Facebook’s Role in Data Misuse Sets Off Storms on Two Continents

WASHINGTON — Facebook on Sunday faced a backlash about how it protects user data, as American and British lawmakers demanded that it explain how a political data firm with links to President Trump’s 2016 campaign was able to harvest private information from more than 50 million Facebook profiles without the social network’s alerting users.

Senator Amy Klobuchar of Minnesota, a Democratic member of the Senate Judiciary Committee, went so far as to press for Mark Zuckerberg, Facebook’s chief executive, to appear before the panel to explain what the social network knew about the misuse of its data “to target political advertising and manipulate voters.”

The calls for greater scrutiny followed reports on Saturday in The New York Times and The Observer of London that Cambridge Analytica, a political data firm founded by Stephen K. Bannon and Robert Mercer, the wealthy Republican donor, had used the Facebook data to develop methods that it claimed could identify the personalities of individual American voters and influence their behavior. The firm’s so-called psychographic modeling underpinned its work for the Trump campaign in 2016, though many have questioned the effectiveness of its techniques.

But Facebook did not inform users whose data had been harvested. The lack of disclosure could violate laws in Britain and in many American states.

Damian Collins, a Conservative lawmaker in Britain who is leading a parliamentary inquiry into fake news and Russian meddling in the country’s referendum to leave the European Union, said this weekend that he, too, would call on Mr. Zuckerberg or another top executive to testify. The social network sent executives who handle policy matters to answer questions at an earlier hearing in February.

“It is not acceptable that they have previously sent witnesses who seek to avoid answering difficult questions by claiming not to know the answers,” Mr. Collins said in a statement. “This also creates a false reassurance that Facebook’s stated policies are always robust and effectively policed.”

The fallout from the reports added to questions Facebook was already confronting over the use of its platform by those seeking to spread Russian propaganda and fake news. The social media giant has grappled with the criticism over the issue for much of the past year, and struggled to keep public opinion on its side.

Over the weekend, Facebook was on the defensive. Top executives took to Twitter to argue that the company’s protections had not been breached, and that Facebook was thus not at fault.

“This was unequivocally not a data breach,” tweeted Andrew Bosworth, a Facebook executive. “No systems were infiltrated, no passwords or information were stolen or hacked.”

The data was obtained in 2014, when Cambridge Analytica, through an outside researcher, paid users small sums to take a personality quiz and download an app, which would scrape some private information from their profiles and from those of their friends — activity that Facebook permitted at the time. The approach was based on a technique pioneered at Cambridge University by data scientists who claimed it could reveal more about a person than even their parents or romantic partners knew.

The researcher hired by Cambridge Analytica, Alexandr Kogan, told Facebook and his app’s users that he was collecting information for academic purposes, not for a political data firm owned by a wealthy conservative. Facebook did nothing to verify how the information was being used.

Mr. Bosworth argued on Twitter that a violation had been committed only by Cambridge Analytica and Mr. Kogan, whose app “did not follow the data agreements.”

Facebook’s chief security officer, Alex Stamos, issued a similar defense in a series of tweets that have since been deleted.

“The recent Cambridge Analytica stories by the NY Times and The Guardian are important and powerful, but it is incorrect to call this a ‘breach’ under any reasonable definition of the term,” Mr. Stamos tweeted.

The explanation did little, however, to stem the tide of anger as independent researchers pointed out that many others could have similarly misused Facebook data.

“Facebook’s platform must protect us from predatory behavior,” wrote a Twitter user named Evan Baily, “or we can’t and shouldn’t trust the platform.”

Jonathan Albright, research director at the Tow Center for Digital Journalism at Columbia University, wrote that the lack oversight and transparency into what sort of data Facebook collected on its users meant that the company’s platform could continue to be exploited.

“Unethical people will always do bad things when we make it easy for them and there are few — if any — lasting repercussions,” Mr. Albright said.

Paul Grewal, a vice president and deputy general counsel at Facebook, said in a statement that the company was looking into whether the data in question still existed. “That is where our focus lies as we remain committed to vigorously enforcing our policies to protect people’s information,” he said.

This month, The Times viewed a set of raw data from the profiles Cambridge Analytica obtained. And a former employee of the data firm described having recently seen hundreds of gigabytes of unencrypted data files on Cambridge servers.

There were also questions from technology experts and others about Facebook’s reaction to the news reports by The Times and The Observer, especially its decision to suspend the account of Christopher Wylie, a data expert who oversaw Cambridge Analytica’s data harvesting — but also spoke out about it to the two news organizations.

On Friday, Facebook threatened to sue The Observer to stop it from publishing, the newspaper’s outgoing editor, John Mulholland, said on Twitter.

Then, late Friday evening, Facebook posted a statement that expressed alarm at the data leak. The company promised to take action and announced that it was suspending the accounts of Cambridge Analytica, Mr. Kogan and Mr. Wylie.

By then, Facebook had learned that Mr. Wylie, who left Cambridge Analytica in 2014, was a named source for the news reports.

In a statement on Sunday, Mr. Wylie described himself as “a curious and naïve 23-year-old,” when he first went to work for Cambridge Analytica.

“I feel a sense of regret every day when I see where they have helped take our world,” he added. “I need to make amends, and that’s why I’m coming forward.”

His lawyer, Tamsin Allen, said that last week Mr. Wylie offered to help Facebook recover the missing data.

Now, though, Facebook said on Sunday, Mr. Wylie is refusing to cooperate with the company until the suspension is lifted — a move the social network is not willing to make because of his role in the data harvesting.

In both Britain and the United States, lawmakers said that in the light of the new reports, they wanted fresh answers from both Facebook and Cambridge Analytica about how the data was obtained and what was done with it.

Mr. Collins, the British lawmaker, said he planned to call Alexander Nix, the chief executive of Cambridge Analytica, to return to Parliament and answer questions about testimony last month in which he claimed that the company never obtained or used Facebook data.

“It seems clear that he has deliberately misled the committee and Parliament,” Mr. Collins said.

In the United States, the attorney general of Massachusetts, Maura Healey, announced on Saturday that her office was opening an investigation. “Massachusetts residents deserve answers immediately from Facebook and Cambridge Analytica,” she said in a Twitter post that linked to the Times article.

Also on Saturday, the two top Congressional Democrats leading inquiries into Russian interference in the 2016 election — Senator Mark Warner of Virginia and Representative Adam Schiff of California — called for investigations of the Facebook data leak.

“This raises serious questions about the level of detail that Cambridge Analytica knew about users,” said Mr. Schiff, who is the ranking Democrat on the House intelligence committee.

Content originally published on https://www.nytimes.com/2018/03/18/us/cambridge-analytica-facebook-privacy-data.html by MATTHEW ROSENBERG and SHEERA FRENKEL