Hacker News Reader

Comment by sithadmin | Hacker News Reader

>The arrogance of Facebook's response to this breach

Is it even clear that there was a 'breach' of any kind that Facebook was responsible for? Correct me if I'm wrong here, but it seems like the chain of events is:

1.) Third party (Aleksandr Kogan) creates 'personality quiz' app, Facebook users opt-in to share information from their profile

2.) Aleksandr Kogan hands off data gathered by the app to Cambridge Analytica, violating Facebook TOS

3.) Whistleblower (Christopher Wylie) lets world know that (2) happened

4.) Media / public gets out pitchforks and blames incident on Facebook

It really seems like Aleksandr Kogan, not Facebook, is the problem here.

View on HN

>"Is it even clear that there was a 'breach' of any kind that Facebook was responsible for?"

How about a breach of basic responsibility to inform users that their data has been used inappropriately and transferred to a third party. FB knew about this as far back as 2015[1]. Did they let users know at any point? No.

Further FB's Chief Security Officers's tweets on Friday failed to show any concern for FB users who were used as pawns. His main concern was to point out that this wasn't actually a FB problem.

And let's not forget that Mark Zuckerberg dismissed the idea that fake news on Facebook influenced the US elections as "a pretty crazy idea."[2]

So the "pitchforks" are a culmination of a significantly longer time frame and not just a reaction to this single news story.

[1] https://www.theguardian.com/us-news/2015/dec/11/senator-ted-...

[2] https://www.theguardian.com/technology/2016/nov/10/facebook-...

"These guys unlawfully got data from a lot of our users. Surely they will delete it if we ask them to, right?

"Now they want to buy a lot of ads on our platform, great!

"Also their ads are getting a lot of engagement somehow, let's make it cheaper for them to buy more!"

According to an NYT article [0] the tweets had been requested by FB comms:

"Over the weekend, after news broke that Cambridge Analytica had harvested data on as many as 50 million Facebook users, Facebook’s communications team encouraged Mr. Stamos to tweet in defense of the company, but only after it asked to approve Mr. Stamos’s tweets, according to two people briefed on the incident.

After the tweets set off a furious response, Mr. Stamos deleted them."

[0]: https://nytimes.com/2018/03/19/technology/facebook-alex-stam...

> It really seems like Aleksandr Kogan, not Facebook, is the problem here

Kogan probably breached the terms he agreed to with Facebook. But fifty million people trusted Facebook with their data and, when asked in their privacy settings, said they didn't want it shared with third parties. That information was then shared with third parties.

If someone calls my bank and convinces customer service they are me, it would be reasonable to say the bank was breached. Not electronically. But breached nonetheless.

Everyone sets up their own account's privacy settings though, and as far as I know, this information didn't include anything that wasn't already publicly available.

That is not clear at all, based on another article. [1] Further, Facebook's lawyers told Wylie that the data was illicitly obtained, though now apparently they've changed their approach.

[1] 'Kogan was able to throw money at the hard problem of acquiring personal data: he advertised for people who were willing to be paid to take a personality quiz on Amazon’s Mechanical Turk and Qualtrics. At the end of which Kogan’s app, called thisismydigitallife, gave him permission to access their Facebook profiles. And not just theirs, but their friends’ too. On average, each “seeder” – the people who had taken the personality test, around 320,000 in total – unwittingly gave access to at least 160 other people’s profiles, none of whom would have known or had reason to suspect.' --from https://www.theguardian.com/news/2018/mar/17/data-war-whistl...

The whistleblower said they had access to private messages. Are those ever publicly available? I don't see any privacy settings for messages in my FB profile.

It depends on when this all happened. In the past a lot more information was available than now.

>If someone calls my bank and convinces customer service they are me, it would be reasonable to say the bank was breached. Not electronically. But breached nonetheless.

That's a bad analogy. A more appropriate one would be if you called your bank and told them to allow a 3rd party to have access to all of your accounts, then blamed your bank when the 3rd party drained all your accounts.

Facebook has no obligation to protect your data from yourself any more than your bank has the obligation to control what you spend your money on.

> A more appropriate one would be if you called your bank and told them to allow a 3rd party to have access to all of your accounts, then blamed your bank when the 3rd party drained all your accounts

Better analogy: you call your bank to allow a third party to have access to all your accounts. My account gets drained. Still a breach.

... But you previously gave me the ability to manage your accounts, then I gave it to the 3rd party that then drained your account.

Still not a breach of the bank, nor a breach of facebook.

The app didn't have any "extra" access or anything other than what the person who installed it would have. The app used the information that the person gave it, and that included information on friends that the person had access to. If you were impacted, blame yourself, your friends that you gave information to who gave it to a 3rd party, and/or the company that made the app.

All facebook did was make the metaphorical parking lot that you got robbed in.

While I agree that there is more they can do here to prevent this kind of thing (like specific and explicit controls on what data an app wants/needs at install time), acting like this is a breach of their information is wrong.

Just like in real life, if someone slips and falls in the lot, the liability is on the owner of the lot. Owners of parking lots are incentivized to make sure people don't slip and fall or they will get sued.

Users don't understand how data works and what can be done with it, so it isn't reasonable to expect that users will know how to protect themselves. The entire system is designed to hide what is being done to users from the users.

Agree with your general statement, but still a bad analogy. You tell your bank to release all your info to third party, then a fourth party learns all your balances.

The problem seems to be that people do not realize what it means to agree to information access for a third party, and the question remains weather Facebook is to blame for it being release to a fourth party.

So really the problem is that people are not aware of the scope of the information aggregate of their actions on social media and how it is or may be used or abused.

>the question remains weather Facebook is to blame for it being release to a fourth party.

And I personally don't think Facebook should be to blame for it ending up in a fourth party's hands. They gave it to the 3rd party at the request of the user. What that 3rd party does with it should be of no concern to Facebook.

If Facebook has to police what users are doing with their own data on other platforms, then strict DRM is going to become a legal necessity. That is what I see when I read comments saying how Facebook should take responsibility here.

I agree that people don't seem to grasp what it means when they click the "i agree" button, and that Facebook (and others) should work much harder on getting the user to understand the full extent of what they are doing, as well as greater control over what data is shared and when. But that's not a problem that's easily solvable (or possibly even solvable at all). And calling for Facebook to simply not accept this information (which isn't a possibility, they are a social network, so social data has to exist on their systems), or to not allow users to have control over their own information is the exact opposite of what I and many others have been fighting for for years.

If I want to export my information, or give it to a 3rd party, that is my right. And Facebook should have no ability to stop me from doing that. This will lead to people giving their personal information to parties that they do not intend to, but I feel that is a risk worth taking to keep your information yours.

Should you be able to share your data with whomever you wish? Yes, I agree to that.

OTOH you and I both know 99.99% of users don't understand what's going on with their data, so the question here is if adult users should be held responsible for something they don't understand and whether Facebook is actually responsible for not informing its users clearly of what was going on.

Do you think it would have made a difference if Facebook had used a red blinking message alerting users before sharing their personal data with a third party? I think so. So yeah, the responsibility is not 100% on Facebook's users.

I never said that the blame was 100% on users, or 100% anywhere.

Like most things in life, it's shared. Facebook should absolutely be held to a higher standard here. They should be explaining what a user is really doing when they try to do it, as well as giving more fine-grained controls over what they provide to these apps.

But I also don't think that a red blinking message would have changed anything, going by how android permissions used to work (big warning that you have to agree to saying what the app gets on install). Apps will make excuses for why they need data, users will want the app and not care or not want to think about what they are giving up, and not a damn thing will change (I can't count the number of times that I've been told "there will be a warning saying that X needs to access Y, you'll need to say yes to use this software" in various programs, and i've never seen a user say no...)

Like I said, having this ability WILL cause people to give out information they didn't mean to. There's no hesitation there, it's going to happen, and probably pretty frequently, but I still feel that's a necessary evil to allow data liberation.

Also, I think stronger legal structures would help here as well. You aren't going to stop it, so make the consequences for getting caught much more strict, and heavily punish companies that are caught using data in ways that's not okay.

> So really the problem is that people are not aware of the scope of the information aggregate of their actions on social media and how it is or may be used or abused.

Simple case: G-fucking-mail. Lot of people on it so even if you're not using it most of your emails end there with a free link to infos from other people's contact list (names, phone number etc.). Shadow profiles are what people will be complaining about 5 years from now if they just discovered what sharing things with 3rd parties mean.

How about your parents make you a joint account holder on their bank accounts to help them with their finances as they age, and then you allow a fraud to drain their account because you're ethically compromised?

> That's a bad analogy. A more appropriate one would be if you called your bank and told them to allow a 3rd party to have access to all of your accounts, then blamed your bank when the 3rd party drained all your accounts.

...after the bank provided the infrastructure to give full control to a 3rd party, frequently encouraged me to do it and gave me the impression that I delegated access only for a specific task and a limited time - even though actually, such a limitation was impossible to implement on technical means, which the bank knew.

It was a breach followed by business motivated poor handling of the breach. Facebook learned about the TOS violation, requested that CA delete the data, and did not follow up with verification that it was indeed deleted. The fail to follow up is compounded by the fact that:

a) Facebook was notified that CA did not delete the data; and

b) The CA-held profiles were used to target politically motivated advertising on Facebook.

One can't avoid linking the two facts. Facebook has no incentive to aggressively protect its user data when it hurts ad spending on the platform.

The app was allowed to scrape friend data as well, meaning that many more people’s information got exposed. That is on facebook.

I keep seeing it listed just as "friend data", and no one clarifying that.

Does it mean "friends lists", or "the data of the app user's friends profiles"? And in that second case, "the data of the app user's friends visible to the app user", or "as much data as if the friends had installed the app themselves"?

Unless it's that final situation, it's exactly how I assumed Facebook scraping worked already.

It's something closer to the latter--presumably, it was scraping what friends posted publicly.

Using an "honor system" doesn't work for privacy, considering thousands of apps have access to the data. The problem is not Aleksandr Kogan.

People are going to call it a breach because it fits their PoV. When this happened with Craigslist people were calling Newmark all kinds of names and quibbling about ownership of the data, etc. [that since it was user generated Craigslist didn't really own it, so that all those *pad companies were not in breach, etc.

That is all it is.

Clearly, Facebook loses hold on the users' data to some 3rd party players, and even now that they have no control that the data is actually deleted or not.

If Facebook has no means to detain such malicious usage of users' data, they should be more careful to open the access of it in the first place.

Facebook trusted user data to a third party who didn't turn out to be trustworthy. How are they not due some share of the blame? Do you think the TOS provides sufficient (or any) protection for this data in the real world?

And if you want to know what kind of company Cambridge Analytica is, check out this under-cover reporting, jus tout this morning: https://www.nytimes.com/2018/03/19/us/cambridge-analytica-al...

SLIMY

That sounds like the use-case for nearly everyone shady on Facebook advertising. Surely there are many other, privately-gathered troves of data that are much larger out there?

With that logic anyone making a quiz should be able to get data on 50M users and that’s not a problem?

My understanding is the people who answered the quiz were a fraction of the 50 million people's whose data was "used." The quiz was a small sample so they could run their analytics on the larger data set.

The issue was back in the day the FB APIs were not as tightly scope controlled as they are now - you were not just giving access to your data but also of that of your friends - even if they did not.

Reply on news.ycombinator.com