Facebook cannot police itself
Facebook is once again struggling with revelations that manipulative characters exploited the vulnerabilities of its platform during the 2016 election to put Donald Trump in the White House. The company said it was suspending the accounts of Cambridge Analytica, a company that worked for the Trump campaign, and a professor, Alexander Kogan, who is said to have deceptively amassed information from more than 50 million people without their consent. That may sound like decisive action, but it came more than two years after Facebook learned of the problem.
Starting in 2014, Kogan got the data, using a quiz app, under the guise of academic research. He handed the information to Cambridge Analytica, which used it to build profiles of voters’ personalities, according to reports in The New York Times and The Observer of London.
What is particularly disturbing is that Facebook has not identified and alerted users whose profile information was vacuumed up, most of whom had never used it but were friends with somebody who had. Further, Facebook did not verify that Cambridge and Kogan deleted the data after the social media company told them to in 2015. The Times reported that Cambridge still had most or all of the data.
Facebook’s response so far is reminiscent of its slow, defensive reaction to the spread of pro-trump fake news on its platform during the 2016 presidential campaign. Days after the election, Facebook’s founder and CEO, Mark Zuckerberg, said it was a “pretty crazy idea” to suggest that fake news had influenced the outcome. It took months for him to admit that he was wrong to so cavalierly dismiss the importance of hoaxes spread on Facebook, many of them by people working on behalf of the Russian government.
The trove contained enough details about roughly 30 million people, including where they lived, that Cambridge Analytica was able to build detailed profiles by linking the data to other sources of information.
Officials in the United States and the European Union are investigating Cambridge Analytica, and others say they might, including members of Congress and the attorney general of Massachusetts, Maura Healey. In Britain, regulators and lawmakers are looking at whether the company tried to illegally influence the “Brexit” referendum of 2016.
More investigations may be on the way. On Monday, Channel 4 News in Britain released hidden-camera tapes in which Cambridge executives said their company used bribes and prostitutes to entrap politicians. The company denies engaging in corruption and extortion. Robert Mercer, the hedge fund billionaire who is a big supporter of Trump, owns a controlling stake in Cambridge, and Stephen Bannon, the former chief strategist for the president, is a former company board member.
Lawmakers and regulators also ought to investigate Facebook’s response. For starters, they need to take a close look at whether the company is in violation of a 2011 consent decree with the Federal Trade Commission, which had accused it of deceiving users by telling them their information would be kept private and then allowing it to be shared and made public. They also need to force the company to quickly identify and alert the tens of millions of people whose information might have been disclosed to Cambridge.
In the longer term, Congress clearly needs to strengthen privacy laws to give people more control over private information and prevent businesses and political campaigns from harvesting personal data under false pretenses. President Barack Obama proposed a privacy bill of rights in 2012, but the idea died in Congress after technology and advertising companies claimed it would be an unfair burden.
Facebook says it takes this case seriously. But it is clear that lawmakers cannot rely on the company to police itself.