3 ms·

> There's no way for Z to even know that X exists Other than the time that X explicitly and directly asked Z for access to their data, you mean. This isn't si

by ysavir 6y ago

> There's no way for Z to even know that X exists Other than the time that X explicitly and directly asked Z for access to their data, you mean. This isn't similar to a case where I stored my users' info in a database on Cloud Hosting Service Inc machines, CHS's lax security allowed the data to be hacked, and I am now accountable to my users because I used an insecure service. Facebook's role in this situation was, literally speaking, a permissions broker between the end users and Dr. Kogan. The end users granted Dr. Kogan permission with every opportunity to learn about Dr. Kogan. Edit: Correction that users had a chance to learn about Dr. Kogan, not CA.

dragontamer 6y ago
Doesn't change my overall point. Asking for Z to sue X has a number of issues: 1. Z doesn't know Y's policy towards X. Is the problem truly Y's fault or X's fault? "Z sues Y" doesn't necessarily implicate Y as the root cause, it just proves that Y was "along the way" towards the root cause. 2. Y sues X is a totally separate question. Consider the case where a car-parts company creates a suspension ("X"), who sells their suspensions to Ford (aka: Y). Sometime while customer "Z" was driving, the suspension fails. Z sues Y for a million bucks to cover the cost of back surgery or something. Y then has to argue with X to figure out who was responsible for the suspension failure. Depending on the agreements / contracts Y could be the root cause, or X. (Maybe it's Y's fault: if Y was using the suspensions incorrectly and X can prove it, then the Y-sues-X case will fail). In this #2 case: if Z sues X directly, Z will fail (because X is not at fault). Its safer for Z to sue Y... and its also the morally sound way to move things forward. ---------- For better or worse, Z (the typical user) has a relationship with Facebook (Y). Cambridge Analytica is X. Whether X or Y is at fault is still ambiguous from Z's perspective (no reason for Z to come up with legal arguments and determine the "right person to sue"). All Z has to prove is someone wronged him, and that Y is the next person up the chain. Let Y's lawyers figure out if Y or X is responsible. Z just needs compensation for Z's issues alone.
- ysavir 6y ago
  > Doesn't change my overall point. That's because you keep making points that ignore that the end users knowingly granted permission to Dr. Kogan. If I buy a car, I don't expect the transmission manufacturer to be part of the specs or shopping process, so yes, I would sue Ford. But if Ford says "comes with Goodyear tires", and then one of those tires proves faulty, I'll be suing Goodyear, not Ford. But if you really want to use comparisons, let's use one that's appropriate: I purchase an iPhone from Apple. In this scenario, Apple has a policy that app developers can't share data with 3rd parties. I download an app and grant it permission to my data. The app developer then shares that data with someone else. Who is at fault? Who is the victim? Should I sue Apple? Should I sue the app developer? Can I really sue anyone considering I myself downloaded the app and granted it access to my data?
  - dragontamer 6y ago
    Analogies seem to be failing. So lets actually talk about the case then. Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA. My opinion: (IANAL). B sues Facebook. Then, Facebook sues CA. This leads to a few results: 1. If B loses its case against Facebook, the game is over. 2. If B wins its case against Facebook, Facebook continues and sues CA. 3. If Facebook loses vs CA, then the game is over and Facebook is found to be at fault. If Facebook wins vs CA, then CA was at fault. 4. If CA was at fault, then maybe CA will then sue its consultant over the issue, and it may continue. So on and so forth until the root cause is discovered, wherein the game ends. Simple process. At least... simple if everyone could afford the proper legal process. B probably can't afford it and many "Bs" need to gather together for a class action lawsuit and all that jazz. The hardest part of the puzzle is what exactly B would be suing over. It feels like B was damaged as a whole, since Facebook leaked B's information to CA. But its hard for me to formalize the complaint. Then again: that's a lawyer's job to find out.
    - ysavir 6y ago
      If we're going with a chain lawsuit, then why skip the step where B sues A for sharing their information with Dr. Kogan? B sues A for sharing their information, then A sues Facebook, then Facebook sues CA. That would be the full cycle, no? If B is allowed to skip suing A in favor of suing Facebook directly, why shouldn't they also skip suing Facebook and sue Dr. Kogan directly? Or maybe it doesn't even get to go that far: B just needs to sue A, Facebook gets to sue Dr. Kogan, and that's all we see.
politicalloss 6y ago
> The end users granted Dr. Kogan permission with every opportunity to learn about Dr. Kogan. > Edit: Correction that users had a chance to learn about Dr. Kogan, not CA. The end users granted Facebook the right to share the friend data that their friends had granted them access to. Is there a screenshot of the 'Authorize App' screen at the time? Indeed, what did the fine print say? I can draw a chord chart of my friend graph using only user IDs and names. You can analyze my personality with what data that I explicitly grant access to?
- josephg 6y ago
  If we’re friends, I’ve shared my information with you. I haven’t given you (or Facebook, or anyone else) permission to share my data with Cambridge analytica.
  - politicalloss 6y ago
    If you authorized an app to access the data shared with you, then you authorized release of your friends' information because that's what data you agreed to share with the app. Indeed, where is a screenshot of the 'Authorize App' consent dialogue that users were presented with. - A agrees to sharing info with B by accepting a friend request. Explicitly per the terms of service, and implicitly because technically anyone can take a screenshot or a photo or a video and share whatever's shared with them (even in DRM'd systems with limited key distribution). - B authorizes C to retrieve the data available to B. - C then reshares, sells, distributes, or otherwise transmits information to D. F enabled A to share data with B, given explicit user consent. F enabled B to share data with C, given explicit user consent. If you don't want people to know things, don't put that information on the internet; and don't authorize friends to share information you haven't volunteered.
    - josephg 6y ago
      Your post conflates ethics (what should happen), law (what is legal to happen) and what actually happens. Ethically, if I tell you my email address, and you sell my name + email address to advertisers without telling me, you've done me wrong. You violated my reasonable expectation of privacy. I have the same expectation if I make a private post to facebook, visible only to my (curated) list of friends. That content is for your eyes only. Violating that expectation probably has no repercussions under US law. But it is almost certainly illegal under the GDPR. I installed Clubhouse the other day and clubhouse asked me to share my contacts with the app. Saying yes without checking with everyone on my contacts' list was probably illegal in europe. (Rightfully so, in my opinion.) In this case, A shared information (posts, etc) with B (A's friend) on Facebook. B authorized app X to access their information - which in turn passed that information to Z (Cambridge Analytica) with neither A nor B's consent. Things that went wrong here: - B should not have been able to pass A's information to a third party (X) without A's explicit consent. - X should not have passed information to Z (Cambridge Analytica) - Facebook shouldn't have built a platform which permitted / encouraged such obvious and blatant abuses of privacy. If a user told facebook that some content was private, facebook violated user's trust by sharing that information with a random 3rd party app. B's consent isn't relevant wrt A's data. (Permission isn't transitive.) Who's legally at fault here? I have no idea, and I'm glad the courts exist to figure all this out. Meanwhile, our technology is utterly failing user's expectations of privacy - which, yes, actually exists in much of the rest of the world. > If you don't want people to know things, don't put that information on the internet What a ridiculous sentiment. No. I want to use the internet and have an expectation of privacy. I will not settle for mediocrity so that facebook can make more money.

by ysavir 6y ago

dragontamer 6y ago

Doesn't change my overall point. Asking for Z to sue X has a number of issues: 1. Z doesn't know Y's policy towards X. Is the problem truly Y's fault or X's fault? "Z sues Y" doesn't necessarily implicate Y as the root cause, it just proves that Y was "along the way" towards the root cause. 2. Y sues X is a totally separate question. Consider the case where a car-parts company creates a suspension ("X"), who sells their suspensions to Ford (aka: Y). Sometime while customer "Z" was driving, the suspension fails. Z sues Y for a million bucks to cover the cost of back surgery or something. Y then has to argue with X to figure out who was responsible for the suspension failure. Depending on the agreements / contracts Y could be the root cause, or X. (Maybe it's Y's fault: if Y was using the suspensions incorrectly and X can prove it, then the Y-sues-X case will fail). In this #2 case: if Z sues X directly, Z will fail (because X is not at fault). Its safer for Z to sue Y... and its also the morally sound way to move things forward. ---------- For better or worse, Z (the typical user) has a relationship with Facebook (Y). Cambridge Analytica is X. Whether X or Y is at fault is still ambiguous from Z's perspective (no reason for Z to come up with legal arguments and determine the "right person to sue"). All Z has to prove is someone wronged him, and that Y is the next person up the chain. Let Y's lawyers figure out if Y or X is responsible. Z just needs compensation for Z's issues alone.

ysavir 6y ago
> Doesn't change my overall point. That's because you keep making points that ignore that the end users knowingly granted permission to Dr. Kogan. If I buy a car, I don't expect the transmission manufacturer to be part of the specs or shopping process, so yes, I would sue Ford. But if Ford says "comes with Goodyear tires", and then one of those tires proves faulty, I'll be suing Goodyear, not Ford. But if you really want to use comparisons, let's use one that's appropriate: I purchase an iPhone from Apple. In this scenario, Apple has a policy that app developers can't share data with 3rd parties. I download an app and grant it permission to my data. The app developer then shares that data with someone else. Who is at fault? Who is the victim? Should I sue Apple? Should I sue the app developer? Can I really sue anyone considering I myself downloaded the app and granted it access to my data?
- dragontamer 6y ago
  Analogies seem to be failing. So lets actually talk about the case then. Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA. My opinion: (IANAL). B sues Facebook. Then, Facebook sues CA. This leads to a few results: 1. If B loses its case against Facebook, the game is over. 2. If B wins its case against Facebook, Facebook continues and sues CA. 3. If Facebook loses vs CA, then the game is over and Facebook is found to be at fault. If Facebook wins vs CA, then CA was at fault. 4. If CA was at fault, then maybe CA will then sue its consultant over the issue, and it may continue. So on and so forth until the root cause is discovered, wherein the game ends. Simple process. At least... simple if everyone could afford the proper legal process. B probably can't afford it and many "Bs" need to gather together for a class action lawsuit and all that jazz. The hardest part of the puzzle is what exactly B would be suing over. It feels like B was damaged as a whole, since Facebook leaked B's information to CA. But its hard for me to formalize the complaint. Then again: that's a lawyer's job to find out.
  - ysavir 6y ago
    If we're going with a chain lawsuit, then why skip the step where B sues A for sharing their information with Dr. Kogan? B sues A for sharing their information, then A sues Facebook, then Facebook sues CA. That would be the full cycle, no? If B is allowed to skip suing A in favor of suing Facebook directly, why shouldn't they also skip suing Facebook and sue Dr. Kogan directly? Or maybe it doesn't even get to go that far: B just needs to sue A, Facebook gets to sue Dr. Kogan, and that's all we see.

politicalloss 6y ago

> The end users granted Dr. Kogan permission with every opportunity to learn about Dr. Kogan. > Edit: Correction that users had a chance to learn about Dr. Kogan, not CA. The end users granted Facebook the right to share the friend data that their friends had granted them access to. Is there a screenshot of the 'Authorize App' screen at the time? Indeed, what did the fine print say? I can draw a chord chart of my friend graph using only user IDs and names. You can analyze my personality with what data that I explicitly grant access to?

josephg 6y ago
If we’re friends, I’ve shared my information with you. I haven’t given you (or Facebook, or anyone else) permission to share my data with Cambridge analytica.
- politicalloss 6y ago
  If you authorized an app to access the data shared with you, then you authorized release of your friends' information because that's what data you agreed to share with the app. Indeed, where is a screenshot of the 'Authorize App' consent dialogue that users were presented with. - A agrees to sharing info with B by accepting a friend request. Explicitly per the terms of service, and implicitly because technically anyone can take a screenshot or a photo or a video and share whatever's shared with them (even in DRM'd systems with limited key distribution). - B authorizes C to retrieve the data available to B. - C then reshares, sells, distributes, or otherwise transmits information to D. F enabled A to share data with B, given explicit user consent. F enabled B to share data with C, given explicit user consent. If you don't want people to know things, don't put that information on the internet; and don't authorize friends to share information you haven't volunteered.
  - josephg 6y ago
    Your post conflates ethics (what should happen), law (what is legal to happen) and what actually happens. Ethically, if I tell you my email address, and you sell my name + email address to advertisers without telling me, you've done me wrong. You violated my reasonable expectation of privacy. I have the same expectation if I make a private post to facebook, visible only to my (curated) list of friends. That content is for your eyes only. Violating that expectation probably has no repercussions under US law. But it is almost certainly illegal under the GDPR. I installed Clubhouse the other day and clubhouse asked me to share my contacts with the app. Saying yes without checking with everyone on my contacts' list was probably illegal in europe. (Rightfully so, in my opinion.) In this case, A shared information (posts, etc) with B (A's friend) on Facebook. B authorized app X to access their information - which in turn passed that information to Z (Cambridge Analytica) with neither A nor B's consent. Things that went wrong here: - B should not have been able to pass A's information to a third party (X) without A's explicit consent. - X should not have passed information to Z (Cambridge Analytica) - Facebook shouldn't have built a platform which permitted / encouraged such obvious and blatant abuses of privacy. If a user told facebook that some content was private, facebook violated user's trust by sharing that information with a random 3rd party app. B's consent isn't relevant wrt A's data. (Permission isn't transitive.) Who's legally at fault here? I have no idea, and I'm glad the courts exist to figure all this out. Meanwhile, our technology is utterly failing user's expectations of privacy - which, yes, actually exists in much of the rest of the world. > If you don't want people to know things, don't put that information on the internet What a ridiculous sentiment. No. I want to use the internet and have an expectation of privacy. I will not settle for mediocrity so that facebook can make more money.