Facebook employees were aware of concerns about“improper data-gathering practices” by Cambridge Analytica months before the Guardian first reported, in December 2015, that the political consultancy had obtained data on millions from an academic. The concerns appeared in a court filing by the attorney general for Washington DC and were subsequently confirmed by Facebook.
The new information “could suggest that Facebook has consistently mislead [sic]” British lawmakers “about what it knew and when about Cambridge Analytica”, tweeted Damian Collins, the chair of the House of Commons digital culture media and sport select committee (DCMS) in response to the court filing.
In a statement, a company spokesperson said: “Facebook absolutely did not mislead anyone about this timeline.”
After publication of this article, the spokesperson acknowledged that Facebook employees heard rumors of data scraping by Cambridge Analytica in September 2015. The spokesperson said that this was a “different incident” from Cambridge Analytica’s acquisition of a trove of data about as many as 87m users that has been widely reported on for the past year.
“In September 2015 employees heard speculation that Cambridge Analytica was scraping data, something that is unfortunately common for any internet service,” the spokesperson said. “In December 2015, we first learned through media reports that Kogan sold data to Cambridge Analytica, and we took action. Those were two different things.”
The filing raised questions about when Facebook first learned about the misuse of personal data by Cambridge Analytica, the now defunct political consultancy.
This timeline has long been complicated by the different corporate entities involved in Cambridge Analytica’s data misuse. The data of as many as 87m people was extracted from Facebook by GSR, a company formed by the former Cambridge University academic Aleksandr Kogan, then transferred to Cambridge Analytica’s parent company, SCL.
The data extraction, though highly controversial, was not against Facebook’s policies, which at the time allowed GSR to take information not only from users who consented but from all their friends. It was the transfer of the data from GSR to SCL that was against Facebook’s policies, the company has long maintained.
After Cambridge Analytica’s acquisition of the data for political purposes became an international scandal, Mark Zuckerberg stated that Facebook “learned from journalists at The Guardian that Kogan had shared data from his app with Cambridge Analytica” in 2015. The article detailing this data sharing was published on 11 December 2015.
The attorney general for Washington DC sued Facebook over its failure to protect user data from Cambridge Analytica in late 2018. Facebook has sought to have the case dismissed and to seal a document – currently redacted in filings – that the DC attorney general cited as evidence in his opposition to the motion to dismiss.
The document is “an email exchange between Facebook employees discussing how Cambridge Analytica (and others) violated Facebook’s policies”, according to a Monday court filing by the DC attorney general.
Those emails include “candid employee assessments that multiple third-party applications accessed and sold consumer data in violation of Facebook’s policies during the 2016 United States presidential election”, according to the filing. “It also indicates Facebook knew of Cambridge Analytica’s improper data-gathering practices months before news outlets reported on the issue,” the filing continues.
The filing further asserts that “as early as September 2015, a DC-based Facebook employee warned the company that Cambridge Analytica” was doing something that is currently redacted and “received responses” – also redacted – relating to “Cambridge Analytica’s data-scraping practices”.
A Facebook spokesperson clarified after publication that there may have been two separate instances of data misuse by Cambridge Analytica. The data-scraping referenced in the filing was not the same data harvesting that has become synonymous with Cambridge Analytica’s name over the past year, the company said.
“Facebook was not aware of the transfer of data from Kogan/GSR to Cambridge Analytica until December 2015, as we have testified under oath,” the Facebook spokesperson said. “These were two different incidents.”
And while the email exchange appears to have been referenced in a report by parliament’s DCMS, it appears that the committee mistakenly assumed that the emails referred to the Kogan/GSR data, and not a separate Cambridge Analytica scraping incident.
The report states: “We were keen to know when and which people working at Facebook first knew about the GSR/Cambridge Analytica breach. The ICO [Information Commissioner’s Office] confirmed, in correspondence with the Committee, that three ‘senior managers’ were involved in email exchanges earlier in 2015 concerning the GSR breach before December 2015, when it was first reported by The Guardian. At the request of the ICO, we have agreed to keep the names confidential, but it would seem that this important information was not shared with the most senior executives at Facebook, leading us to ask why this was the case.”
Facebook will face off with the District of Columbia in court on Friday, where a judge will hear arguments over the company’s motion to dismiss the lawsuit. The judge may also decide then whether to keep the email exchange sealed.
This article was updated to reflect new information provided by Facebook after publication
