Facebook faced new calls for regulation from within the US Congress and was hit with questions about personal data safeguards this weekend, after reports that a political consultant gained access to 50 million users’ data starting in 2014.
The company disclosed the issue in a blog post on Friday, hours before media reports that conservative-leaning Cambridge Analytica, a data company known for its work on Donald Trump’s 2016 presidential campaign, was given access to the data and may not have deleted it.
The New York Times and the UK’s Observer newspaper reported that private information from more than 50 million Facebook users improperly ended up in the hands of Cambridge Analytica, and the information has not been deleted despite Facebook’s demands beginning in 2015.
Some 270,000 people allowed use of their data by a researcher, who scraped the data of all their friends as well, a move allowed by Facebook until 2015. The researcher sold the data to Cambridge, which was against Facebook rules, the newspapers said.
Today’s Observer has an in-depth interview with the man who came up with the idea of scraping Facebook’s user data to create psychological profiles. Earlier this month, he submitted a dossier of evidence to the Information Commissioner’s Office and the National Crime Agency’s cybercrime unit.
Information Commissioner Elizabeth Denham said: “We are investigating the circumstances in which Facebook data may have been illegally acquired and used.
“It’s part of our ongoing investigation into the use of data analytics for political purposes which was launched to consider how political parties and campaigns, data analytics companies and social media platforms in the UK are using and analysing people’s personal information to micro target voters.
“It is important that the public are fully aware of how information is used and shared in modern political campaigns and the potential impact on their privacy.
“We are continuing to invoke all of our powers and are pursuing a number of live lines of inquiry. Any criminal and civil enforcement actions arising from the investigation will be pursued vigorously”.
The scrutiny facing Facebook presents a new threat to its reputation, which was already under attack over Russians’ alleged use of Facebook tools to sway American voters before and after the 2016 US elections.“It’s clear these platforms can’t police themselves,” Democratic US Senator Amy Klobuchar tweeted. “They say ‘trust us.’ Mark Zuckerberg needs to testify before Senate Judiciary.”
Facebook said the root of the problem was that researchers and Cambridge Analytica lied to it and abused its policies, but critics on apportioned blame to Facebook as well, demanding answers on behalf of users and calling for new regulation. Facebook insisted the data was misused but not stolen, because users gave permission, sparking a debate about what constitutes a hack that must be disclosed to customers.
“The lid is being opened on the black box of Facebook’s data practices, and the picture is not pretty,” said Frank Pasquale, a University of Maryland law professor who has written about Silicon Valley’s use of data.
Pasquale said Facebook’s response that data had not technically been stolen seemed to obfuscate the central issue that data was apparently used in a way contrary to the expectations of users. “It amazes me that they are trying to make this about nomenclature. I guess that’s all they have left,” he said.
Democratic US Senator Mark Warner said the episode bolstered the need for new regulations about internet advertising, describing the industry as the “Wild West.”
“Whether it’s allowing Russians to purchase political ads, or extensive micro-targeting based on ill-gotten user data, it’s clear that, left unregulated, this market will continue to be prone to deception and lacking in transparency,” he said. With Republicans controlling the Senate’s majority, though, it was not clear if calls for regulation would prevail.
Cambridge Analytica worked on Trump’s 2016 campaign. A Trump campaign official said, though, that it used Republican data sources, not Cambridge Analytica, for its voter information.
Facebook, in a series of written statements beginning late on Friday, said its policies had been broken by Cambridge Analytica and researchers and that it was exploring legal action. Cambridge Analytica in turn said it had deleted all the data and that the company supplying it had been responsible for obtaining it.
Andrew Bosworth, a Facebook vice president, hinted the company could make more changes to demonstrate it values privacy. “We must do better and will,” he wrote on Twitter, adding that “our business depends on it at every level.” Facebook said it asked for the data to be deleted in 2015 and then relied on written certifications by those involved that they had complied.
Nuala O’Connor, president of the Centre for Democracy & Technology, an advocacy group, said Facebook was relying on the good will of people rather than preparing for intentional misuse. She said she found it puzzling that Facebook knew about the abuse in 2015 but did not disclose it until Friday: “That’s a long time.”
The Massachusetts attorney general’s office said it was launching an investigation into the use of Facebook data. A spokesperson for Maura Healey said she wants to understand how the data was used, what policies if any were violated and what the legal implications are.