# data[].attributes.attachment_link.readable_text
Last week's revelations that Cambridge Analytica improperly accessed Facebook data belonging to millions and used that data to influence the 2016 U.S. presidential race and Brexit vote raised global ire and sent Facebook's stock into a $50 billion wipeout.

Over the past several years, governments and individuals have signaled a growing impatience with data breaches and a desire for organizations that treat them blithely to pay for their inattention and lack of cybersecurity. Especially given that reports are suggesting that Facebook poorly monitored third-party developers access to data, had the Cambridge Analytica breach occurred after May 25, 2018 - when GDPR comes into force - it could have cost Facebook 4% of its annual revenue or $1.62B based on 2017 numbers.

"Facebook and Cambridge Analytica offer a cautionary for organizations leading up to GDPR."

Tweet This

Five days after the breach announcement, Facebook Founder Mark Zuckerberg finally broke his silence, claiming that much of the problem had already been addressed years ago, while laying out a plan to investigate data that could have been leaked via other third-party apps. Absent, however, was any response to Ex-Facebook Insider Sandy Parakilas's claims that Facebook could have stopped these breaches much earlier.

Facebook's Chief Information Security Officer (CISO) Alex Stamos has announced his departure also citing leadership differences around the Cambridge Analytica breach as well how the company handled Russian interference in U.S. elections via Facebook's platform.

Five days after the breach announcement, Facebook Founder Mark Zuckerberg finally broke his silence (shown here during his F8 developer conference keynote).

By March 20th, Zuckerberg had seen his personal net worth decline by more than $5 billion in the days since the breach announcement, but Marketwatch reports that it could have been worse. This year, Zuckerberg has already sold nearly $1 billion of Facebook stock. But while the Cambridge situation grabs headlines as well as calls for Zuckerberg to appear before the U.S. Congress and British Parliament, investigations are underway in New York and Massachusetts and a Facebook user class action lawsuit has already been filed. On March 21, India suspended Cambridge Analytica's local website and issued a public warning to Zuckerberg stating that the site remained welcome in the country, but there would be consequences if Facebook colluded in the data theft of Indians.

Despite all of this action, analysts are saying that regulation is an even bigger threat to Facebook, with possible ad revenue losses on the horizon due to impending data privacy restrictions. Europe has also been historically stricter with the company than other parts of the world. With breach notifications of 72 hours and harsh fines, GDPR will offer a potential revenue-blocking hurdle come May.

"In a little over two months, the Cambridge Analytica breach could have cost Facebook as much as 4% of its revenue."

Tweet This

# data[].attributes.attachment_link.title
Cambridge Analytica and Facebook: A Cautionary Tale As We Near GDPR

# data[].attributes.attachment_link.description
Last week's revelations that Cambridge Analytica improperly accessed Facebook data belonging to millions and used that data to influence the 2016 U.S. presidential race and Brexit vote raised global ire and sent Facebook's stock into a $50 billion wipeout.

# data[].attributes.attachment_link.readable_text
Last year the north side of Fitzwilliam Square was the ninth most profitable place in Dublin to clamp cars, generating almost €42,000 in clamping fees. The principle is clear: if you park here illegally you must pay a fine to get your car back.

Different principles seem to apply on the other side of the square which has been the home of the Dublin office of the Irish Data Protection Regulator (DPC) since 2015 .

For the last seven years - following a complaint from Austrian privacy campaigner Max Schrems - Ireland's regulator has been "engaging" with Facebook through meetings and audits on whether its business practices adhere to or breach EU law.

Because Facebook and other tech giants have their international headquarters in Ireland, the Irish regulator has front-line responsibility for policing them. At no point has Facebook feared the DPC.

Instead the social network shares the view of many European data regulators who liken Ireland to George Orwell's Animal Farm: the larger and more powerful you are, the less likely the DPC is to clamp you.

Among its caseload for 2011, the DPC tackled a veterinary practice for disclosing a dog owner's personal data; censured a leisure centre that requested excessive personal data from patrons; and warned a marketing company to stop calling numbers on the national opt-out register.

We still don't know if EU citizens' data were sucked up by the app linked to Cambridge Analytica

Another case came on its radar that year: Facebook. Unlike those quick, snappy rulings on small Irish businesses, the DPC - seven years later - it is still grappling with the social media giant on behalf of its 374 million active users in Europe.

EU law

After the Cambridge Analytica scandal broke, Irish data regulator Helen Dixon said she would "follow up" on a 2011-12 audit into Facebook. This investigation included a complaint by Schrems that Facebook's Dublin operation was operating outside EU law.

In one prescient point he argued that "third-party consent", cited by Facebook as the legal basis for data collection by third-party apps, had no basis in EU law. Leading data protection figures across Europe share this view.

In its audit reports, however, the DPC - apart from a few minor quibbles - appears to side with Facebook. Your personal data can be sucked up by apps not installed by you - but by a Facebook "friend" - to be stored and sold by a company you've never heard of.

You may not have known this was happening, but Facebook argues you should have.

And if you had a problem with this, you should have switched off the default "share" setting in your Facebook profile.

We still don't know if EU citizens' data were sucked up by the app linked to Cambridge Analytica. But, given thousands of such apps exist, it's likely many EU Facebook users had their data grabbed by others on the DPC's watch.

Facebook chief executive Mark Zuckerberg. "Because Facebook and other tech giants have their international headquarters in Ireland, the Irish regulator has front-line responsibility for policing them." File photograph: Josh Edelson/AFP/Getty Images

You may not know them, but these companies now know everything about you - from your political to your sexual preferences. The vast consequences are only beginning to become clear.

Loophole

Taoiseach Leo Varadkar insisted this week, somewhat disingenuously, that the loophole allowing for this "was closed in 2015". This was because of a Facebook systems update, not because it felt any urgency to respond to non-existent DPC pressure.

In other words, the horse was kind enough to close the door as it bolted. This is data-protection regulation Irish-style.

In 2013, when I visited the DPC headquarters in Portarlington, Co Laois, then regulator Billy Hawkes insisted his consensual approach to regulating Facebook - viewed critically by many EU peers - was more effective than waving a regulatory stick because "it is good to use powers of persuasion backed up by enforcement powers".

From a European perspective, the Cambridge Analytica scandal is not a series of unfortunate events but a new low point in a long narrative of deliberate neglect in Ireland

In 2014, as Cambridge Analytica was culling information it says handed Donald Trump the White House, Hawkes insisted to me that Facebook "is in compliance with its obligation under Irish and European data-protection law". Really?

Now that the extent - and consequences - of its data-trading have become public, Facebook is shocked - shocked - by what happened.

In reality, Facebook is shocked because it was caught out. It walked into this with its eyes open, allowing problematic - possibly illegal - data-collection via third-party apps. And it earned money in the process from data-collecting app developers it knew it couldn't control.

And yet Facebook is simply doing what it was programmed to do. Contrary to its soft-soap PR, Facebook is not here to heal the world Michael Jackson-style. Altruism is a happy by-product of its main mission: to make money by digitising people's DNA and selling it to the highest bidder.

Until 2014,when Cambridge Analytica went to work, Facebook's motto was "move fast and break things". We now know it may have helped break US democracy. Oops.

New low point

From a European perspective, the Cambridge Analytica scandal is not a series of unfortunate events but a new low point in a long narrative of deliberate neglect in Ireland.

Ireland's "consensual" regulation of Facebook has failed - spectacularly. From May new EU rules will allow data-protection organisations around Europe to oversee the work of the DPC in Dublin

The message from Europe to Ireland's DPC is clear: regulate or you will be regulated. Clamp or you will be clamped.

Because failing to stop powerful companies breaking data-protection law is not regulation, it is complicity.
Derek Scally is Berlin Corespondent

# data[].attributes.attachment_link.title
Ireland has failed to regulate Facebook on behalf of Europe

# data[].attributes.attachment_link.description
Last year the north side of Fitzwilliam Square was the ninth most profitable place in Dublin to clamp cars, generating almost €42,000 in clamping fees. The principle is clear: if you park here illegally you must pay a fine to get your car back.

# data[].attributes.attachment_link.readable_text
What did Cambridge Analytica do?

Cambridge Analytica harvested information from over 87 million Facebook users through an external app in 2015.

The data came from a personality quiz, which around 270,000 people were paid to take. The quiz - "thisisyourdigitallife" - in turn pulled data from their friends' profiles as well, ending in the enormous data stash.

In March 2018, a Cambridge Analytica employee named Christopher Wylie (above) was responsible for revealing the extent of the data firm's activities in interviews with The Guardian and The New York Times.

What data did they get?

Cambridge Analytica harvested personal information on where users lived and what pages they liked, which helped build psychological profiles that analyzed characteristics and personality traits.

This kind of information was later deployed in political campaigns.

Wylie said: "We exploited Facebook to harvest millions of people's profiles. And built models to exploit what we knew about them and target their inner demons."

Where did it come from?

The quiz was created by Aleksandr Kogan, a Russian psychology professor at the University of Cambridge, who shared the information in a commercial partnership with Strategic Communication Laboratories (SCL), which later created Cambridge Analytica.

Trump's campaign hired Cambridge Analytica in June 2016 to help target ads using voter data gathered from millions of adults in the US.

Cambridge Analytica also assisted Brexit Leave campaigners in the run-up to the EU referendum.

Was it legal?

Nigel Farage / Twitter

Facebook has contested whether the information was really taken without consent.

It said in 2018: "People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked."

Also, Kogan could have broken Facebook's own rules by using the data for commercial rather than strictly academic purposes.

How is Facebook implicated?

Facebook said it removed the Cambridge Analytica quiz app from the platform in 2015 and demanded that Kogan, Wylie, and Cambridge Analytica confirm that they had deleted all the data harvested.

Wylie, however, claimed that Facebook only demanded that he remove all the Facebook data in August 2016, and they were small steps.

He said: "They [Facebook] waited two years and did absolutely nothing to check that the data was deleted. All they asked me to do was tick a box on a form and post it back."

When the story first broke in early 2018, raw copies of the data obtained by Cambridge Analytica were still available online, The New York Times reported.

Does this change Facebook and Cambridge Analytica's previous testimonies?

Alexander Nix, CEO of Cambridge Analytica, denied working with Kogan as well as using Facebook data. "We do not work with Facebook data and we do not have Facebook data," Nix told British MPs, as cited by The Guardian.

Facebook has also denied that it gave Cambridge Analytica data.

Simon Milner, the company's UK director of policy, told British MPs in 2018: "They [Cambridge Analytica] may have lots of data, but it will not be Facebook user data. It may be data about people who are on Facebook that they have gathered themselves, but it is not data that we have provided."

Facebook has since suspended Cambridge Analytica, its parent company Strategic Communication Laboratories, and Wylie from its platform. Wylie was also suspended from WhatsApp and Instagram, which are both owned by Facebook, The Observer's Carole Cadwalladr reported.

-Christopher Wylie (@chrisinsilico) March 18, 2018

Is Russia involved?

Possibly. Wylie's testimony has revealed a Russian connection to Cambridge Analytica and Kogan.

According to Wylie, Cambridge Analytica in 2014 made a pitch to Russian oil and gas company Lukoil, which was and remains sanctioned by the US.

The company was interested in understanding the link between data, behavioral microtargeting, and political campaigns, and met Cambridge Analytica at least three times between 2014 and 2015, The New York Times reported.

Wylie told The Guardian: "It didn't make any sense to me ... Why would a Russian oil company want to target information on American voters?"

Kogan, the Cambridge academic, had also been an associate professor at St. Petersburg State University and received Russian government grants while creating and harvesting Facebook data through the app, The Guardian reported.

Curiously, Kogan's work in Russia was never publicized, and colleagues told The Guardian "no one knew" about it. Cambridge University said it was carried out in a "private capacity."

Then in 2019, Facebook got slapped with a massive $5 billion fine by the Federal Trade Commission.

Facebook was hit with a $5 billion fine from the Federal Trade Commission as part of a settlement over claims the company mishandled user data

The fine is a record for the FTC - perhaps a precedent for the kind of punishment that tech giants could expect for mishandling users' data - and is a direct response to the Cambridge Analytica scandal.

Beyond the fine, a series of regulations were imposed on Facebook.

And now, the latest news about the ongoing controversy is that Facebook was aware of Cambridge Analytica far earlier than it previously said.

On Friday, NBC's Dylan Byers published a copy of an internal Facebook message thread from September 2015 where employees talked about "clients in the political space."

One such client, Cambridge Analytica, is described in the correspondence as, "a sketchy (to say the least) data modeling company."

In the emails, employees go into far more detail - and even discuss a potential investigation into data scraping by political partners.

It wasn't until December 2015 when Facebook first realized the extent of Cambridge Analytica's data scraping practices and began to act on it.

In short, Facebook employees were flagging potential concerns related to Cambridge Analytica's practices as early as September 2015, but the company didn't act until March 2018.

More: Facebook Cambridge Analytica Russia Russia investigation

# data[].attributes.attachment_link.title
Facebook understood how dangerous the Trump-linked data firm Cambridge Analytica could be much earlier than it previously said. Here's everything that's happened up until now.

# data[].attributes.attachment_link.description
What did Cambridge Analytica do? Cambridge Analytica harvested information from over 87 million Facebook users through an external app in 2015. The data came from a personality quiz, which around 270,000 people were paid to take. The quiz - "thisisyourdigitallife" - in turn pulled data from their friends' profiles as well, ending in the enormous data stash.