Facebook–Cambridge Analytica data scandal


The Facebook–Cambridge Analytica data breach occurred in early 2018 when millions of Facebook users' personal data was harvested without consent by Cambridge Analytica to be predominantly used for political advertising. This data breach was the largest known leak in Facebook history. The data was collected through an app created by Dr. Aleksandr Kogan, a Cambridge academic, in 2013 and consisted of a series of questions to build psychological profiles on users. The app not only harvested the personal data of the users that completed the questions, but also of the users’ Facebook friends. Cambridge Analytica sought to sell the data of American voters to political campaigns and ultimately provided assistance and analytics to the Ted Cruz and Donald Trump campaigns.
The data breach was disclosed in 2018 by Christopher Wylie, a former Cambridge Analytica employee, in interviews with The Guardian and The New York Times. In response, Facebook apologized for their role in the data harvesting and their CEO Mark Zuckerberg testified in front of Congress. These happenings sparked an online movement #DeleteFacebook, which trended on Twitter.

Overview

A data scientist at Cambridge University, Aleksandr Kogan, was hired by Cambridge Analytica, to develop an app called "This Is Your Digital Life" in 2014 . He provided the app to Cambridge Analytica, and Cambridge Analytica in turn arranged an informed consent process for research in which several hundred thousand Facebook users would agree to complete a survey for payment that was only for academic use. However, Facebook allowed this app not only to collect personal information from survey respondents but also from respondents’ Facebook friends. In this way, Cambridge Analytica acquired data from millions of Facebook users.
The harvesting of personal data by Cambridge Analytica was first reported in December 2015 by Harry Davies, a journalist for The Guardian. He reported that Cambridge Analytica was working for United States Senator Ted Cruz using data harvested from millions of people's Facebook accounts without their consent. Further reports followed in the Swiss publication Das Magazin by Hannes Grasseger and Mikael Krogerus , Carole Cadwalladr in The Guardian and Mattathias Schwartz in The Intercept.
Information on the data breach came to a head in March 2018 with the emergence of a whistleblower, an ex-Cambridge Analytica employee Christopher Wylie. He had been an anonymous source for an article in 2017 in The Observer by Cadwalladr, headlined "The Great British Brexit Robbery". Cadwalladr worked with Wylie for a year to coax him to come forward as a whistleblower. She later brought in Channel 4 News in the UK and The New York Times due to legal threats against The Guardian and The Observer by Cambridge Analytica.
The Guardian and The New York Times published articles simultaneously on March 17, 2018. More than $100 billion was knocked off Facebook's market capitalization in days and politicians in the US and UK demanded answers from Facebook CEO Mark Zuckerberg. The negative public response to the media coverage eventually led to him agreeing to testify in front of the United States Congress.

Data characteristics

Numbers

Wired, The New York Times, and The Observer reported that the data-set had included information on 50 million Facebook users. While Cambridge Analytica claimed it had only collected 30 million Facebook user profiles, Facebook later confirmed that it actually had data on potentially over 87 million users, with 70.6 million of those people from the United States. Facebook estimated that California was the most affected U.S. state, with 6.7 million impacted users, followed by Texas, with 5.6 million, and Florida, with 4.3 million. Data was collected on 87 million users while only 270,000 people downloaded the app.

Information

Facebook sent a message to those users believed to be affected, saying the information likely included one's "public profile, page likes, birthday and current city." Some of the app's users gave the app permission to access their News Feed, timeline, and messages. The data was detailed enough for Cambridge Analytica to create psychographic profiles of the subjects of the data. The data also included the locations of each person. For a given political campaign, each profile's information suggested what type of advertisement would be most effective to persuade a particular person in a particular location for some political event.

Data use

Political events for which politicians paid Cambridge Analytica to use information from the data breach include the following:

Ted Cruz campaign

In 2016, Ted Cruz hired Cambridge Analytica to aid his presidential campaign. The Federal Election Commission reported that Cruz paid the company $5.8 million in services. Although Cambridge Analytica was not well-known at the time, this is when it started to create individual psychographic profiles. This data was then used to create tailored advertisements for each person to sway them into voting for Cruz.

Donald Trump campaign

’s 2016 presidential campaign utilized the harvest data to build psychographic profiles, determining users' personality traits based on their Facebook activity. The campaign team used this information as a micro-targeting technique, displaying customized messages about Trump to different US voters on various digital platforms. Ads were segmented into different categories, mainly based on whether individuals were Trump supporters or potential swing votes. Supporters of Trump received triumphant visuals of him, as well as information regarding polling stations. Swing voters were instead often shown images of Trump’s more notable supporters and negative graphics or ideas about his opponent, Hillary Clinton. For example, the collected data was specifically used by “Make America Number 1 Super PAC” to attack Clinton through constructed advertisements that attempted to highlight the corruption of Clinton as a way of propping up Trump as a better candidate for presidency.

Potential usage in Russia

In 2018, the Parliament of the United Kingdom questioned SCL Group director Alexander Nix in a hearing about Cambridge Analytica’s connections with Russian oil company, Lukoil. Nix stated he had no connections to the two companies despite concerns that the oil company was interested in how the company's data was used to target American voters. Cambridge Analytica had become a point of focus in politics since its involvement in Trump's campaign at this point. Democratic officials made it a point of emphasis for improved investigation over concerns of Russian ties with Cambridge Analytica. It was later confirmed by Christopher Wylie that Lukoil was interested in the company’s data regarding political targeting.

Potential usage in Brexit

Cambridge Analytica was allegedly hired as a consultant company for Leave.EU and the United Kingdom Independence Party during 2016, as an effort to convince people to support Brexit. These rumors were the result of the leaked internal emails that were sent between the British firm and the British parliament. Brittany Kaiser declared that the datasets that Leave.EU utilize to create databases were provided by Cambridge Analytica. These datasets composed of the data obtained from Facebook were said to be work done as an initial job deliverable for them. Although Arron Banks, co-founder of Leave.EU, denied any involvement with the company, he later declared “When we said we’d hired Cambridge Analytica, maybe a better choice of words could have been deployed."

Media coverage

In December 2015, The Guardian reported that Cambridge Analytica used the data at the behest of Ted Cruz. According to PolitiFact, Trump paid Cambridge Analytica in September, October, and November for data on Americans and their political preferences. On March 17, 2018, The Observer and The New York Times broke the story simultaneously. Kogan's recent name change to Aleksandr Spectre, which resulted in the ominous "Dr. Spectre," added to the intrigue and popular appeal of the story. The Observer worked with Christopher Wylie, a former employee of Cambridge Analytica, for more than a year before bringing in The New York Times to report the story in the US. Meghan McCain has drawn an equivalence between the use of data by Cambridge Analytica and Barack Obama's 2012 presidential campaign. This data was not used in an unethical way, however, according to PolitiFact. Obama's campaign used this data to “have their supporters contact their most persuadable friends” rather than using this data for highly targeted digital ads on websites such as Facebook.
The Facebook–Cambridge Analytica data scandal also received media coverage in the form of a 2019 Netflix documentary, The Great Hack. This is the first feature-length media piece that ties together the various elements of the scandal through a narrative. The documentary provides information on the background information and events related to Cambridge Analytica, Facebook, and the 2016 election that resulted in the overall data scandal. The Great Hack communicates the experiences and personal journeys of multiple individuals that were involved in the event in different ways and through different relationships. These individuals include David Carroll, Brittany Kaiser, and more. David Carroll is a New York professor in the field of media that attempted to navigate the legal system in order to discover what data Cambridge Analytica had in possession about him. Meanwhile, Brittany Kaiser is a former Cambridge Analytica employee that ultimately became a whistleblower for the data scandal.

Responses

Facebook and other companies

Facebook CEO Mark Zuckerberg first apologized for the situation with Cambridge Analytica on CNN, calling it an "issue", a "mistake" and a "breach of trust". He explained that he was responding to the Facebook community’s concerns and that the company’s initial focus on data portability had shifted to locking down data; he also reminded the platform’s users of their right of access to personal data. Other Facebook officials argued against calling it a "data breach," arguing those who took the personality quiz originally consented to give away their information. Zuckerberg pledged to make changes and reforms in Facebook policy to prevent similar breaches. On March 25, 2018, Zuckerberg published a personal letter in various newspapers apologizing on behalf of Facebook. In April, Facebook decided to implement the EU's General Data Protection Regulation in all areas of operation and not just the EU.
Amazon said that they suspended Cambridge Analytica from using their Amazon Web Services when they learned in 2015 that their service was collecting personal information. The Italian banking company UniCredit stopped advertising and marketing on Facebook in August 2018.
On April 25, 2018, Facebook released their first earnings report since the scandal was reported. Revenue fell since the last quarter, but this is usual as it followed the holiday season quote. The quarter revenue was the highest for a first quarter, and the second overall.
In April 2018, Facebook established Social Science One as a response to the event.

Governmental actions

The governments of India and Brazil demanded that Cambridge Analytica report how anyone used data from the breach in political campaigning, and various regional governments in the United States have lawsuits in their court systems from citizens affected by the data breach.
In early July 2018, the United Kingdom's Information Commissioner's Office announced it intended to fine Facebook £500,000 over the data breach, this being the maximum fine allowed at the time of the breach, saying Facebook "contravened the law by failing to safeguard people's information".
In March 2019, a court filing by the U.S. Attorney General for the District of Columbia alleged that Facebook knew of Cambridge Analytica's "improper data-gathering practices" months before they were first publicly reported in December 2015.
In July 2019, the Federal Trade Commission voted to approve fining Facebook around $5 billion to finally settle the investigation into the data breach, with a 3-2 vote.

Impact on Facebook users and investors

Since April 2018, the first full month since the breaking of the Cambridge Analytica data breach, the number of likes, posts and shares on the site had decreased by almost 20%, and has decreased ever since, with the aforementioned activity only momentarily increasing during the summer and during the 2018 US midterm elections. Despite this, user growth of the site has increased in the period since increased media coverage, increasing by 1.8% during the final quarter of 2018.
On March 26, 2018, a little after a week after the story was initially published, Facebook stock fell by about 24%, equivalent to $134 billion. By May 10, Wall Street reported that the company recovered their losses.

#DeleteFacebook movement

The public reacted to the data privacy breach by initiating the campaign #DeleteFacebook with the aim of starting a movement to boycott Facebook. The co-founder of WhatsApp, which is owned by Facebook, joined in on the movement by declaring it was time to delete the platform. The hashtag was tweeted almost 400,000 times Twitter within a 30 day period after news of the data breach. 93% of the mentions of the hashtag actually appeared on Twitter, making it the main social media platform used to share the hashtag. However, a survey by investment firm Raymond James found that although approximately 84% of Facebook users were concerned about how the app used their data, about 48% of those surveyed claimed they wouldn’t actually cut back on their usage of the social media network. Additionally, in 2018, Mark Zuckerberg commented that he didn’t think the company had seen "a meaningful number of people act" on deleting Facebook.
An additional campaign and hashtag, #OwnYourData, was coined by Brittany Kaiser. The hashtag was created by Kaiser as a Facebook campaign that pushed for increased transparency on the platform. #OwnYourData was also used in Kaiser's petition for Facebook to alter their policies and give users increased power and control over their data, which she refers to as users’ assets and property. In addition to the hashtag, Kaiser also created the Own Your Data Foundation to promote increased digital intelligence education.

Witness and expert testimony to governments

The United States Senate Judiciary Committee called witnesses to testify about the data breach and general data privacy. They held two hearings, one focusing on Facebook's role in the breach and privacy on social media, and the other on Cambridge Analytica's role and its impact in data privacy. The former was held on April 10, 2018, where Mark Zuckerberg testified and Senator Chuck Grassley and Senator Diane Feinstein gave statements. The latter occurred on May 16, 2018, where Professor Eitan Hersh, Dr. Mark Jamison, and Christopher Wylie testified, while Senator Chuck Grassley and Senator Diane Feinstein made statements.

Eitan Hersh

In 2015, Professor Eitan Hersh published Hacking the Electorate: How Campaigns Perceive Voters, which analyzed the databases used for campaigns between 2008 and 2014. On May 6, 2018, Eitan Hersh, a professor of political science at Tufts University testified before Congress as an expert on voter targeting.
Hersh claimed that the voter targeting by Cambridge Analytica did not excessively affect the outcome of the 2016 election because the techniques used by Cambridge Analytica were similar to those of presidential campaigns well before 2016. Further, he claimed that the correlation between user “likes” and personality traits were weak and thus the psychological profiling of users were also weak.

Mark Jamison

Dr. Mark Jamison, the director and Gunter Professor of the Public Utility Research Center at the University of Florida, testified before Congress on May 6, 2018 as an expert. Jamison reiterated that it was not unusual for presidential campaigns to use data like Facebook’s data to profile voters; Presidents Barack Obama and George W. Bush also used models to micro-target voters. Jamison criticized Facebook for not being “clear and candid with its users” because the users were not aware of the extent that their data would be used. Jamison finished his testimony by saying that if the federal government were to regulate voter targeting to happen on sites like Facebook, it would harm the users of those sites because it would be too restrictive of those sites and would make things worse for regulators.

Christopher Wylie

On May 16, 2018, Christopher Wylie, who is considered the “whistleblower” on Cambridge Analytica and also served as Cambridge Analytica’s Director of Research in 2013 and 2014, also testified to the United States Senate Judiciary Committee. He was considered a witness to both British and American authorities, and he claims he decided to whistle-blow to “protect democratic institutions from rogue actors and hostile foreign interference, as well as ensure the safety of Americans online.” He claimed that at Cambridge Analytica “anything goes” and that Cambridge Analytica was “a corrupting force in the world.” He detailed to Congress how Cambridge Analytica used Facebook’s data to categorize people into groups based on political ideology. He also claimed that Eitan Hersh contradicted “copious amounts of peer-reviewed literature in top scientific journals, including the Proceedings of the National Academy of Science, Psychological Science, and Journal of Personality and Individual Differences” by saying that Facebook’s categorizing of people were weak.
Christopher Wylie also testified about Russian contact with Cambridge Analytica and the campaign, voter disengagement, and his thoughts on Facebook’s response.

Mark Zuckerberg

During his testimony before Congress on April 10, 2018, Mark Zuckerberg said it was his personal mistake that he did not do enough to prevent Facebook from being used for harm. “That goes for fake news, foreign interference in elections and hate speech.” During the testimony, Mark Zuckerberg publicly apologized for the breach of private data: “It was my mistake, and I’m sorry. I started Facebook, I run it, and I’m responsible for what happens here.”
Zuckerberg said that in 2013 researcher Aleksandr Kogan from Cambridge University had created a personality quiz app, which was installed by 300,000 people. The app was then able to retrieve Facebook information, including that of the users' friends, and this was obtained by Kogan. It was not until 2015 that Zuckerberg learned that these users' information was shared by Kogan with Cambridge Analytica. Cambridge Analytica was subsequently asked to remove all the data. It was later discovered by The Guardian, The New York Times and Channel 4 that the data had in fact not been deleted.