Unraveling the Facebook-Cambridge Analytica Scandal
87 million. That’s the number of raw user profiles amassed from Facebook by political consulting firm Cambridge Analytica (“Cambridge”) during the 2016 election (at last count).[1] As anyone who has loosely followed the news over the past weeks well knows, Facebook has garnered a wave of backlash over bombshell revelations about its approach to data security and privacy.[2]
Broken by the New York Times, on the heels of reports by The Guardian in 2015[3] and The Intercept in 2017,[4] the story is as follows: Cambridge, backed by millions in funding from a Republican donor, sought to identify and categorize the personalities of American voters in order to influence their behavior in the 2016 voting cycle.[5] At the time, Cambridge touted its ability to create “psychographic profiles” of voters via statistical modeling that would predict voter intent.[6] That modeling would be fueled by data collected from users’ Facebook profiles, initially amassed off of the platform during the Republican primaries to benefit Ted Cruz’s campaign, and eventually bolstering Donald Trump’s.[7] The modeling aimed to develop a compendium of users’ personality traits, from introversion, neuroticism, and life satisfaction, to agreeableness, self-disclosure tendencies, fair-mindedness, and belief in star signs.[8]
To amass the data, Cambridge approached Russian-American researcher and psychology professor, Aleksandr Kogan, who had previously undertaken data collection for Cambridge’s parent company, the military contractor, Strategic Communications Laboratories (“SCL”).[9] In his time with SCL, Kogan developed a personality survey taken by around 185,000 participants on Facebook.[10] SCL did not, however, limit its data collection to that small pool, but rather, gathered data from those participants’ network of friends, ultimately numbering in the 30 millions.[11] These friends had not only not consented to their data being used by a company seeking to influence the election, but had not consented to the use of their data at all.[12] When Cambridge approached Kogan, they sought to employ his app on Facebook in order to continue this data harvesting.[13]
Ultimately, Cambridge accumulated information from what the Times first reported as over 50 million profiles, but which Facebook itself has since estimated as 87 million.[14] This staggering figure included at least 30 million profiles replete with enough information—like users’ addresses—for Cambridge to match them to outside records.[15] During the Cambridge campaign, only about 270,000 users—the ones who actively opted in to taking Kogan’s survey—had actually consented to the data harvesting.[16]
The news has resulted in a chain reaction. Consider that back in December 2015, Facebook’s only response to the Guardian was that they were “carefully investigating”; yet, a little over three weeks after the Times’ story broke this March, Mark Zuckerberg was called before Congress for a week of testimony.[17] Facebook also intends to notify the 87 million users whose data was breached with a notice atop their News Feed in the coming days.[18]
Castigation over Facebook’s approach to data privacy is nothing new for the social media giant, however. In 2011, the Federal Trade Commission (“FTC”) instituted a consent decree following an investigation into Facebook’s data practices that revealed the company was deceiving users about how their data was being shared with and used by application developers.[19] Even then, government actors voiced concerns of the manner in which Facebook allowed developers to tap users’ data—and that of their unwitting friends—via the quizzes that were especially popular on the site between 2010 and 2015.[20] At that time, Facebook had similarly failed to inform users of the way in which their data and their network’s data was being used.[21] As such, the consent decree mandated, among other things, that Facebook not misrepresent the use of personal information and, importantly, that Facebook police third parties (e.g., the developers of FarmVille) while concurrently ensuring that fourth parties, like Cambridge, did not obtain information.[22]
With over 214 million users in the United States and 2.2 billion worldwide, it remains to be seen what penalties, if any, will be meted out, and how they may prove more effective than the consent decree has apparently been.[23] In any event, my Facebook feed keeps chugging along—photos of friends’ kids, engagement news, links to cats avoiding baths, all scroll-worthy as ever. My trending news? Finally a mention about the Facebook scandal has crept in, in the middle of the article pack, to decry the technological ineptitude of Senators who, in their discussion with Mr. Zuckerberg this week, “didn’t seem to know how Facebook works” at all.[24] And after all, maybe that’s been the point all along: we don’t know how Facebook works; it knows how we do.
Footnotes
