SEC probes why Face­book didn’t warn sooner on pri­vacy lapse

Com­pany faces ques­tions on its knowl­edge of Cam­bridge An­a­lyt­ica’s use of data

The Niagara Falls Review - - Canada & World - DAVE MICHAELS AND GE­OR­GIA WELLS The Wall Street Jour­nal

Se­cu­ri­ties reg­u­la­tors are in­ves­ti­gat­ing whether Face­book Inc. ad­e­quately warned in­vestors that de­vel­op­ers and other third par­ties may have ob­tained users’ data with­out their per­mis­sion or in vi­o­la­tion of Face­book’s poli­cies, peo­ple fa­mil­iar with the mat­ter said.

The Se­cu­ri­ties and Ex­change Com­mis­sion’s probe of the so­cial-me­dia com­pany, first re­ported in early July, fol­lows rev­e­la­tions that Cam­bridge An­a­lyt­ica, a data-an­a­lyt­ics firm that had ties to Pres­i­dent Don­ald Trump’s 2016 cam­paign, got ac­cess to in­for­ma­tion on mil­lions of Face­book users.

The SEC has re­quested in­for­ma­tion from Face­book seek­ing to un­der­stand how much the com­pany knew about Cam­bridge An­a­lyt­ica’s use of the data, these peo­ple said.

The agency also wants to know how the com­pany an­a­lyzed the risk it faced from de­vel­op­ers shar­ing data with oth­ers in vi­o­la­tion of Face­book’s poli­cies, they added.

The SEC en­forces se­cu­ri­ties laws that gov­ern what must be dis­closed to share­hold­ers so they can make in­formed in­vest­ment de­ci­sions. It is one of sev­eral gov­ern­ment agen­cies in­ves­ti­gat­ing Face­book and its han­dling of user data.

The agency could close the Face­book in­ves­ti­ga­tion, which is in its early stages, with­out tak­ing en­force­ment ac­tion against the firm. Face­book and the SEC de­clined to com­ment.

The SEC has shown greater in­ter­est in re­cent months in prob­ing data-se­cu­rity breaches and lapses. The agency has taken the po­si­tion, most re­cently in a case filed against Altaba Inc., Ya­hoo Inc.’s suc­ces­sor com­pany, that pub­lic com­pa­nies must dis­close ma­te­rial data leaks or breaches they know about. Telling in­vestors that such in­ci­dents could hap­pen isn’t good enough.

The Jus­tice Depart­ment and the Fed­eral Trade Com­mis­sion are also prob­ing the data leak and how Face­book and other par­ties

han­dled it. The FTC is prob­ing whether Face­book vi­o­lated terms of an ear­lier con­sent de­cree re­quir­ing the com­pany to get user con­sent for col­lect­ing per­sonal data and shar­ing it with oth­ers.

The SEC is prob­ing whether Face­book should have dis­closed to share­hold­ers its knowl­edge of the Cam­bridge An­a­lyt­ica vi­o­la­tion in 2015, when it learned that Alek­sandr Ko­gan, a pro­fes­sor at the Uni­ver­sity of Cam­bridge, had im­prop­erly shared data in 2014 for as many as 87 mil­lion Face­book users with Cam­bridge An­a­lyt­ica.

Face­book has said it told Mr. Ko­gan and Cam­bridge An­a­lyt­ica in 2015 to delete the data, and that it be­lieved they had. Cam­bridge An­a­lyt­ica, Mr. Ko­gan and an­other data-an­a­lyt­ics ex­pert who worked on the project, Christo­pher Wylie, all cer­ti­fied they had de­stroyed the data, Face­book has said. The com­pany said it learned in 2018 that it was pos­si­ble not all

of the data were de­stroyed.

The in­ci­dent didn’t come to light un­til March, when the New York Times and the Guardian news­pa­pers re­vealed Mr. Ko­gan’s role in har­vest­ing data for Cam­bridge An­a­lyt­ica.

Face­book’s shares fell about 17 per cent in the weeks af­ter news about the breach broke. Shares of Face­book have sub­se­quently climbed more than 30 per cent and have re­cently been at or near all-time highs.

In April, Face­book Chief Ex­ec­u­tive Mark Zucker­berg said it was pos­si­ble that oth­ers mis­used data from the so­cial net­work.

Later that month, Face­book up­dated its in­vestor dis­clo­sures to re­flect that like­li­hood and said the FTC and other gov­ern­ment agen­cies were prob­ing how Face­book re­sponded to the episode.

The com­pany’s April quar­terly in­vestor fil­ing said it could dis­cover “ad­di­tional in­ci­dents of mis­use of user data or other un­de­sir­able ac­tiv­ity by third par­ties.” Such in­ci­dents could “neg­a­tively

af­fect user trust and en­gage­ment, harm our rep­u­ta­tion and brands and ad­versely af­fect our busi­ness and fi­nan­cial re­sults,” Face­book wrote in the dis­clo­sure.

Face­book has char­ac­ter­ized the Cam­bridge An­a­lyt­ica in­ci­dent as a “breach of trust” but de­nies it amounted to a data breach.

Face­book’s prior in­vestor fil­ing, its 2017 an­nual re­port is­sued in Fe­bru­ary, used the word “mis­use” just once, when de­scrib­ing the risk of hack­ers break­ing into its sys­tems to steal user data.

The 2017 re­port didn’t ad­dress the risk of app de­vel­op­ers or other com­mer­cial en­ti­ties such as Cam­bridge An­a­lyt­ica im­prop­erly ob­tain­ing user data, al­though Face­book warned if “de­vel­op­ers fail to adopt or ad­here to ad­e­quate data se­cu­rity prac­tices … our data or our users data may be im­prop­erly ac­cessed, used or dis­closed.”

Face­book of­fi­cials be­lieved in 2015 that what they dis­cov­ered wasn’t ma­te­rial in­for­ma­tion for in­vestors, be­cause the data shared with Cam­bridge An­a­lyt­ica wasn’t as sen­si­tive as other types of user data that Face­book keeps, such as some users’ pay­ment in­for­ma­tion, a per­son fa­mil­iar with the mat­ter said. The Cam­bridge An­a­lyt­ica data in­cluded in­for­ma­tion on peo­ple who down­loaded a per­son­al­i­tytest app Mr. Ko­gan de­vel­oped as well as some de­tails about those peo­ple’s friends.

John Reed Stark, a for­mer SEC en­force­ment at­tor­ney who is now a cy­ber­se­cu­rity con­sul­tant, said the agency could find fault with how the com­pany re­ported the in­ci­dent. “If Face­book is earn­ing rev­enue from con­tracts with third-party ven­dors that mis­use pri­vate mem­ber data, yet fail­ing to dis­close that these con­tracts po­ten­tially vi­o­late global and U.S. pri­vacy laws as well as what­ever terms of use Face­book main­tains with its mem­bers, this could raise a red flag for the SEC,” Mr. Stark said.

CHIP SOMODEVILLA/GETTY IM­AGES FILE PHOTO

In April, Face­book CEO Mark Zucker­berg said it was pos­si­ble that oth­ers mis­used data from the so­cial net­work.

Newspapers in English

Newspapers from Canada

© PressReader. All rights reserved.