Customers are the product: At Facebook, the private data of 87 million people have been used without authorization by the micro-target marketing company Cambridge Analytica, used to target 100s of millions more ads

Excerpt from: https://www.theguardian.com/media/media-blog/2018/apr/15/why-the-politicians-must-set-their-sights-on-facebook

The private data of 87 million people have been used without authorisation by the marketing company Cambridge Analytica and used to target ads to still more tens and hundreds of millions.   Cambridge Analytica, the micro-targeting firm – partly owned by the rightwing billionaire Robert Mercer and used by the Trump campaign in the 2016 election – uses psychometric data to persuade people to vote or buy things in certain ways (though the company says the unauthorised Facebook data was not used in its work for Trump). The covert nature of persuasion on the social web means that effective marketing is no longer something you can see or even perceive, but rather something which through a thousand “touch points” might subtly change your behaviour without you noticing.

The data protection of tens of millions of Americans is at the heart of the issue, but how it was used drew only fleeting attention.

“The Trump campaign had sales support,” said Zuckerberg. “I am going to call them embeds,” shot back Sarbanes – 19,769 followers – who went on to suggest that “sales support” might translate into an unauthorised “in-kind” donation toward campaigns. Donald Trump’s campaign had 5.9m ads approved while Hillary Clinton’s had 66,000, pointed out Sarbanes, who suggested “a lot of Americans are waking up to the fact that [Facebook] is becoming a self-regulated super structure for political discourse”, before being cut off by the chairman. The video of the exchange is available on Sarbanes’ Facebook page.

The advertising purchased on and through Facebook is often protected by contractual clauses with advertisers, putting the public in the bizarre position of not being able to actually see what publicity is being targeted at them. When last week Facebook removed related accounts and posted a few samples of the advertising that the Internet Research Agency puts on the network, they showed that “ads” often mean what we might think of as posts that have been paid to reach a wider audience. And the advertising expenditure only tells part of the story.

If the threads of regulation that Congress started to very gently pull on lead anywhere, it must be to more than just the protection of US user data, important though that is, and it must go beyond the concept of political persuasion and advertising into the broader areas of influence, power and money.

**

We, as Facebook users, are not the company’s customers but the company’s product.  The extracted data included names, phone numbers, mail and email addresses, political and religious affiliations, and other interests. It was used, it is said, “to accomplish Cambridge Analytica’s driving principle: to build psychological profiles of voters to affect election results in the UK and the US”. 

“Facebook utterly failed in its duty and promise to secure the personal information of millions of its users, and, when aware that this … information was aimed against its owners, it failed to take appropriate action.” 

Richard Fields, of the Washington law firm Fields PLLC, said: “Facebook has made billions of dollars selling advertisements targeted to its customers, and in this instance made millions selling advertisements to political campaigns that developed those very ads on the back of their customers’ own … personal information. That’s unacceptable, and they must be held accountable.”

An internal memo that circulated at Facebook in 2016 in which the author, Andrew Bosworth, a vice-president of the company who once taught Zuckerberg at Harvard, jocularly noted that while maybe Facebook “costs a life by exposing someone to bullies” or “maybe someone dies in a terrorist attack coordinated on our tools”, hey-ho, “anything that allows us to connect more people more often is de facto good”

**

Lawyers in UK and US allege four firms misused personal data of more than 71m people

Woman with laptop and cellphone
The lawsuit claims the firms obtained Facebook users’ private data to develop ‘political propaganda campaigns’ in the UK and the US. Photograph: Getty Images

British and US lawyers have launched a joint class action against Facebook, Cambridge Analytica and two other companies for allegedly misusing the personal data of more than 71 million people.

The lawsuit claims the firms obtained users’ private information from the social media network to develop “political propaganda campaigns” in the UK and the US.

Facebook, it is said, may initially have been misled, but failed to act responsibly to protect the data of 1 million British users and 70.6 million people in America. The data, it is suggested, was first used in the British EU referendum and then in the US during the 2016 presidential election.

As well as Cambridge Analytica, the two firms named in the legal writ are SCL Group Limited and Global Science Research Limited (GSR).

Steve Bannon, Donald Trump’s former campaign and White House adviser, led Cambridge Analytica in 2014, when the data was collected and extracted, the legal papers state.

The Cambridge University neuroscientist Aleksandr Kogan, a founding director of GSR, is also named.

Cambridge Analytica was set up in 2013 as an offshoot of SCL Group, which offered similar services to businesses and political parties. 

Cambridge Analytica on Monday again rebutted many claims made about the company’s business. It argued, among other things, that it only ever received data on 30 million US citizens; that it did not use the data at all in the Trump campaign or the Brexit referendum; and that the Facebook data it received was legally obtained through a Facebook tool. “It has become open season for critics to say whatever they like about us based on speculation and hearsay,” the acting chief executive, Alexander Tayler, said.

The claim, the first involving British citizens, has been lodged in the US state of Delaware where Facebook, SCL and Cambridge Analytica are all incorporated. Seven individual plaintiffs, all Facebook users, are named in the writ; five American and two British. The numbers may expand as the case proceeds.

It has been brought under the US Stored Communications Act. US lawyers said the legislation provides for a minimum $1000 (£700) penalty for any violation found by a court, meaning that, if the case goes against Facebook, it could face damages in excess of $70bn.

Jason McCue, of the London-based McCue and Partners, which specialises in data privacy and human rights law, is leading the UK arm of the claim.

He said: “The defendants effectively abused the human right to privacy of ordinary Facebook users and, if that were not enough, then the fruits of that abuse are alleged to have undermined the democratic process. This case will go some way to ensure that neither of these things can happen in the future.”

The extracted data included names, phone numbers, mail and email addresses, political and religious affiliations, and other interests. It was used, it is said, “to accomplish Cambridge Analytica’s driving principle: to build psychological profiles of voters to affect election results in the UK and the US”.

While Kogan’s GSR was granted permission by Facebook to collect data for academic research, the lawsuit maintains, it ended up being used for political and commercial purposes.

In the US, Robert Ruyak, the co-lead counsel in the lawsuit, said: “Facebook utterly failed in its duty and promise to secure the personal information of millions of its users, and, when aware that this … information was aimed against its owners, it failed to take appropriate action.”

Richard Fields, of the Washington law firm Fields PLLC, said: “Facebook has made billions of dollars selling advertisements targeted to its customers, and in this instance made millions selling advertisements to political campaigns that developed those very ads on the back of their customers’ own … personal information. That’s unacceptable, and they must be held accountable.”

Quick guide

How the story unfolded

News of the lawsuit came on the day Facebook started to notify individual victims of Cambridge Analytica’s data harvesting operation, allowing the specific group of affected users to come forward for the first time.

In early April, Facebook released aggregate figures of those it believed to be affected. Worldwide, it estimated that 87 million people had had their information harvested by the app, This is Your Digital Life, created by Cambridge Analytica and Kogan.

The social network has since broken that figure down by country: the vast majority of those whose information was “improperly shared with Cambridge Analytica” were in the US (more than 70 million people), but substantial numbers of those affected were in the UK (1.1 million), Canada (600,000), India (550,000) and Australia (310,000).

Most of those users will have had their information – including their public profile, page likes, birthday and home town – uploaded through no direct action of their own. Instead, one of their friends would have logged in to Kogan’s app and gave it permission to extract their friends’ data, probably unknowingly. 

Just 300,000 people worldwide – including 56 people in Australia and 10 in New Zealand, as well as an unknown number of users in the UK – were sufficient to gather the full data set.

As the scandal has grown, the systematic weakness of Facebook’s access controls in the first half of this decade has prompted concerns that Cambridge Analytica may just be the tip of the iceberg.

Facebook has confessed to another unrelated data leak, with more than a billion profiles being “scraped” due to a feature that allowed users to look at pages by entering a phone number or email address.

The company has not yet made a commitment to informing users of whether they were caught up in any of these other data leaks.

**

Ponder this … and weep. The United States, theoretically a mature democracy of 327 million souls, is ruled by a 71-year-old unstable narcissist with a serious social media habit. And the lawmakers of this republic have hauled up before them a 34-year-old white male, one Mark Elliot Zuckerberg, the sole and impregnable ruler of a virtual country of about 2.2 billion people who stands accused of unwittingly facilitating the election of said narcissist by allowing Russian agents and other bad actors to exploit the surveillance apparatus of his – Zuckerberg’s – virtual state.

How did we get into this preposterous mess? Answering this question requires an understanding of (among other things) the peculiar nature of digital technology, the ideology of Silicon Valley, the astonishing political naivety of Zuckerberg, the ethical tunnel vision of software engineers and – most important – the business model that has come to be known as “surveillance capitalism”. 

A key factor was the astonishing capacity of network effects to facilitate monopolistic outcomes. Facebook is a closed private platform that was constructed on a public platform – the world wide web – which in turn was built on the open internet, a public facility created by taxpayers’ money.

It was created by Zuckerberg as a software application that enabled people to hook up with one another and share personal information. Because the underlying architecture – the web – already existed, and because the service it provided was free, it spread like wildfire.

And although it was not the first social networking application, it was more astutely designed and robust than incumbents such as MySpace and it eventually wiped them out. As it grew, the network effect kicked in – to the point where if a teenager wanted to get laid s/he simply had to be on Facebook. So in the social-networking market it became the winner that took all.

In the beginning, Facebook didn’t really have a business model. But because providing free services costs money, it urgently needed one. This necessity became the mother of invention: although in the beginning Zuckerberg (like the two Google co-founders, incidentally) despised advertising, in the end – like them – he faced up to sordid reality and Facebook became an advertising company.

Given that its users were generously providing all kinds of information about themselves (what they liked, what schools they attended, what they did for a living, etc) it was easy to assemble a detailed profile of each one. And this information could be used to enable paying customers (called advertisers) to aim commercial messages at them.

In this way, Facebook became a surveillance capitalist – deriving revenues from surveilling its users. And the more they “engaged” with it – the more time they spent on the site – the more “monetisable” data they generated.

This turned out to be a licence to print money and it made Facebook the sixth most valuable company in the world at one time. Zuckerberg’s programmers built a remarkable automated system to assist advertisers in choosing particular audiences and refining their messages – and in the process boosted their boss’s net worth to $62bn.

Perhaps the most astonishing aspect of all this is that Zuckerberg and his colleagues apparently didn’t twig that their automated system could also be used by politically motivated customers to direct political or ideological messages at Facebook users.

How else can we account for Zuckerberg’s air of outraged innocence when evidence began to appear in 2017 that this was precisely what had happened during the presidential election, and his slow and grudging acceptance of the awful truth which culminated in admissions of the extent to which Cambridge Analytica’s activities had undermined the privacy of up to 87 million Facebook users?

“We didn’t focus enough on preventing abuse and thinking through how people could use these tools to do harm as well,” he finally conceded last week. “That goes for fake news, foreign interference in elections, hate speech, in addition to developers and data privacy. We didn’t take a broad enough view of what our responsibility is, and that was a huge mistake. It was my mistake.”

Before we get carried away by this latest contrition fest, it’s worth remembering that this is par for the Zuckerberg course. There have been – by one count – at least 11 previous scandals involving Facebook, and in many of them the boy-wonder CEO has been trotted out to do his shtick. It’s got to the point where one can write the script. It goes: sure we screwed up; we’re determined to do better in future; but, hey, “life is about learning from the mistakes and figuring out what you need to do to move forward”.

As the Guardian’s Nils Pratley put it the other day, “This breezy I-promise-to-do-better mantra would be understandable if offered by a schoolchild who had fluffed an exam. But Zuckerberg is running the world’s eighth largest company and $50bn has just been removed from its stock market value in a scandal that, aside from raising deep questions about personal privacy and social media’s influence on democracy, may provoke a regulatory backlash.”

Kenneth Tynan memorably defined a neurosis as “a secret you don’t know you’re keeping”. The problem with Zuckerberg’s apologetic cant is that it serves to conceal the secret that he must know he’s keeping – namely that the root of the company’s problems, and the reason it can’t fix itself, is its abusive business model.

Facebook extracts the personal information and data trails of its users to paint virtual targets on their backs. And it has to keep increasing user “engagement” to justify its stock-market valuation (and maintain Zuckerberg’s net worth).

As a senior company executive, Andrew Bosworth, once put it in a leaked internal memo: “The ugly truth is that we believe in connecting people so deeply that anything that allows us to connect more people more often is de facto good. It is perhaps the only area where the metrics do tell the true story as far as we are concerned … That’s why all the work we do in growth is justified. All the questionable contact importing practices. All the subtle language that helps people stay searchable by friends. All of the work we do to bring more communication in. The work we will likely have to do in China some day. All of it.” Yep: all of it.

 Topics