# data[].attributes.body
https://variety.com/2018/digital/features/facebook-privacy-crisis-big-data-mark-zuckerberg-1202741394/

# data[].attributes.body
WHAT DID THEY LEARN FROM THEIR CRISIS? DID THEY MAKE A COMMUNICATION PLAN TO AVOID FUTURE CRISES? WHAT DID THEY DO TO SHOW THAT THEY HAD LEARNED FROM THEIR MISTAKES?

It’s been barely six months since Mark Zuckerberg appeared before Congress and promised lawmakers and the American public that he and Facebook, the company he founded and leads today, would do better. “This episode has clearly hurt us,” Mr. Zuckerberg said. “We have to do a lot of work about building trust back.”

The episode he was referring to was the revelation in March that Cambridge Analytica, a political consulting firm connected to the Trump campaign, had harvested the sensitive data of as many as 87 million Facebook users without their explicit permission. That scandal rocked Facebook, sending the company’s stock price spiraling. Mr. Zuckerberg himself lost nearly $11 billion.

Since Mr. Zuckerberg’s testimony, lawmakers have done little to nothing to better regulate technology platforms like Facebook and hold them more accountable for suspect practices. But there’s also little evidence that Facebook, and Mr. Zuckerberg, has taken his pledge to Congress as seriously as once hoped either: Facebook announced late last month the biggest data breach in its history, affecting nearly 50 million user accounts. In the same week, the news site Gizmodo published an investigation that found Facebook gave advertisers access to contact information harvested from the address books on their users’ cellphones.

Equally worrisome from Gizmodo’s report: Facebook is also allowing advertisers to target phone numbers that users have provided solely for security reasons. Security experts generally advise users to add two-factor authentication to their accounts, which sometimes takes the form of providing a phone number to receive text messages containing log-in codes. It’s ironic — two-factor authentication is supposed to better safeguard privacy and security, but these phone numbers are winding up in the hands of advertisers.

While the Cambridge Analytica scandal engulfed Facebook in a firestorm of controversy, this time the company effectively got a free pass from a nation fixated on Brett Kavanaugh and his turbulent Supreme Court confirmation. Still, with consequential midterms less than a month away, this latest string of Facebook privacy failures is a discouraging reminder of how much potential there is for things to go terribly wrong — again —  during those elections. It’s not just about user privacy, it’s a sign of how well Facebook is poised to handle sophisticated foreign disinformation campaigns, and where its priorities lie.

The seriousness of Facebook’s most recent data breach ranks it among one of the most egregious in the history of Silicon Valley. A weakness in Facebook’s code allowed hackers to gain access into other people’s accounts, and potentially control not only the Facebook profiles but any services that those users logged into using Facebook — Instagram, Spotify and Tinder, for example.

The breach originated from three bugs in Facebook’s code. At least one was introduced over a year ago; it’s still not clear when the other two became part of the code. Information security is a difficult problem: A company might do the right thing every time and still be successfully attacked. But one of the reasons Facebook’s breach is so concerning is the company’s footprint in the lives of so many people — 2.2 billion and counting. Facebook has sought to find ways into as many aspects of people's lives as possible, becoming the recipient of a glut of data and the implicit trust of its users. The company has been careless with that trust — and is still being careless.

Speaking before Congress and in other public statements, Mr. Zuckerberg has been upfront about being caught unaware of the influence his company can have in ordinary people’s lives, whether that influence is in determining election outcomes or sparking real-life violence in places like Sri Lanka and Libya. And perhaps nobody fully understands that power — academics and experts are still piecing together the puzzle of how advertising systems honed on personal information can enable foreign propaganda campaigns, and to what extent this phenomenon affects democratic elections. It may be a long time before it all becomes clear. (In the meantime, falsehoods about Judge Kavanaugh’s accuser Christine Blasey Ford are going viral on Facebook). In response to such concerns, Facebook has set up a “war room” in its headquarters to monitor potential foreign influence campaigns during elections.

# data[].attributes.body
HOW DID THEY REACH OUT TO AFFECTED CONSTITUENTS?

DID THEY UNDERSTAND THE CONSTITUENTS’ SITUATION?

WHAT WAS THE RECEPTION?

WERE THE MESSAGES TAILORED FIT FOR THE CONSTITUENTS?

# data[].attributes.body
WHAT DID THE MEDIA SAY ABOUT THEM? WRITE ABOUT THEM?
As most media want to be, many sources showed the flaws of both Facebook and Cambridge Analytica
The Hated One -
The New York Times -

HOW ARE THEY FRAMED BY THE MEDIA?

DID THEY MAXIMIZE THEIR MEDIA RELATIONS BY INCLUDING SOCIAL MEDIA?

WHO DID THEY PICK TO TALK TO THE MEDIA? WHAT HAPPENED?

# data[].attributes.body
DID THEY COMMUNICATE EARLY AND OFTEN? WHAT DID THEY SAY? DID THEY DELAY? HOW LONG? WHAT REPUTATION REPAIR STRATEGY/STRATEGIES DID THEY USE? WHAT WAS THE EFFECT?
(SHOW TIMELINE - https://www.cnbc.com/2018/04/10/facebook-cambridge-analytica-a-timeline-of-the-data-hijacking-scandal.html) (CHECK FACEBOOK ARTICLE - https://www.facebook.com/zuck/posts/10104712037900071)
Facebook says Kogan “lied to us” by saying he was gathering the data for research purposes and violated the company’s policies by passing the data to Cambridge Analytica. Kogan says his app’s terms and conditions specifically allowed “commercial use.” Facebook says that after it learned of the situation in 2015, it removed Kogan’s app and demanded that he “and all parties he had given data to” destroy the data.

WERE THEIR MESSAGES CONSISTENT?

March 16, 2018: Just before the Guardian and New York Times publish fresh revelations about the Cambridge Analytica scandal, Facebook quietly drops the news that it has finally suspended CA/SCL. Why it didn’t do this years earlier remains a key question

March 17: In an update on the CA suspension Facebook makes a big show of rejecting the notion that any user data was ‘breached’. “People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked,” it writes

March 19: Facebook says it has hired digital forensics firm Stroz Friedberg to perform an audit on the political consulting and marketing firm Cambridge Analytica. It subsequently confirms its investigators have left the company’s UK offices at the request of the national data watchdog which is running its own investigation into use of data analytics for political purposes. The UK’s information commissioner publicly warns the company its staff could compromise her investigation

March 21: Zuckerberg announces further measures relating to the scandal — including a historical audit, saying apps and developers that do not agree to a “thorough audit” will be banned, and committing to tell all users whose data was misused. “We will investigate all apps that had access to large amounts of information before we changed our platform to dramatically reduce data access in 2014, and we will conduct a full audit of any app with suspicious activity. We will ban any developer from our platform that does not agree to a thorough audit. And if we find developers that misused personally identifiable information, we will ban them and tell everyone affected by those apps. That includes people whose data Kogan misused here as well,” he writes on Facebook.

He also says developers’ access to user data will be removed if people haven’t used the app in three months. And says Facebook will also reduce the data users give to an app when they sign in — to just “your name, profile photo, and email address”.

Facebook will also require developers to not only get approval but also “sign a contract in order to ask anyone for access to their posts or other private data”, he says.

Another change he announces in the post: Facebook will start showing users a tool at the top of the News Feed “to make sure you understand which apps you’ve allowed to access your data” and with “an easy way to revoke those apps’ permissions to your data”.

He concedes that while Facebook already had a tool to do this in its privacy settings people may not have seen or known that it existed.

These sorts of changes are very likely related to GDPR compliance.

Another change the company announces on this day is that it will expand its bug bounty program to enable people to report misuse of data.

It confirms that some of the changes it’s announced were already in the works as a result of the EU’s GDPR privacy framework — but adds: “This week’s events have accelerated our efforts”

March 25: Facebook apologizes for the data scandal with a full page ad in newspapers in the US and UK

March 28: Facebook announces changes to privacy settings to make them easier to find and use. It also says terms of services changes aimed at improving transparency are on the way — also all likely to be related to GDPR compliance

March 29: Facebook says it will close down a 2013 feature called Partner Categories — ending the background linking of its user data holdings with third party data held by major data brokers. Also very likely related to GDPR compliance

At the same time, in an update on parallel measures it’s taking to fight election interference, Facebook says it will launch a public archive in the summer showing “all ads that ran with a political label”. It specifies this will show the ad creative itself; how much money was spent on each ad; the number of impressions it received; and the demographic information about the audience reached. Ads will be displayed in the archive for four years after they ran

April 1: Facebook confirms to us that it is working on a certification tool that requires marketers using its Custom Audience ad targeting platform to guarantee email addresses were rightfully attained and users consented to their data being used them for marketing purposes — apparently attempting to tighten up its ad targeting system (again, GDPR is the likely driver for that)

April 3: Facebook releases the bulk app deletion tool Zuckerberg trailed as coming in the wake of the scandal — though this still doesn’t give users a select all option, but it makes the process a lot less tedious than it was.

It also announces culling a swathe of IRA Russian troll farm pages and accounts on Facebook and Instagram. It adds that it will be updating its help center tool “in the next few weeks” to enable people to check whether they liked or followed one of these pages. It’s not clear whether it will also proactively push notifications to affected users

April 4: Facebook outs a rewrite of its T&Cs — again, likely a compliance measure to try to meet GDPR’s transparency requirements — making it clearer to users what information it collects and why. It doesn’t say why it took almost 15 years to come up with a plain English explainer of the user data it collects

April 4: Buried in an update on a range of measures to reduce data access on its platform — such as deleting Messenger users’ call and SMS metadata after a year, rather than retaining it — Facebook reveals it has disabled a search and account recovery tool after “malicious actors” abused the feature — warning that “most” Facebook users will have had their public info scraped by unknown entities.

The company also reveals a breakdown of the top ten countries affected by the Cambridge Analytica data leakage, and subsequently reveals 2.7M of the affected users are EU citizens

April 6: Facebook says it will require admins of popular pages and advertisers buying political or “issue” ads on “debated topics of national legislative importance” like education or abortion to verify their identity and location — in an effort to fight disinformation on its platform. Those that refuse, are found to be fraudulent or are trying to influence foreign elections will have their Pages prevented from posting to the News Feed or their ads blocked

April 9: Facebook says it will begin informing users if their data was passed to Cambridge Analytica from today by dropping a notification into the News Feed.

It also offers a tool where people can do a manual check

April 9: Facebook also announces an initiative aimed at helping social science researchers gauge the product’s impact on elections and political events.

The initiative is funded by the Laura and John Arnold Foundation, Democracy Fund, the William and Flora Hewlett Foundation, the John S. and James L. Knight Foundation, the Charles Koch Foundation, the Omidyar Network, and the Alfred P. Sloan Foundation.

Facebook says the researchers will be given access to “privacy-protected datasets” — though it does not detail how people’s data will be robustly anonymized — and says it will not have any right or review or approval on research findings prior to publication.

Zuckerberg claims the election research commission will be “independent” of Facebook and will define the research agenda, soliciting research on the effects of social media on elections and democracy

April 10: Per its earlier announcement, Facebook begins blocking apps from accessing user data 90 days after non-use. It also rolls out the earlier trailed updates to its bug bounty program

-------------------------------------

Here’s how Facebook fell short:
1. Slow response times
2. Lack of transparency - Zuckerberg initially denied that the spread of “fake news” on Facebook had influenced the 2016 election at all, downplaying the seriousness of the issue — chipping away even further at the public’s trust in the brand. Once Zuckerberg had pledged to take action to fix the problem, the company was still reluctant to share details about how misinformation had been able to spread so quickly.

Though company reps maintain that Facebook itself does not create content, the public doesn’t feel that this abdicates it of responsibility. Facebook needs to show users precisely how it handles objectionable content.
3. Questionable authenticity

--------------------------------------------------

How did Facebook respond?

There is only one word for it - BADLY

Despite the fact that suspicions had already been raised internally, Facebook sent letters to the Observer and other news media maintaining the 50 million data leak was not ‘technically’ a breach of ‘trust’ and reminding the respondents that the organisation had the right to sue. The UK Guardian and the New York Times were not intimidated and published further information and the scandal became a media storm.

In Britain the Information Commissioner Elizabeth Denham declared she was “deeply shocked” and obtained legal warrants to raid Cambridge Alanlytica’s HQ. In America the nonpartisan government watchdog Common Cause filed two complaints claiming Cambridge Analytica had breached electoral law.

A coda to this sorry saga came when UK Channel 4 filmed a sting session involving Cambridge bosses boasting about their role in the Trump’s election success. The then CEO, Alexander Nix, was filmed describing how “pretty” Ukrainian girls could be used in honey trap stunts against candidates. He is now suspended.

The storm of outrage has seen a decline of 17% in Facebook shares since 16 March.

Facebook founder and chief Mark Zuckerberg decided it was best to remain silent. On March 25 he did an about face and in full page advertisements in Sunday papers all over the world confessed: “This was a breach of trust and I’m sorry we didn’t do more at the time. We are now making sure this doesn’t happen again.”

The apology was too late to stop 50 billion being wiped off Facebook's value and too late to stop millions of its users deleting their files. The lasting long-term damage to the brand is still to be seen and in Zuckerbergs words could take years to recover from.

There are some useful PR and crisis communication lessons to be learned from all of this:

If you have made a mistake apologise immediately.

Zuckerberg’s came 12 days after the first media disclosure and four years after concerns were raised inside the platform.

Cambridge Analytica made no apology until the new COE, Dr Alexander Tayler, released a press release on 23 March that still claimed data had not been misused. By then the company was virtually in ruins with data confiscated and subject to an investigation which could lead to criminal charges.

Having made the apology, really put things right.

The problem with Facebook is that there is a belief that they make corrections oh-so-reluctantly and late when bad practice (fake news, hate messages, misuse of data) is revealed.

There were, when the scandal broke, 2.9 million Facebook users in New Zealand. Quite a few have deleted their profiles and if you are concerned about your personal information you should seriously consider doing it too.

Other Silicon Valley tech behemoths have added their opinion, effectively putting the boot into Facebook and particularly Mark Zuckerberg. Apple’s chief executive, Tim Cook, issued a harsh rebuke to Zuckerberg and Facebook’s business model, saying that detailed profiles of individuals compiled by internet platforms should not exist.

Elon Musk, well he just deleted SpaceX and Tesla’s Facebook pages to support the #deletefacebook movement

# data[].attributes.body
DO THEY HAVE A CENTRALIZED MANAGEMENT CENTER OR COMMUNICATIONS HUB?
There is no center focused on communications, but there are about 80 satellite Facebook offices globally --- 36 of which are in the United States --- and Facebook Headquarters.

WHERE IS THIS?
36 - United States
43 - Taiwan, China, South Korea (2), India (5), Australia (2), Malaysia, Indonesia, Hong Kong (2), New Zealand, Switzerland (2), Poland, Italy, South Africa, UAE, Denmark, Belgium, Argentina, Brazil (2), Netherlands, Germany, Colombia, Ireland, United Kingdom, Philippines, Mexico, Canada (2), Norway, France, Singapore, Israel, Sweden, Japan, Spain

WHAT’S THE TEAM COMPOSED OF? ARE THEY REALLY EXPERTS?
Communications & Public Policy Team
Caryn Marooney
- former VP of Global Communications
- assumed day-to-day control of entire Facebook comms team in March 2016
- graduated BS in Labor Relations
- co-founded Outcast Communications (PR firm specializing in tech companies)
- became sole president after partner's departure
Nick Clegg
- VP of Global Affairs and Communications
- former politician (Deputy Prime Minister of the United Kingdom from 2010-2015 among others)
- journalist for the Financial Times
- graduated with upper second class honors degree in social anthropology
- in charge of EC negotiating team on Chinese and Russian accession talks to the WTO
- weekly radio show on the London Broadcasting Company
Elliot Schrage
- VP of Global Comm., Marketing & Public Policy
- specialized in US securities offerings, mergers and acquisitions, and corporate transactions in Sullivan & Cromwell
- project financing for Euro Disneyland theme park
- managing director of the New York office of Clark & Weinstock
- Bernard L. Schwarz Senior Fellow in Business and Foreign Policy at the Council on Foreign Relations
- senior VP for Global Comms at Gap Inc.
- VP of Global Comm. and Public Affairs at Google
Debbie Frost
- Director of Comm./Public Affairs
- Head of Int'l Communications at Google
- PR Manager & European Comms Manager at Nike European Operations Netherlands BV
- Associate at Burson-Marsteller
- LLB honors (Bachelor of Law)
Vadim Lavrusik
- Journalist Program Manager
- product manager at Youtube
- founder & CEO of Frisbee
- product manager of Facebook Live
- product and media partnership at Facebook
Andy Mitchell
- Head of Global Media Accounts
- Director of News and Global Media Partnerships at Facebook
- Strategic Media and Platform Partnerships at Facebook
- VP of Digital Marketing & Marketing Development at CNN
- Director of Interactive Marketing at CNN
- Director of Marketing of CNN/SI Interactive
Rachel Whetstone
- former VP of communications of WhatsApp, Instagram, and Messenger
- current PR executive of Netflix
- Senior VP of Communications and Public Policy for Uber
- Senior VP of Public Policy and PR for Google
Joel Kaplan
- VP of Global Public Policy
- White House Deputy Chief of Staff for Policy for George W. Bush
- Deputy Director of the Office of Management And Budget (OMB)
- Executive VP for Public Policy and External Affairs for Energy Future Holdings (EFH)
- former VP US Public Policy at Facebook
Campbell Brown
- Head of Global News Partnerships
- television news reporter and anchorwoman (Weekend Today)
- series host (Campbell Brown)
- White House correspondent (NBC News)

# data[].attributes.body
DO THEY HAVE A CRISIS PLAN IN THE FIRST PLACE?
There is currently no published document regarding crisis communication released by the company itself. However, there has been an observation that Facebook usually sends a male and female executive as a pair, suggesting gender balance and majority, and exhibiting well-rehearsed responses in casual conversations to industry conferences.
Instead, search results show links to articles regarding thoughts and advice people outside Facebook have regarding how they approached and dealt with the situation because there seems to be an absence of a locally planned strategy regarding conflicts such as this.

WHAT DID THEY DO TO GET CONTROL OF THE SITUATION?
Regarding the first report of the illicit harvesting of personal data by Cambridge Analytica, they refused to comment on the story other than saying that they were investigating. They also reserved their responses towards reports concerning the aforementioned topic. Sources say that it was evident that they did not immediately know how to respond, or that their executives thought the bad PR would blow over.

WHAT DID THEY FIND OUT?
The Facebook head of news partnerships said that they have been caught flat-footed

DID THEY NOTIFY THE EMPLOYEES?
The employees were indeed notified, most

DID THEY ADMIT THEIR MISTAKES?
Mark Zuckerburg, the director of Facebook, publicly apologized through CNN for the Cambridge Analytica situation, referring to it mainly as a mistake and a breach of trust, and backing it up with the people's Right of Access to Personal Data.

# data[].attributes.body
A. Crisis Plan & Logistical Details
B. Centralized Management Center
C. Communication Style
D. Media Relations
E. Constituents
F. Revised Crisis Plan