Facebook CEO Mark Zuckerberg weighed in for the first time on reports that Cambridge Analytica, a data firm advising the Trump campaign, had gained unauthorized access to millions of users’ personal information.
Zuckerberg said the social media platform has an obligation to protect its users’ data and outlined the steps Facebook is taking to crack down on abuse of its platform.
“We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you. I’ve been working to understand exactly what happened and how to make sure this doesn’t happen again,” Zuckerberg wrote in a Facebook post. “The good news is that the most important actions to prevent this from happening again today we have already taken years ago. But we also made mistakes, there’s more to do, and we need to step up and do it.”
The Facebook co-founder outlined a plan to investigate all third-party apps with access to private information, restrict developers’ access to data to prevent future abuses and to make it easier for Facebook users to understand how apps are accessing their information.
“I’m serious about doing what it takes to protect our community,” Zuckerberg said. “While this specific issue involving Cambridge Analytica should no longer happen with new apps today, that doesn’t change what happened in the past. We will learn from this experience to secure our platform further and make our community safer for everyone going forward.”
The company’s stock has been reeling since The New York Times’ bombshell report on Sunday that the firm, infused with a $15 million investment from Republican donor Robert Mercer, had harvested the private information from the Facebook profiles of more than 50 million users without their permission.
The scandal wiped out $50 billion in market capitalization this week before Facebook’s stock began to recover today, rising as much as 5% before closing at $169.39, up a fraction. Meanwhile, there have been calls on Capitol Hill for an investigation.
“The silence from Zuckerberg and [COO] Sheryl [Sandberg] has put gasoline into the fire, and, I think, it just added to the noise coming out of the beltway, as well as the European Union, as the regulatory chatter continues to elevate,” said Daniel Ives, BGH Insights’s chief strategy officer and head of technology research.
In 2013, Cambridge University researcher Aleksandr Kogan created a personality quiz app that some 300,000 people installed, sharing their data and information about their friends. Zuckerberg said that, because of the way the Facebook platform worked at that time, this gave Kogan access to “tens of millions of their friends’ data.”
Facebook changed the rules in 2014, to dramatically limit the data apps could access — in the interest of prevent abuse, Zuckerberg said. That meant apps like Kogan’s “could no longer ask for data about a person’s friends unless their friends had also authorized the app.” It also required app developers to request approval before extracting sensitive data.
A journalist from The Guardian newspaper contacted Facebook in 2015 to report that Kogan had shared data from his app with Cambridge Analytica. That was a violation of Facebook’s policies prohibiting developers from sharing data without people’s consent — so Kogan’s app was banned from the platform.
Facebook also demanded that Cambridge Analytica “formally certify” it had deleted all the data.
Last week, the social network learned from The New York Times, The Guardian and Channel 4 that this may not have happened — resulting in an immediate ban from the platform. Cambridge Analytica says the data has been deleted and agreed to a forensic audit by a firm Facebook hired to perform confirm this claim.
“This was a breach of trust between Kogan, Cambridge Analytica and Facebook,” Zuckerberg wrote. “But it was also a breach of trust between Facebook and the people who share their data with us and expect us to protect it. We need to fix that.”
To prevent bad actors from accessing people information in this way in the future, Zuckerberg said the Facebook will investigate apps that had access to large amounts of information before the company changed its policies in 2014 to reduce data access. It will audit any app with suspicious activity and ban any developer or platform that refuses to submit to this audit.
“If we find developers that misused personally identifiable information, we will ban them and tell everyone affected by those apps,” Zuckerberg said. “That includes people whose data Kogan misused here as well.”
Facebook will further restrict developers’ data access to prevent other kinds of abuse. It will reduce the data provided to an app when you sign in the user’s name, profile photo and email address. It also will require developers to get approval to ask for access to a user’s post or private data.
In the coming month, Zuckerberg said Facebook will make it easier for users to understand what data apps are accessing. A new tool, to appear at the top of the News Feed, will make it easy to remove an app’s permission to access private data.
Wedbush Securities Analyst Michael Pachter said he felt Zuckerberg clearly explained what happened, articulated how Facebook would respond, and, more importantly, accepted responsibility.
“I think he was an adult,” Pachter said. “I think he addressed it head on.”
Pachter said the company’s stock will rebound if Zuckerberg can successfully address concerns in Washington, D.C., and beyond, that Facebook is responding appropriately to the data leak. Investor concern — which has been reflected in the stock price — is that legislators will impose regulations that limit user engagement, and, by turn, Facebook’s revenue.
“Zuckerberg’s response caused a rally,” Pachter said. “Maybe he’ll put some of the disgruntled legislators at ease that he’s addressing it in a responsible manner.”