Data leaks puts Facebook under intensifying scrutiny on two continents

WASHINGTON — United States and British lawmakers demanded on Sunday (March 19) that Facebook explain how a political data firm with links to US President Donald Trump's 2016 campaign was able to harvest private information from more than 50 million Facebook profiles without the social network's alerting users.

The backlash forced Facebook to once again defend the way it protects user data.

Senator Amy Klobuchar, a member of the Senate Judiciary Committee, went so far as to press for Mr Mark Zuckerberg, Facebook's chief executive, to appear before the panel to explain what the social network knew about the misuse of its data "to target political advertising and manipulate voters."

The calls for greater scrutiny followed reports Saturday in The New York Times and The Observer of London that Cambridge Analytica, a political data firm founded by Mr Steve Bannon and Mr Robert Mercer, the wealthy Republican donor, had used the Facebook data to develop methods that it claimed could identify the personalities of individual US voters and influence their behaviour.

The firm's so-called psychographic modeling underpinned its work for the Trump campaign in 2016, though many have questioned the effectiveness of its techniques.

But Facebook did not inform users whose data had been harvested. The lack of disclosure could violate laws in Britain and in many US states.

Mr Damian Collins, a Conservative lawmaker in Britain who is leading a parliamentary inquiry into fake news and Russian meddling in the country's referendum to leave the European Union (EU), said this weekend that he, too, would call on Mr Zuckerberg or another top executive to testify. The social network sent executives who handle policy matters to answer questions in February.

"It is not acceptable that they have previously sent witnesses who seek to avoid answering difficult questions by claiming not to know the answers," Mr Collins said in a statement. "This also creates a false reassurance that Facebook's stated policies are always robust and effectively policed."

The fallout from the reports added to questions Facebook was already confronting over the use of its platform by those seeking to spread Russian propaganda and fake news. The social media giant has grappled with the criticism over the issue for much of the past year, and struggled to keep public opinion on its side.

Over the weekend, Facebook was on the defensive. Top executives took to Twitter to argue that the company's protections had not been breached, and that Facebook was thus not at fault.

"This was unequivocally not a data breach," tweeted Mr Andrew Bosworth, a Facebook executive. "No systems were infiltrated, no passwords or information were stolen or hacked."

The data was obtained in 2014, when Cambridge Analytica, through an outside researcher, paid users small sums to take a personality quiz and download an app, which would scrape some private information from their profiles and from those of their friends - activity that Facebook permitted at the time.

The approach was based on a technique pioneered at Cambridge University by data scientists who claimed it could reveal more about a person than even their parents or romantic partners knew.

The researcher hired by Cambridge Analytica, Mr Alexandr Kogan, told Facebook and his app's users that he was collecting information for academic purposes, not for a political data firm owned by a wealthy conservative.

Facebook did nothing to verify how the information was being used.

Mr Bosworth argued on Twitter that a violation had been committed only by Cambridge Analytica and Mr Kogan, whose app "did not follow the data agreements."

Facebook's chief security officer Alex Stamos issued a similar defence in a series of tweets that have since been deleted.

"The recent Cambridge Analytica stories by the NY Times and The Guardian are important and powerful, but it is incorrect to call this a *breach' under any reasonable definition of the term," Mr Stamos tweeted.

The explanation did little, however, to stem the tide of anger as independent researchers pointed out that many others could have similarly misused Facebook data.

"Facebook's platform must protect us from predatory behaviour," wrote a Twitter user named Evan Baily, "or we can't and shouldn't trust the platform."

Mr Jonathan Albright, research director at the Tow Center for Digital Journalism at Columbia University, wrote that the lack of oversight and transparency into what sort of data Facebook collected on its users meant that the company's platform could continue to be exploited.

"Unethical people will always do bad things when we make it easy for them and there are few - if any - lasting repercussions," Mr Albright said.

Mr Paul Grewal, a vice president and deputy general counsel at Facebook, said in a statement that the company was looking into whether the data in question still existed. "That is where our focus lies as we remain committed to vigorously enforcing our policies to protect people's information," he said.

This month, The Times viewed a set of raw data from the profiles Cambridge Analytica obtained. And a former employee of the data firm described having recently seen hundreds of gigabytes of unencrypted data files on Cambridge servers.

There were also questions from technology experts and others about Facebook's reaction to the news reports by The Times and The Observer, especially its decision to suspend the account of Mr Christopher Wylie, a data expert who oversaw Cambridge Analytica's data harvesting - but also spoke out about it to the two news organisations.

On Friday, Facebook threatened to sue The Observer to stop it from publishing, the newspaper's outgoing editor John Mulholland said on Twitter.

Then, late Friday evening, Facebook posted a statement that expressed alarm at the data leak. The company promised to take action and announced that it was suspending the accounts of Cambridge Analytica, Mr Kogan and Mr Wylie.

By then, Facebook had learned that Mr Wylie, who left Cambridge Analytica in 2014, was a named source for the news reports.

In a statement Sunday, Mr Wylie described himself as "a curious and naive 23-year-old," when he first went to work for Cambridge Analytica.

"I feel a sense of regret every day when I see where they have helped take our world," he added. "I need to make amends, and that's why I'm coming forward."

His lawyer, Tamsin Allen, said that last week Mr Wylie offered to help Facebook recover the missing data.

Now, though, Facebook said Sunday, Mr Wylie is refusing to cooperate with the company until the suspension is lifted - a move the social network is not willing to make because of his role in the data harvesting.

In both Britain and the US, lawmakers said that in the light of the new reports, they wanted fresh answers from both Facebook and Cambridge Analytica about how the data was obtained and what was done with it.

Mr Collins, the British lawmaker, said he planned to call Mr Alexander Nix, chief executive of Cambridge Analytica, to return to Parliament and answer questions about testimony last month in which he claimed that the company never obtained or used Facebook data.

"It seems clear that he has deliberately misled the committee and Parliament," Mr Collins said.

In the US, the attorney general of Massachusetts, Ms Maura Healey, announced Saturday that her office was opening an investigation. "Massachusetts residents deserve answers immediately from Facebook and Cambridge Analytica," she said in a Twitter post that linked to the Times article.

Also Saturday, the two top congressional Democrats leading inquiries into Russian interference in the 2016 election - Senator Mark Warner of Virginia and Representative Adam Schiff of California - called for investigations of the Facebook data leak.

"This raises serious questions about the level of detail that Cambridge Analytica knew about users," said Mr Schiff, who is the ranking Democrat on the House Intelligence Committee. THE NEW YORK TIMES