5 ms·

Cambridge Analytica used the Facebook API to ask users to share data about them & their friends. Stupid users agreed to that. According to Facebook, this is no

• ysavir 6y ago
  And does anything about this make Facebook liable for the way CA used the data willingly given to them by their users? Facebook is either: 1. a neutral party, acting on the wishes of its users, who asked to grant CA access to their data. The victims are users and the aggressor is CA for misusing data. Or: 2. a victim party, after CA went against their policies. CA is the aggressor in this scenario, and the users are not part of the equation.
  • dragontamer 6y ago
    Or 3: The law works differently than you expect. Asking for a victim to find the "root cause" of a problem is too much to ask. If X wronged Y causes a wrong to happen to Z... the legal system is largely designed for "Z sues Y" then "Y sues X". Asking for Z to sue X directly is asking for too much. There's no way for Z to even know that X exists.
    • ysavir 6y ago
      > There's no way for Z to even know that X exists Other than the time that X explicitly and directly asked Z for access to their data, you mean. This isn't similar to a case where I stored my users' info in a database on Cloud Hosting Service Inc machines, CHS's lax security allowed the data to be hacked, and I am now accountable to my users because I used an insecure service. Facebook's role in this situation was, literally speaking, a permissions broker between the end users and Dr. Kogan. The end users granted Dr. Kogan permission with every opportunity to learn about Dr. Kogan. Edit: Correction that users had a chance to learn about Dr. Kogan, not CA.
      • dragontamer 6y ago
        Doesn't change my overall point. Asking for Z to sue X has a number of issues: 1. Z doesn't know Y's policy towards X. Is the problem truly Y's fault or X's fault? "Z sues Y" doesn't necessarily implicate Y as the root cause, it just proves that Y was "along the way" towards the root cause. 2. Y sues X is a totally separate question. Consider the case where a car-parts company creates a suspension ("X"), who sells their suspensions to Ford (aka: Y). Sometime while customer "Z" was driving, the suspension fails. Z sues Y for a million bucks to cover the cost of back surgery or something. Y then has to argue with X to figure out who was responsible for the suspension failure. Depending on the agreements / contracts Y could be the root cause, or X. (Maybe it's Y's fault: if Y was using the suspensions incorrectly and X can prove it, then the Y-sues-X case will fail). In this #2 case: if Z sues X directly, Z will fail (because X is not at fault). Its safer for Z to sue Y... and its also the morally sound way to move things forward. ---------- For better or worse, Z (the typical user) has a relationship with Facebook (Y). Cambridge Analytica is X. Whether X or Y is at fault is still ambiguous from Z's perspective (no reason for Z to come up with legal arguments and determine the "right person to sue"). All Z has to prove is someone wronged him, and that Y is the next person up the chain. Let Y's lawyers figure out if Y or X is responsible. Z just needs compensation for Z's issues alone.
        • ysavir 6y ago
          > Doesn't change my overall point. That's because you keep making points that ignore that the end users knowingly granted permission to Dr. Kogan. If I buy a car, I don't expect the transmission manufacturer to be part of the specs or shopping process, so yes, I would sue Ford. But if Ford says "comes with Goodyear tires", and then one of those tires proves faulty, I'll be suing Goodyear, not Ford. But if you really want to use comparisons, let's use one that's appropriate: I purchase an iPhone from Apple. In this scenario, Apple has a policy that app developers can't share data with 3rd parties. I download an app and grant it permission to my data. The app developer then shares that data with someone else. Who is at fault? Who is the victim? Should I sue Apple? Should I sue the app developer? Can I really sue anyone considering I myself downloaded the app and granted it access to my data?
    • politicalloss 6y ago
      Did the losses and liabilities result from the actions of the plaintiff? Do we need multiple non-joined cases? BTW, the SOLID project believes that data portability is a privacy advantage of their competing, open source federated system. If you don't want people to know something, don't put it on the internet; regardless of TOS. We shouldn't expect or rely upon information asymmetry holding over time. Facebook certainly required users (who are not paying customers) to sign data sharing agreements. Facebook did not commit the crimes of Cambridge Analytica (Steve Bannon, Trump's campaign guy; Ted Cruz). Facebook was fined $5b. Cambridge Analytica went bankrupt and Nix is barred from serving on the board of any UK company for 7 years. Facebook's expenses related to Russian misinformation campaigns, Facebook's expenses related to the administration's denial of ongoing foreign information operations paid for by advertisers who don't want a spot next to sleaze.
  • dfxm12 6y ago
    You are saying Facebook users willingly gave their data to CA as if it is a matter of fact. Can I refer you to the post you replied to? Facebook disputes this! Also, no need to set up a false dichotomy. There are other possibilities. Usually, figuring out liability is a function of the court, thus this legal action. You'll probably get the answer to your question when the suit has been concluded.
  • lmkg 6y ago
    Someone is not responsible for causing damages can still be held liable for damages if they were negligent. One could argue that by having policies but not enforcing them, Facebook contributed to the harm befalling users, especially if an argument can be constructed that users relied on Facebook's platform policies as part of deciding whether to share data with CA.
  • orangeoxidation 6y ago
    > Cambridge Analytica's app on Facebook had harvested the data of people who interacted with it - and that of friends who had not given consent. This is the problem (quote from op article). Facebook collected data on people and than shared this data to third parties without their consent. That friends gave consent to this has no relevance. They don't have the right to do so and they didn't do it themselves. Facebook did - on the request of CA (or rather that 'researcher'), with the approval of friends.
    • ergocoder 6y ago
      Yeah, it's relevant. If you share your friend's data, it's primarily your fault. You know your friend's email, and you decide to share it with someone else. Now I agree that FB should bear some responsibility since it's such a large platform. But it's you who is mainly at fault for sharing. If you shout your friend's email in a hotel's lobby, you wouldn't blame the hotel, right?
      • munk-a 6y ago
        > If you shout your friend's email in a hotel's lobby, you wouldn't blame the hotel, right? No but your friend would be quite in the right to blame you if they got threatening emails as a result of it. Depending on whether actual harm came from the act and whether you shouted their email with an intent to cause harm (even a different harm like a cascade of d** pics) then you could be held liable for damages. If you act in a manner intended to cause harm and harm results - even if not in the manner you intended - then you can be held liable. Greasing a sidewalk so that folks will fall on their ass for the giggles and then causing someone to break their spine still leaves you liable for damages - even if you were unable to foresee the potential outcome of someone breaking their spine. The hotel lobby example is likely to not result in liability due to difficulties in showing you acted maliciously but there certainly is a possibility there.
      • orangeoxidation 6y ago
        > If you shout your friend's email in a hotel's lobby, you wouldn't blame the hotel, right? I wouldn't. But if my friend went to reception and told the staff "Hey, you know my friend in room 101? Please share their mail with the stranger in room 301. Thank you." I very much would.
• Ajedi32 6y ago
  From the link: > The claim that this is a data breach is completely false. Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent. People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked. Users knowingly _agreed_ to share their data with Dr. Kogan. Dr. Kogan was contractually prohibited from passing that information on to third parties (Cambridge Analytica) but did so anyway and was banned as a result.
  • btown 6y ago
    And Facebook is being sued for... not having technical mitigations to guard against contractual breaches?
    • AmericanChopper 6y ago
      The reason we have a system of civil laws is so that everybody doesn’t have to all individually set up their own system to guard against contractual breaches.
    • ArnoVW 6y ago
      the way the legal system works: you are responsible for your contracts. If your supplier messes up, your customers sue you, you sue your supplier.
      • musingsole 6y ago
        I haven't seen it phrased that way before, and now that I have, I simultaneously accept the logic of it and am horrified by the bureaucratic churn that must spin up just to ferry legal responsibility to (in theory) the correct party.
        • ArnoVW 6y ago
          'luckily' it is expensive to sue, so everything works out. Consider the alternative: the laptop you bought on Amazon catches fire and burns down the school of your daughter. The school contacts your insurance, who now has to contact a component supplier in Shenzen (who supplied the power supply), and sue them under Chinese law, instead of Amazon.
• justapassenger 6y ago
  So to solve that we need DRM user data, do platforms can control it beyond their properties? Cool.