4 ms·

Maybe you haven't worked in a big company: someone raises a thread that one of your users is crawling and stealing all of your data and you don't resolve it for

Maybe you haven't worked in a big company: someone raises a thread that one of your users is crawling and stealing all of your data and you don't resolve it for 3 months? At minimum, "Facebook" knew about the problem for 3 months. If it wasn't raised to Zuck personally, it should at least have been handled by someone more quickly than that. FB claimed they didn't know about it, but they knew about it for at least 3 months before the guardian article. Don't get tricked by weasel words where Zuck pretends to have selective Amnesia. Maybe he knew, maybe he didn't. But multiple people knew, and there were multiple email threads about it. FB can't claim ignorance here.

smsm42 7y ago
Some of the employees had concerns about what CA is doing. Which btw didn't do much different from what many others were previously doing with FB data. That doesn't mean it immediately rose to CEO level and everybody in top brass knew everything about it. Of course, if whoever handled it knew then what they know now - that it'd be such a public issue - they'd escalate faster, but they didn't. As such, "Facebook knew" is a bit meaningless statement - "Facebook" is not one person, it's very many persons, and knowledge propagated through this number of persons over some time. They details how it happened may be curious, but there's no additional proof of anything or refutation of the statement that FB top brass didn't know about it - it very well may be that some people knew, but didn't report (yet) it to FB top brass, because they did not realize what exactly is happening and how important it is about to become.
- ggg3 7y ago
  but we do agree that this can be throw in the garbage because the real case is that the CEO didn't have data protections in place. he can claim ignorance but wont be able to down besides VP leve if we want to be realistic. either you handle the legal requirements or you hire someone, otherwise you are negligent and can't claim you didn't know the law. so discussion in this and every other individual casew is futile, as we should be discussing if data protections should be a given like health inspection or not.
- soraminazuki 7y ago
  It doesn’t really matter how the chain of responsibility works within FB, or how many people “knew” about the incident. FB handles an amount of extremely personal data never seen before in human history. It’s their responsibility to act as quickly as possible to protect such data.
abraae 7y ago
I've seen many instances, even on HN over the last few years, of large companies with the most hideous security practices being told over and over again, and simply doing nothing. My guess (only a guess) would be that the inside of Equifax was a toxic mess where plenty of techies knew of the dangers well before their hack.
SpicyLemonZest 7y ago
They didn't resolve it for 3 months because they didn't think it was particularly important. And I mean, I'm not trying to exonerate Facebook here. Enforcing data access policies is extremely important, they were wrong to think otherwise, and they'd better have learned their lesson. But we already knew all of that.
- jacquesm 7y ago
  Which would you prefer: - incompetence - malice
  - cameronbrown 7y ago
    I don't know which option is scariest. I'd have to chalk it up to incompetence and mismanaged incentives. I reckon senior management didn't have a problem with what Cambridge Analytica did at all considering its the same thing the Obama campaign pioneered (data driven political profiling and targeted advertising) in 2012. Because of how warped company opinion must be on the concept of personal data, they probably didn't care.
  - lowdose 7y ago
    Hanlon's razor says incompetence over malice. https://en.m.wikipedia.org/wiki/Hanlon%27s_razor https://en.m.wikipedia.org/wiki/Hanlon%27s_razor > "Never attribute to malice that which is adequately explained by stupidity."

smsm42 7y ago

Some of the employees had concerns about what CA is doing. Which btw didn't do much different from what many others were previously doing with FB data. That doesn't mean it immediately rose to CEO level and everybody in top brass knew everything about it. Of course, if whoever handled it knew then what they know now - that it'd be such a public issue - they'd escalate faster, but they didn't. As such, "Facebook knew" is a bit meaningless statement - "Facebook" is not one person, it's very many persons, and knowledge propagated through this number of persons over some time. They details how it happened may be curious, but there's no additional proof of anything or refutation of the statement that FB top brass didn't know about it - it very well may be that some people knew, but didn't report (yet) it to FB top brass, because they did not realize what exactly is happening and how important it is about to become.

ggg3 7y ago
but we do agree that this can be throw in the garbage because the real case is that the CEO didn't have data protections in place. he can claim ignorance but wont be able to down besides VP leve if we want to be realistic. either you handle the legal requirements or you hire someone, otherwise you are negligent and can't claim you didn't know the law. so discussion in this and every other individual casew is futile, as we should be discussing if data protections should be a given like health inspection or not.
soraminazuki 7y ago
It doesn’t really matter how the chain of responsibility works within FB, or how many people “knew” about the incident. FB handles an amount of extremely personal data never seen before in human history. It’s their responsibility to act as quickly as possible to protect such data.

abraae 7y ago

I've seen many instances, even on HN over the last few years, of large companies with the most hideous security practices being told over and over again, and simply doing nothing. My guess (only a guess) would be that the inside of Equifax was a toxic mess where plenty of techies knew of the dangers well before their hack.

SpicyLemonZest 7y ago

They didn't resolve it for 3 months because they didn't think it was particularly important. And I mean, I'm not trying to exonerate Facebook here. Enforcing data access policies is extremely important, they were wrong to think otherwise, and they'd better have learned their lesson. But we already knew all of that.

jacquesm 7y ago
Which would you prefer: - incompetence - malice
- cameronbrown 7y ago
  I don't know which option is scariest. I'd have to chalk it up to incompetence and mismanaged incentives. I reckon senior management didn't have a problem with what Cambridge Analytica did at all considering its the same thing the Obama campaign pioneered (data driven political profiling and targeted advertising) in 2012. Because of how warped company opinion must be on the concept of personal data, they probably didn't care.
- lowdose 7y ago
  Hanlon's razor says incompetence over malice. https://en.m.wikipedia.org/wiki/Hanlon%27s_razor https://en.m.wikipedia.org/wiki/Hanlon%27s_razor > "Never attribute to malice that which is adequately explained by stupidity."