6 ms·

This wasn't a data breach, it was a misuse of data by a third party.

cryptoz 9y ago
You are nitpicking a small part of an article (incorrectly) and it distracts from the main point: A foreign power is working with American billionaires to subvert democracy and install a dictator. This is a serious issue and one of the biggest news stories of our time. > This wasn't a data breach Yes it was. > it was a misuse of data by a third party. So a bank robber who gets into the vault just misused the locks? Or the security guard misused his eyes? This was a data breach. Your language makes it sound less serious than it is, and you are wrong. This was a data breach. Edit: Less than 30 seconds in, this post is already downvoted. I won't complain about downvotes of course, but it's insane that no conversation is actually allowed to happen on this site without burying one side. I spoke with a neutral tone, didn't do any name calling, I'm not looking for a fight. But downvotes within seconds! You can't silence me HN. I'll keep commenting my opinions and facts no matter how much you don't like what I'm saying. Nitpicking breach or misuse is silly and distracts from the actual substance of the article. It was a breach, by the way.
- hashkb 9y ago
  You're downvoted because you're technically not correct. The case is more like the bank manager allowing the robber into the vault, with full knowledge that the robber wants to and could easily make off with all the valuables, then asking the robber to please not do that before heading back to work, leaving the thief unattended in the vault. Edit: it's a breach of contract, maybe; but not a "data breach" which I think everyone understands to be more like the case where the vault is forcibly broken into.
  - billiam 9y ago
    I really don’t get your point. Bikeshedding on what to call it makes it seem like the actions of the company, the Bond villains behind it, and Facebook are just fine. FB’s actions show that they knew CA was not just pushing the envelope of the consumer preference and false identity manipulation that makes them their billions but totes aware it was being done together with a foreign adversary to subvert our democracy.
    - hashkb 9y ago
      Words mean things. Don't assume that because someone nitpicks a technically incorrect use of a word/term that they are shooting down the entire argument. In fact, we're often trying to help; because we do agree with you; but can't get behind what you're saying 100% because part of it is not actually correct. I'm definitely not disputing the fact that FB is an evil entity that only cares about making profits off your personal information. But, they haven't suffered a data breach in the same way as, say, Equifax; and it seems to me that choosing to use the word "breach" here must be in an effort to get more clicks; because "breach in the Equifax sense" is what the author knows most people will assume is meant.
    - jpttsn 9y ago
      Bikeshedding what to call a crime can be useful and important. The democracy we are concerned about protecting presupposes rule of law, and precision when discussing laws and crimes.
  - cryptoz 9y ago
    I was completely technically correct. It's a data breach. Plain and simple. > A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.
    - sgroppino 9y ago
      A data breach, yes, but I believe by GSR not FB? It seems like users did authorized FB to share data with GSR?
      - IAmEveryone 9y ago
        This is a stupid discussion. So I’ll continue it: Facebook was authorized to have the data. CA was not authorized, at least not to retain the data. Therefor, it is a data breach. Facebook was the breachee, CA was the breacher. And Billy-Ray was a preacher's son.
- UncleEntity 9y ago
  > A foreign power is working with American billionaires to subvert democracy and install a dictator. Seriously? I'm no fan of any politician (or really of "tyranny of the majority") but I was kind of impressed at how well it all worked out last time. An "unpopular" candidate won and the ruling elite turned over the reigns just like they're supposed to do trusting the checks and balances in the system to work. The quickest way to get a dictatorship is to go against the legal results of an election because the unpopular candidate won based on some metric of "unpopular" like "kids rioting in the streets".
  - cryptoz 9y ago
    That was not a peaceful transition. Trump said in plain language that he would not accept the results if he lost. He called on gun owners to shoot and kill his political opponents who he has also been trying to jail for the past many years. If you are impressed with the level of functional elections and government in the US since the last election, I'm shocked. It is not a functional system. It is clearly disfunctional.
    - UncleEntity 9y ago
      > That was not a peaceful transition. Indeed, it was the only election since I've been alive that the losing side rioted in the streets calling for the overturning of the election results. > He called on gun owners to shoot and kill his political opponents who he has also been trying to jail for the past many years. Fake news much?
goldenkey 9y ago
Right. They basically just made an app on FB then had users accept the permissions. The horribly beautiful thing about FB permissions is that almost every single app will request EVERYTHING, and if you deny even a single permission that the app doesn't even seem to need, then the app will break or won't let you use it. So every user is indoctrinated into just clicking accept regardless of the supposed "granular" permissions. They are granular as in granulated sand, falls right through your fingers.
- hashkb 9y ago
  It's not a secret that FB's business is profiting off your personal data. You could choose to stop using it.
  - samschooler 9y ago
    However in this situation we are talking about 3rd parties having an all or nothing policy on your data. If you don’t let some apps you login with Facebook have access to everything you can’t use their app.
  - Erlangolem 9y ago
    ...and have everyone else who knows you stop, and block their widgets and buttons that track you, and block any org that might leak, sell, or just share some of your info with them. I can’t stop a friend or just some rando at a party from uploading a photo of me. I can’t stop friends from using FB and getting me into their system. In 2018, privacy isn’t just about what we choose to do.
    - hashkb 9y ago
      I agree. But you should take that first step, and then start lobbying your friends to stop posting pictures of you. Personally, I also excuse myself at gatherings when the cameras come out, because I know it's all going straight to FB. The shaming has already started to decrease; now I'm usually not alone in popping out of the room.
thisisit 9y ago
I think a better source for this is a related story from Guardian on how all of this worked https://www.theguardian.com/technology/2018/mar/17/facebook-cambridge-analytica-kogan-data-algorithm https://www.theguardian.com/technology/2018/mar/17/facebook-... It was extremely attractive. It could also be deemed illicit, primarily because Kogan did not have permission to collect or use data for commercial purposes. His permission from Facebook to harvest profiles in large quantities was specifically restricted to academic use. And although the company at the time allowed apps to collect friend data, it was only for use in the context of Facebook itself, to encourage interaction. Selling data on, or putting it to other purposes, – including Cambridge Analytica’s political marketing – was strictly barred. It also appears likely the project was breaking British data protection laws, which ban sale or use of personal data without consent. That includes cases where consent is given for one purpose but data is used for another.
- 21 9y ago
  Facebook? Yeah So I, like, need to collect some data, lol Sorry, can't do that But I'm like, uh, an academic, this is for great science, see my Cambridge page here, lol Ah, ok, just don't share it, k? Yeah, yeah, no prb kthxby
mrtksn 9y ago
Don't you think that it can be a breach in the same sense of a breach by phishing? After all, both of the cases are about people giving their "secrets" for one reason but the info being used for something else. I mean, in the case of traditional phishing the user is tricked to provide the password by impersonating a banking site, getting their funds stolen and in the case in question, the users are tricked to provide personal information by being promised some kind of personality analysis but their data is used for political propaganda that they didn't asked for resulting in life-changing consequences du to politics.
- mch82 9y ago
  Interesting comparison.
anonymouz 9y ago
Technically perhaps correct, but for the victims it seems rather irrelevant to me. In a data breach, someone would have used a technical vulnerability or some other (e.g. social engineering) vulnerability of Facebook to get illegitimate access to the data. In this case Facebook simply gave them access to the data and took their word that they won't misuse it. Now maybe the latter situation might not be a data breach in the classical sense, but I don't see how it makes it any better for the victims. If anything it seems worse -- Facebook didn't even try to protect their data.
- jdavis703 9y ago
  Facebook isn't the victim here, it's voters who may have been specifically targeted at a "physchographic" level and had their opinions unduly influenced. Further, every person who's a member of a democracy that was targeted by Cambridge Anayltica and is now being run by corrupted politicians (or in the case of Brexit by misinformed voters) is a victim.
  - dreta 9y ago
    Nobody’s saying FB’s the victim. It’s their fault, if anything. People are „unduly” influenced all the time, and by everybody. Saying CA somehow worse than anybody else just because they worked for people you don’t like is disingenuous. It’s FB that should be held accountable here; they gave away people’s personal data to a third party.
  - rtx 9y ago
    Why are you calling it Target by CA? Its such a great advancement in technology.
  - anonymouz 9y ago
    Yes, sorry, if that wasn't clear. By victims I mean the people whose data was harvested of course.
cryptoz 9y ago
Every single definition I find classifies this as a data breach. > A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.
- sgroppino 9y ago
  Possibly, but remember it starts with the user authorizing a company (FB) to release his/her data to a third-party. If the user doesn't trust the third-party then it shouldn't authorize the data sharing. The question I guess is that FB then agrees to share the data under certain conditions (that the third party only uses the data for an agreed purpose), and if this agreement between FB and the third party isn't honoured, shouldn't FB then sue for damages on behalf of the user?
- UncleEntity 9y ago
  Yes indeed, we need to redefine "data breach" to include "against terms of service" to make it easier to go after all the future Aaron Swartz's. If you redefine a concept and use it against your political enemies don't be all that surprised when they turn around and use it against your political allies.
- deleted 9y ago
  [deleted]
- DangerousPie 9y ago
  But they were authorized to access the data, weren't they? The problem wasn't that they accessed it, it was that they used it for things they weren't allowed to.
  - rhizome 9y ago
    Everybody with an FB app key is "authorized to access [the] data," but the API TOU says you can't save anything. I'm imagining the crux of the CA issue is that they saved stuff.
nemothekid 9y ago
It’s a data breach in the same way “social engineering” can still be considered hacking
- auntienomen 9y ago
  I.e., prosecutors aren't really interested in the distinction.
sambe 9y ago
Yes, per https://mobile.twitter.com/alexstamos/status/975044091393187848 https://mobile.twitter.com/alexstamos/status/975044091393187... this (headline) seems like quite a sensationalisation. Nonetheless good to repeatedly raise people’s awareness of what they agreed/are agreeing to.
johnchristopher 9y ago
If that third party wasn't sanctioned or authorized by the contract binding it with facebook then it's a breach. (not sure if you meant /s)

You are nitpicking a small part of an article (incorrectly) and it distracts from the main point: A foreign power is working with American billionaires to subvert democracy and install a dictator. This is a serious issue and one of the biggest news stories of our time. > This wasn't a data breach Yes it was. > it was a misuse of data by a third party. So a bank robber who gets into the vault just misused the locks? Or the security guard misused his eyes? This was a data breach. Your language makes it sound less serious than it is, and you are wrong. This was a data breach. Edit: Less than 30 seconds in, this post is already downvoted. I won't complain about downvotes of course, but it's insane that no conversation is actually allowed to happen on this site without burying one side. I spoke with a neutral tone, didn't do any name calling, I'm not looking for a fight. But downvotes within seconds! You can't silence me HN. I'll keep commenting my opinions and facts no matter how much you don't like what I'm saying. Nitpicking breach or misuse is silly and distracts from the actual substance of the article. It was a breach, by the way.

hashkb 9y ago
You're downvoted because you're technically not correct. The case is more like the bank manager allowing the robber into the vault, with full knowledge that the robber wants to and could easily make off with all the valuables, then asking the robber to please not do that before heading back to work, leaving the thief unattended in the vault. Edit: it's a breach of contract, maybe; but not a "data breach" which I think everyone understands to be more like the case where the vault is forcibly broken into.
- billiam 9y ago
  I really don’t get your point. Bikeshedding on what to call it makes it seem like the actions of the company, the Bond villains behind it, and Facebook are just fine. FB’s actions show that they knew CA was not just pushing the envelope of the consumer preference and false identity manipulation that makes them their billions but totes aware it was being done together with a foreign adversary to subvert our democracy.
  - hashkb 9y ago
    Words mean things. Don't assume that because someone nitpicks a technically incorrect use of a word/term that they are shooting down the entire argument. In fact, we're often trying to help; because we do agree with you; but can't get behind what you're saying 100% because part of it is not actually correct. I'm definitely not disputing the fact that FB is an evil entity that only cares about making profits off your personal information. But, they haven't suffered a data breach in the same way as, say, Equifax; and it seems to me that choosing to use the word "breach" here must be in an effort to get more clicks; because "breach in the Equifax sense" is what the author knows most people will assume is meant.
  - jpttsn 9y ago
    Bikeshedding what to call a crime can be useful and important. The democracy we are concerned about protecting presupposes rule of law, and precision when discussing laws and crimes.
- cryptoz 9y ago
  I was completely technically correct. It's a data breach. Plain and simple. > A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.
  - sgroppino 9y ago
    A data breach, yes, but I believe by GSR not FB? It seems like users did authorized FB to share data with GSR?
    - IAmEveryone 9y ago
      This is a stupid discussion. So I’ll continue it: Facebook was authorized to have the data. CA was not authorized, at least not to retain the data. Therefor, it is a data breach. Facebook was the breachee, CA was the breacher. And Billy-Ray was a preacher's son.
UncleEntity 9y ago
> A foreign power is working with American billionaires to subvert democracy and install a dictator. Seriously? I'm no fan of any politician (or really of "tyranny of the majority") but I was kind of impressed at how well it all worked out last time. An "unpopular" candidate won and the ruling elite turned over the reigns just like they're supposed to do trusting the checks and balances in the system to work. The quickest way to get a dictatorship is to go against the legal results of an election because the unpopular candidate won based on some metric of "unpopular" like "kids rioting in the streets".
- cryptoz 9y ago
  That was not a peaceful transition. Trump said in plain language that he would not accept the results if he lost. He called on gun owners to shoot and kill his political opponents who he has also been trying to jail for the past many years. If you are impressed with the level of functional elections and government in the US since the last election, I'm shocked. It is not a functional system. It is clearly disfunctional.
  - UncleEntity 9y ago
    > That was not a peaceful transition. Indeed, it was the only election since I've been alive that the losing side rioted in the streets calling for the overturning of the election results. > He called on gun owners to shoot and kill his political opponents who he has also been trying to jail for the past many years. Fake news much?

goldenkey 9y ago

Right. They basically just made an app on FB then had users accept the permissions. The horribly beautiful thing about FB permissions is that almost every single app will request EVERYTHING, and if you deny even a single permission that the app doesn't even seem to need, then the app will break or won't let you use it. So every user is indoctrinated into just clicking accept regardless of the supposed "granular" permissions. They are granular as in granulated sand, falls right through your fingers.

hashkb 9y ago
It's not a secret that FB's business is profiting off your personal data. You could choose to stop using it.
- samschooler 9y ago
  However in this situation we are talking about 3rd parties having an all or nothing policy on your data. If you don’t let some apps you login with Facebook have access to everything you can’t use their app.
- Erlangolem 9y ago
  ...and have everyone else who knows you stop, and block their widgets and buttons that track you, and block any org that might leak, sell, or just share some of your info with them. I can’t stop a friend or just some rando at a party from uploading a photo of me. I can’t stop friends from using FB and getting me into their system. In 2018, privacy isn’t just about what we choose to do.
  - hashkb 9y ago
    I agree. But you should take that first step, and then start lobbying your friends to stop posting pictures of you. Personally, I also excuse myself at gatherings when the cameras come out, because I know it's all going straight to FB. The shaming has already started to decrease; now I'm usually not alone in popping out of the room.

thisisit 9y ago

I think a better source for this is a related story from Guardian on how all of this worked https://www.theguardian.com/technology/2018/mar/17/facebook-cambridge-analytica-kogan-data-algorithm https://www.theguardian.com/technology/2018/mar/17/facebook-... It was extremely attractive. It could also be deemed illicit, primarily because Kogan did not have permission to collect or use data for commercial purposes. His permission from Facebook to harvest profiles in large quantities was specifically restricted to academic use. And although the company at the time allowed apps to collect friend data, it was only for use in the context of Facebook itself, to encourage interaction. Selling data on, or putting it to other purposes, – including Cambridge Analytica’s political marketing – was strictly barred. It also appears likely the project was breaking British data protection laws, which ban sale or use of personal data without consent. That includes cases where consent is given for one purpose but data is used for another.

21 9y ago
Facebook? Yeah So I, like, need to collect some data, lol Sorry, can't do that But I'm like, uh, an academic, this is for great science, see my Cambridge page here, lol Ah, ok, just don't share it, k? Yeah, yeah, no prb kthxby

mrtksn 9y ago

Don't you think that it can be a breach in the same sense of a breach by phishing? After all, both of the cases are about people giving their "secrets" for one reason but the info being used for something else. I mean, in the case of traditional phishing the user is tricked to provide the password by impersonating a banking site, getting their funds stolen and in the case in question, the users are tricked to provide personal information by being promised some kind of personality analysis but their data is used for political propaganda that they didn't asked for resulting in life-changing consequences du to politics.

mch82 9y ago
Interesting comparison.

anonymouz 9y ago

Technically perhaps correct, but for the victims it seems rather irrelevant to me. In a data breach, someone would have used a technical vulnerability or some other (e.g. social engineering) vulnerability of Facebook to get illegitimate access to the data. In this case Facebook simply gave them access to the data and took their word that they won't misuse it. Now maybe the latter situation might not be a data breach in the classical sense, but I don't see how it makes it any better for the victims. If anything it seems worse -- Facebook didn't even try to protect their data.

jdavis703 9y ago
Facebook isn't the victim here, it's voters who may have been specifically targeted at a "physchographic" level and had their opinions unduly influenced. Further, every person who's a member of a democracy that was targeted by Cambridge Anayltica and is now being run by corrupted politicians (or in the case of Brexit by misinformed voters) is a victim.
- dreta 9y ago
  Nobody’s saying FB’s the victim. It’s their fault, if anything. People are „unduly” influenced all the time, and by everybody. Saying CA somehow worse than anybody else just because they worked for people you don’t like is disingenuous. It’s FB that should be held accountable here; they gave away people’s personal data to a third party.
- rtx 9y ago
  Why are you calling it Target by CA? Its such a great advancement in technology.
- anonymouz 9y ago
  Yes, sorry, if that wasn't clear. By victims I mean the people whose data was harvested of course.

cryptoz 9y ago

Every single definition I find classifies this as a data breach. > A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so.

sgroppino 9y ago
Possibly, but remember it starts with the user authorizing a company (FB) to release his/her data to a third-party. If the user doesn't trust the third-party then it shouldn't authorize the data sharing. The question I guess is that FB then agrees to share the data under certain conditions (that the third party only uses the data for an agreed purpose), and if this agreement between FB and the third party isn't honoured, shouldn't FB then sue for damages on behalf of the user?
UncleEntity 9y ago
Yes indeed, we need to redefine "data breach" to include "against terms of service" to make it easier to go after all the future Aaron Swartz's. If you redefine a concept and use it against your political enemies don't be all that surprised when they turn around and use it against your political allies.
deleted 9y ago
[deleted]
DangerousPie 9y ago
But they were authorized to access the data, weren't they? The problem wasn't that they accessed it, it was that they used it for things they weren't allowed to.
- rhizome 9y ago
  Everybody with an FB app key is "authorized to access [the] data," but the API TOU says you can't save anything. I'm imagining the crux of the CA issue is that they saved stuff.

nemothekid 9y ago

It’s a data breach in the same way “social engineering” can still be considered hacking

auntienomen 9y ago
I.e., prosecutors aren't really interested in the distinction.

sambe 9y ago

Yes, per https://mobile.twitter.com/alexstamos/status/975044091393187848 https://mobile.twitter.com/alexstamos/status/975044091393187... this (headline) seems like quite a sensationalisation. Nonetheless good to repeatedly raise people’s awareness of what they agreed/are agreeing to.

johnchristopher 9y ago

If that third party wasn't sanctioned or authorized by the contract binding it with facebook then it's a breach. (not sure if you meant /s)