WASHINGTON (AP) — A data analysis firm employed by President Donald Trump's 2016 campaign tapped the Facebook profiles of more than 50 million users without their permission, allowing it to capitalize on the private social media activity of a large portion of the U.S. electorate, newspapers reported Saturday.
FILE - In this May 16, 2012, file photo, the Facebook logo is displayed on an iPad in Philadelphia. Facebook suspended Cambridge Analytica, a data-analysis firm that worked for President Donald Trump's 2016 campaign, over allegations that it held onto improperly obtained user data after telling Facebook it had deleted the information. (AP Photo/Matt Rourke, File)
One of the largest data leaks in Facebook history allowed Cambridge Analytica, which had ties to Trump campaign strategist Steve Bannon, to develop techniques that formed the basis of its work on the Trump campaign, The New York Times and The Guardian reported.
Facebook said it suspended Cambridge Analytica over allegations that it kept the improperly obtained user data after telling Facebook it had been deleted.
In a blog post, Facebook explained that Cambridge Analytica had years ago received user data from a Facebook app that purported to be a psychological research tool, though the firm was not authorized to have the information. Roughly 270,000 people downloaded and shared personal details with the app.
Cambridge Analytica later certified in 2015 that it had destroyed the information it had received, according to Facebook, although the social network said it received reports "several days ago" that not all the data was deleted. Facebook says it is investigating.
Facebook has also suspended the access of Cambridge Analytica's parent company, Strategic Communication Laboratories; University of Cambridge psychology professor Aleksandr Kogan, the academic who created the app in question; and another individual, Christopher Wylie of Eunoia Technologies, who also allegedly received user data from the app. Wylie is a former Cambridge Analytics employee who has emerged as a primary source for the Times report.
Cambridge Analytica denied wrongdoing in a statement. It said the parent company's SCL Elections unit hired Kogan to undertake "a large scale research project in the U.S.," but subsequently deleted all data it received from Kogan's company after learning that Kogan had obtained data in violation of Facebook policies. The firm said none of Kogan's data was used in its 2016 election work for the "avoidance of doubt."
Kogan did not immediately reply to an emailed request for comment. Wylie could not immediately be located.
The Facebook blog post, written by deputy general counsel Paul Grewal, cited the "public prominence" of Cambridge Analytica, called the alleged data retention an "unacceptable violation of trust" and said the social network will take legal action if necessary to hold all parties "responsible and accountable for any unlawful behavior."
Cambridge Analytica is probably best known for its political work during the 2016 U.S. presidential campaign. The company claims to build psychological profiles based on personal details from millions of Americans that can categorize individual voters. It worked for both the primary campaign of Texas Republican Sen. Ted Cruz, and Trump's general-election campaign.
Trump's campaign Saturday denied using the firm's data, saying it relied on the Republican National Committee for its data.
"The campaign used the RNC for its voter data and not Cambridge Analytica," the campaign said in a statement. "Using the RNC data was one of the best choices the campaign made. Any claims that voter data were used from another source to support the victory in 2016 are false."
Cambridge Analytica is backed by the family of billionaire donor Robert Mercer, a hedge fund manager who also supported the Trump campaign and other conservative candidates and causes, including Bannon, the Trump campaign strategist. Trump campaign officials have downplayed Cambridge Analytica's role, saying they briefly used the company for television advertising and paid some of its most skilled data employees.
The firm had secured a $15 million investment from Mercer and wooed Bannon with the promise of tools that could identify the personalities of American voters and influence their behavior. But Cambridge Analytica did not have the data to make its new products work. So the firm harvested private information from the Facebook profiles of more than 50 million users without their permission.
A representative for Bannon did not immediately respond to an email seeking comment.
The company has surfaced in the U.S. probes into Russian interference in the 2016 presidential election. British officials are also investigating the firm in connection with the June 2016 EU referendum.
Trump's former national security adviser, Michael Flynn, disclosed an advisory role with Cambridge Analytica last August. SCL later said that position never materialized. Flynn is cooperating with special counsel Robert Mueller's investigation into Russian election interference after pleading guilty to a felony charge.
Cambridge Analytica CEO Alexander Nix also disclosed last November that the company reached out to WikiLeaks founder Julian Assange during the campaign to request emails related to the campaign of Democrat Hillary Clinton. Nix said Assange denied the request, which came after Assange had said publicly that he had the emails. Clinton campaign emails stolen by Russian agents are one focus of the election-interference probes.
Nix has denied any involvement in Russian election meddling.
Revelations that Cambridge Analytica misused social media data could also be of interest to Mueller's investigation. While much of the thrust of special counsel's investigation has been tightly held, Mueller has requested that the firm turn over the emails of any employees who worked on the campaign, according to a report in The Wall Street Journal last year.
Mueller is also looking at the role Wikileaks played in acquiring and making public the stolen Clinton campaign emails.
Facebook's recurring nightmare: Helping muddy up elections
By RYAN NAKASHIMA and ANICK JESDANUN , AP Technology Writers
MENLO PARK, Calif. (AP) — Facebook has a problem it just can't kick: People keep exploiting it in ways that could sway elections, and in the worst cases even undermine democracy.
News reports that Facebook let the Trump-affiliated data mining firm Cambridge Analytica abscond with data from tens of millions of users mark the third time in roughly a year the company appears to have been outfoxed by crafty outsiders in this way.
Before the Cambridge imbroglio, there were Russian agents running election-related propaganda campaigns through targeted ads and fake political events. And before the Russians took center stage, there were purveyors of fake news who spread false stories to rile up hyperpartisan audiences and profit from the resulting ad revenue.
In the previous cases, Facebook initially downplayed the risks posed by these activities. It only seriously grappled with fake news and Russian influence after sustained criticism from users, experts and politicians. In the case of Cambridge, Facebook says the main problem involved the transfer of data to a third party — not its collection in the first place.
Each new issue has also raised the same enduring questions about Facebook's conflicting priorities — to protect its users, but also to ensure that it can exploit their personal details to fuel its hugely lucrative, and precisely targeted, advertising business.
Facebook may say its business model is to connect the world, but it's really "to collect psychosocial data on users and sell that to advertisers." said Mike Caulfield, a faculty trainer at Washington State University who directs a multi-university effort focused on digital literacy.
Late Friday, Facebook announced it was banning Cambridge , an outfit that helped Donald Trump win the White House, saying the company improperly obtained information from 270,000 people who downloaded a purported research app described as a personality test. Facebook first learned of this breach of privacy more than two years ago, but hasn't mentioned it publicly until now.
And the company may still be playing down its scope. Christopher Wylie, a former Cambridge employee who served as a key source for detailed investigative reports published Saturday in The New York Times and The Guardian , said the firm was actually able to pull in data from roughly 50 million profiles by extending its tentacles to the unwitting friends of app users. (Facebook has since barred such second-hand data collection by apps.)
Wylie said he regrets the role he played in what he called "a full service propaganda machine." Cambridge's goal, he told the Guardian in a video interview, was to use the Facebook data to build detailed profiles that could be used to identify and then to target individual voters with personalized political messages calculated to sway their opinions.
"It was a grossly unethical experiment," Wylie said. "Because you are playing with an entire country. The psychology of an entire country without their consent or awareness."
Cambridge has denied wrongdoing and calls Wylie a disgruntled former employee. It acknowledged obtaining user data in violation of Facebook policies, but blamed a middleman contractor for the problem. The company said it never used the data and deleted it all once it learned of the infraction — an assertion contradicted by Wylie and now under investigation by Facebook.
Jonathan Albright, research director at the Tow Center for Digital Journalism at Columbia University, said Facebook badly needs to embrace the transparency it has essentially forced on its users by sharing their habits, likes and dislikes with advertisers. Albright has previously noted cases in which Facebook deleted thousands of posts detailing Russian influence on its service and underreported the audience for Russian posts by failing to mention millions of followers on Instagram, which Facebook owns.
Facebook is "withholding information to the point of negligence," he said Saturday. "How many times can you keep doing that before it gets to the point where you're not going to be able to wrangle your way out?"
The Cambridge imbroglio also revealed what appear to be loopholes in Facebook's privacy assurances, particularly regarding third-party apps. Facebook appears to have no technical way to enforce privacy promises made by app developers, leaving users little choice but to simply trust them.
In fact, the enforcement actions outlined in Facebook's statement don't address prevention at all — just ways to respond to violations after they've occurred.
On Saturday, Facebook continued to insist that the Cambridge data collection was not a "data breach" because "everyone involved gave their consent" to share their data. The purported research app followed Facebook's existing privacy rules, no systems were surreptitiously infiltrated and no one stole passwords or sensitive information without permission. (To Facebook, the only real violation was the transfer of information collected for "research" to a third party such as Cambridge.)
Experts say that argument only makes sense if every user fully understands Facebook's obscure privacy settings, which often default to maximal data sharing.
"It's a disgusting abuse of privacy," said Larry Ponemon, founder of the privacy research firm Ponemon Institute. "In general, most of these privacy settings are superficial," he said. "Companies need to do more to make sure commitments are actually met."
Jesdanun reported from New York.