> The claim that this is a data breach is completely false. Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent. People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.
Users knowingly _agreed_ to share their data with Dr. Kogan. Dr. Kogan was contractually prohibited from passing that information on to third parties (Cambridge Analytica) but did so anyway and was banned as a result.
Consider the alternative: the laptop you bought on Amazon catches fire and burns down the school of your daughter. The school contacts your insurance, who now has to contact a component supplier in Shenzen (who supplied the power supply), and sue them under Chinese law, instead of Amazon.
1. Proprietary customer information, privacy, just generally not talking.
I look it from outdoor equipment perspective - if on my goretex jacket an YKK zipper fails, for me the jacket manufacturer (say Rab) would be the one to raise a warranty ticket/questions, not japanese YKK which produce billions of zippers for everybody all the time. Although Rab is just buying products from DuPont (sigh...), YKK, threads etc. and putting them together (at least that's a more common situation compared to manufacturing it yourself).
I guess in real world Rab would swallow my specific issue while in warranty and issue a fix/replacement, and if they see enough issues with supplier they raise it in batch mode ie for discount for future or one-time compensation.
As an anecdote on this topic.... I recall having a long necked jacket as a kid where the zipper wore down heavily around the collar since the neck was so long that it ended up being too tall for normal day-wear - and thus a lot of unnecessary stress was put on the zipper mechanism when it was partially zipped up. After a few months the teeth had weakened in that area to the point where the zipper would frequently come off the tracks there. In this specific case fitting a jacket with a four inch collar caused a zipper failure - the zipper was probably cheaply made anyways but if the cut of the jacket had been different there likely wouldn't have been an issue.
Can you sue them for this, though? Your contract would need to say "if I personally turn my data over to a third party, that third party will not misuse it". And in the unlikely event that it did say that, misuse of your data by the third party still wouldn't violate the contract, because... the third party is not party to the contract.
Even if you don't buy that argument, at the very least the people who were FB friends of people who sent shared their lists with Kogan should still be able to sue FB, as they had absolutely no relation with Kogan or his app and still some of their data ended up sold.
FB doesn't just hand users' data over without user confirmation... Users see UI permission dialogs and have to explicitly agree to it first (similar to an iPhone app asking for permission to use your microphone or location -- how is Apple responsible if said app gets hacked and leaks your microphone recordings?).
Facebook is either:
1. a neutral party, acting on the wishes of its users, who asked to grant CA access to their data. The victims are users and the aggressor is CA for misusing data.
Or:
2. a victim party, after CA went against their policies. CA is the aggressor in this scenario, and the users are not part of the equation.
This is the problem (quote from op article). Facebook collected data on people and than shared this data to third parties without their consent. That friends gave consent to this has no relevance. They don't have the right to do so and they didn't do it themselves. Facebook did - on the request of CA (or rather that 'researcher'), with the approval of friends.
If you share your friend's data, it's primarily your fault.
You know your friend's email, and you decide to share it with someone else.
Now I agree that FB should bear some responsibility since it's such a large platform.
But it's you who is mainly at fault for sharing.
If you shout your friend's email in a hotel's lobby, you wouldn't blame the hotel, right?
I wouldn't. But if my friend went to reception and told the staff "Hey, you know my friend in room 101? Please share their mail with the stranger in room 301. Thank you." I very much would.
You bear no responsibility at all?
A better example would be "could you tell the stranger in room 301 that my friend's email is ABC?"
Then, later, your friend sue the hotel for telling the stranger about their email.
Yeah.... You should at least bear the majority of responsibility here, no?
No but your friend would be quite in the right to blame you if they got threatening emails as a result of it. Depending on whether actual harm came from the act and whether you shouted their email with an intent to cause harm (even a different harm like a cascade of d** pics) then you could be held liable for damages.
If you act in a manner intended to cause harm and harm results - even if not in the manner you intended - then you can be held liable. Greasing a sidewalk so that folks will fall on their ass for the giggles and then causing someone to break their spine still leaves you liable for damages - even if you were unable to foresee the potential outcome of someone breaking their spine.
The hotel lobby example is likely to not result in liability due to difficulties in showing you acted maliciously but there certainly is a possibility there.
Sure, but, at some point, the users need to take blames for their own actions too.
"I'm too stupid" can't be the defense for everything.
Also, no need to set up a false dichotomy. There are other possibilities. Usually, figuring out liability is a function of the court, thus this legal action. You'll probably get the answer to your question when the suit has been concluded.
Asking for a victim to find the "root cause" of a problem is too much to ask. If X wronged Y causes a wrong to happen to Z... the legal system is largely designed for "Z sues Y" then "Y sues X".
Asking for Z to sue X directly is asking for too much. There's no way for Z to even know that X exists.
Other than the time that X explicitly and directly asked Z for access to their data, you mean.
This isn't similar to a case where I stored my users' info in a database on Cloud Hosting Service Inc machines, CHS's lax security allowed the data to be hacked, and I am now accountable to my users because I used an insecure service. Facebook's role in this situation was, literally speaking, a permissions broker between the end users and Dr. Kogan. The end users granted Dr. Kogan permission with every opportunity to learn about Dr. Kogan.
Edit: Correction that users had a chance to learn about Dr. Kogan, not CA.
Asking for Z to sue X has a number of issues:
1. Z doesn't know Y's policy towards X. Is the problem truly Y's fault or X's fault? "Z sues Y" doesn't necessarily implicate Y as the root cause, it just proves that Y was "along the way" towards the root cause.
2. Y sues X is a totally separate question. Consider the case where a car-parts company creates a suspension ("X"), who sells their suspensions to Ford (aka: Y). Sometime while customer "Z" was driving, the suspension fails. Z sues Y for a million bucks to cover the cost of back surgery or something. Y then has to argue with X to figure out who was responsible for the suspension failure. Depending on the agreements / contracts Y could be the root cause, or X. (Maybe it's Y's fault: if Y was using the suspensions incorrectly and X can prove it, then the Y-sues-X case will fail).
In this #2 case: if Z sues X directly, Z will fail (because X is not at fault). Its safer for Z to sue Y... and its also the morally sound way to move things forward.
----------
For better or worse, Z (the typical user) has a relationship with Facebook (Y). Cambridge Analytica is X. Whether X or Y is at fault is still ambiguous from Z's perspective (no reason for Z to come up with legal arguments and determine the "right person to sue").
All Z has to prove is someone wronged him, and that Y is the next person up the chain. Let Y's lawyers figure out if Y or X is responsible. Z just needs compensation for Z's issues alone.
That's because you keep making points that ignore that the end users knowingly granted permission to Dr. Kogan.
If I buy a car, I don't expect the transmission manufacturer to be part of the specs or shopping process, so yes, I would sue Ford. But if Ford says "comes with Goodyear tires", and then one of those tires proves faulty, I'll be suing Goodyear, not Ford.
But if you really want to use comparisons, let's use one that's appropriate:
I purchase an iPhone from Apple. In this scenario, Apple has a policy that app developers can't share data with 3rd parties. I download an app and grant it permission to my data. The app developer then shares that data with someone else. Who is at fault? Who is the victim? Should I sue Apple? Should I sue the app developer? Can I really sue anyone considering I myself downloaded the app and granted it access to my data?
Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA.
My opinion: (IANAL). B sues Facebook. Then, Facebook sues CA.
This leads to a few results:
1. If B loses its case against Facebook, the game is over.
2. If B wins its case against Facebook, Facebook continues and sues CA.
3. If Facebook loses vs CA, then the game is over and Facebook is found to be at fault. If Facebook wins vs CA, then CA was at fault.
4. If CA was at fault, then maybe CA will then sue its consultant over the issue, and it may continue. So on and so forth until the root cause is discovered, wherein the game ends.
Simple process. At least... simple if everyone could afford the proper legal process. B probably can't afford it and many "Bs" need to gather together for a class action lawsuit and all that jazz.
The hardest part of the puzzle is what exactly B would be suing over. It feels like B was damaged as a whole, since Facebook leaked B's information to CA. But its hard for me to formalize the complaint. Then again: that's a lawyer's job to find out.
B sues A for sharing their information, then A sues Facebook, then Facebook sues CA. That would be the full cycle, no? If B is allowed to skip suing A in favor of suing Facebook directly, why shouldn't they also skip suing Facebook and sue Dr. Kogan directly? Or maybe it doesn't even get to go that far: B just needs to sue A, Facebook gets to sue Dr. Kogan, and that's all we see.
B interacts to A through Facebook, do they not?
If Facebook wants to sue A as the next leg in the chain, they're certainly welcome to try. That's the joy about just following the edge of the graph: its Facebook's job to figure out if A is more at fault (and should be sued) or if Cambridge Analytica is more at fault.
This "chain" methodology further demonstrates which lawsuits are likely fruitless. The concept of Facebook suing A, or even Cambridge Analytica for suing A (if it goes that far) is clearly improper at face value. Breaking things up one-step at a time allows us to seek justice.
IE: the entire point of the justice system.
And what impact does that have?
> its Facebook's job to figure out if A is more at fault (and should be sued) or if Cambridge Analytica is more at fault.
No, it's not Facebook's job to figure that out. If this was an investigation, then it would be the investigating office's job to figure out that. But it's not an investigation, it's a lawsuit, an accusation by one party against another party. The only thing to figure out here is if the accusation is legitimate. This thread started with the GP remarking that the accusation shouldn't be found valid.
To say that it should be found valid because the accused can then separately try to sue another party is not a proper evaluation of the accusation, nor is it demonstrative of a productive legal process (at least in my opinion), nor is it "the entire point of the justice system".
B shared some data with Facebook. That data has somehow leaked to CA, which B never agreed to. Without doing any investigation of their own, B can pretty easily accuse FB of losing their data.
FB can defend itself by saying B shared their data with A, and it is A who misplaced it.
Or, it could be ruled that A could not be expected to understand that they are sharing non-public data about B with a 3rd party, so the ball could be back in FB's court. Perhaps FB should not have offered this option to A at all.
Or perhaps that was well withing FB's and A's rights, and the problem instead is that A never agreed to share this data with CA, they only shared it with Dr Kogan.
In this case again, it could be Dr Kogan alone who is at fault for sharing the data improperly, or it may also be FB's fault for not vetting app developers enough before giving them access to user's data.
Of course, there could also be many more nuanced decisions as well. But for B, the chain can only really start with suing FB - the only entity that B shared their data directly with. B can't know whether it got to CA through A or through D or E, or whether FB was hacked and the information was stolen from them etc., and they have no right to demand this information from FB outside of a lawsuit.
B consented to sharing their information with A (by accepting a friend request or making specific data items public-readable), who granted Facebook the right to share that information with (edit) not CA, Dr. Kogan.
> Edit: Correction that users had a chance to learn about Dr. Kogan, not CA.
The end users granted Facebook the right to share the friend data that their friends had granted them access to.
Is there a screenshot of the 'Authorize App' screen at the time? Indeed, what did the fine print say?
I can draw a chord chart of my friend graph using only user IDs and names.
You can analyze my personality with what data that I explicitly grant access to?
https://i.imgur.com/nti4ShY.png
The print wasn't very fine; it was very clear about what information was shared.
Indeed, where is a screenshot of the 'Authorize App' consent dialogue that users were presented with.
- A agrees to sharing info with B by accepting a friend request. Explicitly per the terms of service, and implicitly because technically anyone can take a screenshot or a photo or a video and share whatever's shared with them (even in DRM'd systems with limited key distribution).
- B authorizes C to retrieve the data available to B.
- C then reshares, sells, distributes, or otherwise transmits information to D.
F enabled A to share data with B, given explicit user consent. F enabled B to share data with C, given explicit user consent.
If you don't want people to know things, don't put that information on the internet; and don't authorize friends to share information you haven't volunteered.
Ethically, if I tell you my email address, and you sell my name + email address to advertisers without telling me, you've done me wrong. You violated my reasonable expectation of privacy. I have the same expectation if I make a private post to facebook, visible only to my (curated) list of friends. That content is for your eyes only.
Violating that expectation probably has no repercussions under US law. But it is almost certainly illegal under the GDPR. I installed Clubhouse the other day and clubhouse asked me to share my contacts with the app. Saying yes without checking with everyone on my contacts' list was probably illegal in europe. (Rightfully so, in my opinion.)
In this case, A shared information (posts, etc) with B (A's friend) on Facebook. B authorized app X to access their information - which in turn passed that information to Z (Cambridge Analytica) with neither A nor B's consent. Things that went wrong here:
- B should not have been able to pass A's information to a third party (X) without A's explicit consent.
- X should not have passed information to Z (Cambridge Analytica)
- Facebook shouldn't have built a platform which permitted / encouraged such obvious and blatant abuses of privacy. If a user told facebook that some content was private, facebook violated user's trust by sharing that information with a random 3rd party app. B's consent isn't relevant wrt A's data. (Permission isn't transitive.)
Who's legally at fault here? I have no idea, and I'm glad the courts exist to figure all this out.
Meanwhile, our technology is utterly failing user's expectations of privacy - which, yes, actually exists in much of the rest of the world.
> If you don't want people to know things, don't put that information on the internet
What a ridiculous sentiment. No. I want to use the internet and have an expectation of privacy. I will not settle for mediocrity so that facebook can make more money.
BTW, the SOLID project believes that data portability is a privacy advantage of their competing, open source federated system.
If you don't want people to know something, don't put it on the internet; regardless of TOS.
We shouldn't expect or rely upon information asymmetry holding over time.
Facebook certainly required users (who are not paying customers) to sign data sharing agreements.
Facebook did not commit the crimes of Cambridge Analytica (Steve Bannon, Trump's campaign guy; Ted Cruz). Facebook was fined $5b. Cambridge Analytica went bankrupt and Nix is barred from serving on the board of any UK company for 7 years.
Facebook's expenses related to Russian misinformation campaigns, Facebook's expenses related to the administration's denial of ongoing foreign information operations paid for by advertisers who don't want a spot next to sleaze.
According to Facebook, this is not what happened and CA's collection of this data represented a breach in their platform policies [0]:
In 2015, we learned that a psychology professor at the University of Cambridge named Dr. Aleksandr Kogan lied to us and violated our Platform Policies by passing data from an app that was using Facebook Login to SCL/Cambridge Analytica ... He also passed that data to Christopher Wylie of Eunoia Technologies, Inc.
[Kogan] did not subsequently abide by our rules. By passing information on to a third party, including SCL/Cambridge Analytica and Christopher Wylie of Eunoia Technologies, he violated our platform policies.
0 - https://about.fb.com/news/2018/03/suspending-cambridge-analy...