8 ms·

Can we not let this become framed as a "breach"? No systems were compromised. Nothing of Facebook's was accessed that wasn't supposed to be accessed. This was d

• mannykannot 9y ago
  I hope you are saying that this is worse than a simple breach, not that it is a non-issue.
  • jakelazaroff 9y ago
    Good call. Edited to clarify.
• koboll 9y ago
  Even "exfiltrated" is not really accurate since it was freely handed over. The problem is that Facebook just made its partners pinky swear to only use the data for research, which is obviously not an adequate data security measure.
• faizshah 9y ago
  The real point is that companies like facebook and equifax have such large caches of personal data and have no legal obligation to protect it. This is a point most people outside of tech don't understand. You might not even be a user of facebook but these companies still have data on you that is highly personal and invasive. An academic who has done some great work on this is Evgeny Morozov. Highly recommend his books, articles and lectures.
  • jakelazaroff 9y ago
    The point of my comment is that we should not compare Facebook to Equifax. The latter may have been lax in protecting that data, but the millions of records exposed last year were taken without their consent. Facebook is literally inviting anyone who can sign up for a developer account to harvest their — sorry, our — data at scale.
    • faizshah 9y ago
      Right and I'm saying that the broader point is it's legal for these companies, Facebook and Equifax being two of the biggest, to have massive caches of highly invasive personal data and have 0 legal obligation to protect it (they can do anything they want with it). How invasive is it for a company like weatherbug to be selling your location data to the highest bidder simply because you want to check the weather on your phone? The massive industry that has been built around advertising and personal data trading needs to be regulated.
      • jakelazaroff 9y ago
        I agree with you with regard to WeatherBug, but Equifax already cannot just sell your credit data to the highest bidder. Whether there should be more restrictions on how that data can be used is up for debate, but for the most part you can't get a credit report on someone without their explicit consent. I specifically want to avoid the Equifax comparison because it looms large in people's minds as an example of an intrusion and forceful removal of data, which is not what occurred with Facebook and Cambridge Analytica. We should have better laws around protecting sensitive data from intruders, too, but they won't be the same laws prohibiting companies from selling data they've collected on us. Conflating these problems will not help us solve them.
• mattkevan 9y ago
  Sounds like a breach to me. The only difference is that instead of the baddies having to sneak in carefully at night to nick stuff, Facebook said 'welcome, come on in, help yourself – here's a sack'. The end result – millions of people having their personal data used against them without their knowledge or consent - is the same.
  • jakelazaroff 9y ago
    "Breach" specifically implies that defenses were penetrated. But as you said, Facebook is not trying to protect our data. This is far worse than if the data were taken from them unwillingly, because it vastly increases the number of entities with unfettered access to it.
    • JumpCrisscross 9y ago
      > ”Breach" specifically implies that defenses were penetrated It’s time to update the definition. “Breach” means you lost my shit. I thought I gave it you in confidence and then you lost it. Facebook arguing “this isn’t technically a breach” comes across as their yet again talking down to users to slip problems under the rug.
      • jakelazaroff 9y ago
        Sure, but we still need some term to disambiguate between "a company didn't protect my data against intruders" and "a company sold my data, then didn't like what the buyer did with it". This isn't like the Equifax breach. It's not a result of Facebook's security practices. It's a result of Facebook's entire business model.
    • notreallyauser 9y ago
      No it doesn't. Not in the dictionary. Not even in any definition of "data breach" I've found published.
  • d_theorist 9y ago
    Two things can result in the same outcome without being the same thing.
• karmelapple 9y ago
  Was this a security breach in the sense that the company with the data got “hacked”? No. Was this a breach in trust to Facebook users? I think undoubtedly yes. And was there a breach of a the Terms of Service by companies taking all this data and using it for non-academic purposes? Yes there was. So the type of breach seems to be a worthwhile distinction to make.
  • _red 9y ago
    >Was this a breach in trust to Facebook users? I think undoubtedly yes. How naive is the average person? The purpose of facebook is to gather this information, hence why its offered as a "free service". Frankly, I don't understand why the stock is going down, facebook is fulfilling its core mission: Get private information on millions of people and package that information for sale to its clients. If anything CA situation should show how FB is fulfilling its core mission. The fact that the public is now waking up to this is not a breach, its simply casting a light on what has always existed.
    • toxican 9y ago
      The average person is incredibly naive with regards to what the cost of a "free service" like Facebook is. It's not until you start looking at people who are in related fields that you start seeing people who truly understand the costs. The public waking up to this breach and the costs being exposed are probably a huge part of why the stock is dropping. Facebook's continued profitability and success is dependent on its users not understanding how their data is being used. And now "everyone" knows, so the secret is out and hopefully Facebook can't get away with this going forward.
  • jstalin 9y ago
    > And was there a breach of a the Terms of Service by companies taking all this data and using it for non-academic purposes? Yes there was. There's a legal concept of 'waiver' meaning that even if something is prohibited in a contract, but the parties don't enforce that part, then that part is later not enforceable. Facebook was fully aware of this behavior, chose not to enforce the ToS, and therefore it waived that clause. Therefore no breach.
• matt_s 9y ago
  For Facebook, an actual data breach would be better. They could button things up and make some statements and move on. This appears to have been systemic and profitable for them because companies would turn around and pay them for highly targeted ads. They ignored it because of greed.
  • toufka 9y ago
    Yep. If/when the 50M profiles become public, Facebook will be bending over backwards to rebrand this as a breach. However, on the (Twitter) record, their CISO has already said emphatically this was not a breach. He's been demoted.
• generalk 9y ago
  > Can we not let this become framed as a "breach"? No > systems were compromised. Nothing of Facebook's was > accessed that wasn't supposed to be accessed. This was > data intentionally exposed by Facebook, just exfiltrated > and given to an entity whom Facebook hadn't authorized. This is similar to a HIPAA "breach" where the word doesn't imply that a security system was compromised, but that protected data was accessed by folks who shouldn't have had it. In this context, framing it as a breach is perfectly accurate. As an aside, a HIPAA-style law that protects and enforces portability for this type of personal data might be a good first step to reforming our industry here, which is currently completely unregulated in this regard.
  • bunderbunder 9y ago
    Let's please do better than HIPAA. It was the first such law that I know of, and there are a lot of kinks to it. Many subsequent laws were able to learn from its mistakes. One of the big weaknesses of HIPAA is that the privacy requirements technically apply to the data custodians, not the data. That allows for some loopholes through which private information can fall out of HIPAA protection, and also creates some unnecessary hassles for health care providers. Ontario's PHIPA is one example of a better model for patient privacy.
  • phkahler 9y ago
    >> ...but that protected data was accessed by folks who shouldn't have had it. Facebook handed over the data. They need to understand that they don't have control over it once it leaves Facebook. Is a violation of ToS a data breach? Do we really want to conflate those things?
    • wpietri 9y ago
      I understand why Facebook doesn't want to call it a breach. But it seems equally reasonable to me that users see it as one. From the user perspective, private data is suddenly in the hands of unknown, suspicious actors who may use it against them. That Facebook would rather not call that a breach so much as "business as usual" is all the more reason legislators may be inclined to define "breach" the way that voters do.
• mrtksn 9y ago
  It's definately a breach, just not breach into Facebook's technical infrastructure. As I wrote previously, don't you think that it can be a breach in the same sense of a breach by phishing? After all, both of the cases are about people giving their "secrets" for one reason but the info being used for something else. I mean, in the case of traditional phishing the user is tricked to provide the password by impersonating a banking site, getting their funds stolen and in the case in question, the users are tricked to provide personal information by being promised some kind of personality analysis but their data is used for political propaganda that they didn't asked for resulting in life-changing consequences du to politics.
  • whiddershins 9y ago
    When you call it a breach it sounds like they made a mistake. It wasn’t a mistake. It was by design.
    • mrtksn 9y ago
      Breach doesn't imply a mistake. Anyway, the idea here is that CA breached Facebook users personal data by methods quite similar to phishing and FB look the other way. Not necessarily by design but maybe by a desire to exploit the platform as much as possible so that did not get in the way of people who were doing interesting things.
      • verylittlemeat 9y ago
        We all know what a data breach is, calling this a data breach is playing fast and loose with the term. https://en.wikipedia.org/wiki/Data_breach https://en.wikipedia.org/wiki/Data_breach Look at all the examples of a data breach in this wiki. The CA/Facebook incident looks nothing like them. CA either paid facebook to collected data through apps or scraped data from public profiles. Maybe the CA/facebook incident will change what we consider "breach" to mean but right now "unauthorized collection of public data to create a political profile of users" is not a data breach.
        • 9y ago
• bogomipz 9y ago
  >'Can we not let this become framed as a "breach"?' Just because it wasn't a hack does not mean it wasn't a breach. To wit - a breach of data governance, breach of trust, breach of moral responsibility.
• xmodem 9y ago
  All this lawyering over the definition of 'breach' is failing to see the forest for the trees. It is a breach of trust, even if not a breach of technical security controls.
  • Bartweiss 9y ago
    I think there's a meaningful, non-definition difference - and in some ways it makes Facebook look worse. Metaphorically, somebody had a gun, and someone else took that gun and used it to rob a bank. Equifax left the gun sitting visible in an unlocked car, and people are angry about the predictable results. Facebook was running a "borrow my gun" program for strangers, but had a clause saying "no using my gun for crimes, no lending my gun to any third parties". One of those strangers lent the gun to the robber, and Facebook is saying this isn't their problem because they said not to do that. So yes, they're both bad outcomes. But "breach" usually means "this was stolen without our knowledge", and that's a very misleading impression to create here.
• lerpa 9y ago
  It's the problem with that kind of speech, it's impersonal and dehumanizing. Let's say it like it is: facebook betrays users expectations giving their data to other businesses. Same for hacking: some people invaded system such and such and took private information. It doesn't matter if it was a breach, a floodgate, a window, what matters is what happened, and what happened is that player X did Y. Let's just state that first and foremost.
  • hinkley 9y ago
    It’s important for the public discourse that someone point this sort of stuff out occasionally. Even if this was not even the most egregious example I’ve seen this week. Once in a while I reread http://www.derailingfordummies.com http://www.derailingfordummies.com and review the definition of “horizontal aggression”. Sometimes it saves me from engaging with people who are derailing the conversation. Accidentally or willfully.
• elorant 9y ago
  You don't even need a developer account. You could just scrape Facebook which is probably what CA did in the first place. They used the app to identify US users and from there on just scrape the pages using a headless browser and multiple proxies.
  • fiddlerwoaroof 9y ago
    Unless I’m doing something wrong, a developer account makes this sort of thing harder: you can’t just access anyone’s data, you have to convince them to authorize your app first. . . Which is probably why there’s all these “find which star wars character you are!” quizzes that make the rounds on FB.
    • jonknee 9y ago
      It's a little easier than getting everyone to sign up, back at the time this app was circulating if you gave it access to your data the app would also gain access to all of your friends' data. That's why a relatively small number of installs allowed it to hoover up huge amounts of data. So even if you were militant about not granting access, but your grandma clicked a button... Whoops!
• learnstats2 9y ago
  It's an alleged legal breach of Data Protection principles. That language is used historically by the ICO in the UK to describe exactly this type of situation. Facebook's responsibilities and Cambridge Analytica's responsibilities towards data protection have been breached. There's no other useful word for that. It might not be a hack and it might not be a security vulnerability, but it is surely a breach.
  • shellac 9y ago
    Yes, in the words of the ICO: > A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Most of the breaches I'm familiar with are accidental - people putting their research on thumb drives and losing them, etc etc. Whether the fox gets into the chicken shed, or you let the chicken out of the safety of the shed, it's a breach of the chicken's security.
• harry8 9y ago
  No more or less a breach than any social engineering attack. No more or less than Chelsea Manning for that matter. "Our servers weren't compromised" is totally irrelevant. Did the sensitive data end up someplace it shouldn't? Yes? Then your data security was breached. The end. But hey let's argue over the technical definition of breach rather than how evil facebook are and how much power they have - both of which are vastly more interesting to consider. I'd like to see some support of the not very, not much school of thought.
• InclinedPlane 9y ago
  Whatever it is, it's the same thing that a breach is. So either call it a breach or invent a new word for it. In any event, calling it a breach results in treating it with the degree of seriousness it deserves so I don't see a reason to not use that word.