Hacker News Reader

Comment by ibejoeb | Hacker News Reader

I guess I'm still confused about this matter. As I understand it, nothing was exploited. A company used intrinsic capabilities of the system to do a job. Are we just raising the question of whether this is an appropriate business model? I suppose that's a good discussion to have.

I'm just a bit miffed that we're effectively holding another obscenities hearing while the only thing going on with the Equifax debacle is that a tech manager has been charged with insider trading.

View on HN

nothing was exploited

Assuming you're only considering the computer security definition of "exploit", I'm not totally sure why this matters.

User data was obtained via means not allowed by Facebook. Facebook realized this & didn't disclose it to the US government or its users, as required (or, at the very least questionably required) by its consent decree with the FTC. Based on this, it's not out of line for the government to question Facebook about this.

>User data was obtained via means not allowed by Facebook

That's what I'm asking. 1) Is it alleged that CA found a flaw in FB's design and 2) did something illegal with it? I've seen accounts alluding to that, but that makes me think that it is entirely by design and it's just be framed negatively for the greatest political impact.

It's illegal for foreign nationals to make direct or indirect contributions to US politics. So the line that has to be drawn is one connecting that law to the CA scandal and its alleged use to drive the strategies of the Trump campaign during the 2016 election.

I don't know for sure if Facebook can be seen as being complicit in breaking US election law. I think their issues are completely domestic as it stands right now. But I'm not a lawyer.

It's all fascinating. How do we reconcile a facebook bot account that may be, at best, loosely tied to Russia, according to some speculators with a foreign national and intelligence officer, Richard Steele, compiling a op report on the Republican presidential candidate?

Ahh, the phantom downvotes. Would you like to address my point? Why is it okay that a foreign national campaigns for one candidate and another foreign national campaigns for another?

The way Cambridge Analytica's got its data was a little nefarious...as I understand it, they obtained data through ways Facebook discouraged (but still enabled).

Whether you consider that an 'exploit' or not is subjective. It's certainly not an 'exploit' in the more common infosec sense.

But the real issue here is that Facebook was complicit in electing Donald Trump. It's political.

>But the real issue here is that Facebook was complicit in electing Donald Trump. It's political.

This bit is really terrifying to me. I don't support Trump, but the idea that we're going to make it even harder for "unapproved" political candidates should make everyone's skin crawl.

I thought the issue was that foreign actors were able to use Facebook to push for their candidate of choice, not that Trump was "unapproved" (why do you use quotes? that phrase doesn't appear anywhere in the comment you're responding to).

Why is it important that Facebook was the medium? Zuck just done saying that they identified 400-500 Russian accounts the were politically active. The "unapproved" in quotes part there is that these are Russians.

Simultaneously, there were tens of thousands of foreign nationals demonstrating in the streets of major cities all over the country, and this is "approved." This is why I'm left wondering: what are we after?

I don't believe for a second that this much fuss would have been made over this issue if Trump had lost the election. Some law enforcement action may have been taken, but it wouldn't have been front page news. The reason for my quotes is that Trump is "unapproved" which is the explanation for the scale of the reaction. I don't particularly approve of him either, but considering the real motivations of the people writing regulation is important.

Of course there wouldn't be as much fuss about it. Trump losing the election would imply that the attempts at influencing people were unsuccessful. At a glance, that would indicate that regulation is unnecessary (though detailed analysis could show otherwise).

Foreign spending on political FB ads was a drop in the ocean. Especially when you consider it played to both sides (acknowledge it leaned towards Trump), was not all in swing states, and a lot of it was after the election. This is almost certainly not about them.

So, in other words, only regulate to prevent challengers. This is precisely what Facebook and the political establishment hope to achieve.

This was all happening at the time when Obama was over in France campaigning for his preferred candidate. Why is that not considered equally improper?

> foreign actors

First it's Russia and now it's Cambridge Analytica. Unless you can trace CA's business activities to foreign hires or somehow devaluing the influence of the former for the latter, even though the Russian angle was what was being pushed around for a good while as The Reason Trump became so favoured (rather than actual failures of the Democratic party!), methinks it's just the alphabet agencies and co. looking for excuses.

I'm okay with it when the political candidate is as objectively bad as Donald Trump

The real issue is that, as noted by Thom Tillis, this "feature" was most likely used by others, up to and including, the Obama campaign.

i thought that the data flow was:

1. FB users took a personality survey conducted by some researchers at Cambridge University.

2. Then one of those researchers sold the data they'd collected on FB users to the newly formed Cambridge Analytica.

3. The Trump campaign employed CA and CA used this data to directly message FB users who'd completed the personality survey

At some point, FB learned of this unapproved resale of this data and requested that CA delete the data set. But CA did not delete the data set.

Assuming I have the story right, what I don't quite get is: why didn't FB start aggressively suing people who'd taken this data and misused it? FB could have started with a lawsuit against the researcher who sold the data in the first place.

CA told Facebook that they did delete the data set. FB (if you believe their timeline) only discovered they lied when the scandal started circulating in the news.

Thanks for additional info and clarification.

So ... what about now? Wouldn't it be a good move for FB to start taking legal action against CA, the survey group, and anyone in sight in order to create the impression that they want to protect user data?

I'm thinking of corporations like Oracle, Microsoft, and Disney (very litigious corporations) -- isn't this a good time for FB to start acting more like those companies?

Facebook sent forensic auditors to investigate CA. There was a general public perception that this was sketchy (what if they're really trying to destroy evidence implicating themselves?), and they were asked to stand down by British law enforcement.

Facebook's position is that they should have done more to stop companies like CA from being in a position to abuse user data - and implicitly, that there's no need for strong regulations to make them do it. Suing everyone in sight would make it seem like they're trying to create a narrative where they did nothing wrong.

The survey was a decoy. By taking the survey, you got a screen that asked if you wanted to allow the survey to have access to your profile. If you said yes, it got all of your data from your facebook account, including all of the data on your friends that your account has access to. The survey itself was basically a trojan horse and irrelevant.

Reply on news.ycombinator.com