Facebook data breach: Is Mark Zuckerberg's apology over Cambridge Analytica scandal too little too late?

Facebook CEO Mark Zuckerberg has finally broken his nearly week-long silence after the world's largest social media network landed in controversy over improper harvesting of data belonging to 50 million of its users by political consultancy Cambridge Analytica. In fact, he embarked on a media blitz, giving interviews to CNN, the New York Times, Recode, Wired and more, to apologise, explain what happened, and outline the company's next steps.

"This was a major breach of trust. I'm really sorry this happened. We have a basic responsibility to protect people's data," Zuckerberg said in an interview with CNN on Wednesday. The same day he wrote a detailed post in his Facebook account, where he outlined the steps that the company plans to take to protect user data. "The good news is that the most important actions to prevent this from happening again today we have already taken years ago," the founder said. As an example he cited that in 2013, Cambridge University researcher Aleksandr Kogan had created a personality quiz app that was installed by around 300,000 Facebook users. But given the way the social media platform worked at the time the researcher was able to access "tens of millions of their friends' data". So, the following year, he claimed that Facebook changed the "entire platform to dramatically limit the data apps could access". Apps could no longer ask for data about a person's friends unless their friends had also authorized the app. "We also required developers to get approval from us before they could request any sensitive data from people," he added.

Proceeding to defend Facebook, Zuckerberg wrote in his post that they learnt about Kogan sharing data from his app with Cambridge Analytica in 2015 from journalists. "It is against our policies for developers to share data without people's consent, so we immediately banned Kogan's app from our platform, and demanded that Kogan and Cambridge Analytica formally certify that they had deleted all improperly acquired data. They provided these certifications," wrote Zuckerberg, maintaining that his company was clueless about the London-based consultancy allegedly retaining the data till the scandal broke last week. "We immediately banned them from using any of our services. Cambridge Analytica claims they have already deleted the data and has agreed to a forensic audit by a firm we hired to confirm this. We're also working with regulators as they investigate what happened," he explained.

However, acknowledging that this was a "breach of trust between Facebook and the people who share their data with us and expect us to protect it" and that the company needed to do more, the founder also outlined a three-step action plan:

• Facebook will investigate all apps that had access to large amount of data before the platform was changed in 2014, conduct thorough audits of any apps with suspicious activity and ban any developers found misusing personally identifiable information. Moreover, the company intends to "tell everyone affected by those apps", including people whose data Kogan had misused.
• The social media platform will restrict developers' data access further, like barring access to data of users who don't use an app for 3 months and demanding minimal data - only name, profile photo, and email address - from users when they sign in. Moreover, developers will not only need to take user approval but also sign a contract in order to ask anyone for access to their posts or other data. "And we'll have more changes to share in the next few days," said Zuckerberg.
• Prominently display a tool at the top of the users' News Feed with the apps being used and an easy way to revoke their permissions to access personal data.

"I believe these are the next steps we must take to continue to secure our platform," said Zuckerberg, adding, "I know it takes longer to fix all these issues than we'd like, but I promise you we'll work through this and build a better service over the long term."

Interestingly, his future plans do not represent a big reduction of advertisers' ability to use Facebook data, which is the company's lifeblood. In most of the interviews he gave, the biggest mistake he confessed to was opening Facebook's data trove broadly to third-party developers without proper monitoring. Followed by taking Cambridge Analytica at its word.
On being asked why Facebook took so long to tell the world what happened, Zuckerberg simply told CNN that he "regretted" not doing it earlier and that "I think we got that wrong". That's hardly satisfactory from a platform so popular that even the current #Delete Facebook campaign has apparently failed to make a significant dent.

Zuckerberg, however, told the channel that he was open to additional government regulation. "I actually am not sure we shouldn't be regulated. I think in general technology is an increasingly important trend in the world. I think the question is more what is the right regulation rather than 'yes or no should we be regulated?" he said. But he pertinently also pointed out that "With a community of 2 billion people, I can't promise we're going to find everything."

If he was hoping to gain some normalcy post these interviews, he's probably pretty disappointed right now. Because far from winding down, Facebook's problems have grown post a former employee telling a British parliamentary committee yesterday that data harvesting of member profiles by outside software developers was once routine.

"There was very little detection or enforcement," Sandy Parakilas, who was in charge of policing Facebook's data handling procedures in 2011 and 2012, reportedly said in his testimony. "During my 16 months (at Facebook), I don't remember a single physical audit of a developer" who was storing users' data from the social network." The Reuters report adds that Parakilas highlighted the vast potential abuses of a little-understood feature known as "friend permissions", which enabled software developers to connect their apps up to the friends of users, and even the friends of friends. Scarily, as the ex-operations manager points out, some of those apps had tens or hundreds of millions of users, so "there was a vast (amount) of data that passed out the door". Asked by a parliamentary committee member whether there were incidents where this data-sharing feature was misused, Parakilas replied "There may well have been. However, Facebook did not investigate deeply enough to determine exactly."

Meanwhile, Facebook representatives, including Deputy Chief Privacy Officer Rob Sherman, met U.S. congressional staff for nearly two hours on Wednesday. Two aides who attended the briefing told Reuters that Facebook was unable to answer many questions. That's not good news for a company that has already lost more than $45 billion of its stock market value over the past three days.

With Reuters inputs