5 ms·

>The arrogance of Facebook's response to this breach Is it even clear that there was a 'breach' of any kind that Facebook was responsible for? Correct me if I'

>The arrogance of Facebook's response to this breach Is it even clear that there was a 'breach' of any kind that Facebook was responsible for? Correct me if I'm wrong here, but it seems like the chain of events is: 1.) Third party (Aleksandr Kogan) creates 'personality quiz' app, Facebook users opt-in to share information from their profile 2.) Aleksandr Kogan hands off data gathered by the app to Cambridge Analytica, violating Facebook TOS 3.) Whistleblower (Christopher Wylie) lets world know that (2) happened 4.) Media / public gets out pitchforks and blames incident on Facebook It really seems like Aleksandr Kogan, not Facebook, is the problem here.

cycrutchfield 9y ago
The app was allowed to scrape friend data as well, meaning that many more people’s information got exposed. That is on facebook.
- Bartweiss 9y ago
  I keep seeing it listed just as "friend data", and no one clarifying that. Does it mean "friends lists", or "the data of the app user's friends profiles"? And in that second case, "the data of the app user's friends visible to the app user", or "as much data as if the friends had installed the app themselves"? Unless it's that final situation, it's exactly how I assumed Facebook scraping worked already.
  - msrpotus 9y ago
    It's something closer to the latter--presumably, it was scraping what friends posted publicly.
JumpCrisscross 9y ago
> It really seems like Aleksandr Kogan, not Facebook, is the problem here Kogan probably breached the terms he agreed to with Facebook. But fifty million people trusted Facebook with their data and, when asked in their privacy settings, said they didn't want it shared with third parties. That information was then shared with third parties. If someone calls my bank and convinces customer service they are me, it would be reasonable to say the bank was breached. Not electronically. But breached nonetheless.
- RandallBrown 9y ago
  Everyone sets up their own account's privacy settings though, and as far as I know, this information didn't include anything that wasn't already publicly available.
  - sverige 9y ago
    That is not clear at all, based on another article. [1] Further, Facebook's lawyers told Wylie that the data was illicitly obtained, though now apparently they've changed their approach. [1] 'Kogan was able to throw money at the hard problem of acquiring personal data: he advertised for people who were willing to be paid to take a personality quiz on Amazon’s Mechanical Turk and Qualtrics. At the end of which Kogan’s app, called thisismydigitallife, gave him permission to access their Facebook profiles. And not just theirs, but their friends’ too. On average, each “seeder” – the people who had taken the personality test, around 320,000 in total – unwittingly gave access to at least 160 other people’s profiles, none of whom would have known or had reason to suspect.' --from https://www.theguardian.com/news/2018/mar/17/data-war-whistleblower-christopher-wylie-faceook-nix-bannon-trump https://www.theguardian.com/news/2018/mar/17/data-war-whistl...
  - SolarUpNote 9y ago
    The whistleblower said they had access to private messages. Are those ever publicly available? I don't see any privacy settings for messages in my FB profile.
    - idoh 9y ago
      It depends on when this all happened. In the past a lot more information was available than now.
- Klathmon 9y ago
  >If someone calls my bank and convinces customer service they are me, it would be reasonable to say the bank was breached. Not electronically. But breached nonetheless. That's a bad analogy. A more appropriate one would be if you called your bank and told them to allow a 3rd party to have access to all of your accounts, then blamed your bank when the 3rd party drained all your accounts. Facebook has no obligation to protect your data from yourself any more than your bank has the obligation to control what you spend your money on.
sergiosgc 9y ago
It was a breach followed by business motivated poor handling of the breach. Facebook learned about the TOS violation, requested that CA delete the data, and did not follow up with verification that it was indeed deleted. The fail to follow up is compounded by the fact that: a) Facebook was notified that CA did not delete the data; and b) The CA-held profiles were used to target politically motivated advertising on Facebook. One can't avoid linking the two facts. Facebook has no incentive to aggressively protect its user data when it hurts ad spending on the platform.
oh-kumudo 9y ago
Clearly, Facebook loses hold on the users' data to some 3rd party players, and even now that they have no control that the data is actually deleted or not. If Facebook has no means to detain such malicious usage of users' data, they should be more careful to open the access of it in the first place.
colordrops 9y ago
Using an "honor system" doesn't work for privacy, considering thousands of apps have access to the data. The problem is not Aleksandr Kogan.
mc32 9y ago
People are going to call it a breach because it fits their PoV. When this happened with Craigslist people were calling Newmark all kinds of names and quibbling about ownership of the data, etc. [that since it was user generated Craigslist didn't really own it, so that all those *pad companies were not in breach, etc. That is all it is.
bogomipz 9y ago
>"Is it even clear that there was a 'breach' of any kind that Facebook was responsible for?" How about a breach of basic responsibility to inform users that their data has been used inappropriately and transferred to a third party. FB knew about this as far back as 2015[1]. Did they let users know at any point? No. Further FB's Chief Security Officers's tweets on Friday failed to show any concern for FB users who were used as pawns. His main concern was to point out that this wasn't actually a FB problem. And let's not forget that Mark Zuckerberg dismissed the idea that fake news on Facebook influenced the US elections as "a pretty crazy idea."[2] So the "pitchforks" are a culmination of a significantly longer time frame and not just a reaction to this single news story. [1] https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz-president-campaign-facebook-user-data https://www.theguardian.com/us-news/2015/dec/11/senator-ted-... [2] https://www.theguardian.com/technology/2016/nov/10/facebook-fake-news-us-election-mark-zuckerberg-donald-trump https://www.theguardian.com/technology/2016/nov/10/facebook-...
- felipeerias 9y ago
  "These guys unlawfully got data from a lot of our users. Surely they will delete it if we ask them to, right? "Now they want to buy a lot of ads on our platform, great! "Also their ads are getting a lot of engagement somehow, let's make it cheaper for them to buy more!"
- ce4 9y ago
  According to an NYT article [0] the tweets had been requested by FB comms: "Over the weekend, after news broke that Cambridge Analytica had harvested data on as many as 50 million Facebook users, Facebook’s communications team encouraged Mr. Stamos to tweet in defense of the company, but only after it asked to approve Mr. Stamos’s tweets, according to two people briefed on the incident. After the tweets set off a furious response, Mr. Stamos deleted them." [0]: https://nytimes.com/2018/03/19/technology/facebook-alex-stamos.html https://nytimes.com/2018/03/19/technology/facebook-alex-stam...
matthewcford 9y ago
The issue was back in the day the FB APIs were not as tightly scope controlled as they are now - you were not just giving access to your data but also of that of your friends - even if they did not.
SubiculumCode 9y ago
And if you want to know what kind of company Cambridge Analytica is, check out this under-cover reporting, jus tout this morning: https://www.nytimes.com/2018/03/19/us/cambridge-analytica-alexander-nix.html https://www.nytimes.com/2018/03/19/us/cambridge-analytica-al... SLIMY
moolcool 9y ago
Facebook trusted user data to a third party who didn't turn out to be trustworthy. How are they not due some share of the blame? Do you think the TOS provides sufficient (or any) protection for this data in the real world?
jdavis703 9y ago
My understanding is the people who answered the quiz were a fraction of the 50 million people's whose data was "used." The quiz was a small sample so they could run their analytics on the larger data set.
flexie 9y ago
With that logic anyone making a quiz should be able to get data on 50M users and that’s not a problem?
tomc1985 9y ago
That sounds like the use-case for nearly everyone shady on Facebook advertising. Surely there are many other, privately-gathered troves of data that are much larger out there?

cycrutchfield 9y ago

The app was allowed to scrape friend data as well, meaning that many more people’s information got exposed. That is on facebook.

Bartweiss 9y ago
I keep seeing it listed just as "friend data", and no one clarifying that. Does it mean "friends lists", or "the data of the app user's friends profiles"? And in that second case, "the data of the app user's friends visible to the app user", or "as much data as if the friends had installed the app themselves"? Unless it's that final situation, it's exactly how I assumed Facebook scraping worked already.
- msrpotus 9y ago
  It's something closer to the latter--presumably, it was scraping what friends posted publicly.

JumpCrisscross 9y ago

> It really seems like Aleksandr Kogan, not Facebook, is the problem here Kogan probably breached the terms he agreed to with Facebook. But fifty million people trusted Facebook with their data and, when asked in their privacy settings, said they didn't want it shared with third parties. That information was then shared with third parties. If someone calls my bank and convinces customer service they are me, it would be reasonable to say the bank was breached. Not electronically. But breached nonetheless.

RandallBrown 9y ago
Everyone sets up their own account's privacy settings though, and as far as I know, this information didn't include anything that wasn't already publicly available.
- sverige 9y ago
  That is not clear at all, based on another article. [1] Further, Facebook's lawyers told Wylie that the data was illicitly obtained, though now apparently they've changed their approach. [1] 'Kogan was able to throw money at the hard problem of acquiring personal data: he advertised for people who were willing to be paid to take a personality quiz on Amazon’s Mechanical Turk and Qualtrics. At the end of which Kogan’s app, called thisismydigitallife, gave him permission to access their Facebook profiles. And not just theirs, but their friends’ too. On average, each “seeder” – the people who had taken the personality test, around 320,000 in total – unwittingly gave access to at least 160 other people’s profiles, none of whom would have known or had reason to suspect.' --from https://www.theguardian.com/news/2018/mar/17/data-war-whistleblower-christopher-wylie-faceook-nix-bannon-trump https://www.theguardian.com/news/2018/mar/17/data-war-whistl...
- SolarUpNote 9y ago
  The whistleblower said they had access to private messages. Are those ever publicly available? I don't see any privacy settings for messages in my FB profile.
  - idoh 9y ago
    It depends on when this all happened. In the past a lot more information was available than now.
Klathmon 9y ago
>If someone calls my bank and convinces customer service they are me, it would be reasonable to say the bank was breached. Not electronically. But breached nonetheless. That's a bad analogy. A more appropriate one would be if you called your bank and told them to allow a 3rd party to have access to all of your accounts, then blamed your bank when the 3rd party drained all your accounts. Facebook has no obligation to protect your data from yourself any more than your bank has the obligation to control what you spend your money on.

sergiosgc 9y ago

It was a breach followed by business motivated poor handling of the breach. Facebook learned about the TOS violation, requested that CA delete the data, and did not follow up with verification that it was indeed deleted. The fail to follow up is compounded by the fact that: a) Facebook was notified that CA did not delete the data; and b) The CA-held profiles were used to target politically motivated advertising on Facebook. One can't avoid linking the two facts. Facebook has no incentive to aggressively protect its user data when it hurts ad spending on the platform.

oh-kumudo 9y ago

Clearly, Facebook loses hold on the users' data to some 3rd party players, and even now that they have no control that the data is actually deleted or not. If Facebook has no means to detain such malicious usage of users' data, they should be more careful to open the access of it in the first place.

colordrops 9y ago

Using an "honor system" doesn't work for privacy, considering thousands of apps have access to the data. The problem is not Aleksandr Kogan.

mc32 9y ago

People are going to call it a breach because it fits their PoV. When this happened with Craigslist people were calling Newmark all kinds of names and quibbling about ownership of the data, etc. [that since it was user generated Craigslist didn't really own it, so that all those *pad companies were not in breach, etc. That is all it is.

bogomipz 9y ago

>"Is it even clear that there was a 'breach' of any kind that Facebook was responsible for?" How about a breach of basic responsibility to inform users that their data has been used inappropriately and transferred to a third party. FB knew about this as far back as 2015[1]. Did they let users know at any point? No. Further FB's Chief Security Officers's tweets on Friday failed to show any concern for FB users who were used as pawns. His main concern was to point out that this wasn't actually a FB problem. And let's not forget that Mark Zuckerberg dismissed the idea that fake news on Facebook influenced the US elections as "a pretty crazy idea."[2] So the "pitchforks" are a culmination of a significantly longer time frame and not just a reaction to this single news story. [1] https://www.theguardian.com/us-news/2015/dec/11/senator-ted-cruz-president-campaign-facebook-user-data https://www.theguardian.com/us-news/2015/dec/11/senator-ted-... [2] https://www.theguardian.com/technology/2016/nov/10/facebook-fake-news-us-election-mark-zuckerberg-donald-trump https://www.theguardian.com/technology/2016/nov/10/facebook-...

felipeerias 9y ago
"These guys unlawfully got data from a lot of our users. Surely they will delete it if we ask them to, right? "Now they want to buy a lot of ads on our platform, great! "Also their ads are getting a lot of engagement somehow, let's make it cheaper for them to buy more!"
ce4 9y ago
According to an NYT article [0] the tweets had been requested by FB comms: "Over the weekend, after news broke that Cambridge Analytica had harvested data on as many as 50 million Facebook users, Facebook’s communications team encouraged Mr. Stamos to tweet in defense of the company, but only after it asked to approve Mr. Stamos’s tweets, according to two people briefed on the incident. After the tweets set off a furious response, Mr. Stamos deleted them." [0]: https://nytimes.com/2018/03/19/technology/facebook-alex-stamos.html https://nytimes.com/2018/03/19/technology/facebook-alex-stam...

matthewcford 9y ago

The issue was back in the day the FB APIs were not as tightly scope controlled as they are now - you were not just giving access to your data but also of that of your friends - even if they did not.

SubiculumCode 9y ago

And if you want to know what kind of company Cambridge Analytica is, check out this under-cover reporting, jus tout this morning: https://www.nytimes.com/2018/03/19/us/cambridge-analytica-alexander-nix.html https://www.nytimes.com/2018/03/19/us/cambridge-analytica-al... SLIMY

moolcool 9y ago

Facebook trusted user data to a third party who didn't turn out to be trustworthy. How are they not due some share of the blame? Do you think the TOS provides sufficient (or any) protection for this data in the real world?

jdavis703 9y ago

My understanding is the people who answered the quiz were a fraction of the 50 million people's whose data was "used." The quiz was a small sample so they could run their analytics on the larger data set.

flexie 9y ago

With that logic anyone making a quiz should be able to get data on 50M users and that’s not a problem?

tomc1985 9y ago

That sounds like the use-case for nearly everyone shady on Facebook advertising. Surely there are many other, privately-gathered troves of data that are much larger out there?