Facebook: The Cambridge Analytica thing wasn’t a ‘data breach’, it’s just how our platform works

Cambridge Analytica, the Robert Mercer-backed, Steve Bannon-linked data analytics firm that worked with the Trump campaign during the 2016 election, harvested data in 2014 from over 50 million Facebook accounts without users’ permission, according to reports published this weekend in The New York Times and The Guardian and Observer.

From The Guardian:

The data was collected through an app called thisisyourdigitallife, built by academic Aleksandr Kogan, separately from his work at Cambridge University. Through his company Global Science Research (GSR), in collaboration with Cambridge Analytica, hundreds of thousands of users were paid to take a personality test and agreed to have their data collected for academic use.

However, the app also collected the information of the test-takers’ Facebook friends, leading to the accumulation of a data pool tens of millions-strong. Facebook’s “platform policy” allowed only collection of friends’ data to improve user experience in the app and barred it being sold on or used for advertising. The discovery of the unprecedented data harvesting, and the use to which it was put, raises urgent new questions about Facebook’s role in targeting voters in the US presidential election. It comes only weeks after indictments of 13 Russians by the special counsel Robert Mueller which stated they had used the platform to perpetrate “information warfare” against the US.

Some have noted that, while the specifics of Cambridge Analytica’s behavior appear to have broken some rules, selling the use of its personalised data to companies is pretty much the core of Facebook’s business model. Here’s a thread from Jay Pinho, who writes about ad tech:

Facebook’s response to all this has been…sort of appallingly bad! It’s downplayed the claim, publishing a post saying that it was suspending Cambridge Analytica from its platform on the evening on Friday, March 16, before the Times and Observer stories broke on Saturday, and stating that only 270,000 people had downloaded thisisyourdigitallife. It spent time Saturday pushing back on the idea that this qualifies as a “data breach.” (Guardian reporter Carole Cadwalla said Facebook threatened legal action before publication over that point.) Facebook also suspended the account of the whistleblower, Christopher Wylie, who helped found Cambridge Analytica.

NYC Media Lab’s Justin Hendrix has seven follow-up questions — and most of them are for Facebook: “Why did Facebook take more than two years to inform the public of this massive breach?” “Did Facebook’s failure to disclose this breach to the public and notify its directly affected consumers break any laws?” “Did any of the Facebook embeds in the Trump campaign know that stolen data was being used for targeting?” “Did Facebook have evidence its own employees mishandled this situation? Was any disciplinary action taken?” and one last big one:

Did other organizations or individuals exploit these apparent weaknesses, and are there other breaches we do not know about?

Given the number of times that Facebook has said things that turned out to be incomplete or false–such as the ever-expanding disclosure of the number of Americans affected by the Russian disinformation campaign in the 2016 election–why should we believe that this is the only breach of this kind that occurred? It is impossible to know how much Facebook user data has been sold, traded or is just sitting on various third-party servers. Think of all the old Facebook games and apps, or any other third party use of Facebook user authentication. It is hard to imagine this is the only incident. How can the company and its senior leadership maintain public trust, and why do they deserve it?

Lawmakers in the US and UK have begun sorting through some of these questions. (One person who’s not saying much: Brad Parscale, who was Trump’s digital director during the 2016 campaign and is his 2020 campaign manager.)

In the meantime, go check which third-party apps have access to your Facebook data.

This story has been republished with permission from Nieman Lab. Read the original story on their website.