Facebook is facing several investigations following media reports that a political consultancy that worked on President Donald Trump’s campaign gained inappropriate access to more than 50 million Facebook users’ data, Reuters reports.
The social media giant said on Sunday it was conducting a “comprehensive internal and external review” to determine if the personal data still existed.
The company also said it was trying to determine the accuracy of allegations that a researcher gave the firm Cambridge Analytica inappropriately obtained Facebook user data starting in 2014.
In a statement, Paul Grewal, a Facebook vice president and deputy general counsel, said the company was committed to “vigorously enforcing our policies to protect people’s information”.
Facebook on Friday said it was suspending Cambridge Analytica after finding data privacy policies had been violated.
The move means Cambridge Analytica and its parent group Strategic Communication Laboratories (SCL) cannot buy ads or administer pages belonging to clients.
The Massachusetts attorney general said her office was launching an investigation. “Massachusetts residents deserve answers immediately from Facebook and Cambridge Analytica,” Maura Healey said on Twitter.
The United Kingdom’s Information Commission also announced they are conducting an investigation of Cambridge Analytica, which also had clients in the country.
“Any criminal and civil enforcement actions arising from the investigation will be pursued vigorously,” Information Commissioner Elizabeth Denham said.
The New York Times and London’s Observer reported on Saturday that private information from more than 50 million Facebook users improperly ended up in the hands of Cambridge Analytica, and the information has not been deleted despite Facebook’s demands beginning in 2015.
Some 270,000 people allowed use of their data by a researcher, who scraped the data of all their friends as well, a move allowed by Facebook until 2015. The researcher sold the data to Cambridge, which was against Facebook rules, the newspapers said.
The reports raised new calls for regulation from within US Congress and presented a new threat to Facebook’s reputation, which was already under attack over Russians’ alleged use of Facebook tools to sway American voters before and after the 2016 US elections.
“It’s clear these platforms can’t police themselves,” Democratic US Senator Amy Klobuchar tweeted.
“They say ‘trust us.’ Mark Zuckerberg needs to testify before Senate Judiciary,” she added, referring to Facebook’s CEO and a committee she sits on.
Republican Senator Marco Rubio said he believed some internet companies have grown too fast to digest their responsibilities and obligations.
“So we’ll learn more about this in the days to come. But yeah I’m disturbed by that,” Rubio told NBC’s Meet the Press.
Democratic US Senator Mark Warner said the episode bolstered the need for new regulations about internet advertising, describing the industry as the “Wild West”.
“Whether it’s allowing Russians to purchase political ads, or extensive micro-targeting based on ill-gotten user data, it’s clear that, left unregulated, this market will continue to be prone to deception and lacking in transparency,” he said.
Who’s to blame?
Facebook said the root of the problem was that researchers and Cambridge Analytica lied to it and abused its policies, but critics on Saturday threw blame at Facebook as well, demanding answers on behalf of users and calling for new regulation.
Facebook insisted the data was misused but not stolen, because users gave permission, sparking a debate about what constitutes a hack that must be disclosed to customers.
“The lid is being opened on the black box of Facebook’s data practices, and the picture is not pretty,” said Frank Pasquale, a University of Maryland law professor who has written about Silicon Valley’s use of data.
Pasquale said Facebook’s response that data had not technically been stolen seemed to obfuscate the central issue that data was apparently used in a way contrary to the expectations of users.
“It amazes me that they are trying to make this about nomenclature. I guess that’s all they have left,” he said.
In its report, the Observer said Cambridge Analytica used the data, taken without authorization in early 2014, to build a software program to predict and influence choices at the ballot box.
It quoted whistleblower Christopher Wylie, who helped set up Cambridge Analytica and worked with an academic at Cambridge University to obtain the data, as saying the system could profile individual voters to target them with personalized political advertisements.
The more than 50 million profiles represented about a third of active North American Facebook users, and nearly a quarter of potential US voters, at the time, the Observer said.
“We exploited Facebook to harvest millions of people’s profiles. And built models to exploit what we knew about them and target their inner demons. That was the basis that the entire company was built on,” Wylie told the Observer.
The New York Times said interviews with a half-dozen former Cambridge Analytica employees and contractors, and a review of the firm’s emails and documents, revealed it not only relied on the private Facebook data but still possesses most or all of it.
The Observer said the data was collected through an app called thisisyourdigitallife, built by academic Aleksandr Kogan, separately from his work at Cambridge University.
Through Kogan’s company Global Science Research (GSR), in collaboration with Cambridge Analytica, hundreds of thousands of users were paid to take a personality test and agreed to have their data collected for academic use, the Observer said.
However, the app also collected the information of the test-takers’ Facebook friends, leading to the accumulation of a data pool tens of millions-strong, the Observer said.
It said Facebook’s “platform policy” allowed only collection of friends data to improve user experience in the app and barred it from being sold on or used for advertising.
Facebook said it acted against Cambridge Analytica and SCL after receiving reports they did not delete information about Facebook users that had been inappropriately shared.
A Cambridge Analytica spokesman said GSR “was contractually committed by us to only obtain data in accordance with the UK Data Protection Act and to seek the informed consent of each respondent”.
“When it subsequently became clear that the data had not been obtained by GSR in line with Facebook’s terms of service, Cambridge Analytica deleted all data received from GSR,” he said.
“We worked with Facebook over this period to ensure that they were satisfied that we had not knowingly breached any of Facebook’s terms of service and also provided a signed statement to confirm that all Facebook data and their derivatives had been deleted,” the spokesman said.
He said “no data from GSR was used by Cambridge Analytica as part of the services it provided to the Donald Trump 2016 presidential campaign.”
Trump’s campaign hired Cambridge Analytica in June 2016 and paid it more than US$6.2 million, according to Federal Election Commission records.
A Trump campaign official said the campaign used the Republican National Committee for its voter data in 2016, not Cambridge Analytica.
“Any claims that voter data were used from another source to support the victory in 2016 are false,” said the official, who spoke on condition of anonymity.
In past interviews with Reuters, Brad Parscale, who ran Trump’s digital ad operation in 2016 and is his 2020 re-election campaign manager, has said Cambridge Analytica played a minor role as a contractor in the 2016 campaign.
He said the campaign used voter data from a Republican-affiliated organization rather than Cambridge Analytica. He declined to comment on Friday.
On its website, Cambridge Analytica says it “provided the Donald J. Trump for President campaign with the expertise and insights that helped win the White House”.
Facebook did not mention the Trump campaign or any other campaigns in its statement.
“We will take legal action if necessary to hold them responsible and accountable for any unlawful behavior,” Facebook said, adding that it was continuing to investigate the claims.
In a Twitter post, Facebook chief security officer Alex Stamos called the news reports “important and powerful” but said it was “incorrect to call this a ‘breach’ under any reasonable definition of the term”.
“We can condemn this behavior while being accurate in our description of it,” he said.
Acknowledging an episode as a data breach can carry legal significance, as companies face a patchwork of state and federal requirements to notify customers and regulators when they detect that information has been compromised.
A source close to the congressional investigations into Russian meddling in the 2016 campaign said the Trump campaign likely will need to address whether it was aware of Cambridge Analytica’s methods for obtaining its data or if the data was leveraged during the election.
Cambridge Analytica says it uses “behavioral microtargeting”, or combining analysis of people’s personalities with demographics, to predict and influence mass behavior. It says it has data on 220 million Americans, two-thirds of the US population.
It has worked on other campaigns in the United States and other countries, and is funded by Robert Mercer, a prominent supporter of politically conservative groups.
Facebook in its statement described a rocky relationship with Cambridge Analytica, Kogan and Wylie going back to 2015.
That year, Facebook said, it learned that Kogan lied to the company and violated its policies by sharing data he acquired with a so-called “research app” that used Facebook’s login system.
Kogan was not immediately available for comment.
Cambridge Analytica worked on Trump’s 2016 campaign. A Trump campaign official said, though, that it used Republican data sources, not Cambridge Analytica, for its voter information.
Facebook, in a series of written statements beginning late on Friday, said its policies had been broken by Cambridge Analytica and researchers and that it was exploring legal action.
Cambridge Analytica in turn said it had deleted all the data and that the company supplying it had been responsible for obtaining it.
Andrew Bosworth, a Facebook vice president, hinted the company could make more changes to demonstrate it values privacy. “We must do better and will,” he wrote on Twitter, adding that “our business depends on it at every level”.
Facebook said it asked for the data to be deleted in 2015 and then relied on written certifications by those involved that they had complied.
Nuala O’Connor, president of the Center for Democracy & Technology, an advocacy group in Washington, D.C., said Facebook was relying on the goodwill of decent people rather than preparing for intentional misuse.
Moreover, she found it puzzling that Facebook knew about the abuse in 2015 but did not disclose it until Friday. “That’s a long time,” she said.
– Contact us at [email protected]