March 17: In an update on the CA suspension Facebook makes a big show of rejecting the notion that any user data was ‘breached’. “People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked,” it writes

March 19: Facebook says it has hired digital forensics firm Stroz Friedberg to perform an audit on the political consulting and marketing firm Cambridge Analytica. It subsequently confirms its investigators have left the company’s UK offices at the request of the national data watchdog which is running its own investigation into use of data analytics for political purposes. The UK’s information commissioner publicly warns the company its staff could compromise her investigation

March 21: Zuckerberg announces further measures relating to the scandal — including a historical audit, saying apps and developers that do not agree to a “thorough audit” will be banned, and committing to tell all users whose data was misused. “We will investigate all apps that had access to large amounts of information before we changed our platform to dramatically reduce data access in 2014, and we will conduct a full audit of any app with suspicious activity. We will ban any developer from our platform that does not agree to a thorough audit. And if we find developers that misused personally identifiable information, we will ban them and tell everyone affected by those apps. That includes people whose data Kogan misused here as well,” he writes on Facebook.

He also says developers’ access to user data will be removed if people haven’t used the app in three months. And says Facebook will also reduce the data users give to an app when they sign in — to just “your name, profile photo, and email address”.

Facebook will also require developers to not only get approval but also “sign a contract in order to ask anyone for access to their posts or other private data”, he says.

Another change he announces in the post: Facebook will start showing users a tool at the top of the News Feed “to make sure you understand which apps you’ve allowed to access your data” and with “an easy way to revoke those apps’ permissions to your data”.

He concedes that while Facebook already had a tool to do this in its privacy settings people may not have seen or known that it existed.

These sorts of changes are very likely related to GDPR compliance.

Another change the company announces on this day is that it will expand its bug bounty program to enable people to report misuse of data.

It confirms that some of the changes it’s announced were already in the works as a result of the EU’s GDPR privacy framework — but adds: “This week’s events have accelerated our efforts”

March 25: Facebook apologizes for the data scandal with a full page ad in newspapers in the US and UK

March 28: Facebook announces changes to privacy settings to make them easier to find and use. It also says terms of services changes aimed at improving transparency are on the way — also all likely to be related to GDPR compliance

March 29: Facebook says it will close down a 2013 feature called Partner Categories — ending the background linking of its user data holdings with third party data held by major data brokers. Also very likely related to GDPR compliance

At the same time, in an update on parallel measures it’s taking to fight election interference, Facebook says it will launch a public archive in the summer showing “all ads that ran with a political label”. It specifies this will show the ad creative itself; how much money was spent on each ad; the number of impressions it received; and the demographic information about the audience reached. Ads will be displayed in the archive for four years after they ran

April 1: Facebook confirms to us that it is working on a certification tool that requires marketers using its Custom Audience ad targeting platform to guarantee email addresses were rightfully attained and users consented to their data being used them for marketing purposes — apparently attempting to tighten up its ad targeting system (again, GDPR is the likely driver for that)

April 3: Facebook releases the bulk app deletion tool Zuckerberg trailed as coming in the wake of the scandal — though this still doesn’t give users a select all option, but it makes the process a lot less tedious than it was.

It also announces culling a swathe of IRA Russian troll farm pages and accounts on Facebook and Instagram. It adds that it will be updating its help center tool “in the next few weeks” to enable people to check whether they liked or followed one of these pages. It’s not clear whether it will also proactively push notifications to affected users

April 4: Facebook outs a rewrite of its T&Cs — again, likely a compliance measure to try to meet GDPR’s transparency requirements — making it clearer to users what information it collects and why. It doesn’t say why it took almost 15 years to come up with a plain English explainer of the user data it collects

April 4: Buried in an update on a range of measures to reduce data access on its platform — such as deleting Messenger users’ call and SMS metadata after a year, rather than retaining it — Facebook reveals it has disabled a search and account recovery tool after “malicious actors” abused the feature — warning that “most” Facebook users will have had their public info scraped by unknown entities.

The company also reveals a breakdown of the top ten countries affected by the Cambridge Analytica data leakage, and subsequently reveals 2.7M of the affected users are EU citizens

April 6: Facebook says it will require admins of popular pages and advertisers buying political or “issue” ads on “debated topics of national legislative importance” like education or abortion to verify their identity and location — in an effort to fight disinformation on its platform. Those that refuse, are found to be fraudulent or are trying to influence foreign elections will have their Pages prevented from posting to the News Feed or their ads blocked

April 9: Facebook says it will begin informing users if their data was passed to Cambridge Analytica from today by dropping a notification into the News Feed.

It also offers a tool where people can do a manual check

April 9: Facebook also announces an initiative aimed at helping social science researchers gauge the product’s impact on elections and political events.

The initiative is funded by the Laura and John Arnold Foundation, Democracy Fund, the William and Flora Hewlett Foundation, the John S. and James L. Knight Foundation, the Charles Koch Foundation, the Omidyar Network, and the Alfred P. Sloan Foundation.

Facebook says the researchers will be given access to “privacy-protected datasets” — though it does not detail how people’s data will be robustly anonymized — and says it will not have any right or review or approval on research findings prior to publication.

Zuckerberg claims the election research commission will be “independent” of Facebook and will define the research agenda, soliciting research on the effects of social media on elections and democracy

April 10: Per its earlier announcement, Facebook begins blocking apps from accessing user data 90 days after non-use. It also rolls out the earlier trailed updates to its bug bounty program

-------------------------------------

Here’s how Facebook fell short:
1. Slow response times
2. Lack of transparency - Zuckerberg initially denied that the spread of “fake news” on Facebook had influenced the 2016 election at all, downplaying the seriousness of the issue — chipping away even further at the public’s trust in the brand. Once Zuckerberg had pledged to take action to fix the problem, the company was still reluctant to share details about how misinformation had been able to spread so quickly.

Though company reps maintain that Facebook itself does not create content, the public doesn’t feel that this abdicates it of responsibility. Facebook needs to show users precisely how it handles objectionable content.
3. Questionable authenticity

--------------------------------------------------

How did Facebook respond?

There is only one word for it - BADLY

Despite the fact that suspicions had already been raised internally, Facebook sent letters to the Observer and other news media maintaining the 50 million data leak was not ‘technically’ a breach of ‘trust’ and reminding the respondents that the organisation had the right to sue. The UK Guardian and the New York Times were not intimidated and published further information and the scandal became a media storm.

In Britain the Information Commissioner Elizabeth Denham declared she was “deeply shocked” and obtained legal warrants to raid Cambridge Alanlytica’s HQ. In America the nonpartisan government watchdog Common Cause filed two complaints claiming Cambridge Analytica had breached electoral law.

A coda to this sorry saga came when UK Channel 4 filmed a sting session involving Cambridge bosses boasting about their role in the Trump’s election success. The then CEO, Alexander Nix, was filmed describing how “pretty” Ukrainian girls could be used in honey trap stunts against candidates. He is now suspended.

The storm of outrage has seen a decline of 17% in Facebook shares since 16 March.

Facebook founder and chief Mark Zuckerberg decided it was best to remain silent. On March 25 he did an about face and in full page advertisements in Sunday papers all over the world confessed: “This was a breach of trust and I’m sorry we didn’t do more at the time. We are now making sure this doesn’t happen again.”

The apology was too late to stop 50 billion being wiped off Facebook's value and too late to stop millions of its users deleting their files. The lasting long-term damage to the brand is still to be seen and in Zuckerbergs words could take years to recover from.

There are some useful PR and crisis communication lessons to be learned from all of this:

If you have made a mistake apologise immediately.

 Zuckerberg’s came 12 days after the first media disclosure and four years after concerns were raised inside the platform.

Cambridge Analytica made no apology until the new COE, Dr Alexander Tayler, released a press release on 23 March that still claimed data had not been misused. By then the company was virtually in ruins with data confiscated and subject to an investigation which could lead to criminal charges.

The problem with Facebook is that there is a belief that they make corrections oh-so-reluctantly and late when bad practice (fake news, hate messages, misuse of data) is revealed.

There were, when the scandal broke, 2.9 million Facebook users in New Zealand. Quite a few have deleted their profiles and if you are concerned about your personal information you should seriously consider doing it too.  

Other Silicon Valley tech behemoths have added their opinion, effectively putting the boot into Facebook and particularly Mark Zuckerberg. Apple’s chief executive, Tim Cook, issued a harsh rebuke to Zuckerberg and Facebook’s business model, saying that detailed profiles of individuals compiled by internet platforms should not exist.

Elon Musk, well he just deleted SpaceX and Tesla’s Facebook pages to support the #deletefacebook movement

The episode he was referring to was the revelation in March that Cambridge Analytica, a political consulting firm connected to the Trump campaign, had harvested the sensitive data of as many as 87 million Facebook users without their explicit permission. That scandal rocked Facebook, sending the company’s stock price spiraling. Mr. Zuckerberg himself lost nearly $11 billion.

Since Mr. Zuckerberg’s testimony, lawmakers have done little to nothing to better regulate technology platforms like Facebook and hold them more accountable for suspect practices. But there’s also little evidence that Facebook, and Mr. Zuckerberg, has taken his pledge to Congress as seriously as once hoped either: Facebook announced late last month the biggest data breach in its history, affecting nearly 50 million user accounts. In the same week, the news site Gizmodo published an investigation that found Facebook gave advertisers access to contact information harvested from the address books on their users’ cellphones.

Equally worrisome from Gizmodo’s report: Facebook is also allowing advertisers to target phone numbers that users have provided solely for security reasons. Security experts generally advise users to add two-factor authentication to their accounts, which sometimes takes the form of providing a phone number to receive text messages containing log-in codes. It’s ironic — two-factor authentication is supposed to better safeguard privacy and security, but these phone numbers are winding up in the hands of advertisers.

While the Cambridge Analytica scandal engulfed Facebook in a firestorm of controversy, this time the company effectively got a free pass from a nation fixated on Brett Kavanaugh and his turbulent Supreme Court confirmation. Still, with consequential midterms less than a month away, this latest string of Facebook privacy failures is a discouraging reminder of how much potential there is for things to go terribly wrong — again —  during those elections. It’s not just about user privacy, it’s a sign of how well Facebook is poised to handle sophisticated foreign disinformation campaigns, and where its priorities lie.

The seriousness of Facebook’s most recent data breach ranks it among one of the most egregious in the history of Silicon Valley. A weakness in Facebook’s code allowed hackers to gain access into other people’s accounts, and potentially control not only the Facebook profiles but any services that those users logged into using Facebook — Instagram, Spotify and Tinder, for example.

The breach originated from three bugs in Facebook’s code. At least one was introduced over a year ago; it’s still not clear when the other two became part of the code. Information security is a difficult problem: A company might do the right thing every time and still be successfully attacked. But one of the reasons Facebook’s breach is so concerning is the company’s footprint in the lives of so many people — 2.2 billion and counting. Facebook has sought to find ways into as many aspects of people's lives as possible, becoming the recipient of a glut of data and the implicit trust of its users. The company has been careless with that trust — and is still being careless.

Speaking before Congress and in other public statements, Mr. Zuckerberg has been upfront about being caught unaware of the influence his company can have in ordinary people’s lives, whether that influence is in determining election outcomes or sparking real-life violence in places like Sri Lanka and Libya. And perhaps nobody fully understands that power — academics and experts are still piecing together the puzzle of how advertising systems honed on personal information can enable foreign propaganda campaigns, and to what extent this phenomenon affects democratic elections. It may be a long time before it all becomes clear. (In the meantime, falsehoods about Judge Kavanaugh’s accuser Christine Blasey Ford are going viral on Facebook). In response to such concerns, Facebook has set up a “war room” in its headquarters to monitor potential foreign influence campaigns during elections.