Zuckerberg named Cambridge Analytica as a concern in 2017, months before the data breach was revealed | CNN Business

CNN
—

Mark Zuckerberg considered disclosing in 2017 that Facebook ( FB ) was investigating “organizations like Cambridge Analytica” along with Russian foreign intelligence actors as part of an election security assessment before eventually dropping the reference at the suggestion of its advisers, according to a 2019 filing by the Securities and Exchange Commission and reviewed by CNN.

The omitted reference provides insight into Zuckerberg’s thinking about Cambridge Analytica in the critical months before press reports revealed that the data analytics firm affiliated with Donald Trump’s 2016 presidential campaign had gained improper access to dozens of millions of Facebook users’ personal information. The data leak sparked a global outcry that led to hearings, an apology tour by Zuckerberg and Facebook’s $5 billion privacy settlement with the US government.

The transcript of the statement suggests that in 2017, Zuckerberg considered Cambridge Analytica a potential election concern on par with Russian election meddling efforts, though he said he had no knowledge of the data leak discovered. for the first time by Facebook employees in 2015. It also notes how Facebook employees had opportunities to inform Zuckerberg about this leak, but chose not to, before reports of the incident emerged in 2018.

Zuckerberg’s comments at the deposition provide the clearest picture of what Zuckerberg knew about Cambridge Analytica and when. US lawmakers, state attorneys general and investors who have sued Facebook, now known as Meta, have previously come under intense scrutiny for breaching their fiduciary duties in connection with the data breach incident .

Meta declined to comment on the release of the transcript, saying its case with the SEC involving the deposition had been settled for more than three years. The 2019 settlement for $100 million resolved allegations by the US government that Facebook misled investors for years after staff first discovered the data leak.

The transcript of the SEC deposition was released Tuesday by the Real Facebook Oversight Board, a watchdog group, which had obtained the document through a public records request. The transcript was first reported on Tuesday by Reuters, which had obtained the document through a separate records request.

“This transcript reveals that something changed between January 2017 and September 2017 for Zuckerberg to consider Cambridge Analytica a commensurate threat to Russian intelligence,” said Zamaan Qureshi, policy adviser to the Real Facebook Oversight Board. “But for reasons Facebook’s CEO has yet to reveal, the world would only know about Cambridge Analytica in March 2018.”

In September 2017, Zuckerberg released a public statement about Facebook’s efforts to safeguard the integrity of elections, saying the company will study the impact that foreign actors, “Russian groups and other former Soviet states” and “organizations like campaigns” had on Facebook during the 2016 election.

But according to court documents, Zuckerberg had originally proposed naming Russian foreign intelligence and Cambridge Analytica at the same time.

“We are already investigating foreign actors, including Russian intelligence, actors from other former Soviet states, and organizations such as Cambridge Analytica,” Zuckerberg initially wrote, according to the SEC’s draft of the statement, which Zuckerberg declare that it was authentic.

Zuckerberg stated that the reference to Cambridge Analytica was removed after a staff member advised against naming specific organizations. “I don’t think that was particularly important for general communication,” he said, according to the transcript. “So I think when people brought that up, I just took it out.”

The testimony suggests he became aware of Cambridge Analytica around the same time as the general public, through press reports around the 2016 election about the company’s marketing claims. But it also suggests he was kept in the dark about the Cambridge Analytica-linked data leak that predated the election and would eventually lead to Facebook’s wider reckoning with regulators and policymakers.

The Cambridge Analytica saga began with a psychology professor who collected data from millions of Facebook users through an app that offered a personality test, then gave it to a service that promised to use techniques vague and sophisticated to sway voters during a high-stakes election where the winning presidential candidate narrowly won several key states.

A 2020 report by the UK’s Information Commissioner’s Office later cast significant doubt on Cambridge Analytica’s capabilities, suggesting that many of them had been exaggerated. But Facebook’s improper data sharing set off a cascade of events that has culminated in numerous investigations and lawsuits.

After hearing about Cambridge Analytica’s claims that it could use personal data to create “psychographic profiles” of voters that could then be targeted with effective political advertising, Zuckerberg began asking subordinates whether the company’s marketing had any merit. .

In a January 2017 email produced by the SEC, Zuckerberg asked staff to “tell me what they actually did from an analytics and advertising perspective and to what extent.”

Elaborating on his thought process, Zuckerberg stated, “Like, are these people doing something new? Or are they just talking about data in an inflated way… What I understand from these conversations is that, to summarize – very quickly, I was much closer to the latter.

But even though Facebook as an organization knew at the time, in 2017, that Cambridge Analytica had obtained the personal information of Facebook users in violation of the platform’s policies, this incident was never brought up to Zuckerberg as a piece of context potentially relevant, according to the deposition. After Facebook’s discovery of the leak, the company demanded that Cambridge Analytica delete the data it had improperly obtained through a third party and ordered the company to sign a certification indicating its compliance.

Zuckerberg stated that he was not “fully caught up” on the 2015 data breach, and Facebook’s response to it, until March 2018, when public reports of the incident emerged.

In the statement, Zuckerberg explained that he was not informed sooner likely because Facebook considered the 2015 incident a “closed case until 2018, when new allegations emerged suggesting that Cambridge Analytica may have lied to us” about have deleted Facebook data. (The UK ICO report later found that Cambridge Analytica appeared to take some steps to remove the data, but also expressed doubts about whether those steps were effective enough.)

Zuckerberg reiterated in his testimony that if Facebook had moved more quickly to implement an existing, separate plan restricting app developers’ access to Facebook information, the data leak likely could have been prevented since from the beginning