7 ms·

Facebook did not authorize data retention. CA’s actions were therefore unauthorized use of data, which is the textbook definition of a data breach.

darawk 9y ago
...you mean facebook said "don't keep this" and then they kept it? And people are calling that a breach?
- cryptoz 9y ago
  Yes, that's what Facebook said. And yes, people are calling it a breach because of that. Because it is. If you pay a company for a service, and then use the service against the terms of use, putting millions of people into danger, you have created a massive data breach of unauthorized data access that has massive real-world physical consequences. This was a data breach of the highest order.
- dragonwriter 9y ago
  Well, no, the breach happened when the data was acquired under false (bogus “academic use”) pretenses and then transferred to CA, thus taking personal data contrary to both the will of the subjects and the policy of the entity through which it was taken; the “dont keep this” was a (pitiful) post-breach mitigation effort by Facebook.
bdcravens 9y ago
So you're saying that every company that is screen scraped in violation of their TOS has experienced a data breach?
- IAmEveryone 9y ago
  No. Facebook’s app Developer TOS are different than that of some random website, in that they require explicit consent. It’s a contract, not a one-sided passive statement and is therefore binding in a way a linked TOS is not.
UncleEntity 9y ago
> Facebook did not authorize data retention. CA’s actions were therefore unauthorized use of data, which is the textbook definition of a data breach. But they did authorize data acquisition which means they weren't "breached" but fully consented to handing over the data. Be like HN saying I can read all the comments I want but can't copy them to my hard drive, if I did copy them and used them for some other purpose would this also be a "textbook definition of a data breach"?
TwoBit 9y ago
That's not at all what a data breach is, much less a "textbook definition" of one.

darawk 9y ago

...you mean facebook said "don't keep this" and then they kept it? And people are calling that a breach?

cryptoz 9y ago
Yes, that's what Facebook said. And yes, people are calling it a breach because of that. Because it is. If you pay a company for a service, and then use the service against the terms of use, putting millions of people into danger, you have created a massive data breach of unauthorized data access that has massive real-world physical consequences. This was a data breach of the highest order.
dragonwriter 9y ago
Well, no, the breach happened when the data was acquired under false (bogus “academic use”) pretenses and then transferred to CA, thus taking personal data contrary to both the will of the subjects and the policy of the entity through which it was taken; the “dont keep this” was a (pitiful) post-breach mitigation effort by Facebook.

bdcravens 9y ago

So you're saying that every company that is screen scraped in violation of their TOS has experienced a data breach?

IAmEveryone 9y ago
No. Facebook’s app Developer TOS are different than that of some random website, in that they require explicit consent. It’s a contract, not a one-sided passive statement and is therefore binding in a way a linked TOS is not.

UncleEntity 9y ago

> Facebook did not authorize data retention. CA’s actions were therefore unauthorized use of data, which is the textbook definition of a data breach. But they did authorize data acquisition which means they weren't "breached" but fully consented to handing over the data. Be like HN saying I can read all the comments I want but can't copy them to my hard drive, if I did copy them and used them for some other purpose would this also be a "textbook definition of a data breach"?

TwoBit 9y ago

That's not at all what a data breach is, much less a "textbook definition" of one.