-risk content, and regular reporting on enforcement.

Meta was told to acknowledge the letter within 48 hours and submit a detailed implementation plan within seven calendar days.

Three days later, government officials said Meta had expressed support for efforts against harmful online content.

But the exchange did not end there.

On April 20, DICT publicly said Meta's response was insufficient. The department said Meta had offered general descriptions of existing policies but had not provided the specific, time-bound actions the government had requested.

That April disagreement looks very different after Zamboanga.

Four months later, CICC says it sent Meta an urgent report about a livestream involving an immediate threat to life, and the stream remained online for almost ten more minutes.

What emergency arrangement existed by August 18?

Did CICC have a dedicated 24/7 contact? Had Meta committed to a response time for reports involving active violence?

Was the Zamboanga report sent through such a channel, and if so, did it work as designed?

The absence of such an arrangement would raise another question. What happened after the Philippine government demanded one in April?

Those questions belong to Meta and to the Philippine agencies that were supposed to follow through.

TAKING DOWN THE ORIGINAL DID NOT END THE PROBLEM

The hearing also showed why every minute before removal can create problems beyond the original livestream.

Paraiso said another person recorded the footage on a separate device and later uploaded a copy. Removing the original stream therefore did not remove every version already in circulation.

During the August 20 hearing itself, Hontiveros said her staff could still find shooting footage on Meta. Paraiso asked the committee to send the links to CICC so the agency could relay them to Meta for removal.

That happened two days after the original incident.

The problem Meta described after Christchurch was appearing again on a smaller scale. Once footage is recorded, screen-captured, altered, or uploaded from another account, removing the source addresses only part of the problem.

Meta's own Christchurch figures show how different the task becomes once the company knows what it is searching for.

After identifying that video, Facebook said it blocked more than 1.2 million attempted uploads during the first 24 hours and removed about 300,000 additional copies after posting. It also used video, image, and audio matching to locate altered versions.

Identifying the first livestream requires the system to decide what an unfamiliar video actually shows. Later copies can be compared with material that Meta has already identified, although altered recordings can still escape matching systems.

That makes the footage found during the Senate hearing especially relevant.

Meta had already taken down the original, yet copies remained available and still required somebody to find them, report them, and ask for removal.

FACEBOOK LIVE MAY NEED AN EMERGENCY BRAKE

After Christchurch, Meta considered the idea of placing a delay on every Facebook Live broadcast.

The company rejected a universal delay. It said millions of Live broadcasts occur each day and argued that delaying all of them could also slow user reports, review, and contact with first responders.

I understand that argument.

Most Facebook Live broadcasts are harmless. Holding every live church service, birthday, press conference, concert, game, or family video because a tiny fraction may become dangerous would be an enormous intervention.

The Zamboanga case raises a narrower technical question.

What happens when a credible authority has already identified an active livestream as an immediate danger?

At that point, Facebook could have options short of allowing normal distribution while an ordinary review runs its course. It could temporarily limit distribution, stop recommendations, freeze wider sharing, place the stream into a restricted state, or route it directly to a reviewer with emergency authority.

I have found no public evidence that Meta currently uses that exact system for violent livestreams. I am describing a possible safety design, not Meta's current procedure.

The idea is an emergency brake triggered only by strong risk signals or a highly credible report.

Zamboanga gives us a reason to ask whether Facebook Live needs one.

WE NOW KNOW WHERE MOST OF THE 14 MINUTES WENT

The August 20 hearing answered part of the question that initially bothered me.

CICC says it detected and reported the livestream at around five minutes. The video remained on Facebook for roughly nine to ten more minutes.

We still need Meta's side before deciding whether those minutes reflect technical necessity, policy safeguards, human-review delay, routing problems, or a failure in the emergency process.

But the unknown period is now much smaller and much more specific.

Meta should be asked for the incident log.

When did its system receive CICC's report? When was the report classified as urgent?

When did a reviewer first see it? When was the decision to stop the stream made, and when did the stream actually become unavailable?

Those timestamps could tell us where the delay occurred without replaying a second of the shooting. They could also tell us whether the emergency relationship the Philippine government demanded from Meta in April exists in practice.

I started with a question about why Facebook needed almost 15 minutes.

After the Senate hearing, the question is narrower.

CICC says Facebook was warned at around minute five.

Why did it need almost ten more?